@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/ui/views.js

@@ -12,6 +12,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ConversationsService } from "../conversations/conversations.service.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs, NEEDS_CONFIG_REASON } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { PreviewerRegistry } from "../files/previewers.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -100,9 +101,10 @@ function actionResultProblems(r) {
  */
 let UiViews = class UiViews {
     d;
-    constructor(host, conversations, previewers, db, log) {
+    constructor(host, conversations, previewers, db, log, effective) {
         this.d = {
             host,
+            effective,
             // org config rows plus the required bootstrap plugins
             enabledPlugins: (orgId) => host.enabledPlugins(orgId),
             canAccessConversation: (orgId, id, accountId) => conversations.isAccessible(orgId, id, accountId),
@@ -223,7 +225,18 @@ let UiViews = class UiViews {
             throw notFound();
         if (!(await this.d.enabledPlugins(t.orgId)).has(t.plugin))
             throw notFound();
-        const base = { orgId: t.orgId, accountId: t.accountId, role: t.role, locale: t.locale };
+        // spec A §6: the extension is not called for an org whose effective config is not valid
+        const effective = await this.d.effective.get(t.orgId, t.plugin);
+        if (!effective.ok) {
+            throw new ApiError("extension.needs_config", `Extension ${t.plugin} ${NEEDS_CONFIG_REASON}`);
+        }
+        const base = {
+            orgId: t.orgId,
+            accountId: t.accountId,
+            role: t.role,
+            locale: t.locale,
+            config: effective.config,
+        };
         if (!isConversationPlace(entry.contribution.place)) {
             if (t.item !== undefined || t.card !== undefined) {
                 throw new ApiError("validation_failed", "item and callId are for conversation views");
@@ -299,6 +312,7 @@ UiViews = __decorate([
     __param(1, Inject(ConversationsService)),
     __param(2, Inject(PreviewerRegistry)),
     __param(3, Inject(KernelDb)),
-    __param(4, Inject(KERNEL_LOGGER))
+    __param(4, Inject(KERNEL_LOGGER)),
+    __param(5, Inject(EffectiveConfigs))
 ], UiViews);
 export { UiViews };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.6",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -64,14 +64,14 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.2"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.4"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "@capybara-hq/testing": "0.1.0-rc.4"
+    "@capybara-hq/testing": "0.1.0-rc.7"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0074_subagent_tree.sql

@@ -0,0 +1,50 @@
+-- Agent map (spec docs/superpowers/specs/2026-11-06-agent-map-design.md §6): nested sub-agents
+-- and a budget per tree.
+-- - conversations.subagent_depth: levels below the root conversation (0 = a root, 1 = its child).
+-- - runs.budget_run_id: the person-triggered root run whose window this run's dispatches and its
+--   descendants' tokens count against; null = the run is its own budget run.
+-- - subagent_dispatches.budget_run_id: the budget run the dispatch counted against (existing rows:
+--   the dispatching run, which was its own budget run before nesting).
+-- - subagent_dispatches.for_skill: the dispatch of a `context: fork` skill invocation (existing
+--   fork dispatches are backfilled).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS subagent_depth smallint NOT NULL DEFAULT 0;
+
+ALTER TABLE runs ADD COLUMN IF NOT EXISTS budget_run_id text;
+CREATE INDEX IF NOT EXISTS runs_budget_run_idx ON runs (budget_run_id)
+  WHERE budget_run_id IS NOT NULL;
+
+ALTER TABLE subagent_dispatches ADD COLUMN IF NOT EXISTS budget_run_id text;
+UPDATE subagent_dispatches SET budget_run_id = parent_run_id WHERE budget_run_id IS NULL;
+ALTER TABLE subagent_dispatches ALTER COLUMN budget_run_id SET NOT NULL;
+ALTER TABLE subagent_dispatches ADD COLUMN IF NOT EXISTS for_skill boolean NOT NULL DEFAULT false;
+-- Existing fork dispatches (phase D: call id `skill-<seq>` at step 0, `skillCallId` / `FORK_STEP`
+-- in runtime/subagents/skill-fork.ts) are marked, so a fork in flight across the upgrade keeps its
+-- wait and its finish is never delivered as a background child's. A second run changes nothing.
+UPDATE subagent_dispatches SET for_skill = true
+WHERE for_skill = false AND step = 0 AND parent_call_id ~ '^skill-[0-9]+$';
+CREATE INDEX IF NOT EXISTS subagent_dispatches_budget_run_idx
+  ON subagent_dispatches (budget_run_id);
+
+-- Org overrides stored in deployment_settings.subagentLimitOverrides ({orgId: {...}}): the limit
+-- maxConcurrentPerRun is now maxConcurrentPerConversation (per conversation, §6). Each org entry
+-- holding the old key gets the new key with its value instead; an entry that already has the new
+-- key keeps it. Rows without the old key are left as they are, so a second run changes nothing.
+UPDATE deployment_settings AS ds
+SET value = (
+  SELECT jsonb_object_agg(
+    e.org,
+    CASE
+      WHEN jsonb_typeof(e.entry) = 'object' AND e.entry ? 'maxConcurrentPerRun'
+        THEN jsonb_build_object('maxConcurrentPerConversation', e.entry -> 'maxConcurrentPerRun')
+          || (e.entry - 'maxConcurrentPerRun')
+      ELSE e.entry
+    END
+  )
+  FROM jsonb_each(ds.value) AS e(org, entry)
+)
+WHERE ds.key = 'subagentLimitOverrides'
+  AND jsonb_typeof(ds.value) = 'object'
+  AND EXISTS (
+    SELECT 1 FROM jsonb_each(ds.value) AS e(org, entry)
+    WHERE jsonb_typeof(e.entry) = 'object' AND e.entry ? 'maxConcurrentPerRun'
+  );

package/src/migrations/0075_plugin_scope.sql

@@ -0,0 +1,61 @@
+-- Plugin scope (phase 1, spec 2026-11-05-plugin-component-management-design.md §5): every catalog item
+-- gets a scope (all / optional / named), a builtin flag, a disabled flag, an org list (named) and
+-- per-org switches. Replaces the catalog policy, grants and requests. Expand-only: `policy`,
+-- `catalog_org_grants` and `catalog_requests` stay (nothing reads them after this release).
+-- The backfill runs once per database (the migrator records the file); the UPDATEs below only read
+-- the old columns, and the inserts are ON CONFLICT DO NOTHING.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS scope text NOT NULL DEFAULT 'optional';
+ALTER TABLE catalog_items DROP CONSTRAINT IF EXISTS catalog_items_scope_check;
+ALTER TABLE catalog_items ADD CONSTRAINT catalog_items_scope_check
+  CHECK (scope IN ('all', 'optional', 'named'));
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS builtin boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS disabled boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS scope_version integer NOT NULL DEFAULT 0;
+
+-- named scope: the orgs the item is offered to.
+CREATE TABLE IF NOT EXISTS catalog_item_scope_orgs (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  PRIMARY KEY (item_id, org_id)
+);
+
+-- Per-org on / off switch of an item's components.
+CREATE TABLE IF NOT EXISTS catalog_item_org_switches (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (item_id, org_id)
+);
+
+-- Backfill from policy / grants / installs.
+UPDATE catalog_items SET disabled = true WHERE policy = 'disabled';
+UPDATE catalog_items SET scope = 'named' WHERE policy = 'needs_approval';
+
+-- Required bootstrap plugins are builtin and offered to every org.
+UPDATE catalog_items SET scope = 'all', builtin = true
+  WHERE id IN (SELECT catalog_item_id FROM extension_installs
+               WHERE required AND catalog_item_id IS NOT NULL);
+
+-- named: granted orgs and orgs that already installed it.
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT g.item_id, g.org_id FROM catalog_org_grants g
+  JOIN catalog_items i ON i.id = g.item_id AND i.scope = 'named'
+  ON CONFLICT DO NOTHING;
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT DISTINCT p.item_id, p.org_id FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope = 'named'
+  WHERE p.status = 'installed'
+  ON CONFLICT DO NOTHING;
+
+-- An org that installed the item keeps it on (builtin / all items need no switch).
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT DISTINCT p.item_id, p.org_id, true FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope <> 'all'
+  WHERE p.status = 'installed'
+  ON CONFLICT DO NOTHING;
+
+-- Requests are gone: pending ones are withdrawn ('cancelled', the status the old withdraw used).
+UPDATE catalog_requests SET status = 'cancelled', note = 'superseded by scope', decided_at = now()
+  WHERE status = 'pending';

package/src/migrations/0076_skills_created_by_nullable.sql

@@ -0,0 +1,6 @@
+-- Plugin scope sync (spec 2026-11-05-plugin-component-management-design.md §5): the kernel installs
+-- plugins in an org as no person (the worker job that converges orgs to a plugin's scope), so a
+-- skill or skill version it creates has no creator. Relaxing NOT NULL is expand-only: rows written
+-- before keep their creator, and dropping NOT NULL on a nullable column is a no-op.
+ALTER TABLE skills ALTER COLUMN created_by DROP NOT NULL;
+ALTER TABLE skill_versions ALTER COLUMN created_by DROP NOT NULL;

package/src/migrations/0077_scope_requests.sql

@@ -0,0 +1,52 @@
+-- Requests under plugin scope (phase 1, spec 2026-11-05-plugin-component-management-design.md
+-- §5.1). A request has a kind: `access` (an org admin asks the enterprise admin to add the org to a
+-- `named` item shown to other orgs), `import` (an org admin asks for a marketplace entry that is not
+-- in the catalog yet: no item, the entry instead) or `enable` (a member asks the org admin to switch
+-- an `optional` item on). Expand-only: `stage`, `version`, `org_decided_*` stay (the new code still
+-- writes `stage` so the old NOT NULL and CHECK hold, and reads none of them).
+
+-- Whether orgs outside a `named` item's list see it (as requestable). Never makes it usable.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS shown_to_others boolean NOT NULL DEFAULT true;
+
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'access';
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_kind_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_kind_check
+  CHECK (kind IN ('access', 'import', 'enable'));
+-- An `import` request names a marketplace entry; its item is written when the import's confirm
+-- commits.
+ALTER TABLE catalog_requests ALTER COLUMN item_id DROP NOT NULL;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS marketplace_id text
+  REFERENCES marketplaces(id) ON DELETE SET NULL;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS entry_name text;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS entry_version text;
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_target_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_target_check
+  CHECK (kind = 'import' AND entry_name IS NOT NULL OR kind <> 'import' AND item_id IS NOT NULL);
+-- The optional reason of a rejection, shown to the requester.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS reason text;
+-- The prepared import of an approved `import` request (it resolves when that staging is confirmed;
+-- a staging that expires leaves it pending).
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS staging_id uuid;
+CREATE INDEX IF NOT EXISTS catalog_requests_staging_idx
+  ON catalog_requests (staging_id) WHERE staging_id IS NOT NULL;
+-- The requester dismissed the decision notice from the inbox.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS dismissed_at timestamptz;
+
+-- One pending request per (org, kind, item or entry): replaces the old (org, item) index.
+DROP INDEX IF EXISTS directory_requests_pending_uq;
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_item_uq
+  ON catalog_requests (org_id, kind, item_id)
+  WHERE status = 'pending' AND item_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_entry_uq
+  ON catalog_requests (org_id, marketplace_id, entry_name)
+  WHERE status = 'pending' AND kind = 'import';
+CREATE INDEX IF NOT EXISTS catalog_requests_kind_idx
+  ON catalog_requests (kind, status, created_at);
+CREATE INDEX IF NOT EXISTS catalog_requests_requester_idx
+  ON catalog_requests (org_id, requested_by) WHERE status IN ('approved', 'rejected');
+
+-- Rows written before kinds: a member's request (stage org) was an `enable` one; decided requests
+-- from before are not shown to their requesters as new decisions.
+UPDATE catalog_requests SET kind = 'enable' WHERE stage = 'org' AND kind = 'access';
+UPDATE catalog_requests SET dismissed_at = now()
+  WHERE status <> 'pending' AND dismissed_at IS NULL;

package/src/migrations/0078_scope_grant_switches.sql

@@ -0,0 +1,18 @@
+-- Plugin scope follow-up to 0075 (spec 2026-11-05-plugin-component-management-design.md §6
+-- "Migration of what exists"): 0075 put the orgs granted a `needs_approval` item on its `named`
+-- list, where a listed org without a switch row wants the plugin on. A grant only allowed an
+-- install; an org that never installed it did not have it on. Such orgs get an explicit switch
+-- row `enabled = false`, so the plugin stays off there until an org admin switches it on.
+-- Expand-only and idempotent: inserts only, ON CONFLICT DO NOTHING (a switch row an org admin or
+-- 0075 wrote wins).
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT s.item_id, s.org_id, false
+  FROM catalog_item_scope_orgs s
+  JOIN catalog_items i ON i.id = s.item_id AND i.policy = 'needs_approval'
+  JOIN catalog_org_grants g ON g.item_id = s.item_id AND g.org_id = s.org_id
+  WHERE NOT EXISTS (
+    SELECT 1 FROM plugin_installs p
+    WHERE p.item_id = s.item_id AND p.org_id = s.org_id
+      AND p.status IN ('installing', 'installed', 'upgrading')
+  )
+  ON CONFLICT DO NOTHING;

package/src/migrations/0079_scope_live_install_switches.sql

@@ -0,0 +1,19 @@
+-- Plugin scope follow-up to 0075 (spec 2026-11-05-plugin-component-management-design.md §6
+-- "Migration of what exists"): 0075 listed and switched on only the org installs with status
+-- `installed`. An install that was `installing` or `upgrading` when 0075 ran got no switch row,
+-- which for an `optional` item means off, and no place on a `named` item's org list; the worker's
+-- start-time scope resync would then uninstall it. Such installs get what 0075 gave installed ones:
+-- the org on the named list and a switch row `enabled = true` (builtin / `all` items need none).
+-- Expand-only and idempotent: inserts only, ON CONFLICT DO NOTHING (a row an org admin, 0075 or
+-- 0078 wrote wins).
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT DISTINCT p.item_id, p.org_id FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope = 'named'
+  WHERE p.status IN ('installing', 'upgrading')
+  ON CONFLICT DO NOTHING;
+
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT DISTINCT p.item_id, p.org_id, true FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope <> 'all'
+  WHERE p.status IN ('installing', 'upgrading')
+  ON CONFLICT DO NOTHING;

package/src/migrations/0080_rename_enterprise_admin.sql

@@ -0,0 +1,18 @@
+-- The deployment-level role "enterprise admin" becomes "super admin" (plugin and component
+-- management spec §13.4b): accounts.is_enterprise_admin becomes is_super_admin, and the stored
+-- deployment setting orgCreation "enterprise_admin" becomes "super_admin". Historical audit rows
+-- are not rewritten. No compatibility layer (release candidate).
+
+-- capybara:allow-destructive column rename; code is renamed in the same release (release candidate, no compatibility layer)
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+             WHERE table_schema = 'capybara' AND table_name = 'accounts'
+               AND column_name = 'is_enterprise_admin') THEN
+    ALTER TABLE accounts RENAME COLUMN is_enterprise_admin TO is_super_admin;
+  END IF;
+END
+$$;
+
+UPDATE deployment_settings SET value = '"super_admin"'::jsonb
+  WHERE key = 'orgCreation' AND value = '"enterprise_admin"'::jsonb;

package/src/migrations/0081_platform_components.sql

@@ -0,0 +1,129 @@
+-- Platform components (phase 2, plan 2026-11-06-plugin-scope-phase-2.md rulings A2-C2, E2): skills,
+-- agent templates and connector templates owned by the deployment instead of an org, with their own
+-- scope (follow the plugin's, or their own), an org list (named) and per-org switches. Org copies
+-- link to them. Expand-only: nothing existing is changed except `agent_templates.plugin_name`
+-- losing NOT NULL (a template without a plugin is the bare `<name>`).
+
+CREATE TABLE IF NOT EXISTS platform_skills (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text NOT NULL,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_skills_live_name_uq
+  ON platform_skills ((coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS platform_skill_versions (
+  skill_id text NOT NULL REFERENCES platform_skills(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  manifest jsonb NOT NULL,
+  object_prefix text NOT NULL,
+  catalog_version text,
+  source_format text NOT NULL DEFAULT 'capybara' CHECK (source_format IN ('capybara', 'claude-code')),
+  suggest_pinned boolean NOT NULL DEFAULT false,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (skill_id, version)
+);
+
+CREATE TABLE IF NOT EXISTS platform_agent_templates (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_agent_templates_live_name_uq
+  ON platform_agent_templates ((coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS platform_agent_template_versions (
+  template_id text NOT NULL REFERENCES platform_agent_templates(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  definition jsonb NOT NULL,
+  object_prefix text,
+  catalog_version text,
+  source_format text NOT NULL DEFAULT 'capybara' CHECK (source_format IN ('capybara', 'claude-code')),
+  suggest_pinned boolean NOT NULL DEFAULT false,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (template_id, version)
+);
+
+CREATE TABLE IF NOT EXISTS platform_connector_templates (
+  id text PRIMARY KEY,
+  catalog_item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  template_id text NOT NULL,
+  current_version text NOT NULL,
+  file jsonb NOT NULL,
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_connector_templates_live_uq
+  ON platform_connector_templates (catalog_item_id, template_id)
+  WHERE deleted_at IS NULL;
+
+-- Scope of an own-scope component: the orgs it is offered to (named) and each org's switch.
+CREATE TABLE IF NOT EXISTS component_scope_orgs (
+  kind text NOT NULL CHECK (kind IN ('skill', 'agent_template', 'connector_template')),
+  component_id text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  PRIMARY KEY (kind, component_id, org_id)
+);
+CREATE TABLE IF NOT EXISTS component_org_switches (
+  kind text NOT NULL CHECK (kind IN ('skill', 'agent_template', 'connector_template')),
+  component_id text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (kind, component_id, org_id)
+);
+
+-- Links from the org copies (ruling B2): a pin keeps the copy on its own stored version.
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS platform_skill_id text
+  REFERENCES platform_skills(id) ON DELETE SET NULL;
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS pinned_version integer;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS platform_template_id text
+  REFERENCES platform_agent_templates(id) ON DELETE SET NULL;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS pinned_version integer;
+ALTER TABLE connectors ADD COLUMN IF NOT EXISTS platform_template_id text
+  REFERENCES platform_connector_templates(id) ON DELETE SET NULL;
+
+-- A template without a plugin is the bare `<name>`; the live-name index must still hold for NULLs.
+ALTER TABLE agent_templates ALTER COLUMN plugin_name DROP NOT NULL;
+-- capybara:allow-destructive the index is recreated in the same transaction over coalesce(plugin_name, '') so NULL plugin names stay unique; no data change
+DROP INDEX IF EXISTS agent_templates_live_name_uq;
+CREATE UNIQUE INDEX IF NOT EXISTS agent_templates_live_name_uq
+  ON agent_templates (org_id, (coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;

package/src/migrations/0082_platform_migration.sql

@@ -0,0 +1,33 @@
+-- Plugin scope phase 2, Task 5: the migration of org copies to platform components
+-- (`catalog/platform-migration.ts`, the worker job `platform-components-migrate`), and the org
+-- notices it writes for the org admins' inbox.
+
+-- The catalog version the item's platform components were last written from
+-- (`PlatformComponents.syncFromVersion`); null = never: the migration job writes them once. Removed
+-- components are not brought back, since an item with a version here is never synced by the job.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS platform_synced_version text;
+
+-- One row per run of the job (at every worker start and once a day): when it ran and what it
+-- changed; rows older than 30 days are pruned, except the first finished run, whose start is the
+-- cutoff of the one-shot rename step (only org skills whose current version predates it).
+CREATE TABLE IF NOT EXISTS platform_migration_runs (
+  id uuid PRIMARY KEY,
+  started_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz,
+  stats jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+
+-- A notice for an org's admins (inbox item kind = `kind`), until one of them dismisses it.
+-- `skill_renamed`: detail `{ skillId, from, to, platformSkillId, plugin }`.
+CREATE TABLE IF NOT EXISTS org_notices (
+  id uuid PRIMARY KEY,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  kind text NOT NULL CHECK (kind IN ('skill_renamed')),
+  detail jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  dismissed_at timestamptz,
+  dismissed_by text REFERENCES accounts(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS org_notices_open_idx
+  ON org_notices (org_id, created_at DESC)
+  WHERE dismissed_at IS NULL;

package/src/migrations/0083_plugin_scope_sync_failures.sql

@@ -0,0 +1,15 @@
+-- Plugin scope phase 2, Task 11: the plugin scope sync's open failures, for the super admin's
+-- inbox (`catalog/scope-sync.ts` writes them, `inbox/platform-inbox.service.ts` reads them). One
+-- row per (item, org) whose last sync attempt failed; the next sync of that pair that does not
+-- fail deletes it. The audit event `plugin.scope_sync_failed` stays the history. `op`: `install`
+-- (turning it on), `uninstall` (turning it off), `dependencies` (installing the dependencies a
+-- platform update added to a live install).
+CREATE TABLE IF NOT EXISTS plugin_scope_sync_failures (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  op text NOT NULL CHECK (op IN ('install', 'uninstall', 'dependencies')),
+  code text NOT NULL,
+  message text NOT NULL,
+  failed_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (item_id, org_id)
+);

package/src/migrations/0084_org_owned_items.sql

@@ -0,0 +1,85 @@
+-- Org-owned items, sharing, pending uploads and notices (phase 3, plan
+-- 2026-11-06-plugin-scope-phase-3.md Task 1; rulings P3-3, P3-5, P3-6, P3-8, F27). Expand-only:
+-- every column is nullable or defaulted, and existing rows stay platform-owned (owner_org_id NULL)
+-- and not shareable. The only dropped objects are the old live-name indexes and the old notice
+-- kind check, replaced in the same file.
+
+-- Owners and pending uploads of catalog items. `owner_org_id` NULL = the platform; an org's
+-- upload that carries an extension waits for the super admin (`awaiting_confirmation`), with the
+-- uploaded version in `pending_*` until confirmed (P3-9 to P3-13).
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS awaiting_confirmation boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_version text;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_by text
+  REFERENCES accounts(id) ON DELETE SET NULL;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_at timestamptz;
+CREATE INDEX IF NOT EXISTS catalog_items_owner_idx
+  ON catalog_items (owner_org_id)
+  WHERE owner_org_id IS NOT NULL AND deleted_at IS NULL;
+
+-- Whether a version may be used (ruling P3-52): `applied_at` is set when it was applied or
+-- confirmed (a platform import is applied as it is written: the default; an org's upload writes
+-- NULL until its owner applies it or the super admin confirms it), `rejected_at` when the super
+-- admin rejected it. Readers serving other orgs or the generic update use only applied, not
+-- rejected versions, whoever owns the item (a transfer keeps the version rows). Existing rows
+-- are platform imports: applied.
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS applied_at timestamptz DEFAULT now();
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS rejected_at timestamptz;
+
+-- Platform components: the owning org (NULL = platform), the org they were created in
+-- (`origin_org_id`, no FK, immutable; F27) and the share switch (P3-3, P3-5).
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS origin_org_id text;
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS origin_org_id text;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE platform_connector_templates ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_connector_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+
+-- Live names are unique per origin org (P3-5); the new indexes come first, then the old ones go
+-- (F27: new names, so a re-run is a true no-op).
+CREATE UNIQUE INDEX IF NOT EXISTS platform_skills_live_name_origin_uq
+  ON platform_skills ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS platform_agent_templates_live_name_origin_uq
+  ON platform_agent_templates ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+-- capybara:allow-destructive replaced by platform_skills_live_name_origin_uq created above in this file; no data change
+DROP INDEX IF EXISTS platform_skills_live_name_uq;
+-- capybara:allow-destructive replaced by platform_agent_templates_live_name_origin_uq created above in this file; no data change
+DROP INDEX IF EXISTS platform_agent_templates_live_name_uq;
+
+-- Org copies: whether the owner shares the copy with other orgs (P3-3, P3-6).
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+
+-- An org's upload waits in staging under its org (P3-8); deleting the org drops the staging.
+ALTER TABLE plugin_import_staging ADD COLUMN IF NOT EXISTS org_id text
+  REFERENCES orgs(id) ON DELETE CASCADE;
+
+-- New org notice kinds. 0082 declared the CHECK inline, so it is named org_notices_kind_check.
+-- capybara:allow-destructive the check is added back with the wider kind list in the next statement; existing rows (skill_renamed) satisfy it
+ALTER TABLE org_notices DROP CONSTRAINT IF EXISTS org_notices_kind_check;
+ALTER TABLE org_notices ADD CONSTRAINT org_notices_kind_check
+  CHECK (kind IN ('skill_renamed', 'item_shared', 'shared_item_updated',
+                  'upload_confirmed', 'upload_rejected'));
+
+-- A notice for the super admins (platform inbox), until one of them dismisses it.
+-- `ownership_transferred`: a deleted org's shared item now belongs to the platform.
+CREATE TABLE IF NOT EXISTS platform_notices (
+  id uuid PRIMARY KEY,
+  kind text NOT NULL CHECK (kind IN ('ownership_transferred')),
+  detail jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  dismissed_at timestamptz,
+  dismissed_by text REFERENCES accounts(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS platform_notices_open_idx
+  ON platform_notices (created_at DESC)
+  WHERE dismissed_at IS NULL;

package/src/migrations/0085_agent_templates_phase4.sql

@@ -0,0 +1,45 @@
+-- Agent templates, phase 4 (spec 2026-11-05-plugin-component-management-design.md §15.2: P4-7
+-- connector_setup requests, P4-8 provenance). Expand-only: every new column is nullable, existing
+-- rows keep their shape, and the only dropped objects are two checks replaced in this file.
+
+-- P4-8: where an agent came from. Display data only (no FK: the template may be deleted or
+-- renamed later), written when an agent is created from a template.
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_id text;
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_version int;
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_name text;
+
+-- P4-7: a `connector_setup` request asks an org admin to set up the connectors an agent made from a
+-- template needs (`pending_keys`: the template's connector keys still without an instance). It
+-- names its agent and no item or marketplace entry.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS agent_id text
+  REFERENCES agents(id) ON DELETE CASCADE;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS pending_keys jsonb;
+
+-- capybara:allow-destructive the check is added back with `connector_setup` in the next statement; existing rows (access, import, enable) satisfy it
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_kind_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_kind_check
+  CHECK (kind IN ('access', 'import', 'enable', 'connector_setup'));
+
+-- item_id is already nullable (0077). The target check of 0077 required an item for every kind but
+-- `import`; a connector_setup row needs an agent instead.
+-- capybara:allow-destructive the check is added back with the connector_setup branch in the next statement; existing rows satisfy its first and third branches
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_target_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_target_check
+  CHECK (
+    kind = 'import' AND entry_name IS NOT NULL
+    OR kind = 'connector_setup' AND agent_id IS NOT NULL
+      AND item_id IS NULL AND entry_name IS NULL
+    OR kind NOT IN ('import', 'connector_setup') AND item_id IS NOT NULL
+  );
+
+-- `pending_keys` is a JSON array of keys when set.
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_pending_keys_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_pending_keys_check
+  CHECK (pending_keys IS NULL OR jsonb_typeof(pending_keys) = 'array');
+
+-- At most one pending setup request per agent (P4-7).
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_setup_uq
+  ON catalog_requests (agent_id) WHERE kind = 'connector_setup' AND status = 'pending';
+
+CREATE INDEX IF NOT EXISTS catalog_requests_agent_idx
+  ON catalog_requests (agent_id) WHERE agent_id IS NOT NULL;

package/src/migrations/0086_org_layering.sql

@@ -0,0 +1,30 @@
+-- Platform / org layering (spec 2026-11-07-platform-org-layering-design.md). Expand-only: two new
+-- tables, nothing existing changes.
+
+-- 0086, spec §5.4 / §5.8: an org's copy of an extension's overridable deployment config fields. A
+-- row is a copy; no row means the org follows the platform ("no copy" and "a copy equal to the
+-- platform" stay distinct). `config` holds the copy's non-secret values; its secrets live in
+-- `secrets` under the org (namespace `kernel`, key `plugin-override:<plugin>:<path>`). Rows are kept
+-- when the extension is disabled or uninstalled, like `extension_org_configs`.
+CREATE TABLE IF NOT EXISTS extension_org_overrides (
+  plugin text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (plugin, org_id)
+);
+
+-- 0086, spec §7: an org admin's switch of one tool of an extension that is on in the org. No row
+-- means the tool follows the extension (on).
+CREATE TABLE IF NOT EXISTS org_tool_switches (
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  plugin text NOT NULL,
+  tool text NOT NULL,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (org_id, plugin, tool)
+);