@cleocode/core 2026.6.12 → 2026.6.14

package/dist/store/schema/cleo-global/services.js

@@ -0,0 +1,200 @@
+/**
+ * Global-scope `cleo.db` — **universal service-credential vault** (3 tables).
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937). The **service** half of the universal vault — machine-wide OAuth /
+ * API credentials for third-party SERVICES (github, google, notion, figma, …) —
+ * cannibalized from onecli's `app_connections` / `app_configs` /
+ * `agent_app_connections`, DROPPING every org / project / billing column (the
+ * vault is machine-wide, exactly like the `accounts` LLM-credential pool — T11709,
+ * the established precedent this directory mirrors). Three tables:
+ *
+ *  - `service_connections` — one user-connected credential per `(provider, label)`:
+ *    the encrypted token blob + non-secret metadata (scopes, expiry, username).
+ *  - `service_configs` — per-provider BYOC (bring-your-own-client) OAuth app:
+ *    enabled flag + encrypted client secret + non-secret settings (client id,
+ *    scopes). One row per provider.
+ *  - `agent_service_grants` — per-agent access to a connection, plus the
+ *    `session_policy` (block / rate-limit / manual-approval) the trust gate
+ *    evaluates BEFORE any decrypt (T11937 AC4 — policy-before-decrypt).
+ *
+ * ## NOT the LLM credential pool (`accounts`) — do not confuse the two
+ *
+ * `accounts` (T11709) holds MODEL-API credentials (the pool the LLM runner picks
+ * from). These `service_*` tables hold SERVICE-API credentials (the things an
+ * agent's tools call: github, gmail, …). Different physical names, different
+ * consumers, different egress path. The crypto, ISO-timestamp typing, and
+ * accessor patterns are shared by design.
+ *
+ * ## Encrypted at rest (global KDF — reuse, no new crypto · T11710)
+ *
+ * `credentials_enc` (the `{access_token, refresh_token}` JSON blob) and
+ * `client_secret_enc` (the BYOC client secret) are `encryptGlobal()` ciphertext
+ * (packages/core/src/crypto/credentials.ts), NEVER plaintext. They keep the
+ * versioned `0x01 + 12B IV + 16B authTag` framing and decrypt via the project-
+ * INDEPENDENT KDF `HMAC-SHA256(machine-key || globalSalt, id)` with
+ * `id = service:${provider}:${label}` — so a service credential decrypts
+ * consistently for the machine regardless of the reading project's cwd.
+ *
+ * ## E10 typing (per docs/migration/sqlite-schema-canonical.md)
+ *
+ * TEXT ISO-8601 timestamps (`*_at`, GLOB-checked in the migration); named enums
+ * ({@link SERVICE_CONNECTION_STATUSES}); typed booleans (`enabled`); JSON-as-TEXT
+ * (`scopes`, `metadata`, `settings`, `session_policy`). The consolidated
+ * schema-parity gate (T11364) re-derives the CHECK set from THIS metadata, so the
+ * forward migration's CHECKs must match it exactly.
+ *
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ../../../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (T11710)
+ * @see ./accounts.ts — `accounts` (the SIBLING LLM-credential-pool table, T11709)
+ * @see ../../service-connections-accessor.ts — the store CRUD + sealed-handle egress
+ * @see ../../service-trust-gate.ts — policy-before-decrypt grant evaluation
+ * @see ../../../../migrations/drizzle-cleo-global — the forward migration
+ */
+import { sql } from 'drizzle-orm';
+import { index, integer, primaryKey, sqliteTable, text, unique } from 'drizzle-orm/sqlite-core';
+/**
+ * Legal `service_connections.status` values — the lifecycle of a connection.
+ *
+ * - `active` — usable; the token is (or can be refreshed to) valid.
+ * - `expired` — the access token (and refresh, if any) has lapsed; needs re-auth.
+ * - `revoked` — the user (or provider) revoked the grant; never usable again.
+ *
+ * @task T11937
+ */
+export const SERVICE_CONNECTION_STATUSES = ['active', 'expired', 'revoked'];
+/**
+ * `service_connections` — one user-connected service credential per `(provider, label)`.
+ *
+ * `credentials_enc` is the `encryptGlobal()` ciphertext of the
+ * `{access_token, refresh_token}` JSON blob (NEVER plaintext). `scopes` is the
+ * JSON-serialized granted scope list; `metadata` is non-secret JSON (e.g. the
+ * connected `username`/`email`) safe to display. The `(provider, label)` pair is
+ * unique. The OAuth build/exchange/refresh that POPULATES `credentials_enc` is
+ * T11939 — this table is the clean seam it writes into.
+ *
+ * @task T11937
+ */
+export const serviceConnections = sqliteTable('service_connections', {
+    /** Surrogate primary key (autoincrement via INTEGER PRIMARY KEY rowid alias). */
+    id: integer('id').primaryKey(),
+    /** Stable service-provider key (e.g. `github` | `google`). Joins SERVICE_PROVIDERS. */
+    provider: text('provider').notNull(),
+    /**
+     * Human-readable connection label, unique WITHIN a provider (e.g. `personal`,
+     * `work-org`). The `(provider, label)` pair is the natural unique key and the
+     * `${provider}:${label}` half of the `encryptGlobal` id.
+     */
+    label: text('label').notNull(),
+    /**
+     * Connection lifecycle — `active` | `expired` | `revoked`
+     * ({@link SERVICE_CONNECTION_STATUSES}). Only `active` connections resolve.
+     */
+    status: text('status', { enum: SERVICE_CONNECTION_STATUSES }).notNull().default('active'),
+    /**
+     * Encrypted credential blob — `encryptGlobal()` ciphertext of the
+     * `{access_token, refresh_token}` JSON (`0x01 + 12B IV + 16B authTag` framing,
+     * T11710). NEVER plaintext. NULL until the OAuth dance (T11939) writes a token.
+     */
+    credentialsEnc: text('credentials_enc'),
+    /** JSON-serialized granted scope list (non-secret). Serialized TEXT; defaults to `[]`. */
+    scopes: text('scopes').notNull().default('[]'),
+    /** ISO-8601 UTC access-token expiry; NULL for a non-expiring token. */
+    expiresAt: text('expires_at'),
+    /**
+     * Free-form NON-SECRET JSON (e.g. connected `username` / `email` / account id)
+     * safe to display. NEVER holds token material. Serialized TEXT; defaults `{}`.
+     */
+    metadata: text('metadata').notNull().default('{}'),
+    /** ISO-8601 UTC instant the connection was first established. Defaults to write time. */
+    connectedAt: text('connected_at').notNull().default(sql `(datetime('now'))`),
+    /** ISO-8601 UTC last-update instant. Defaults to write time; bumped on mutation. */
+    updatedAt: text('updated_at').notNull().default(sql `(datetime('now'))`),
+}, (table) => [
+    // A label is unique within a provider — the natural unique key.
+    unique('ux_service_connections_provider_label').on(table.provider, table.label),
+    // Lookup index — resolve a provider's active connections.
+    index('idx_service_connections_provider_status').on(table.provider, table.status),
+]);
+/**
+ * `service_configs` — per-provider BYOC (bring-your-own-client) OAuth app config.
+ *
+ * When a user brings their own OAuth client (rather than using CLEO's first-party
+ * app), the client id + non-secret OAuth settings live in `settings` (JSON) and
+ * the client SECRET lives encrypted in `client_secret_enc`. One row per provider
+ * (`UNIQUE(provider)`). `enabled` toggles whether the BYOC config is used. This
+ * is the clean seam the OAuth flow (T11939) reads to prefer a user client over
+ * the registry default.
+ *
+ * @task T11937
+ */
+export const serviceConfigs = sqliteTable('service_configs', {
+    /** Surrogate primary key. */
+    id: integer('id').primaryKey(),
+    /** Stable service-provider key — unique (one BYOC config per provider). */
+    provider: text('provider').notNull(),
+    /** Whether this BYOC config is active. Typed boolean (CHECK IN (0,1)). Default false. */
+    enabled: integer('enabled', { mode: 'boolean' }).notNull().default(false),
+    /**
+     * Encrypted BYOC client secret — `encryptGlobal()` ciphertext (id
+     * `service-config:${provider}`). NEVER plaintext. NULL for a public-client
+     * (PKCE) provider that has no secret.
+     */
+    clientSecretEnc: text('client_secret_enc'),
+    /**
+     * Non-secret BYOC settings JSON — the user's OAuth `client_id`, custom
+     * `scopes`, custom endpoints, etc. NEVER holds the client secret. Serialized
+     * TEXT; defaults `{}`.
+     */
+    settings: text('settings').notNull().default('{}'),
+    /** ISO-8601 UTC row-creation instant. Defaults to write time. */
+    createdAt: text('created_at').notNull().default(sql `(datetime('now'))`),
+    /** ISO-8601 UTC last-update instant. Defaults to write time; bumped on mutation. */
+    updatedAt: text('updated_at').notNull().default(sql `(datetime('now'))`),
+}, (table) => [
+    // One BYOC config per provider.
+    unique('ux_service_configs_provider').on(table.provider),
+]);
+/**
+ * `agent_service_grants` — per-agent access to a service connection + policy.
+ *
+ * A grant authorizes one `agent_id` to use one `service_connection_id`, carrying
+ * the `session_policy` JSON (block / rate-limit / manual-approval) the trust gate
+ * (T11937 AC4) evaluates BEFORE any `decryptGlobal`. ABSENCE of a grant denies;
+ * a `block` policy denies; only a passing policy lets the store decrypt. The
+ * composite `(agent_id, service_connection_id)` is the primary key.
+ *
+ * `service_connection_id` references `service_connections(id)` — both tables live
+ * in the SAME global `cleo.db` file (Pattern A), so the FK is in-file and
+ * enforceable. The FK is declared natively (intra-domain, single global file —
+ * mirrors the agent-registry FK convention).
+ *
+ * @task T11937
+ */
+export const agentServiceGrants = sqliteTable('agent_service_grants', {
+    /** The granted agent's id (FK-soft to the agent registry; string id). */
+    agentId: text('agent_id').notNull(),
+    /** The service connection this grant authorizes — references `service_connections(id)`. */
+    serviceConnectionId: integer('service_connection_id')
+        .notNull()
+        .references(() => serviceConnections.id),
+    /**
+     * Per-session access policy JSON evaluated BEFORE decrypt. Shape (see
+     * {@link import('../../service-trust-gate.js').SessionPolicy}):
+     * `{ mode: 'allow'|'block', rateLimit?: {...}, manualApproval?: boolean }`.
+     * Serialized TEXT; defaults `{"mode":"allow"}` (a bare grant = allow).
+     */
+    sessionPolicy: text('session_policy').notNull().default('{"mode":"allow"}'),
+    /** ISO-8601 UTC grant-creation instant. Defaults to write time. */
+    createdAt: text('created_at').notNull().default(sql `(datetime('now'))`),
+    /** ISO-8601 UTC last-update instant. Defaults to write time; bumped on mutation. */
+    updatedAt: text('updated_at').notNull().default(sql `(datetime('now'))`),
+}, (table) => [
+    // A grant is uniquely identified by (agent, connection).
+    primaryKey({ columns: [table.agentId, table.serviceConnectionId] }),
+    // Lookup index — resolve all grants for one agent.
+    index('idx_agent_service_grants_agent').on(table.agentId),
+]);
+//# sourceMappingURL=services.js.map

package/dist/store/schema/cleo-global/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEhG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAKrF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAC3C,qBAAqB,EACrB;IACE,iFAAiF;IACjF,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC9B,uFAAuF;IACvF,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC;;;;OAIG;IACH,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B;;;OAGG;IACH,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzF;;;;OAIG;IACH,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,0FAA0F;IAC1F,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,uEAAuE;IACvE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,yFAAyF;IACzF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;IAC3E,oFAAoF;IACpF,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;CACxE,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,gEAAgE;IAChE,MAAM,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;IAC/E,0DAA0D;IAC1D,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;CAClF,CACF,CAAC;AAOF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CACvC,iBAAiB,EACjB;IACE,6BAA6B;IAC7B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC9B,2EAA2E;IAC3E,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzE;;;;OAIG;IACH,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,iEAAiE;IACjE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;IACvE,oFAAoF;IACpF,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;CACxE,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,gCAAgC;IAChC,MAAM,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;CACzD,CACF,CAAC;AAOF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAC3C,sBAAsB,EACtB;IACE,yEAAyE;IACzE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,2FAA2F;IAC3F,mBAAmB,EAAE,OAAO,CAAC,uBAAuB,CAAC;SAClD,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC1C;;;;;OAKG;IACH,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3E,mEAAmE;IACnE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;IACvE,oFAAoF;IACpF,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;CACxE,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACnE,mDAAmD;IACnD,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;CAC1D,CACF,CAAC"}

package/dist/store/schema/cleo-global/session-manifest.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Global-scope `cleo.db` — cross-project **session manifest** mirror (1 table).
+ *
+ * EP-SESSION-MANIFEST (epic T11638, task T11639). The `session_manifest` table is
+ * a CROSS-PROJECT MIRROR of the per-project `tasks_sessions` rows: each project's
+ * authoritative session lives in that project's `tasks_sessions` table (PROJECT
+ * scope `cleo.db`), and a best-effort writer copies a compact projection into this
+ * GLOBAL-scope row so the fleet has a single, machine-wide view of every session
+ * across every project — without ATTACHing N per-project DBs.
+ *
+ * ## NOT named `sessions` (AC1)
+ *
+ * The table is deliberately `session_manifest`, NOT `sessions`. The authoritative
+ * project-tier table is `tasks_sessions`; naming the global mirror `sessions` would
+ * invite a future reader to mistake the mirror for the source of truth. The name
+ * encodes its role: a manifest (an index/catalog), never the authority.
+ *
+ * ## MIRROR, never authoritative (AC4)
+ *
+ * Every column here is derived from the project row. The mirror writer is
+ * best-effort (a failure NEVER fails the underlying session op) and reconcile-on-
+ * start re-reads the authoritative project row and OVERWRITES the manifest row, so
+ * a stale or partially-written manifest entry can never drift into being treated as
+ * truth. Consumers needing exact session state MUST read the project's
+ * `tasks_sessions`; this table answers "which sessions exist, where, and how are
+ * they forked" cheaply across projects.
+ *
+ * ## Identity (`project_id`)
+ *
+ * `project_id` is the canonical `nexus_project_registry.project_id` (12-hex) for
+ * the project that owns the session — a soft FK into the global registry table in
+ * THIS same `cleo.db`. It is reused (never minted here) so the manifest joins
+ * cleanly to the registry. Nullable: a session started outside any resolvable
+ * registered project still mirrors, with `project_id` NULL.
+ *
+ * ## Fork tree (`parent_session_id`)
+ *
+ * `parent_session_id` mirrors the project row's own `parent_session_id`
+ * (populated from `CLEO_PARENT_SESSION_ID`, stamped by the supervisor — PR #996 /
+ * T11629). It reconstructs the orchestrator→worker fork tree machine-wide without
+ * a per-project DB scan. Soft self-reference to `session_manifest.session_id`;
+ * NULL for a root session.
+ *
+ * @task T11639
+ * @epic T11638
+ * @saga T11242
+ * @see ../cleo-project/tasks-core.ts — `tasksSessions` (the authoritative source)
+ * @see ./nexus.ts — `nexusProjectRegistry` (the `project_id` SSoT)
+ * @see ../../sessions/session-manifest-mirror.ts — the best-effort mirror writers
+ */
+/**
+ * `session_manifest` — cross-project mirror of per-project `tasks_sessions` rows.
+ *
+ * A best-effort projection: one row per session, keyed on the session id, carrying
+ * just enough to answer fleet-wide "what sessions exist, in which project, and how
+ * are they forked" without opening every project's `cleo.db`. NOT authoritative —
+ * the project's `tasks_sessions` row is the source of truth; this row is overwritten
+ * on reconcile-on-start so it can never drift into authority (AC4).
+ *
+ * @task T11639
+ */
+export declare const sessionManifest: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "session_manifest";
+    schema: undefined;
+    columns: {
+        sessionId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        projectId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        parentSessionId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        projectPath: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        startedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        endedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        mirroredAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "session_manifest";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/** Row type for `session_manifest` SELECT queries (mirror shape). */
+export type SessionManifestRow = typeof sessionManifest.$inferSelect;
+/** Row type for `session_manifest` INSERT/UPSERT operations (mirror shape). */
+export type NewSessionManifestRow = typeof sessionManifest.$inferInsert;
+//# sourceMappingURL=session-manifest.d.ts.map

package/dist/store/schema/cleo-global/session-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manifest.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/session-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC;AACrE,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC"}

package/dist/store/schema/cleo-global/session-manifest.js

@@ -0,0 +1,99 @@
+/**
+ * Global-scope `cleo.db` — cross-project **session manifest** mirror (1 table).
+ *
+ * EP-SESSION-MANIFEST (epic T11638, task T11639). The `session_manifest` table is
+ * a CROSS-PROJECT MIRROR of the per-project `tasks_sessions` rows: each project's
+ * authoritative session lives in that project's `tasks_sessions` table (PROJECT
+ * scope `cleo.db`), and a best-effort writer copies a compact projection into this
+ * GLOBAL-scope row so the fleet has a single, machine-wide view of every session
+ * across every project — without ATTACHing N per-project DBs.
+ *
+ * ## NOT named `sessions` (AC1)
+ *
+ * The table is deliberately `session_manifest`, NOT `sessions`. The authoritative
+ * project-tier table is `tasks_sessions`; naming the global mirror `sessions` would
+ * invite a future reader to mistake the mirror for the source of truth. The name
+ * encodes its role: a manifest (an index/catalog), never the authority.
+ *
+ * ## MIRROR, never authoritative (AC4)
+ *
+ * Every column here is derived from the project row. The mirror writer is
+ * best-effort (a failure NEVER fails the underlying session op) and reconcile-on-
+ * start re-reads the authoritative project row and OVERWRITES the manifest row, so
+ * a stale or partially-written manifest entry can never drift into being treated as
+ * truth. Consumers needing exact session state MUST read the project's
+ * `tasks_sessions`; this table answers "which sessions exist, where, and how are
+ * they forked" cheaply across projects.
+ *
+ * ## Identity (`project_id`)
+ *
+ * `project_id` is the canonical `nexus_project_registry.project_id` (12-hex) for
+ * the project that owns the session — a soft FK into the global registry table in
+ * THIS same `cleo.db`. It is reused (never minted here) so the manifest joins
+ * cleanly to the registry. Nullable: a session started outside any resolvable
+ * registered project still mirrors, with `project_id` NULL.
+ *
+ * ## Fork tree (`parent_session_id`)
+ *
+ * `parent_session_id` mirrors the project row's own `parent_session_id`
+ * (populated from `CLEO_PARENT_SESSION_ID`, stamped by the supervisor — PR #996 /
+ * T11629). It reconstructs the orchestrator→worker fork tree machine-wide without
+ * a per-project DB scan. Soft self-reference to `session_manifest.session_id`;
+ * NULL for a root session.
+ *
+ * @task T11639
+ * @epic T11638
+ * @saga T11242
+ * @see ../cleo-project/tasks-core.ts — `tasksSessions` (the authoritative source)
+ * @see ./nexus.ts — `nexusProjectRegistry` (the `project_id` SSoT)
+ * @see ../../sessions/session-manifest-mirror.ts — the best-effort mirror writers
+ */
+import { sql } from 'drizzle-orm';
+import { index, sqliteTable, text } from 'drizzle-orm/sqlite-core';
+/**
+ * `session_manifest` — cross-project mirror of per-project `tasks_sessions` rows.
+ *
+ * A best-effort projection: one row per session, keyed on the session id, carrying
+ * just enough to answer fleet-wide "what sessions exist, in which project, and how
+ * are they forked" without opening every project's `cleo.db`. NOT authoritative —
+ * the project's `tasks_sessions` row is the source of truth; this row is overwritten
+ * on reconcile-on-start so it can never drift into authority (AC4).
+ *
+ * @task T11639
+ */
+export const sessionManifest = sqliteTable('session_manifest', {
+    /** Session id (canonical `ses_...` form). Primary key — one manifest row per session. */
+    sessionId: text('session_id').primaryKey(),
+    /**
+     * Canonical `nexus_project_registry.project_id` (12-hex) of the owning project.
+     * Soft FK into the global registry in THIS `cleo.db`; NULL when the session was
+     * started outside any resolvable registered project.
+     */
+    projectId: text('project_id'),
+    /**
+     * Fork-tree parent session id, mirrored from the project row's own
+     * `parent_session_id` (sourced from `CLEO_PARENT_SESSION_ID`, T11629). Soft
+     * self-reference to `session_manifest.session_id`; NULL for a root session.
+     */
+    parentSessionId: text('parent_session_id'),
+    /** Mirrored session name. */
+    name: text('name'),
+    /** Mirrored session status (`active` | `ended` | `orphaned` | …). */
+    status: text('status'),
+    /** Mirrored absolute project root path (for operator readability / debugging). */
+    projectPath: text('project_path'),
+    /** Mirrored ISO-8601 UTC session-start instant. */
+    startedAt: text('started_at'),
+    /** Mirrored ISO-8601 UTC session-end instant; NULL while active. */
+    endedAt: text('ended_at'),
+    /**
+     * ISO-8601 UTC instant this mirror row was last written by a mirror/reconcile
+     * writer (NOT the session's own activity). Defaults to write time.
+     */
+    mirroredAt: text('mirrored_at').notNull().default(sql `(datetime('now'))`),
+}, (table) => [
+    index('idx_session_manifest_project_id').on(table.projectId),
+    index('idx_session_manifest_parent').on(table.parentSessionId),
+    index('idx_session_manifest_status').on(table.status),
+]);
+//# sourceMappingURL=session-manifest.js.map

package/dist/store/schema/cleo-global/session-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manifest.js","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/session-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACxC,kBAAkB,EAClB;IACE,yFAAyF;IACzF,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE;IAC1C;;;;OAIG;IACH,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,6BAA6B;IAC7B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,qEAAqE;IACrE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,kFAAkF;IAClF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,mDAAmD;IACnD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,oEAAoE;IACpE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;CAC1E,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC5D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;IAC9D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CACtD,CACF,CAAC"}

package/dist/store/schema/cleo-project/docs.d.ts

@@ -351,7 +351,7 @@ export declare const docsAttachmentRefs: import("drizzle-orm/sqlite-core").SQLit
             name: string;
             tableName: "docs_attachment_refs";
             dataType: "string enum";
-            data: "task" | "decision" | "pattern" | "learning" | "observation" | "session";
+            data: "task" | "observation" | "decision" | "pattern" | "learning" | "session";
             driverParam: string;
             notNull: true;
             hasDefault: false;

package/dist/store/schema/cleo-project/provenance-rest.d.ts

@@ -595,7 +595,7 @@ export declare const tasksReleases: import("drizzle-orm/sqlite-core").SQLiteTabl
             name: string;
             tableName: "tasks_releases";
             dataType: "string enum";
-            data: "latest" | "beta" | "dev" | "hotfix";
+            data: "beta" | "latest" | "dev" | "hotfix";
             driverParam: string;
             notNull: true;
             hasDefault: true;

package/dist/store/schema/cleo-project/tasks-core.d.ts

@@ -1490,6 +1490,22 @@ export declare const tasksSessions: import("drizzle-orm/sqlite-core").SQLiteTabl
             identity: undefined;
             generated: undefined;
         }, {}>;
+        parentSessionId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "tasks_sessions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
         agentIdentifier: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: string;
             tableName: "tasks_sessions";

package/dist/store/schema/cleo-project/tasks-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks-core.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-project/tasks-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AA8BH,8EAA8E;AAC9E,eAAO,MAAM,aAAa,mDAAoD,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6GtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBjC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+EzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsClC,CAAC;AAIF,gEAAgE;AAChE,MAAM,MAAM,YAAY,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAC1D,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAC7D,mFAAmF;AACnF,MAAM,MAAM,8BAA8B,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAC;AAC7F,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAC;AAChG,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACnG,yFAAyF;AACzF,MAAM,MAAM,oCAAoC,GAC9C,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACrD,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACnG,yFAAyF;AACzF,MAAM,MAAM,oCAAoC,GAC9C,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACrD,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,qBAAqB,CAAC,YAAY,CAAC;AAC/E,+EAA+E;AAC/E,MAAM,MAAM,yBAAyB,GAAG,OAAO,qBAAqB,CAAC,YAAY,CAAC;AAClF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC1E,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC7E,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAChE,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACnE,kFAAkF;AAClF,MAAM,MAAM,2BAA2B,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AACzF,qFAAqF;AACrF,MAAM,MAAM,8BAA8B,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AAC5F,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAC/E,+EAA+E;AAC/E,MAAM,MAAM,0BAA0B,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAClF,2FAA2F;AAC3F,MAAM,MAAM,qCAAqC,GAC/C,OAAO,kCAAkC,CAAC,YAAY,CAAC;AACzD,8FAA8F;AAC9F,MAAM,MAAM,wCAAwC,GAClD,OAAO,kCAAkC,CAAC,YAAY,CAAC;AACzD,8EAA8E;AAC9E,MAAM,MAAM,wBAAwB,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC;AAClF,iFAAiF;AACjF,MAAM,MAAM,2BAA2B,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC"}
+{"version":3,"file":"tasks-core.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-project/tasks-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AA8BH,8EAA8E;AAC9E,eAAO,MAAM,aAAa,mDAAoD,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6GtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBjC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6FzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsClC,CAAC;AAIF,gEAAgE;AAChE,MAAM,MAAM,YAAY,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAC1D,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAC7D,mFAAmF;AACnF,MAAM,MAAM,8BAA8B,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAC;AAC7F,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAC;AAChG,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACnG,yFAAyF;AACzF,MAAM,MAAM,oCAAoC,GAC9C,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACrD,sFAAsF;AACtF,MAAM,MAAM,iCAAiC,GAAG,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACnG,yFAAyF;AACzF,MAAM,MAAM,oCAAoC,GAC9C,OAAO,8BAA8B,CAAC,YAAY,CAAC;AACrD,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,qBAAqB,CAAC,YAAY,CAAC;AAC/E,+EAA+E;AAC/E,MAAM,MAAM,yBAAyB,GAAG,OAAO,qBAAqB,CAAC,YAAY,CAAC;AAClF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC1E,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC7E,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAChE,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACnE,kFAAkF;AAClF,MAAM,MAAM,2BAA2B,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AACzF,qFAAqF;AACrF,MAAM,MAAM,8BAA8B,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AAC5F,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAC/E,+EAA+E;AAC/E,MAAM,MAAM,0BAA0B,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAClF,2FAA2F;AAC3F,MAAM,MAAM,qCAAqC,GAC/C,OAAO,kCAAkC,CAAC,YAAY,CAAC;AACzD,8FAA8F;AAC9F,MAAM,MAAM,wCAAwC,GAClD,OAAO,kCAAkC,CAAC,YAAY,CAAC;AACzD,8EAA8E;AAC9E,MAAM,MAAM,wBAAwB,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC;AAClF,iFAAiF;AACjF,MAAM,MAAM,2BAA2B,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC"}

package/dist/store/schema/cleo-project/tasks-core.js

@@ -355,6 +355,19 @@ export const tasksSessions = sqliteTable('tasks_sessions', {
     nextSessionId: text('next_session_id').references(() => tasksSessions.id, {
         onDelete: 'set null',
     }),
+    /**
+     * Fork-tree PARENT session pointer (self-FK). Distinct from
+     * `previousSessionId` (the linear resume chain): `parentSessionId` is the
+     * orchestrator→worker spawn edge, sourced from `CLEO_PARENT_SESSION_ID`
+     * (stamped by the supervisor — T11629 / PR #996) at session start. NULL for a
+     * root session with no spawning parent. Nullable, `ON DELETE SET NULL`.
+     *
+     * @task T11639
+     * @epic T11638
+     */
+    parentSessionId: text('parent_session_id').references(() => tasksSessions.id, {
+        onDelete: 'set null',
+    }),
     /** Agent identifier. */
     agentIdentifier: text('agent_identifier'),
     /** ISO-8601 UTC handoff-consumed instant (canonical TEXT, §4). */
@@ -387,6 +400,7 @@ export const tasksSessions = sqliteTable('tasks_sessions', {
 }, (table) => [
     index('idx_tasks_sessions_status').on(table.status),
     index('idx_tasks_sessions_previous').on(table.previousSessionId),
+    index('idx_tasks_sessions_parent').on(table.parentSessionId),
     index('idx_tasks_sessions_agent_identifier').on(table.agentIdentifier),
     index('idx_tasks_sessions_started_at').on(table.startedAt),
     index('idx_tasks_sessions_status_started_at').on(table.status, table.startedAt),