@marinoscar/kvox-eval 0.0.0-bootstrap → 0.1.0-next.0

package/host/prisma/migrations/20240101000016_revoke_viewer_ai_use/migration.sql

@@ -0,0 +1,32 @@
+-- =============================================================================
+-- Revoke `ai:use` from the Viewer role on existing deployments (issue #499)
+-- =============================================================================
+-- Viewer is the DEFAULT role every new user lands in (see `ROLES` in
+-- `prisma/seed-data.ts` and the allowlist-driven signup path). Seeding
+-- `ai:use` onto it (issue #423, epic #419) meant every fresh signup could
+-- call AI with no explicit grant — harmless under the `byok` key policy (no
+-- key, no calls succeed), but wrong under `byok_with_org_fallback`: a
+-- brand-new Viewer would silently spend the deployment's own org key the
+-- first time they touched an AI surface, with no administrator having
+-- decided that person should be able to.
+--
+-- This migration is DATA-ONLY (no `schema.prisma` change — the shape of
+-- `role_permissions` is unchanged) and undoes exactly that one grant on
+-- deployments that already ran the old seed: it deletes the single
+-- `role_permissions` row joining the role named 'viewer' and the permission
+-- named 'ai:use', and touches nothing else — not Admin's or Contributor's
+-- grants, not any other Viewer permission.
+--
+-- IDEMPOTENT: a `DELETE ... WHERE` naming both rows by subquery is a no-op if
+-- the row is already gone, or if either the 'viewer' role or the 'ai:use'
+-- permission does not exist at all (a fork that renamed or removed either).
+-- Safe to run against a database that never had the row (a fresh install
+-- seeded from the already-updated `seed-data.ts`) and safe to re-run.
+--
+-- An administrator who wants a specific Viewer (or all of them) to use AI
+-- again grants it back explicitly — re-insert a `role_permissions` row for
+-- `('viewer', 'ai:use')` — or promotes the account to Contributor, which
+-- still carries the grant.
+DELETE FROM "role_permissions"
+WHERE "role_id" = (SELECT "id" FROM "roles" WHERE "name" = 'viewer')
+  AND "permission_id" = (SELECT "id" FROM "permissions" WHERE "name" = 'ai:use');

package/host/prisma/migrations/20240101000017_add_user_credentials/migration.sql

@@ -0,0 +1,29 @@
+-- =============================================================================
+-- Per-user encrypted credentials (issue #387)
+-- =============================================================================
+-- A sibling of "credentials", which is NOT modified. Rows are addressed by
+-- (user_id, purpose, name); `secret` is ciphertext encrypted under the
+-- owner-bound sub-key domain `user:<user_id>:<purpose>`. All three unique
+-- columns are NOT NULL so the unique index is a real constraint. Rows cascade
+-- with their owner.
+
+-- CreateTable
+CREATE TABLE "user_credentials" (
+    "id" UUID NOT NULL,
+    "user_id" UUID NOT NULL,
+    "purpose" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "secret" TEXT NOT NULL,
+    "hint" TEXT,
+    "label" TEXT,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "user_credentials_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_credentials_user_id_purpose_name_key" ON "user_credentials"("user_id", "purpose", "name");
+
+-- AddForeignKey
+ALTER TABLE "user_credentials" ADD CONSTRAINT "user_credentials_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/host/prisma/migrations/20240101000018_add_device_session_credential_link/migration.sql

@@ -0,0 +1,52 @@
+-- =============================================================================
+-- Device session <-> issued credential link (issue #518)
+-- =============================================================================
+-- Today nothing links a `DeviceCode` row to what it issued: once the polling
+-- client collects a PAT (and that PAT is used to mint refresh tokens),
+-- revoking the `DeviceCode` "session" does nothing to the credential the
+-- device is actually holding. This migration adds the columns that let a
+-- device-session revocation reach both:
+--
+-- 1. `device_codes.pat_id`: the PAT minted for this device once collected.
+--    Nullable until collection. `SetNull` on delete — a `DeviceCode` history
+--    row must survive its PAT being deleted (or aging out) independently.
+-- 2. `device_codes.collected_at` / `credential_expires_at`: collection state
+--    copied from the PAT at collection time, so the sessions list can filter
+--    "approved, not yet collected" vs. "collected, still valid" without a
+--    join against `personal_access_tokens`.
+-- 3. `device_codes.revoked_at`: marks the device session (and whatever it
+--    issued) as revoked. Distinct from `PersonalAccessToken.revokedAt` /
+--    `RefreshToken.revokedAt`, which the revocation service also sets on the
+--    linked rows — this column is what the sessions list itself filters on.
+-- 4. `refresh_tokens.device_code_id`: the device-authorization session that
+--    minted this refresh token, if any, so that same revocation can reach
+--    refresh tokens too. `SetNull` on delete for the same reason as above.
+--
+-- Additive only: every new column is nullable, no backfill, no data migration.
+-- =============================================================================
+
+-- AlterTable
+ALTER TABLE "device_codes"
+  ADD COLUMN "pat_id" UUID,
+  ADD COLUMN "collected_at" TIMESTAMPTZ,
+  ADD COLUMN "credential_expires_at" TIMESTAMPTZ,
+  ADD COLUMN "revoked_at" TIMESTAMPTZ;
+
+-- AlterTable
+ALTER TABLE "refresh_tokens" ADD COLUMN "device_code_id" UUID;
+
+-- CreateIndex
+-- Serves the sessions list: "this user's device sessions that are not
+-- revoked" (approved-uncollected and collected-unexpired both satisfy
+-- `revoked_at IS NULL`); the remaining collected/expiry filtering is done in
+-- the query predicate, not a second index.
+CREATE INDEX "device_codes_user_id_revoked_at_idx" ON "device_codes"("user_id", "revoked_at");
+
+-- CreateIndex
+CREATE INDEX "refresh_tokens_device_code_id_idx" ON "refresh_tokens"("device_code_id");
+
+-- AddForeignKey
+ALTER TABLE "device_codes" ADD CONSTRAINT "device_codes_pat_id_fkey" FOREIGN KEY ("pat_id") REFERENCES "personal_access_tokens"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_device_code_id_fkey" FOREIGN KEY ("device_code_id") REFERENCES "device_codes"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/host/prisma/migrations/20240101000019_add_worker_node_vitals/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "worker_nodes" ADD COLUMN     "last_vitals" JSONB,
+ADD COLUMN     "last_vitals_at" TIMESTAMPTZ;

package/host/prisma/migrations/20240101000020_add_job_trace_context/migration.sql

@@ -0,0 +1,6 @@
+-- Issue #607: carry the enqueuing request's W3C trace context on the job row.
+-- Nullable, no default, no index: existing rows simply have no trace context.
+-- The partial unique index jobs_active_dedup_uniq_idx is deliberately untouched.
+
+-- AlterTable
+ALTER TABLE "jobs" ADD COLUMN "trace_context" TEXT;

package/host/prisma/migrations/20240101000021_add_retention_created_at_indexes/migration.sql

@@ -0,0 +1,13 @@
+-- Retention sweeps (#681): each purge reads "the oldest rows older than the
+-- cutoff", across every user. Plain btree indexes on the timestamp, so a batch
+-- is an index range scan rather than a sequential scan. `audit_events` already
+-- has `audit_events_created_at_idx`.
+
+-- CreateIndex
+CREATE INDEX "notification_deliveries_created_at_idx" ON "notification_deliveries"("created_at");
+
+-- CreateIndex
+CREATE INDEX "notifications_created_at_idx" ON "notifications"("created_at");
+
+-- CreateIndex
+CREATE INDEX "ai_runs_created_at_idx" ON "ai_runs"("created_at");

package/host/prisma/migrations/20240101000022_add_organizations/migration.sql

@@ -0,0 +1,142 @@
+-- CreateEnum
+CREATE TYPE "MembershipStatus" AS ENUM ('active', 'suspended');
+
+-- CreateEnum
+CREATE TYPE "InviteStatus" AS ENUM ('pending', 'accepted', 'revoked', 'expired');
+
+-- AlterTable
+ALTER TABLE "device_codes" ADD COLUMN     "org_id" UUID;
+
+-- AlterTable
+ALTER TABLE "personal_access_tokens" ADD COLUMN     "org_id" UUID;
+
+-- AlterTable
+ALTER TABLE "refresh_tokens" ADD COLUMN     "org_id" UUID;
+
+-- CreateTable
+CREATE TABLE "organizations" (
+    "id" UUID NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "is_default" BOOLEAN NOT NULL DEFAULT false,
+    "created_by_id" UUID,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "organizations_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "memberships" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "user_id" UUID NOT NULL,
+    "status" "MembershipStatus" NOT NULL DEFAULT 'active',
+    "last_active_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "memberships_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "org_invites" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "email" TEXT NOT NULL,
+    "status" "InviteStatus" NOT NULL DEFAULT 'pending',
+    "token_hash" TEXT,
+    "expires_at" TIMESTAMPTZ,
+    "invited_by_id" UUID,
+    "accepted_by_id" UUID,
+    "accepted_at" TIMESTAMPTZ,
+    "notes" TEXT,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "org_invites_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "organizations_slug_key" ON "organizations"("slug");
+
+-- CreateIndex
+CREATE INDEX "memberships_user_id_idx" ON "memberships"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "memberships_org_id_user_id_key" ON "memberships"("org_id", "user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "org_invites_token_hash_key" ON "org_invites"("token_hash");
+
+-- CreateIndex
+CREATE INDEX "org_invites_email_idx" ON "org_invites"("email");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "org_invites_org_id_email_key" ON "org_invites"("org_id", "email");
+
+-- CreateIndex
+CREATE INDEX "device_codes_org_id_idx" ON "device_codes"("org_id");
+
+-- CreateIndex
+CREATE INDEX "personal_access_tokens_org_id_idx" ON "personal_access_tokens"("org_id");
+
+-- CreateIndex
+CREATE INDEX "refresh_tokens_org_id_idx" ON "refresh_tokens"("org_id");
+
+-- AddForeignKey
+ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "personal_access_tokens" ADD CONSTRAINT "personal_access_tokens_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "device_codes" ADD CONSTRAINT "device_codes_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "organizations" ADD CONSTRAINT "organizations_created_by_id_fkey" FOREIGN KEY ("created_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_invites" ADD CONSTRAINT "org_invites_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_invites" ADD CONSTRAINT "org_invites_invited_by_id_fkey" FOREIGN KEY ("invited_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_invites" ADD CONSTRAINT "org_invites_accepted_by_id_fkey" FOREIGN KEY ("accepted_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- =============================================================================
+-- Raw SQL (hand-written; Prisma cannot express a partial unique index)
+-- =============================================================================
+
+-- Exactly one default organization: a constant-expression partial unique index.
+-- Intentional schema drift: never replace it with @@unique or a findFirst check.
+CREATE UNIQUE INDEX "organizations_default_uniq_idx" ON "organizations" ((true)) WHERE "is_default";
+
+-- =============================================================================
+-- Backfill (forward-only). Every INSERT names its id: the server-side uuid
+-- defaults were dropped (0005_drop_stale_uuid_defaults).
+-- =============================================================================
+
+-- 1. The default organization.
+INSERT INTO "organizations" ("id", "name", "slug", "is_default", "created_at", "updated_at")
+VALUES (gen_random_uuid(), 'Default organization', 'default', true, now(), now())
+ON CONFLICT DO NOTHING;
+
+-- 2. One active membership per existing user.
+INSERT INTO "memberships" ("id", "org_id", "user_id", "status", "last_active_at", "created_at", "updated_at")
+SELECT gen_random_uuid(), o."id", u."id", 'active', now(), now(), now()
+FROM "users" u
+CROSS JOIN "organizations" o
+WHERE o."is_default"
+ON CONFLICT ("org_id", "user_id") DO NOTHING;
+
+-- 3. Every existing credential row acts in the default organization.
+UPDATE "refresh_tokens" SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default") WHERE "org_id" IS NULL;
+UPDATE "personal_access_tokens" SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default") WHERE "org_id" IS NULL;
+UPDATE "device_codes" SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default") WHERE "org_id" IS NULL;

package/host/prisma/migrations/20240101000023_split_system_org_roles/migration.sql

@@ -0,0 +1,131 @@
+-- =============================================================================
+-- Split RBAC into system roles and org roles (PP-6.3, issue #723)
+-- =============================================================================
+--
+-- System roles operate the deployment and stay in "user_roles" (admin). Org
+-- roles operate one organization and move onto the membership
+-- ("memberships"."role_id"): org_admin, contributor, viewer. Every role and
+-- permission gains a "scope". Effective permissions become the system roles'
+-- grants plus the grants of the current organization's membership role, so the
+-- data below is moved so that every user keeps exactly what they had.
+--
+-- Forward-only and in one transaction: the expand (columns) and the data move
+-- happen together, so no request between "migrate deploy" and the seed run
+-- sees an administrator without a permission. Nothing is dropped: "user_roles"
+-- keeps its shape (expand/contract); only rows pointing at org roles go.
+-- Every INSERT names its id (0005_drop_stale_uuid_defaults).
+-- =============================================================================
+
+-- CreateEnum
+CREATE TYPE "RoleScope" AS ENUM ('system', 'org');
+
+-- AlterTable: nullable first, backfilled below, then NOT NULL.
+ALTER TABLE "memberships" ADD COLUMN     "role_id" UUID;
+
+-- AlterTable: NULL means the default org role (viewer).
+ALTER TABLE "org_invites" ADD COLUMN     "role_id" UUID;
+
+-- AlterTable
+ALTER TABLE "permissions" ADD COLUMN     "scope" "RoleScope" NOT NULL DEFAULT 'system';
+
+-- AlterTable
+ALTER TABLE "roles" ADD COLUMN     "scope" "RoleScope" NOT NULL DEFAULT 'system';
+
+-- -----------------------------------------------------------------------------
+-- 1. The org roles exist. org_admin is new; viewer is the fallback role of
+--    step 4 and may be missing on a database the seed has not reached yet.
+--    The seed refreshes both descriptions.
+-- -----------------------------------------------------------------------------
+INSERT INTO "roles" ("id", "name", "description", "scope")
+VALUES (gen_random_uuid(), 'org_admin', 'Organization administrator - everything a contributor can do, plus manage the organization members and invites', 'org')
+ON CONFLICT ("name") DO NOTHING;
+
+INSERT INTO "roles" ("id", "name", "description", "scope")
+VALUES (gen_random_uuid(), 'viewer', 'Read-only organization member - view content and manage own settings', 'org')
+ON CONFLICT ("name") DO NOTHING;
+
+-- -----------------------------------------------------------------------------
+-- 2. Scopes. admin stays 'system' (the column default), like every
+--    operational permission. An app's own roles and permissions keep the
+--    default until the seed writes the scope their declarations name.
+-- -----------------------------------------------------------------------------
+UPDATE "roles" SET "scope" = 'org' WHERE "name" IN ('org_admin', 'contributor', 'viewer');
+
+UPDATE "permissions" SET "scope" = 'org'
+WHERE "name" IN (
+  'user_settings:read', 'user_settings:write', 'storage:read', 'storage:write', 'ai:use',
+  'org_members:read', 'org_members:write', 'org_invites:read', 'org_invites:write'
+);
+
+-- -----------------------------------------------------------------------------
+-- 3. admin's grants of org permissions move to org_admin: copy first, then
+--    delete. Every admin gets org_admin on their membership in step 4, in this
+--    same transaction, so no administrator loses a permission. Grants an
+--    administrator made to contributor or viewer are left as they are.
+-- -----------------------------------------------------------------------------
+INSERT INTO "role_permissions" ("role_id", "permission_id")
+SELECT oa."id", rp."permission_id"
+FROM "role_permissions" rp
+JOIN "roles" a ON a."id" = rp."role_id" AND a."name" = 'admin'
+JOIN "permissions" p ON p."id" = rp."permission_id" AND p."scope" = 'org'
+CROSS JOIN "roles" oa
+WHERE oa."name" = 'org_admin'
+ON CONFLICT DO NOTHING;
+
+DELETE FROM "role_permissions" rp
+USING "roles" a, "permissions" p
+WHERE rp."role_id" = a."id" AND a."name" = 'admin'
+  AND rp."permission_id" = p."id" AND p."scope" = 'org';
+
+-- -----------------------------------------------------------------------------
+-- 4. Every user is a member of the default organization (0023 did this for
+--    the users that existed then; this catches any created since through a
+--    path that skipped it), and every membership gets its role from the
+--    user's global roles: admin -> org_admin; otherwise the highest of
+--    contributor > viewer; none -> viewer (the default org role).
+-- -----------------------------------------------------------------------------
+INSERT INTO "memberships" ("id", "org_id", "user_id", "status", "last_active_at", "created_at", "updated_at")
+SELECT gen_random_uuid(), o."id", u."id", 'active', now(), now(), now()
+FROM "users" u
+CROSS JOIN "organizations" o
+WHERE o."is_default"
+ON CONFLICT ("org_id", "user_id") DO NOTHING;
+
+UPDATE "memberships" m
+SET "role_id" = (
+  SELECT r."id" FROM "roles" r
+  WHERE r."name" = CASE
+    WHEN EXISTS (
+      SELECT 1 FROM "user_roles" ur JOIN "roles" x ON x."id" = ur."role_id"
+      WHERE ur."user_id" = m."user_id" AND x."name" = 'admin'
+    ) THEN 'org_admin'
+    WHEN EXISTS (
+      SELECT 1 FROM "user_roles" ur JOIN "roles" x ON x."id" = ur."role_id"
+      WHERE ur."user_id" = m."user_id" AND x."name" = 'contributor'
+    ) THEN 'contributor'
+    ELSE 'viewer'
+  END
+)
+WHERE m."role_id" IS NULL;
+
+ALTER TABLE "memberships" ALTER COLUMN "role_id" SET NOT NULL;
+
+-- -----------------------------------------------------------------------------
+-- 5. Contract, in data only: the global assignments of org roles are now
+--    carried by the memberships. admin rows (system) stay.
+-- -----------------------------------------------------------------------------
+DELETE FROM "user_roles" ur
+USING "roles" r
+WHERE ur."role_id" = r."id" AND r."scope" = 'org';
+
+-- CreateIndex
+CREATE INDEX "memberships_role_id_idx" ON "memberships"("role_id");
+
+-- CreateIndex
+CREATE INDEX "org_invites_role_id_idx" ON "org_invites"("role_id");
+
+-- AddForeignKey
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_invites" ADD CONSTRAINT "org_invites_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/host/prisma/migrations/20240101000024_org_scoped_rls/migration.sql

@@ -0,0 +1,215 @@
+-- =============================================================================
+-- org_id on tenant-scoped tables and row-level security (PP-6.5, issue #725)
+-- =============================================================================
+--
+-- The database enforces organization isolation (ADR 0002 D5). Four tables are
+-- org-owned and get a NOT NULL (or, for usage events, nullable) org_id plus a
+-- FORCEd policy keyed on transaction-local settings; audit_events gets a
+-- nullable org_id and no policy in this release.
+--
+--   storage_objects        org_id NOT NULL, FK RESTRICT, RLS forced
+--   storage_object_chunks  org_id NOT NULL, FK RESTRICT, RLS forced; its link to
+--                          the parent is now COMPOSITE (object_id, org_id) ->
+--                          storage_objects (id, org_id): a foreign-key check
+--                          bypasses row-level security, so a plain key would let
+--                          one organization store a reference to another's row
+--   ai_runs                org_id NOT NULL, FK RESTRICT, RLS forced. Restrict, not
+--                          SetNull: the column is NOT NULL, so history cannot
+--                          survive an organization's deletion by nulling it
+--   ai_usage_events        org_id nullable, FK SET NULL, RLS forced. Nullable so
+--                          a deployment-wide event (a catalogue sync) and the
+--                          history of a deleted organization survive; such a row
+--                          is visible to the system (bypass) client only
+--   audit_events           org_id nullable, FK SET NULL, NO row-level security
+--
+-- BACKFILL. Every existing row of the three NOT NULL tables, and of
+-- ai_usage_events, goes to the default organization (created by
+-- 0023_add_organizations on every database). Two exceptions keep NULL:
+--
+--   - ai_usage_events with operation = 'catalog': a catalogue sync is run by the
+--     deployment, not by an organization, and new ones are written without one.
+--   - audit_events whose action is a SYSTEM action. Everything else (including
+--     an action this migration does not know) belongs to the default
+--     organization. System action prefixes:
+--         system_settings:  email_settings:  push_config:  storage_config:
+--         ai_config:  ai_model:  ai_catalog:  telemetry:  support_bundle:
+--         maintenance:  db_restore:  db_backup:  allowlist:  users:  nodes:
+--         jobs.  notification_broadcast.  settings.  retention.
+--
+-- The backfill runs in an explicit transaction that raises the bypass flag
+-- (the pattern ADR 0002 prescribes for any migration that touches an RLS
+-- table: under FORCE a bare UPDATE would silently change zero rows). The
+-- policies are enabled AFTER it, so on a first apply the flag is belt and
+-- braces; it keeps the pattern in front of the next reader.
+--
+-- THE APPLICATION ROLE MUST BE NOSUPERUSER NOBYPASSRLS, or every policy below is
+-- inert (a superuser sees every row of a FORCEd table). The block at the end
+-- warns when the role applying this migration is not an ordinary role. The
+-- Doctor check `db.rls_role` fails while any FORCEd table exists and the
+-- application role is a superuser or has BYPASSRLS.
+--
+-- DEPLOYMENT NOTE. The statements below take short locks and build the new
+-- indexes inside the migration transaction; on a very large storage_objects or
+-- ai_usage_events table pre-create the indexes with CREATE INDEX CONCURRENTLY
+-- IF NOT EXISTS under the same names before applying.
+-- =============================================================================
+
+-- DropForeignKey
+ALTER TABLE "storage_object_chunks" DROP CONSTRAINT "storage_object_chunks_object_id_fkey";
+
+-- AlterTable (expand: nullable first, so existing rows can be backfilled)
+ALTER TABLE "storage_objects" ADD COLUMN     "org_id" UUID;
+ALTER TABLE "storage_object_chunks" ADD COLUMN     "org_id" UUID;
+ALTER TABLE "ai_runs" ADD COLUMN     "org_id" UUID;
+ALTER TABLE "ai_usage_events" ADD COLUMN     "org_id" UUID;
+ALTER TABLE "audit_events" ADD COLUMN     "org_id" UUID;
+
+-- Backfill, as system work.
+BEGIN;
+SELECT set_config('app.rls_bypass', 'on', true);
+
+UPDATE "storage_objects"
+   SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default")
+ WHERE "org_id" IS NULL;
+
+UPDATE "storage_object_chunks" AS c
+   SET "org_id" = o."org_id"
+  FROM "storage_objects" AS o
+ WHERE c."object_id" = o."id" AND c."org_id" IS NULL;
+
+UPDATE "ai_runs"
+   SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default")
+ WHERE "org_id" IS NULL;
+
+UPDATE "ai_usage_events"
+   SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default")
+ WHERE "org_id" IS NULL AND "operation" <> 'catalog';
+
+UPDATE "audit_events"
+   SET "org_id" = (SELECT "id" FROM "organizations" WHERE "is_default")
+ WHERE "org_id" IS NULL
+   AND "action" NOT LIKE 'system\_settings:%'
+   AND "action" NOT LIKE 'email\_settings:%'
+   AND "action" NOT LIKE 'push\_config:%'
+   AND "action" NOT LIKE 'storage\_config:%'
+   AND "action" NOT LIKE 'ai\_config:%'
+   AND "action" NOT LIKE 'ai\_model:%'
+   AND "action" NOT LIKE 'ai\_catalog:%'
+   AND "action" NOT LIKE 'telemetry:%'
+   AND "action" NOT LIKE 'support\_bundle:%'
+   AND "action" NOT LIKE 'maintenance:%'
+   AND "action" NOT LIKE 'db\_restore:%'
+   AND "action" NOT LIKE 'db\_backup:%'
+   AND "action" NOT LIKE 'allowlist:%'
+   AND "action" NOT LIKE 'users:%'
+   AND "action" NOT LIKE 'nodes:%'
+   AND "action" NOT LIKE 'jobs.%'
+   AND "action" NOT LIKE 'notification\_broadcast.%'
+   AND "action" NOT LIKE 'settings.%'
+   AND "action" NOT LIKE 'retention.%';
+COMMIT;
+
+-- AlterTable (contract: the three tables whose column is NOT NULL)
+ALTER TABLE "storage_objects" ALTER COLUMN "org_id" SET NOT NULL;
+ALTER TABLE "storage_object_chunks" ALTER COLUMN "org_id" SET NOT NULL;
+ALTER TABLE "ai_runs" ALTER COLUMN "org_id" SET NOT NULL;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "storage_objects_id_org_id_key" ON "storage_objects"("id", "org_id");
+
+-- CreateIndex
+CREATE INDEX "storage_objects_org_id_uploaded_by_id_created_at_idx" ON "storage_objects"("org_id", "uploaded_by_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "storage_objects_org_id_status_idx" ON "storage_objects"("org_id", "status");
+
+-- CreateIndex
+CREATE INDEX "storage_object_chunks_org_id_object_id_idx" ON "storage_object_chunks"("org_id", "object_id");
+
+-- CreateIndex
+CREATE INDEX "ai_runs_org_id_user_id_created_at_idx" ON "ai_runs"("org_id", "user_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "ai_usage_events_org_id_user_id_created_at_idx" ON "ai_usage_events"("org_id", "user_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "ai_usage_events_org_id_created_at_idx" ON "ai_usage_events"("org_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "audit_events_org_id_created_at_idx" ON "audit_events"("org_id", "created_at");
+
+-- AddForeignKey
+ALTER TABLE "storage_objects" ADD CONSTRAINT "storage_objects_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey (composite: object_id and org_id together)
+ALTER TABLE "storage_object_chunks" ADD CONSTRAINT "storage_object_chunks_object_id_org_id_fkey" FOREIGN KEY ("object_id", "org_id") REFERENCES "storage_objects"("id", "org_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "storage_object_chunks" ADD CONSTRAINT "storage_object_chunks_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ai_runs" ADD CONSTRAINT "ai_runs_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ai_usage_events" ADD CONSTRAINT "ai_usage_events_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_events" ADD CONSTRAINT "audit_events_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- =============================================================================
+-- Row-level security. Prisma's schema language cannot express any of this and
+-- its diff ignores it; the policy names are listed in RLS_POLICIES
+-- (packages/platform-db/src/drift/rls-policies.ts) and asserted against
+-- pg_policies by the drift test.
+--
+-- NULLIF(..., '') is required: current_setting(name, true) is NULL on a fresh
+-- connection but the EMPTY STRING on a connection that has ever held a
+-- transaction-local value, and a bare ''::uuid cast errors.
+-- FORCE applies the policy to the table owner, which is the application role:
+-- unscoped code sees no rows and cannot insert (it fails closed).
+-- =============================================================================
+
+ALTER TABLE "storage_objects" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "storage_objects" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "storage_objects_org_isolation" ON "storage_objects"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+ALTER TABLE "storage_object_chunks" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "storage_object_chunks" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "storage_object_chunks_org_isolation" ON "storage_object_chunks"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+ALTER TABLE "ai_runs" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "ai_runs" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "ai_runs_org_isolation" ON "ai_runs"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+ALTER TABLE "ai_usage_events" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "ai_usage_events" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "ai_usage_events_org_isolation" ON "ai_usage_events"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+-- A policy is inert for a superuser or a BYPASSRLS role. Warn (do not fail:
+-- the migration role may legitimately differ from the application role).
+DO $$
+DECLARE
+  inert boolean;
+BEGIN
+  SELECT rolsuper OR rolbypassrls INTO inert FROM pg_roles WHERE rolname = current_user;
+  IF inert THEN
+    RAISE WARNING 'row-level security is INERT for role "%": it is a superuser or has BYPASSRLS. Run the application as an ordinary role (NOSUPERUSER NOBYPASSRLS) or tenant isolation is not enforced.', current_user;
+  END IF;
+END
+$$;