@opengeni/core 1.0.1 → 2.2.0-canary.0

package/src/editable-artifact-live/application.ts

@@ -23,9 +23,13 @@ import type { EditableArtifactLiveTicket } from "./types";
 
 export type EditableArtifactLiveCompatibilityRequest = Readonly<{
   artifact: EditableArtifact;
-  protocolVersion: number;
+  modality: EditableArtifactModality;
+  liveProtocolVersion: number;
   kernelVersion: string;
   modelSchemaVersion: number;
+  snapshotVersion: number;
+  commandProtocolVersion: number;
+  committedTransactionProtocolVersion: number;
 }>;
 
 /** A client/runtime protocol tuple cannot be served by the loaded kernel. */
@@ -71,9 +75,13 @@ export type ReadEditableArtifactApplicationInput = Readonly<{
 
 export type MintEditableArtifactApplicationTicketInput = ReadEditableArtifactApplicationInput &
   Readonly<{
-    protocolVersion: number;
+    modality: EditableArtifactModality;
+    liveProtocolVersion: number;
     kernelVersion: string;
     modelSchemaVersion: number;
+    snapshotVersion: number;
+    commandProtocolVersion: number;
+    committedTransactionProtocolVersion: number;
     allowEdit: boolean;
   }>;
 
@@ -148,9 +156,19 @@ export class EditableArtifactApplication implements EditableArtifactApplicationP
     const artifact = await this.readArtifact(input);
     await this.dependencies.compatibility.assertCompatible({
       artifact,
-      protocolVersion: positiveInteger(input.protocolVersion, "protocolVersion"),
+      modality: input.modality,
+      liveProtocolVersion: positiveInteger(input.liveProtocolVersion, "liveProtocolVersion"),
       kernelVersion: boundedVersion(input.kernelVersion, "kernelVersion"),
       modelSchemaVersion: positiveInteger(input.modelSchemaVersion, "modelSchemaVersion"),
+      snapshotVersion: positiveInteger(input.snapshotVersion, "snapshotVersion"),
+      commandProtocolVersion: positiveInteger(
+        input.commandProtocolVersion,
+        "commandProtocolVersion",
+      ),
+      committedTransactionProtocolVersion: positiveInteger(
+        input.committedTransactionProtocolVersion,
+        "committedTransactionProtocolVersion",
+      ),
     });
     return await this.dependencies.live.mintTicket({
       scope: artifact.scope,

package/src/editable-artifact-live/ports.ts

@@ -40,7 +40,6 @@ export type EditableArtifactLiveBootstrapRead = Readonly<{
   scope: EditableArtifactScope;
   artifactId: EditableArtifactId;
   resume: EditableArtifactLiveResume;
-  protocolVersion: number;
 }>;
 
 export type EditableArtifactLiveTransactionPage = Readonly<{

package/src/editable-artifact-live/server.ts

@@ -81,7 +81,6 @@ const MAX_IDENTIFIER_BYTES = 512;
 const MAX_CAUSAL_ACTORS = 1_024;
 
 export type EditableArtifactLiveServerOptions = Readonly<{
-  protocolVersion?: number;
   ticketTtlMs?: number;
   maxClientFrameBytes?: number;
   maxOutboundFrameBytes?: number;
@@ -101,7 +100,10 @@ export type EditableArtifactLiveServerOptions = Readonly<{
 }>;
 
 type NormalizedOptions = Required<Omit<EditableArtifactLiveServerOptions, "ticketTtlMs">> &
-  Readonly<{ ticketTtlMs?: number }>;
+  Readonly<{
+    protocolVersion: typeof EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
+    ticketTtlMs?: number;
+  }>;
 
 export type OpenEditableArtifactLiveInput = Readonly<{
   token: string;
@@ -147,7 +149,6 @@ export class EditableArtifactLiveServer {
       tickets: dependencies.tickets,
       tokens: dependencies.tokens,
       clock: dependencies.clock,
-      protocolVersion: this.options.protocolVersion,
       ...(this.options.ticketTtlMs === undefined ? {} : { ttlMs: this.options.ticketTtlMs }),
     });
   }
@@ -312,7 +313,6 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
         scope: this.ticket.scope,
         artifactId: this.artifactId,
         resume: this.resume,
-        protocolVersion: this.options.protocolVersion,
       });
       this.assertOpen();
       validateBootstrap(bootstrap, this.artifactId, this.modality, this.resume, this.options);
@@ -706,7 +706,13 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
       } as const;
       await this.send(
         snapshot.modality === "spreadsheet"
-          ? { ...common, modality: snapshot.modality, causalFrontier: causalFrontier! }
+          ? {
+              ...common,
+              modality: snapshot.modality,
+              causalFrontier: causalFrontier!,
+              operationProtocolVersion: snapshot.operationProtocolVersion,
+              snapshotVersion: snapshot.snapshotVersion,
+            }
           : {
               ...common,
               modality: snapshot.modality,
@@ -1264,7 +1270,7 @@ function validateResume(
   resume: EditableArtifactLiveResume,
   durableModality: EditableArtifactModality,
 ): void {
-  const resumeModality = resume.modality ?? "spreadsheet";
+  const resumeModality = resume.modality;
   if (resumeModality !== durableModality) {
     throw new EditableArtifactLiveError(
       "invalid_frame",
@@ -1608,7 +1614,7 @@ function boundedString(value: string, label: string, maxBytes: number): void {
 
 function normalizeOptions(options: EditableArtifactLiveServerOptions): NormalizedOptions {
   const normalized = {
-    protocolVersion: options.protocolVersion ?? EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
+    protocolVersion: EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
     maxClientFrameBytes: options.maxClientFrameBytes ?? DEFAULT_MAX_CLIENT_FRAME_BYTES,
     maxOutboundFrameBytes: options.maxOutboundFrameBytes ?? DEFAULT_MAX_OUTBOUND_FRAME_BYTES,
     maxSnapshotBytes: options.maxSnapshotBytes ?? DEFAULT_MAX_SNAPSHOT_BYTES,

package/src/editable-artifact-live/ticket.ts

@@ -31,7 +31,6 @@ export type EditableArtifactLiveTicketAuthorityDependencies = Readonly<{
   tokens: EditableArtifactLiveTokenPort;
   clock: EditableArtifactLiveClockPort;
   ttlMs?: number;
-  protocolVersion?: number;
 }>;
 
 export class EditableArtifactLiveTicketAuthority {
@@ -43,10 +42,7 @@ export class EditableArtifactLiveTicketAuthority {
     if (!Number.isSafeInteger(this.ttlMs) || this.ttlMs < 1_000 || this.ttlMs > MAX_TTL_MS) {
       throw new TypeError(`ticket ttl must be 1000-${MAX_TTL_MS} milliseconds`);
     }
-    this.protocolVersion = dependencies.protocolVersion ?? EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
-    if (!Number.isSafeInteger(this.protocolVersion) || this.protocolVersion < 1) {
-      throw new TypeError("protocol version must be a positive safe integer");
-    }
+    this.protocolVersion = EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
   }
 
   async mint(

package/src/editable-artifact-live/types.ts

@@ -1,3 +1,4 @@
+import { EDITABLE_ARTIFACT_LIVE_WIRE_VERSION } from "@opengeni/contracts/editable-artifact-live";
 import type {
   EditableArtifactActor,
   EditableArtifactCausalFrontier,
@@ -11,7 +12,7 @@ import type {
   EditableArtifactTransactionId,
 } from "../domain/editable-artifacts/types";
 
-export const EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION = 1;
+export const EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION = EDITABLE_ARTIFACT_LIVE_WIRE_VERSION;
 
 export type EditableArtifactLiveTicket = Readonly<{
   artifactId: EditableArtifactId;
@@ -52,6 +53,7 @@ export type EditableArtifactLiveSnapshot =
         modality: "spreadsheet";
         causalFrontier: EditableArtifactCausalFrontier;
         operationProtocolVersion: number;
+        snapshotVersion: number;
       }>)
   | (EditableArtifactLiveSnapshotCommon &
       Readonly<{
@@ -120,7 +122,7 @@ type EditableArtifactLiveResumeCommon = Readonly<{
 export type EditableArtifactLiveResume =
   | (EditableArtifactLiveResumeCommon &
       Readonly<{
-        modality?: "spreadsheet";
+        modality: "spreadsheet";
         localCausalFrontier: EditableArtifactCausalFrontier;
       }>)
   | (EditableArtifactLiveResumeCommon &
@@ -166,6 +168,8 @@ export type EditableArtifactLiveServerFrame =
         | Readonly<{
             modality: "spreadsheet";
             causalFrontier: EditableArtifactCausalFrontier;
+            operationProtocolVersion: number;
+            snapshotVersion: number;
           }>
         | Readonly<{
             modality: "document" | "presentation";

package/src/editable-artifact-live/wire.ts

@@ -81,15 +81,5 @@ export function encodeEditableArtifactLiveMutationWireFrame(
 export function encodeEditableArtifactLiveServerWireFrame(
   frame: EditableArtifactLiveServerFrame,
 ): Uint8Array {
-  if (frame.type === "transaction" && frame.transaction.modality === "spreadsheet") {
-    const { operationProtocolVersion, modality: _modality, ...transaction } = frame.transaction;
-    return encodeContractServerFrame({
-      ...frame,
-      transaction: {
-        ...transaction,
-        protocolVersion: operationProtocolVersion,
-      },
-    } as unknown as ContractServerFrame);
-  }
   return encodeContractServerFrame(frame as unknown as ContractServerFrame);
 }

package/src/index.ts

@@ -43,6 +43,7 @@ export * from "./transcription";
 // fleet tools, the machines REST route, and the rest of the sandbox layer.
 export * from "./sandbox/fleet";
 export * from "./sandbox/routing";
+export * from "./sandbox/runtime-settings";
 
 // Access layer (transport-neutral grant resolution + permission checks).
 export * from "./access";
@@ -59,25 +60,36 @@ export * from "./domain/skill-imports";
 export * from "./domain/environments";
 export * from "./rigs";
 export * from "./domain/packs";
+export * from "./domain/automations";
+export * from "./domain/pr-review";
 export * from "./domain/personal-connection-delegations";
 export * from "./domain/resources";
+export * from "./domain/github-repository-bindings";
 export * from "./domain/session-tool-policy";
 export * from "./domain/scheduled-tasks";
 export * from "./domain/sessions";
 export * from "./domain/insights";
 export * from "./domain/memory-slack-publication";
 export * from "./domain/memory-slack-delivery";
-export * from "./domain/durable-learning-slack-publication";
+export * from "./domain/governed-learning-slack-publication";
 export * from "./domain/slack-publication-secret-safety";
 export * from "./domain/company-profile-durable-learning-adapter";
+export * from "./domain/company-profile-agent-admin";
+export * from "./domain/company-brain-governed-writes";
+export * from "./domain/governed-learning-evaluator";
+export * from "./domain/governed-learning-activation";
+export * from "./domain/remember";
 export * from "./domain/slack-bot";
 export * from "./domain/conversation-integrations";
 export * from "./domain/fiken";
 export * from "./domain/workspace-members";
 export * from "./domain/video-generation";
 export * from "./domain/video-generation-capabilities";
+export * from "./domain/organization-membership-lifecycle";
 export * from "./application/new-session-drafts";
 export * from "./application/session-commands";
+export * from "./application/session-tenancy";
+export * from "./application/user-resource-grants";
 
 // Durable editable-artifact live broker, ticket, ports, and projection types.
 export * from "./editable-artifact-live";

package/src/rigs/index.ts

@@ -11,6 +11,7 @@ import type {
   ProposeRigChangeRequest,
   Rig,
   RigChange,
+  ResourceAuthorityScope,
   RigVersion,
   UpdateRigRequest,
 } from "@opengeni/contracts";
@@ -21,7 +22,6 @@ import {
   createRigChange,
   createRigVersion,
   createRigVersionForChangePromotion,
-  deleteRigIfNoActiveSessions,
   getRig,
   getRigByName,
   getRigChange,
@@ -30,12 +30,15 @@ import {
   listRigChanges,
   listRigVersions,
   recordAuditEvent,
+  revokeScopedRig,
   RigActiveVersionChangedError,
   RigChangeTransitionError,
-  updateRig,
+  updateScopedRig,
   type Database,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
+import { boundedParallelMap } from "@opengeni/runtime/mcp-network";
+import { requirePermission } from "../access";
 import { rigProviderImagesFromVerification } from "./provider-images";
 
 export * from "./provider-images";
@@ -44,6 +47,34 @@ export const MAX_RIGS_PER_WORKSPACE = 50;
 export const MAX_CHECKS_PER_RIG = 100;
 export const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
 export const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;
+export const RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY = 4;
+
+type VariableSetEnvironment = { values: Record<string, string> } | null;
+
+/** Load complete rig defaults concurrently while preserving listed precedence. */
+export async function loadRigDefaultVariableSetEnvironment(
+  variableSetIds: readonly string[],
+  load: (variableSetId: string) => Promise<VariableSetEnvironment>,
+): Promise<Record<string, string>> {
+  const variableSets = await boundedParallelMap(
+    variableSetIds,
+    RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY,
+    load,
+  );
+  const values: Record<string, string> = {};
+  for (const variableSet of variableSets) {
+    Object.assign(values, variableSet?.values ?? {});
+  }
+  return values;
+}
+
+/** Rig defaults layer below the session's explicitly selected variable set. */
+export function mergeRigDefaultVariableSetEnvironment(
+  rigDefaultValues: Record<string, string>,
+  sessionValues: Record<string, string>,
+): Record<string, string> {
+  return { ...rigDefaultValues, ...sessionValues };
+}
 
 export type RigServices = {
   db: Database;
@@ -92,10 +123,10 @@ export function rigActorForGrant(grant: AccessGrant): string {
 
 export async function requireRigForApi(
   db: Database,
-  workspaceId: string,
+  grant: AccessGrant,
   rigId: string,
 ): Promise<Rig> {
-  const rig = await getRig(db, workspaceId, rigId);
+  const rig = await getRig(db, grant, rigId);
   if (!rig) {
     throw new HTTPException(404, { message: "rig not found" });
   }
@@ -133,7 +164,9 @@ function assertUniqueCheckNames(checks: ReadonlyArray<{ name: string }> | undefi
   const seen = new Set<string>();
   for (const check of checks) {
     if (seen.has(check.name)) {
-      throw new HTTPException(422, { message: `duplicate rig check name: ${check.name}` });
+      throw new HTTPException(422, {
+        message: `duplicate rig check name: ${check.name}`,
+      });
     }
     seen.add(check.name);
   }
@@ -143,42 +176,78 @@ function assertUniqueCheckNames(checks: ReadonlyArray<{ name: string }> | undefi
 // cross-workspace id indistinguishable from a missing one, so both map to 422.
 async function assertVariableSetsExist(
   db: Database,
-  workspaceId: string,
+  access: AccessGrant,
+  rigScope: ResourceAuthorityScope,
   ids: ReadonlyArray<string> | undefined,
 ): Promise<void> {
-  if (!ids || ids.length === 0) {
+  if (ids === undefined) {
+    return;
+  }
+  requirePermission(access, "variable-sets:attach");
+  if (ids.length === 0) {
     return;
   }
+  requirePermission(access, "variable-sets:use");
   const unique = [...new Set(ids)];
   for (const id of unique) {
-    const variableSet = await getVariableSet(db, workspaceId, id);
+    const variableSet = await getVariableSet(db, access, id);
     if (!variableSet) {
-      throw new HTTPException(422, { message: `unknown defaultVariableSetId: ${id}` });
+      throw new HTTPException(422, {
+        message: `unknown defaultVariableSetId: ${id}`,
+      });
+    }
+    if (!variableSetScopeAllowedForRig(rigScope, variableSet.scope)) {
+      throw new HTTPException(422, {
+        message: `${rigScope}-scoped rigs cannot use ${variableSet.scope}-scoped variable sets`,
+      });
     }
   }
 }
 
+/** A resource may depend only on Variable Sets whose audience is no narrower
+ * than its own. User-owned rigs may use anything visible to their owner. */
+export function variableSetScopeAllowedForRig(
+  rigScope: ResourceAuthorityScope,
+  variableSetScope: ResourceAuthorityScope,
+): boolean {
+  return (
+    rigScope === "user" ||
+    variableSetScope === "organization" ||
+    (rigScope === "workspace" && variableSetScope === "workspace")
+  );
+}
+
 export async function createRigForApi(
   deps: RigServices,
   grant: AccessGrant,
   payload: CreateRigRequest,
+  options: { allowOrganization?: boolean } = {},
 ): Promise<Rig> {
-  const workspaceId = grant.workspaceId;
   const name = trimmedRigName(payload.name);
   assertUniqueCheckNames(payload.checks);
-  await assertVariableSetsExist(deps.db, workspaceId, payload.defaultVariableSetIds);
-  if ((await countRigs(deps.db, workspaceId)) >= MAX_RIGS_PER_WORKSPACE) {
+  await assertVariableSetsExist(
+    deps.db,
+    grant,
+    payload.scope,
+    payload.defaultVariableSetIds.length > 0 ? payload.defaultVariableSetIds : undefined,
+  );
+  if ((await countRigs(deps.db, grant, payload.scope)) >= MAX_RIGS_PER_WORKSPACE) {
     throw new HTTPException(422, {
       message: `a workspace supports at most ${MAX_RIGS_PER_WORKSPACE} rigs`,
     });
   }
-  if (await getRigByName(deps.db, workspaceId, name)) {
-    throw new HTTPException(409, { message: `rig name is already in use: ${name}` });
+  if (await getRigByName(deps.db, grant, name, payload.scope)) {
+    throw new HTTPException(409, {
+      message: `rig name is already in use: ${name}`,
+    });
   }
   const createdBy = rigActorForGrant(grant);
   const rig = await createRig(deps.db, {
     accountId: grant.accountId,
-    workspaceId,
+    workspaceId: grant.workspaceId,
+    scope: payload.scope,
+    subjectId: grant.subjectId,
+    allowOrganization: options.allowOrganization === true,
     name,
     description: payload.description ?? null,
     createdBy,
@@ -192,7 +261,11 @@ export async function createRigForApi(
       createdBy,
     },
   });
-  await recordRigAuditEvent(deps.db, { grant, action: "rig.created", rigId: rig.id });
+  await recordRigAuditEvent(deps.db, {
+    grant,
+    action: "rig.created",
+    rigId: rig.id,
+  });
   return rig;
 }
 
@@ -201,20 +274,27 @@ export async function updateRigForApi(
   grant: AccessGrant,
   rig: Rig,
   payload: UpdateRigRequest,
+  options: { allowOrganization?: boolean } = {},
 ): Promise<Rig> {
-  const workspaceId = grant.workspaceId;
   const name = payload.name !== undefined ? trimmedRigName(payload.name) : undefined;
   if (name !== undefined && name !== rig.name) {
-    const existing = await getRigByName(deps.db, workspaceId, name);
+    const existing = await getRigByName(deps.db, grant, name, rig.scope);
     if (existing && existing.id !== rig.id) {
-      throw new HTTPException(409, { message: `rig name is already in use: ${name}` });
+      throw new HTTPException(409, {
+        message: `rig name is already in use: ${name}`,
+      });
     }
   }
-  const updated = await updateRig(deps.db, workspaceId, rig.id, {
+  const updated = await updateScopedRig(deps.db, grant, rig.id, {
     ...(name !== undefined ? { name } : {}),
     ...(payload.description !== undefined ? { description: payload.description } : {}),
+    allowOrganization: options.allowOrganization === true,
+  });
+  await recordRigAuditEvent(deps.db, {
+    grant,
+    action: "rig.updated",
+    rigId: rig.id,
   });
-  await recordRigAuditEvent(deps.db, { grant, action: "rig.updated", rigId: rig.id });
   return updated;
 }
 
@@ -222,18 +302,27 @@ export async function deleteRigForApi(
   deps: RigServices,
   grant: AccessGrant,
   rig: Rig,
+  options: { allowOrganization?: boolean } = {},
 ): Promise<void> {
-  const workspaceId = grant.workspaceId;
-  const deleted = await deleteRigIfNoActiveSessions(deps.db, workspaceId, rig.id);
-  if (deleted.activeSessionCount > 0) {
-    throw new HTTPException(409, {
-      message: `rig is referenced by ${deleted.activeSessionCount} active session(s); it cannot be deleted`,
+  try {
+    await revokeScopedRig(deps.db, grant, rig.id, {
+      allowOrganization: options.allowOrganization === true,
     });
+  } catch (error) {
+    let current: unknown = error;
+    while (current instanceof Error) {
+      if (current.message.includes("active sessions")) {
+        throw new HTTPException(409, { message: current.message });
+      }
+      current = current.cause;
+    }
+    throw error;
   }
-  if (!deleted.deleted) {
-    throw new HTTPException(404, { message: "rig not found" });
-  }
-  await recordRigAuditEvent(deps.db, { grant, action: "rig.deleted", rigId: rig.id });
+  await recordRigAuditEvent(deps.db, {
+    grant,
+    action: "rig.deleted",
+    rigId: rig.id,
+  });
 }
 
 // Records a proposed change against the rig's CURRENT active version (the base
@@ -247,15 +336,18 @@ export async function proposeRigChangeForApi(
   request: ProposeRigChangeRequest,
   options: { proposedBy?: string } = {},
 ): Promise<RigChange> {
-  const workspaceId = grant.workspaceId;
+  const workspaceId = rig.workspaceId;
   if (!rig.activeVersion) {
-    throw new HTTPException(422, { message: "rig has no active version to base a change on" });
+    throw new HTTPException(422, {
+      message: "rig has no active version to base a change on",
+    });
   }
   if (request.kind === "definition_edit") {
     assertUniqueCheckNames(request.payload.checks);
     await assertVariableSetsExist(
       deps.db,
-      workspaceId,
+      grant,
+      rig.scope,
       request.payload.defaultVariableSetIds ?? undefined,
     );
   }
@@ -342,18 +434,22 @@ export async function promoteSetupAppendChange(
     });
   }
   if (change.status !== "proposed" && change.status !== "verifying") {
-    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });
+    throw new HTTPException(409, {
+      message: `rig change is ${change.status}; cannot promote`,
+    });
   }
   if (!change.baseVersionId) {
     throw new HTTPException(422, { message: "rig change has no base version" });
   }
-  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);
+  const base = await getRigVersion(deps.db, rig.workspaceId, rig.id, change.baseVersionId);
   if (!base) {
     throw new HTTPException(404, { message: "base rig version not found" });
   }
   const payload = change.payload as { command?: unknown; note?: unknown };
   if (typeof payload.command !== "string" || !payload.command.trim()) {
-    throw new HTTPException(422, { message: "setup_append change is missing command" });
+    throw new HTTPException(422, {
+      message: "setup_append change is missing command",
+    });
   }
   const nextDefinition = {
     image: base.image,
@@ -364,7 +460,7 @@ export async function promoteSetupAppendChange(
   };
   const { version, change: updated } = await promoteChangeWithActiveCas(
     deps,
-    grant.workspaceId,
+    rig.workspaceId,
     rig.id,
     change.id,
     {
@@ -382,13 +478,21 @@ export async function promoteSetupAppendChange(
     grant,
     action: "rig.change.merged",
     rigId: rig.id,
-    metadata: { changeId: change.id, versionId: version.id, version: version.version },
+    metadata: {
+      changeId: change.id,
+      versionId: version.id,
+      version: version.version,
+    },
   });
   await recordRigAuditEvent(deps.db, {
     grant,
     action: "rig.version.promoted",
     rigId: rig.id,
-    metadata: { changeId: change.id, versionId: version.id, version: version.version },
+    metadata: {
+      changeId: change.id,
+      versionId: version.id,
+      version: version.version,
+    },
   });
   return { change: updated, version };
 }
@@ -400,10 +504,14 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
   change: RigChange,
 ): Promise<{ change: RigChange; version: RigVersion }> {
   if (change.kind !== "definition_edit") {
-    throw new HTTPException(422, { message: "only definition_edit changes use explicit promote" });
+    throw new HTTPException(422, {
+      message: "only definition_edit changes use explicit promote",
+    });
   }
   if (change.status !== "proposed") {
-    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });
+    throw new HTTPException(409, {
+      message: `rig change is ${change.status}; cannot promote`,
+    });
   }
   if (change.verification?.passed !== true) {
     throw new HTTPException(422, {
@@ -413,7 +521,7 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
   if (!change.baseVersionId) {
     throw new HTTPException(422, { message: "rig change has no base version" });
   }
-  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);
+  const base = await getRigVersion(deps.db, rig.workspaceId, rig.id, change.baseVersionId);
   if (!base) {
     throw new HTTPException(404, { message: "base rig version not found" });
   }
@@ -439,7 +547,7 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
   };
   const { version, change: updated } = await promoteChangeWithActiveCas(
     deps,
-    grant.workspaceId,
+    rig.workspaceId,
     rig.id,
     change.id,
     {
@@ -457,13 +565,21 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
     grant,
     action: "rig.change.merged",
     rigId: rig.id,
-    metadata: { changeId: change.id, versionId: version.id, version: version.version },
+    metadata: {
+      changeId: change.id,
+      versionId: version.id,
+      version: version.version,
+    },
   });
   await recordRigAuditEvent(deps.db, {
     grant,
     action: "rig.version.promoted",
     rigId: rig.id,
-    metadata: { changeId: change.id, versionId: version.id, version: version.version },
+    metadata: {
+      changeId: change.id,
+      versionId: version.id,
+      version: version.version,
+    },
   });
   return { change: updated, version };
 }
@@ -480,13 +596,14 @@ export async function createRigVersionForApi(
   assertUniqueCheckNames(payload.checks);
   await assertVariableSetsExist(
     deps.db,
-    grant.workspaceId,
+    grant,
+    rig.scope,
     payload.defaultVariableSetIds ?? undefined,
   );
   const base = rig.activeVersion;
   const version = await createRigVersion(
     deps.db,
-    grant.workspaceId,
+    rig.workspaceId,
     rig.id,
     {
       image: payload.image === undefined ? base.image : payload.image,
@@ -516,7 +633,7 @@ export async function activateRigVersionForApi(
   rig: Rig,
   versionId: string,
 ): Promise<RigVersion> {
-  const workspaceId = grant.workspaceId;
+  const workspaceId = rig.workspaceId;
   const version = await activateRigVersion(deps.db, workspaceId, rig.id, versionId);
   await recordRigAuditEvent(deps.db, {
     grant,