@opengeni/db 0.10.7 → 0.12.1

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { n as agentRunStates, o as apiKeys, p as auditEvents, q as billingCustomers, r as capabilityCatalogItems, t as capabilityInstallations, u as codexCapacityWaiters, v as codexCredentialLeases, x as codexResetRedemptionAttempts, y as codexRotationSettings, z as codexSubscriptionCredentials, d as composerDrafts, A as connections, B as creditLedgerEntries, C as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, D as documentBases, E as documentChunks, F as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, G as enrollments, H as fileUploads, I as files, J as githubInstallationRepositories, K as githubInstallations, L as hostExportConfig, M as hostExportConsumers, N as hostExportCursorState, O as hostExportDeadLetters, P as hostExportOutbox, Q as importBatches, R as integrationOauthClients, S as integrationOauthStateNonces, T as knowledgeMemories, U as machineMetricsLatest, V as machineMetricsSeries, W as managedAccounts, X as packInstallations, Y as rigChanges, Z as rigVersions, _ as rigs, j as sandboxKindValues, $ as sandboxLeaseHolders, a0 as sandboxLeaseLivenessValues, a1 as sandboxLeases, a2 as sandboxPtySessions, a3 as sandboxSessionEnvelopes, a4 as sandboxes, a5 as scheduledTaskRuns, a6 as scheduledTasks, a7 as sessionAttemptInterruptions, s as sessionCommandReceipts, a8 as sessionEvents, a9 as sessionGoals, aa as sessionHistoryItems, ab as sessionHumanInputRequests, ac as sessionListSnapshots, ad as sessionMcpServers, ae as sessionPendingToolCalls, af as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, ag as sessionRecordings, ah as sessionSystemUpdateOutbox, ai as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, aj as sessionWorkflowWakeOutbox, a as sessions, ak as socialConnections, al as socialPosts, am as stripeWebhookEvents, an as usageEvents, ao as workspaceCaptures, ap as workspaceControlEvents, aq as workspaceInferenceControls, ar as workspaceMemberships, as as workspaceModelPolicies, at as workspacePacks, au as workspaceSessionActivityRevisions, av as workspaceVariableSetVariables, aw as workspaceVariableSets, w as workspaces } from './schema-CqkzrBRS.js';
+export { o as agentRunStates, p as apiKeys, q as auditEvents, r as billingCustomers, t as capabilityCatalogItems, u as capabilityInstallations, v as codexCapacityWaiters, x as codexCredentialLeases, y as codexResetRedemptionAttempts, z as codexRotationSettings, A as codexSubscriptionCredentials, d as composerDrafts, B as connections, C as creditLedgerEntries, D as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, E as documentBases, F as documentChunks, G as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, H as enrollments, I as fileUploads, J as files, K as githubInstallationRepositories, L as githubInstallations, M as hostExportConfig, N as hostExportConsumers, O as hostExportCursorState, P as hostExportDeadLetters, Q as hostExportOutbox, R as importBatches, S as integrationOauthClients, T as integrationOauthStateNonces, U as knowledgeMemories, V as machineMetricsLatest, W as machineMetricsSeries, X as managedAccounts, Y as nestedAgentDepthConfiguration, n as newSessionDrafts, Z as packInstallations, _ as rigChanges, $ as rigVersions, a0 as rigs, j as sandboxKindValues, a1 as sandboxLeaseHolders, a2 as sandboxLeaseLivenessValues, a3 as sandboxLeases, a4 as sandboxPtySessions, a5 as sandboxRetainedProcessStateValues, a6 as sandboxRetainedProcesses, a7 as sandboxSessionEnvelopes, a8 as sandboxWorkspaceMutationActorKindValues, a9 as sandboxWorkspaceMutationAdmissions, aa as sandboxWorkspaceMutationHolderKindValues, ab as sandboxes, ac as scheduledTaskRuns, ad as scheduledTasks, ae as sessionAttemptInterruptions, s as sessionCommandReceipts, af as sessionEvents, ag as sessionGoals, ah as sessionHistoryItems, ai as sessionHumanInputRequests, aj as sessionListSnapshots, ak as sessionMcpServers, al as sessionPendingToolCalls, am as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, an as sessionRecordings, ao as sessionSpawnDenials, ap as sessionSystemUpdateOutbox, aq as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, ar as sessionWorkflowWakeOutbox, a as sessions, as as socialConnections, at as socialPosts, au as stripeWebhookEvents, av as usageEvents, aw as workspaceCaptures, ax as workspaceControlEvents, ay as workspaceInferenceControls, az as workspaceMemberships, aA as workspaceModelPolicies, aB as workspacePacks, aC as workspaceSessionActivityRevisions, aD as workspaceVariableSetVariables, aE as workspaceVariableSets, w as workspaces } from './schema-BejThLcd.js';

package/dist/schema.js

@@ -38,6 +38,8 @@ import {
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
+  nestedAgentDepthConfiguration,
+  newSessionDrafts,
   packInstallations,
   rigChanges,
   rigVersions,
@@ -47,7 +49,12 @@ import {
   sandboxLeaseLivenessValues,
   sandboxLeases,
   sandboxPtySessions,
+  sandboxRetainedProcessStateValues,
+  sandboxRetainedProcesses,
   sandboxSessionEnvelopes,
+  sandboxWorkspaceMutationActorKindValues,
+  sandboxWorkspaceMutationAdmissions,
+  sandboxWorkspaceMutationHolderKindValues,
   sandboxes,
   scheduledTaskRuns,
   scheduledTasks,
@@ -65,6 +72,7 @@ import {
   sessionRecordingModeValues,
   sessionRecordingStateValues,
   sessionRecordings,
+  sessionSpawnDenials,
   sessionSystemUpdateOutbox,
   sessionSystemUpdates,
   sessionTurnAttempts,
@@ -85,7 +93,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-P6PKXY5W.js";
+} from "./chunk-VUKRIBO5.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -127,6 +135,8 @@ export {
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
+  nestedAgentDepthConfiguration,
+  newSessionDrafts,
   packInstallations,
   rigChanges,
   rigVersions,
@@ -136,7 +146,12 @@ export {
   sandboxLeaseLivenessValues,
   sandboxLeases,
   sandboxPtySessions,
+  sandboxRetainedProcessStateValues,
+  sandboxRetainedProcesses,
   sandboxSessionEnvelopes,
+  sandboxWorkspaceMutationActorKindValues,
+  sandboxWorkspaceMutationAdmissions,
+  sandboxWorkspaceMutationHolderKindValues,
   sandboxes,
   scheduledTaskRuns,
   scheduledTasks,
@@ -154,6 +169,7 @@ export {
   sessionRecordingModeValues,
   sessionRecordingStateValues,
   sessionRecordings,
+  sessionSpawnDenials,
   sessionSystemUpdateOutbox,
   sessionSystemUpdates,
   sessionTurnAttempts,

package/drizzle/0109_nested_agent_depth_expand.sql

@@ -0,0 +1,42 @@
+-- deployment-mode: rolling
+-- Expand phase: persist deployment policy and add nullable lineage columns.
+SET lock_timeout = '5s';
+SET statement_timeout = '30s';
+
+CREATE TABLE "nested_agent_depth_configuration" (
+  "singleton" boolean PRIMARY KEY DEFAULT true NOT NULL,
+  "max_nested_agent_depth" integer NOT NULL,
+  "policy_source" text NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "nested_agent_depth_configuration_singleton_check" CHECK ("singleton"),
+  CONSTRAINT "nested_agent_depth_configuration_max_check"
+    CHECK ("max_nested_agent_depth" >= 0 AND "max_nested_agent_depth" <= 2147483647),
+  CONSTRAINT "nested_agent_depth_configuration_source_check"
+    CHECK ("policy_source" IN ('deployment', 'default'))
+);
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format('GRANT SELECT ON %I."nested_agent_depth_configuration" TO opengeni_app', current_schema());
+  END IF;
+END $grants$;
+
+INSERT INTO "nested_agent_depth_configuration" (
+  "singleton", "max_nested_agent_depth", "policy_source"
+) VALUES (
+  true,
+  coalesce(nullif(current_setting('opengeni.max_nested_agent_depth', true), ''), '3')::integer,
+  coalesce(nullif(current_setting('opengeni.nested_agent_depth_policy_source', true), ''), 'default')
+) ON CONFLICT ("singleton") DO NOTHING;
+
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "root_session_id" uuid,
+  ADD COLUMN IF NOT EXISTS "nested_agent_depth" integer,
+  ADD COLUMN IF NOT EXISTS "max_nested_agent_depth_override" integer,
+  ADD COLUMN IF NOT EXISTS "effective_max_nested_agent_depth" integer,
+  ADD COLUMN IF NOT EXISTS "nested_agent_depth_policy_source" text,
+  ADD COLUMN IF NOT EXISTS "nested_agent_depth_policy_session_id" uuid;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0110_nested_agent_depth_boundary.sql

@@ -0,0 +1,480 @@
+-- deployment-mode: rolling
+-- Mixed-version admission boundary, denial evidence, idempotency fencing,
+-- policy lock/read, and RLS. This boundary must be installed before the
+-- batched lineage backfill: old writers remain allowed to insert sessions and
+-- this trigger supplies the new snapshot while the backfill is in flight.
+SET lock_timeout = '5s';
+SET statement_timeout = '30s';
+
+-- A partial unique index on sessions and a separate partial unique index on
+-- denials cannot prevent one old writer from committing a success while a
+-- newer writer commits a denial for the same workspace/key. This small
+-- cross-outcome ledger is the database authority for that decision. It is
+-- intentionally private to the trigger functions; callers replay the outcome
+-- from the durable source row.
+CREATE TABLE "session_create_idempotency_guard" (
+  "workspace_id" uuid NOT NULL,
+  "idempotency_key" text NOT NULL,
+  "outcome" text NOT NULL,
+  "session_id" uuid,
+  "denial_id" uuid,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_create_idempotency_guard_pk"
+    PRIMARY KEY ("workspace_id", "idempotency_key"),
+  CONSTRAINT "session_create_idempotency_guard_workspace_fk"
+    FOREIGN KEY ("workspace_id")
+    REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  CONSTRAINT "session_create_idempotency_guard_outcome_check"
+    CHECK ("outcome" IN ('session', 'denial')),
+  CONSTRAINT "session_create_idempotency_guard_target_check"
+    CHECK (("outcome" = 'session' AND "session_id" IS NOT NULL AND "denial_id" IS NULL)
+       OR ("outcome" = 'denial' AND "session_id" IS NULL AND "denial_id" IS NOT NULL))
+);
+
+CREATE TABLE "session_spawn_denials" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "parent_session_id" uuid,
+  "root_session_id" uuid,
+  "current_depth" integer NOT NULL,
+  "attempted_depth" bigint NOT NULL,
+  "effective_max_nested_agent_depth" integer NOT NULL,
+  "requested_max_nested_agent_depth_override" integer,
+  "policy_source" text NOT NULL,
+  "policy_session_id" uuid,
+  "subject_id" text,
+  "code" text NOT NULL,
+  "idempotency_key" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_spawn_denials_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "session_spawn_denials_depth_check"
+    CHECK ("current_depth" >= 0 AND "attempted_depth" >= 0
+      AND "effective_max_nested_agent_depth" >= 0
+      AND ("requested_max_nested_agent_depth_override" IS NULL
+        OR "requested_max_nested_agent_depth_override" >= 0)),
+  CONSTRAINT "session_spawn_denials_policy_source_check"
+    CHECK ("policy_source" IN ('session', 'workspace', 'deployment', 'default')),
+  CONSTRAINT "session_spawn_denials_code_check"
+    CHECK ("code" IN ('nested_agent_depth_exceeded', 'nested_agent_depth_override_forbidden'))
+);
+CREATE UNIQUE INDEX "session_spawn_denials_workspace_id_uq"
+  ON "session_spawn_denials" ("workspace_id", "id");
+CREATE INDEX "session_spawn_denials_workspace_created_idx"
+  ON "session_spawn_denials" ("workspace_id", "created_at");
+CREATE INDEX "session_spawn_denials_parent_idx"
+  ON "session_spawn_denials" ("workspace_id", "parent_session_id", "created_at");
+CREATE UNIQUE INDEX "session_spawn_denials_workspace_idempotency_idx"
+  ON "session_spawn_denials" ("workspace_id", "idempotency_key")
+  WHERE "idempotency_key" IS NOT NULL;
+
+CREATE OR REPLACE FUNCTION opengeni_private.session_create_idempotency_guard_insert()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+AS $function$
+DECLARE
+  inserted_rows integer;
+  new_outcome text;
+  new_session_id uuid;
+  new_denial_id uuid;
+  new_idempotency_key text;
+BEGIN
+  IF TG_TABLE_NAME = 'sessions' THEN
+    new_idempotency_key := NEW.create_idempotency_key;
+    new_outcome := 'session';
+    new_session_id := NEW.id;
+    new_denial_id := NULL;
+  ELSE
+    new_idempotency_key := NEW.idempotency_key;
+    new_outcome := 'denial';
+    new_session_id := NULL;
+    new_denial_id := NEW.id;
+  END IF;
+  IF new_idempotency_key IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  -- This is the exact lock used by the application admission path. The
+  -- trigger must take it before reserving the cross-outcome ledger row so an
+  -- old writer and a current writer cannot choose different winners for the
+  -- same workspace/key. The depth trigger already took this same advisory
+  -- lock and checked for an existing winner; taking it again is
+  -- transaction-reentrant and keeps this guard safe for direct old writers as
+  -- well as the current application.
+  PERFORM pg_advisory_xact_lock(
+    hashtext('session-create:' || NEW.workspace_id::text || ':' || new_idempotency_key)
+  );
+
+  EXECUTE format($sql$
+    INSERT INTO %I."session_create_idempotency_guard"
+      ("workspace_id", "idempotency_key", "outcome", "session_id", "denial_id")
+    VALUES ($1, $2, $3, $4, $5)
+    ON CONFLICT ("workspace_id", "idempotency_key") DO NOTHING
+  $sql$, TG_TABLE_SCHEMA)
+  USING NEW.workspace_id, new_idempotency_key, new_outcome, new_session_id, new_denial_id;
+  GET DIAGNOSTICS inserted_rows = ROW_COUNT;
+  IF inserted_rows = 1 THEN
+    RETURN NEW;
+  END IF;
+
+  -- The durable ledger row is the winner. Returning NULL from a BEFORE INSERT
+  -- trigger suppresses this source row without aborting the transaction, so
+  -- old writers and current writers both receive an empty RETURNING result and
+  -- can replay the winner. Raising 23505 here would abort the transaction
+  -- before the application could inspect the durable winner.
+  RETURN NULL;
+END
+$function$;
+
+DO $lock_function$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION %I."lock_nested_agent_depth_configuration"()
+    RETURNS TABLE ("max_nested_agent_depth" integer, "policy_source" text)
+    LANGUAGE sql SECURITY DEFINER SET search_path = %I, pg_catalog
+    AS $body$
+      SELECT "max_nested_agent_depth", "policy_source"
+      FROM %I."nested_agent_depth_configuration"
+      WHERE "singleton" FOR SHARE
+    $body$
+  $ddl$, target_schema, target_schema, target_schema);
+  EXECUTE format('REVOKE ALL ON FUNCTION %I."lock_nested_agent_depth_configuration"() FROM PUBLIC', target_schema);
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %I."lock_nested_agent_depth_configuration"() TO opengeni_app', target_schema);
+    EXECUTE format('GRANT SELECT, INSERT ON %I."session_spawn_denials" TO opengeni_app', target_schema);
+  END IF;
+END $lock_function$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.session_depth_policy_defaults()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+AS $function$
+DECLARE
+  workspace_policy integer;
+  workspace_has_policy boolean;
+  workspace_account_id uuid;
+  control_account_id uuid;
+  deployment_policy integer;
+  deployment_source text;
+  parent_root uuid;
+  parent_depth integer;
+  parent_effective integer;
+  parent_source text;
+  parent_policy_session uuid;
+  expected_root uuid;
+  expected_depth bigint;
+  expected_effective integer;
+  expected_source text;
+  expected_policy_session uuid;
+  new_idempotency_key text;
+  ledger_winner_exists boolean;
+BEGIN
+  -- Keep direct/older writers on the same control -> advisory -> workspace
+  -- ordering as pre-boundary application admission. The control prefix is
+  -- required for rolling compatibility: an old binary can already hold this
+  -- row before its insert reaches this trigger. The keyed advisory lock below
+  -- still fences the cross-outcome ledger before policy evaluation.
+  EXECUTE format('SELECT account_id FROM %I.workspace_inference_controls '
+      'WHERE workspace_id = $1 FOR SHARE', TG_TABLE_SCHEMA)
+    INTO control_account_id USING NEW.workspace_id;
+  IF control_account_id IS NULL THEN
+    RAISE EXCEPTION 'workspace has no mandatory inference-control row' USING ERRCODE = '23503';
+  END IF;
+
+  -- Take the same transaction advisory lock as current and old application
+  -- admission, then check the durable outcome before policy/control suffix
+  -- reads. A retry must replay its winner even if the retry's parent would now
+  -- exceed the effective depth policy. Waiting on the advisory lock also makes
+  -- an uncommitted winner visible before this check, instead of allowing a
+  -- mixed-version loser to evaluate policy first.
+  IF TG_TABLE_NAME = 'sessions' THEN
+    new_idempotency_key := NEW.create_idempotency_key;
+    IF new_idempotency_key IS NOT NULL THEN
+      PERFORM pg_advisory_xact_lock(
+        hashtext('session-create:' || NEW.workspace_id::text || ':' || new_idempotency_key)
+      );
+      EXECUTE format('SELECT EXISTS (
+          SELECT 1
+          FROM %I.session_create_idempotency_guard
+          WHERE workspace_id = $1 AND idempotency_key = $2
+        )', TG_TABLE_SCHEMA)
+        INTO ledger_winner_exists
+        USING NEW.workspace_id, new_idempotency_key;
+      IF ledger_winner_exists THEN
+        RETURN NULL;
+      END IF;
+    END IF;
+  END IF;
+
+  EXECUTE format('SELECT CASE WHEN jsonb_typeof(settings -> ''maxNestedAgentDepth'') = ''number''
+      AND settings ->> ''maxNestedAgentDepth'' ~ ''^(0|[1-9][0-9]{0,9})$''
+      AND (settings ->> ''maxNestedAgentDepth'')::numeric BETWEEN 0 AND 2147483647
+      THEN (settings ->> ''maxNestedAgentDepth'')::integer ELSE NULL END,
+      coalesce((jsonb_typeof(settings -> ''maxNestedAgentDepth'') = ''number''
+       AND settings ->> ''maxNestedAgentDepth'' ~ ''^(0|[1-9][0-9]{0,9})$''
+       AND (settings ->> ''maxNestedAgentDepth'')::numeric BETWEEN 0 AND 2147483647), false),
+      account_id
+      FROM %I.workspaces WHERE id = $1', TG_TABLE_SCHEMA)
+    INTO workspace_policy, workspace_has_policy, workspace_account_id USING NEW.workspace_id;
+  IF workspace_account_id IS NULL THEN
+    RAISE EXCEPTION 'workspace not found for session insert' USING ERRCODE = '23503';
+  END IF;
+  EXECUTE format('SELECT max_nested_agent_depth, policy_source FROM %I.lock_nested_agent_depth_configuration()', TG_TABLE_SCHEMA)
+    INTO deployment_policy, deployment_source;
+  IF deployment_policy IS NULL THEN
+    RAISE EXCEPTION 'nested-agent deployment policy is not configured' USING ERRCODE = '23514';
+  END IF;
+
+  IF NEW.parent_session_id IS NULL THEN
+    expected_root := NEW.id;
+    expected_depth := 0;
+  ELSE
+    EXECUTE format('SELECT root_session_id, nested_agent_depth, effective_max_nested_agent_depth,
+        nested_agent_depth_policy_source, nested_agent_depth_policy_session_id
+        FROM %I.sessions WHERE workspace_id = $1 AND id = $2 FOR SHARE', TG_TABLE_SCHEMA)
+      INTO parent_root, parent_depth, parent_effective, parent_source, parent_policy_session
+      USING NEW.workspace_id, NEW.parent_session_id;
+    IF parent_root IS NULL OR parent_depth IS NULL THEN
+      -- During 0111, a legacy parent can still have nullable lineage columns.
+      -- Walk that existing tree and derive the missing snapshot from the
+      -- nearest materialized ancestor, or from the legacy root and workspace
+      -- policy when the whole chain predates this boundary. This keeps old
+      -- trees writable while the bounded backfill catches up; it does not
+      -- bypass the effective-depth check below.
+      EXECUTE format($sql$
+        WITH RECURSIVE lineage AS (
+          SELECT
+            node.id,
+            node.parent_session_id,
+            node.root_session_id,
+            node.nested_agent_depth,
+            node.effective_max_nested_agent_depth,
+            node.nested_agent_depth_policy_source,
+            node.nested_agent_depth_policy_session_id,
+            0::bigint AS distance,
+            ARRAY[node.id]::uuid[] AS path
+          FROM %I.sessions AS node
+          WHERE node.workspace_id = $1 AND node.id = $2
+          UNION ALL
+          SELECT
+            ancestor.id,
+            ancestor.parent_session_id,
+            ancestor.root_session_id,
+            ancestor.nested_agent_depth,
+            ancestor.effective_max_nested_agent_depth,
+            ancestor.nested_agent_depth_policy_source,
+            ancestor.nested_agent_depth_policy_session_id,
+            lineage.distance + 1,
+            lineage.path || ancestor.id
+          FROM %I.sessions AS ancestor
+          JOIN lineage
+            ON ancestor.workspace_id = $1
+           AND ancestor.id = lineage.parent_session_id
+          WHERE NOT ancestor.id = ANY(lineage.path)
+        ),
+        complete AS (
+          SELECT *
+          FROM lineage
+          WHERE root_session_id IS NOT NULL
+            AND nested_agent_depth IS NOT NULL
+            AND effective_max_nested_agent_depth IS NOT NULL
+            AND nested_agent_depth_policy_source IS NOT NULL
+        )
+        SELECT
+          COALESCE(
+            (SELECT root_session_id FROM lineage
+             WHERE root_session_id IS NOT NULL
+             ORDER BY distance LIMIT 1),
+            (SELECT id FROM lineage
+             WHERE parent_session_id IS NULL
+             ORDER BY distance DESC LIMIT 1)
+          ),
+          COALESCE(
+            (SELECT nested_agent_depth::bigint + distance FROM lineage
+             WHERE nested_agent_depth IS NOT NULL
+             ORDER BY distance LIMIT 1),
+            (SELECT max(distance) FROM lineage)
+          ),
+          (SELECT effective_max_nested_agent_depth FROM complete
+           ORDER BY distance LIMIT 1),
+          (SELECT nested_agent_depth_policy_source FROM complete
+           ORDER BY distance LIMIT 1),
+          (SELECT nested_agent_depth_policy_session_id FROM complete
+           ORDER BY distance LIMIT 1)
+      $sql$, TG_TABLE_SCHEMA, TG_TABLE_SCHEMA)
+        INTO parent_root, parent_depth, parent_effective, parent_source, parent_policy_session
+        USING NEW.workspace_id, NEW.parent_session_id;
+    END IF;
+    IF parent_root IS NULL OR parent_depth IS NULL THEN
+      RAISE EXCEPTION 'parent session not found for nested insert' USING ERRCODE = '23503';
+    END IF;
+    expected_root := parent_root;
+    expected_depth := parent_depth + 1;
+  END IF;
+
+  IF NEW.max_nested_agent_depth_override IS NOT NULL THEN
+    expected_effective := NEW.max_nested_agent_depth_override;
+    expected_source := 'session';
+    expected_policy_session := NEW.id;
+  ELSIF NEW.parent_session_id IS NOT NULL AND parent_source = 'session' THEN
+    expected_effective := parent_effective;
+    expected_source := 'session';
+    expected_policy_session := parent_policy_session;
+  ELSIF workspace_has_policy THEN
+    expected_effective := workspace_policy;
+    expected_source := 'workspace';
+    expected_policy_session := NULL;
+  ELSE
+    expected_effective := deployment_policy;
+    expected_source := deployment_source;
+    expected_policy_session := NULL;
+  END IF;
+
+  IF expected_depth > expected_effective THEN
+    RAISE EXCEPTION 'nested agent depth exceeds effective maximum' USING ERRCODE = '23514';
+  END IF;
+  NEW.root_session_id := expected_root;
+  NEW.nested_agent_depth := expected_depth;
+  NEW.effective_max_nested_agent_depth := expected_effective;
+  NEW.nested_agent_depth_policy_source := expected_source;
+  NEW.nested_agent_depth_policy_session_id := expected_policy_session;
+  RETURN NEW;
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.session_spawn_denials_append_only()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+AS $function$
+DECLARE
+  workspace_exists boolean;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    -- Workspace/account deletion is intentionally allowed to cascade through
+    -- evidence rows. A direct row delete while its workspace still exists is
+    -- never allowed, preserving append-only audit evidence for live tenants.
+    IF pg_trigger_depth() > 1 THEN
+      RETURN OLD;
+    END IF;
+    -- The FK cascade removes the parent workspace before its child rows are
+    -- deleted. Resolve the target schema dynamically because embedded hosts
+    -- run the same migration chain outside public.
+    EXECUTE format('SELECT EXISTS (SELECT 1 FROM %I.workspaces WHERE id = $1)', TG_TABLE_SCHEMA)
+      INTO workspace_exists
+      USING OLD.workspace_id;
+    IF NOT workspace_exists THEN
+      RETURN OLD;
+    END IF;
+  END IF;
+  RAISE EXCEPTION 'session spawn denial evidence is append-only' USING ERRCODE = '55000';
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.lock_nested_agent_workspace_policy_update()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+AS $function$
+DECLARE
+  control_account_id uuid;
+BEGIN
+  IF OLD.settings -> 'maxNestedAgentDepth'
+       IS NOT DISTINCT FROM NEW.settings -> 'maxNestedAgentDepth' THEN
+    RETURN NEW;
+  END IF;
+  EXECUTE format('SELECT account_id FROM %I.workspace_inference_controls '
+      'WHERE workspace_id = $1 FOR UPDATE', TG_TABLE_SCHEMA)
+    INTO control_account_id USING NEW.id;
+  IF control_account_id IS NULL THEN
+    RAISE EXCEPTION 'workspace has no mandatory inference-control row' USING ERRCODE = '23503';
+  END IF;
+  RETURN NEW;
+END
+$function$;
+
+-- Fence the source tables before installing any source-row guard. A SHARE
+-- lock waits for every pre-boundary writer already in flight, and prevents
+-- new INSERT/UPDATE/DELETE writers from committing while the trigger boundary
+-- and initial ledger reconciliation are installed. Without this fence an old
+-- writer can commit after the trigger install decision but before its source
+-- row is backfilled into the ledger.
+LOCK TABLE "workspaces", "sessions", "session_spawn_denials" IN SHARE MODE;
+
+DO $triggers$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format('DROP TRIGGER IF EXISTS session_depth_policy_defaults ON %I.sessions', target_schema);
+  EXECUTE format('CREATE TRIGGER session_depth_policy_defaults BEFORE INSERT ON %I.sessions FOR EACH ROW EXECUTE FUNCTION opengeni_private.session_depth_policy_defaults()', target_schema);
+  EXECUTE format('DROP TRIGGER IF EXISTS session_create_idempotency_guard ON %I.sessions', target_schema);
+  EXECUTE format('DROP TRIGGER IF EXISTS session_idempotency_guard ON %I.sessions', target_schema);
+  EXECUTE format('CREATE TRIGGER session_idempotency_guard BEFORE INSERT ON %I.sessions FOR EACH ROW WHEN (NEW.create_idempotency_key IS NOT NULL) EXECUTE FUNCTION opengeni_private.session_create_idempotency_guard_insert()', target_schema);
+  EXECUTE format('DROP TRIGGER IF EXISTS session_spawn_denials_append_only ON %I.session_spawn_denials', target_schema);
+  EXECUTE format('CREATE TRIGGER session_spawn_denials_append_only BEFORE UPDATE OR DELETE ON %I.session_spawn_denials FOR EACH ROW EXECUTE FUNCTION opengeni_private.session_spawn_denials_append_only()', target_schema);
+  EXECUTE format('DROP TRIGGER IF EXISTS session_spawn_denials_idempotency_guard ON %I.session_spawn_denials', target_schema);
+  EXECUTE format('CREATE TRIGGER session_spawn_denials_idempotency_guard BEFORE INSERT ON %I.session_spawn_denials FOR EACH ROW WHEN (NEW.idempotency_key IS NOT NULL) EXECUTE FUNCTION opengeni_private.session_create_idempotency_guard_insert()', target_schema);
+  EXECUTE format('DROP TRIGGER IF EXISTS lock_nested_agent_workspace_policy_update ON %I.workspaces', target_schema);
+  EXECUTE format('CREATE TRIGGER lock_nested_agent_workspace_policy_update BEFORE UPDATE OF settings ON %I.workspaces FOR EACH ROW EXECUTE FUNCTION opengeni_private.lock_nested_agent_workspace_policy_update()', target_schema);
+END $triggers$;
+
+-- Preserve source rows created before this boundary. The shared source-table
+-- lock remains held, so this reconciliation is fenced against both old and
+-- new writers and cannot miss a source row between the scan and ledger insert.
+INSERT INTO "session_create_idempotency_guard" (
+  "workspace_id", "idempotency_key", "outcome", "session_id"
+)
+SELECT "workspace_id", "create_idempotency_key", 'session', "id"
+FROM "sessions"
+WHERE "create_idempotency_key" IS NOT NULL
+ON CONFLICT ("workspace_id", "idempotency_key") DO NOTHING;
+
+-- Keep a final reconciliation for both outcomes while the source-table locks
+-- are still held. The checks make a migration failure explicit rather than
+-- publishing a source row with no ledger entry.
+INSERT INTO "session_create_idempotency_guard" (
+  "workspace_id", "idempotency_key", "outcome", "session_id"
+)
+SELECT "workspace_id", "create_idempotency_key", 'session', "id"
+FROM "sessions"
+WHERE "create_idempotency_key" IS NOT NULL
+ON CONFLICT ("workspace_id", "idempotency_key") DO NOTHING;
+INSERT INTO "session_create_idempotency_guard" (
+  "workspace_id", "idempotency_key", "outcome", "denial_id"
+)
+SELECT "workspace_id", "idempotency_key", 'denial', "id"
+FROM "session_spawn_denials"
+WHERE "idempotency_key" IS NOT NULL
+ON CONFLICT ("workspace_id", "idempotency_key") DO NOTHING;
+
+DO $reconcile$
+DECLARE
+  missing_source_rows integer;
+BEGIN
+  SELECT count(*)::integer
+  INTO missing_source_rows
+  FROM (
+    SELECT "workspace_id", "create_idempotency_key" AS "idempotency_key"
+    FROM "sessions"
+    WHERE "create_idempotency_key" IS NOT NULL
+    UNION ALL
+    SELECT "workspace_id", "idempotency_key"
+    FROM "session_spawn_denials"
+    WHERE "idempotency_key" IS NOT NULL
+  ) source_rows
+  WHERE NOT EXISTS (
+    SELECT 1
+    FROM "session_create_idempotency_guard" guard
+    WHERE guard."workspace_id" = source_rows."workspace_id"
+      AND guard."idempotency_key" = source_rows."idempotency_key"
+  );
+  IF missing_source_rows <> 0 THEN
+    RAISE EXCEPTION 'session create idempotency ledger reconciliation missed % source rows', missing_source_rows
+      USING ERRCODE = '23514';
+  END IF;
+END $reconcile$;
+
+ALTER TABLE "session_spawn_denials" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_spawn_denials" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "session_spawn_denials"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0111_nested_agent_depth_backfill.sql

@@ -0,0 +1,49 @@
+-- deployment-mode: rolling
+-- opengeni:batched-backfill batch-size=1000 lock-timeout=5s statement-timeout=30s
+WITH candidates AS (
+  SELECT
+    session.ctid AS target_ctid,
+    CASE WHEN session."parent_session_id" IS NULL THEN session."id"
+         ELSE parent."root_session_id" END AS root_session_id,
+    CASE WHEN session."parent_session_id" IS NULL THEN 0
+         ELSE parent."nested_agent_depth"::bigint + 1 END AS nested_agent_depth,
+    CASE
+      WHEN jsonb_typeof(workspace."settings" -> 'maxNestedAgentDepth') = 'number'
+       AND workspace."settings" ->> 'maxNestedAgentDepth' ~ '^(0|[1-9][0-9]{0,9})$'
+       AND (workspace."settings" ->> 'maxNestedAgentDepth')::numeric BETWEEN 0 AND 2147483647
+      THEN (workspace."settings" ->> 'maxNestedAgentDepth')::integer
+      ELSE configuration."max_nested_agent_depth"
+    END AS effective_max_nested_agent_depth,
+    CASE
+      WHEN jsonb_typeof(workspace."settings" -> 'maxNestedAgentDepth') = 'number'
+       AND workspace."settings" ->> 'maxNestedAgentDepth' ~ '^(0|[1-9][0-9]{0,9})$'
+       AND (workspace."settings" ->> 'maxNestedAgentDepth')::numeric BETWEEN 0 AND 2147483647
+      THEN 'workspace'
+      ELSE configuration."policy_source"
+    END AS nested_agent_depth_policy_source
+  FROM "sessions" session
+  LEFT JOIN "sessions" parent
+    ON parent."workspace_id" = session."workspace_id"
+   AND parent."id" = session."parent_session_id"
+  JOIN "workspaces" workspace ON workspace."id" = session."workspace_id"
+  JOIN "nested_agent_depth_configuration" configuration ON configuration."singleton"
+  WHERE (session."root_session_id" IS NULL
+      OR session."nested_agent_depth" IS NULL
+      OR session."effective_max_nested_agent_depth" IS NULL
+      OR session."nested_agent_depth_policy_source" IS NULL)
+    AND (session."parent_session_id" IS NULL
+      OR (parent."root_session_id" IS NOT NULL AND parent."nested_agent_depth" IS NOT NULL))
+  ORDER BY session."created_at", session."id"
+  LIMIT 1000
+  FOR UPDATE OF session
+)
+UPDATE "sessions" session
+SET "root_session_id" = candidates.root_session_id,
+    "nested_agent_depth" = candidates.nested_agent_depth,
+    "max_nested_agent_depth_override" = NULL,
+    "effective_max_nested_agent_depth" = candidates.effective_max_nested_agent_depth,
+    "nested_agent_depth_policy_source" = candidates.nested_agent_depth_policy_source,
+    "nested_agent_depth_policy_session_id" = NULL
+FROM candidates
+WHERE session.ctid = candidates.target_ctid
+RETURNING session."id";