@opengeni/db 0.12.1 → 0.12.6

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-BMFDXFPA.js";
+} from "./chunk-XRVNI2GB.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/{schema-BejThLcd.d.ts → schema-CeXWlYcG.d.ts}

@@ -3838,6 +3838,23 @@ declare const sessions: drizzle_orm_pg_core.PgTableWithColumns<{
                 inheritedFromSessionId: string | null;
             };
         }>;
+        toolPolicyVersion: drizzle_orm_pg_core.PgColumn<{
+            name: "tool_policy_version";
+            tableName: "sessions";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         parentSessionId: drizzle_orm_pg_core.PgColumn<{
             name: "parent_session_id";
             tableName: "sessions";
@@ -6079,6 +6096,129 @@ declare const documents: drizzle_orm_pg_core.PgTableWithColumns<{
         }, {}, {
             $type: string[];
         }>;
+        visibility: drizzle_orm_pg_core.PgColumn<{
+            name: "visibility";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBy: drizzle_orm_pg_core.PgColumn<{
+            name: "created_by";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        agentAccess: drizzle_orm_pg_core.PgColumn<{
+            name: "agent_access";
+            tableName: "documents";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        summary: drizzle_orm_pg_core.PgColumn<{
+            name: "summary";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        topics: drizzle_orm_pg_core.PgColumn<{
+            name: "topics";
+            tableName: "documents";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        curationStatus: drizzle_orm_pg_core.PgColumn<{
+            name: "curation_status";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        curation: drizzle_orm_pg_core.PgColumn<{
+            name: "curation";
+            tableName: "documents";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
         createdAt: drizzle_orm_pg_core.PgColumn<{
             name: "created_at";
             tableName: "documents";
@@ -10269,7 +10409,7 @@ declare const codexCapacityWaiters: drizzle_orm_pg_core.PgTableWithColumns<{
             columnType: "PgUUID";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -10296,6 +10436,23 @@ declare const codexCapacityWaiters: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        blockedTurnGeneration: drizzle_orm_pg_core.PgColumn<{
+            name: "blocked_turn_generation";
+            tableName: "codex_capacity_waiters";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         workflowId: drizzle_orm_pg_core.PgColumn<{
             name: "workflow_id";
             tableName: "codex_capacity_waiters";
@@ -10354,7 +10511,7 @@ declare const codexCapacityWaiters: drizzle_orm_pg_core.PgTableWithColumns<{
             columnType: "PgInteger";
             data: number;
             driverParam: string | number;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -13410,6 +13567,159 @@ declare const sandboxRetainedProcesses: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        reconcileAfter: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_after";
+            tableName: "sandbox_retained_processes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileClaimId: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_claim_id";
+            tableName: "sandbox_retained_processes";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileClaimedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_claimed_at";
+            tableName: "sandbox_retained_processes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileAttempts: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_attempts";
+            tableName: "sandbox_retained_processes";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastReconcileOutcome: drizzle_orm_pg_core.PgColumn<{
+            name: "last_reconcile_outcome";
+            tableName: "sandbox_retained_processes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileProofOutcome: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_proof_outcome";
+            tableName: "sandbox_retained_processes";
+            dataType: "string";
+            columnType: "PgText";
+            data: "exited" | "lost";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["exited", "lost"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileProofExitCode: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_proof_exit_code";
+            tableName: "sandbox_retained_processes";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileProofReason: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_proof_reason";
+            tableName: "sandbox_retained_processes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reconcileProofObservedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "reconcile_proof_observed_at";
+            tableName: "sandbox_retained_processes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;
@@ -16438,6 +16748,23 @@ declare const githubInstallations: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        githubAccountId: drizzle_orm_pg_core.PgColumn<{
+            name: "github_account_id";
+            tableName: "github_installations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         accountLogin: drizzle_orm_pg_core.PgColumn<{
             name: "account_login";
             tableName: "github_installations";
@@ -16506,6 +16833,108 @@ declare const githubInstallations: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        githubActorId: drizzle_orm_pg_core.PgColumn<{
+            name: "github_actor_id";
+            tableName: "github_installations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        githubActorLogin: drizzle_orm_pg_core.PgColumn<{
+            name: "github_actor_login";
+            tableName: "github_installations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityKind: drizzle_orm_pg_core.PgColumn<{
+            name: "authority_kind";
+            tableName: "github_installations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityCheckedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "authority_checked_at";
+            tableName: "github_installations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityExpiresAt: drizzle_orm_pg_core.PgColumn<{
+            name: "authority_expires_at";
+            tableName: "github_installations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityNonce: drizzle_orm_pg_core.PgColumn<{
+            name: "authority_nonce";
+            tableName: "github_installations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: drizzle_orm_pg_core.PgColumn<{
             name: "created_at";
             tableName: "github_installations";

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { o as agentRunStates, p as apiKeys, q as auditEvents, r as billingCustomers, t as capabilityCatalogItems, u as capabilityInstallations, v as codexCapacityWaiters, x as codexCredentialLeases, y as codexResetRedemptionAttempts, z as codexRotationSettings, A as codexSubscriptionCredentials, d as composerDrafts, B as connections, C as creditLedgerEntries, D as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, E as documentBases, F as documentChunks, G as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, H as enrollments, I as fileUploads, J as files, K as githubInstallationRepositories, L as githubInstallations, M as hostExportConfig, N as hostExportConsumers, O as hostExportCursorState, P as hostExportDeadLetters, Q as hostExportOutbox, R as importBatches, S as integrationOauthClients, T as integrationOauthStateNonces, U as knowledgeMemories, V as machineMetricsLatest, W as machineMetricsSeries, X as managedAccounts, Y as nestedAgentDepthConfiguration, n as newSessionDrafts, Z as packInstallations, _ as rigChanges, $ as rigVersions, a0 as rigs, j as sandboxKindValues, a1 as sandboxLeaseHolders, a2 as sandboxLeaseLivenessValues, a3 as sandboxLeases, a4 as sandboxPtySessions, a5 as sandboxRetainedProcessStateValues, a6 as sandboxRetainedProcesses, a7 as sandboxSessionEnvelopes, a8 as sandboxWorkspaceMutationActorKindValues, a9 as sandboxWorkspaceMutationAdmissions, aa as sandboxWorkspaceMutationHolderKindValues, ab as sandboxes, ac as scheduledTaskRuns, ad as scheduledTasks, ae as sessionAttemptInterruptions, s as sessionCommandReceipts, af as sessionEvents, ag as sessionGoals, ah as sessionHistoryItems, ai as sessionHumanInputRequests, aj as sessionListSnapshots, ak as sessionMcpServers, al as sessionPendingToolCalls, am as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, an as sessionRecordings, ao as sessionSpawnDenials, ap as sessionSystemUpdateOutbox, aq as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, ar as sessionWorkflowWakeOutbox, a as sessions, as as socialConnections, at as socialPosts, au as stripeWebhookEvents, av as usageEvents, aw as workspaceCaptures, ax as workspaceControlEvents, ay as workspaceInferenceControls, az as workspaceMemberships, aA as workspaceModelPolicies, aB as workspacePacks, aC as workspaceSessionActivityRevisions, aD as workspaceVariableSetVariables, aE as workspaceVariableSets, w as workspaces } from './schema-BejThLcd.js';
+export { o as agentRunStates, p as apiKeys, q as auditEvents, r as billingCustomers, t as capabilityCatalogItems, u as capabilityInstallations, v as codexCapacityWaiters, x as codexCredentialLeases, y as codexResetRedemptionAttempts, z as codexRotationSettings, A as codexSubscriptionCredentials, d as composerDrafts, B as connections, C as creditLedgerEntries, D as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, E as documentBases, F as documentChunks, G as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, H as enrollments, I as fileUploads, J as files, K as githubInstallationRepositories, L as githubInstallations, M as hostExportConfig, N as hostExportConsumers, O as hostExportCursorState, P as hostExportDeadLetters, Q as hostExportOutbox, R as importBatches, S as integrationOauthClients, T as integrationOauthStateNonces, U as knowledgeMemories, V as machineMetricsLatest, W as machineMetricsSeries, X as managedAccounts, Y as nestedAgentDepthConfiguration, n as newSessionDrafts, Z as packInstallations, _ as rigChanges, $ as rigVersions, a0 as rigs, j as sandboxKindValues, a1 as sandboxLeaseHolders, a2 as sandboxLeaseLivenessValues, a3 as sandboxLeases, a4 as sandboxPtySessions, a5 as sandboxRetainedProcessStateValues, a6 as sandboxRetainedProcesses, a7 as sandboxSessionEnvelopes, a8 as sandboxWorkspaceMutationActorKindValues, a9 as sandboxWorkspaceMutationAdmissions, aa as sandboxWorkspaceMutationHolderKindValues, ab as sandboxes, ac as scheduledTaskRuns, ad as scheduledTasks, ae as sessionAttemptInterruptions, s as sessionCommandReceipts, af as sessionEvents, ag as sessionGoals, ah as sessionHistoryItems, ai as sessionHumanInputRequests, aj as sessionListSnapshots, ak as sessionMcpServers, al as sessionPendingToolCalls, am as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, an as sessionRecordings, ao as sessionSpawnDenials, ap as sessionSystemUpdateOutbox, aq as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, ar as sessionWorkflowWakeOutbox, a as sessions, as as socialConnections, at as socialPosts, au as stripeWebhookEvents, av as usageEvents, aw as workspaceCaptures, ax as workspaceControlEvents, ay as workspaceInferenceControls, az as workspaceMemberships, aA as workspaceModelPolicies, aB as workspacePacks, aC as workspaceSessionActivityRevisions, aD as workspaceVariableSetVariables, aE as workspaceVariableSets, w as workspaces } from './schema-CeXWlYcG.js';

package/dist/schema.js

@@ -93,7 +93,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-VUKRIBO5.js";
+} from "./chunk-CYA6BHV6.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/drizzle/0122_codex_capacity_same_turn.sql

@@ -0,0 +1,59 @@
+-- deployment-mode: maintenance
+-- This changes the waiter/worker contract in one no-overlap cutover: old
+-- workers terminally settled capacity waits, while new workers preserve the
+-- same logical turn. Do not run old and new workers concurrently.
+
+ALTER TABLE "session_turn_attempts"
+  DROP CONSTRAINT "session_turn_attempts_outcome_check";
+ALTER TABLE "session_turn_attempts"
+  ADD CONSTRAINT "session_turn_attempts_outcome_check"
+  CHECK (
+    "outcome" IS NULL OR "outcome" IN (
+      'completed', 'failed', 'cancelled', 'superseded', 'requires_action',
+      'waiting_capacity', 'interrupted_recoverable',
+      'lease_lost_recoverable', 'pre_cutover_closed'
+    )
+  );
+
+-- A waiter is turn-owned. Goal identity is only an optional generation fence,
+-- so goal-less prompts can wait and goal deletion cannot cascade away the
+-- durable ledger before reconciliation supersedes the blocked turn.
+ALTER TABLE "codex_capacity_waiters"
+  DROP CONSTRAINT "codex_capacity_waiters_workspace_goal_fk";
+ALTER TABLE "codex_capacity_waiters"
+  ALTER COLUMN "goal_id" DROP NOT NULL,
+  ALTER COLUMN "goal_version" DROP NOT NULL,
+  ADD COLUMN "blocked_turn_generation" integer;
+
+UPDATE "codex_capacity_waiters" waiter
+SET "blocked_turn_generation" = turn."execution_generation"
+FROM "session_turns" turn
+WHERE turn."workspace_id" = waiter."workspace_id"
+  AND turn."id" = waiter."blocked_turn_id";
+
+DO $audit$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "codex_capacity_waiters"
+    WHERE "blocked_turn_generation" IS NULL
+       OR "blocked_turn_generation" < 1
+       OR (("goal_id" IS NULL) <> ("goal_version" IS NULL))
+       OR ("goal_version" IS NOT NULL AND "goal_version" < 1)
+  ) THEN
+    RAISE EXCEPTION 'codex capacity same-turn backfill found an invalid waiter';
+  END IF;
+END $audit$;
+
+ALTER TABLE "codex_capacity_waiters"
+  ALTER COLUMN "blocked_turn_generation" SET NOT NULL,
+  DROP CONSTRAINT IF EXISTS "codex_capacity_waiters_generation_check",
+  ADD CONSTRAINT "codex_capacity_waiters_generation_check"
+  CHECK (
+    "generation" > 0
+    AND "blocked_turn_generation" > 0
+    AND (
+      ("goal_id" IS NULL AND "goal_version" IS NULL)
+      OR ("goal_id" IS NOT NULL AND "goal_version" > 0)
+    )
+  );

package/drizzle/0123_session_tool_policy_version.sql

@@ -0,0 +1,14 @@
+-- deployment-mode: rolling
+
+-- A durable policy mutation is fenced independently from the global event
+-- sequence. The default keeps old writers safe during the rolling upgrade;
+-- the policy update command advances this value with a locked SQL CAS.
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "tool_policy_version" integer NOT NULL DEFAULT 1;
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT IF EXISTS "sessions_tool_policy_version_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_tool_policy_version_check"
+  CHECK ("tool_policy_version" >= 1) NOT VALID;

package/drizzle/0124_session_event_duplicate_lookup.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "session_events_duplicate_of_event_idx"
+  ON "session_events" ("duplicate_of_event_id");

package/drizzle/0125_document_drops_visibility.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: rolling
+-- Knowledge drops: auto-curation + per-document visibility.
+-- Follows 0041_knowledge_layer.sql conventions: IF NOT EXISTS column adds only.
+-- NO policy changes (documents already has FORCE RLS + workspace_isolation from 0041).
+--
+-- visibility: 'workspace' (anyone in the workspace) | 'private' (creator only).
+-- created_by: the access-grant subject id that created the document (text — subject
+--   ids are labels like 'dev' or 'api_key:<uuid>', not uuids). NULL for pre-existing
+--   rows, which stay workspace-visible.
+-- agent_access: whether agent retrieval surfaces (docs MCP tools) may return the
+--   document. Humans keep REST access regardless.
+-- curation_status: 'none' (ordinary add, caller supplied metadata) | 'pending'
+--   (dropped, awaiting auto-curation) | 'suggested' (curated; base move NOT applied)
+--   | 'auto_filed' (curated and moved to the suggested base) | 'failed' (curation
+--   errored; document still indexes).
+-- curation: the curator output audit blob {suggestedBaseId, suggestedBaseName,
+--   confidence, reason, originalTitle, model}.
+
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "visibility" text NOT NULL DEFAULT 'workspace';
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "created_by" text;
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "agent_access" boolean NOT NULL DEFAULT true;
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "summary" text;
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "topics" jsonb NOT NULL DEFAULT '[]'::jsonb;
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "curation_status" text NOT NULL DEFAULT 'none';
+ALTER TABLE "documents" ADD COLUMN IF NOT EXISTS "curation" jsonb;
+
+-- Drop review surface: list pending/suggested drops per workspace cheaply.
+CREATE INDEX IF NOT EXISTS "documents_workspace_curation_status_idx"
+  ON "documents" ("workspace_id", "curation_status");