@opengeni/db 0.18.1 → 0.21.0

package/src/memory-governance.ts

@@ -0,0 +1,317 @@
+import { sql } from "drizzle-orm";
+import type { Database } from "./index";
+import { setSubjectRlsContext, withWorkspaceRls } from "./index";
+import {
+  hashMemoryOperationPlan,
+  hashMemoryRevertPlan,
+  normalizeMemoryOperationPlan,
+  normalizeMemoryRevertPlan,
+  normalizeMemoryRoleKey,
+  type MemoryOperationPlanInput,
+  type MemoryRevertPlanInput,
+} from "./memory-domain";
+
+export class MemoryGovernanceAuthorityError extends Error {
+  readonly name = "MemoryGovernanceAuthorityError";
+}
+
+export type MemoryGovernanceDirectSubjectAuthority = {
+  kind: "subject";
+  accountId: string;
+  workspaceId: string;
+  subjectId: string;
+};
+
+export type MemoryGovernanceDirectServiceAuthority = {
+  kind: "service";
+  accountId: string;
+  workspaceId: string;
+  serviceId: string;
+};
+
+export type MemoryGovernanceAttemptAuthority = {
+  kind: "attempt";
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+};
+
+export type MemoryGovernanceAuthority =
+  | MemoryGovernanceDirectSubjectAuthority
+  | MemoryGovernanceDirectServiceAuthority
+  | MemoryGovernanceAttemptAuthority;
+
+type ResolvedMemoryGovernanceAuthority = {
+  accountId: string;
+  workspaceId: string;
+  actorKind: "subject" | "service";
+  actorSubjectId: string;
+  sessionId: string | null;
+  turnId: string | null;
+  attemptId: string | null;
+  executionGeneration: number | null;
+  roleKey: string | null;
+};
+
+function requireBoundedActorId(value: string, label: string): string {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 1024) {
+    throw new MemoryGovernanceAuthorityError(`${label} must be a non-empty bounded identifier`);
+  }
+  return normalized;
+}
+
+async function setAndVerifyMemoryGovernanceContext(
+  db: Database,
+  authority: ResolvedMemoryGovernanceAuthority,
+): Promise<void> {
+  if (authority.actorKind === "subject") {
+    await setSubjectRlsContext(db, authority.actorSubjectId);
+  } else {
+    await db.execute(sql`select set_config('opengeni.subject_id', '', true)`);
+  }
+  await db.execute(sql`
+    select
+      set_config('opengeni.memory_actor_kind', ${authority.actorKind}, true),
+      set_config('opengeni.memory_actor_id', ${authority.actorSubjectId}, true),
+      set_config('opengeni.memory_session_id', ${authority.sessionId ?? ""}, true),
+      set_config('opengeni.memory_role_key', ${authority.roleKey ?? ""}, true)
+  `);
+  const rows = (await db.execute(sql`
+    select
+      nullif(current_setting('opengeni.account_id', true), '') as account_id,
+      nullif(current_setting('opengeni.workspace_id', true), '') as workspace_id,
+      nullif(current_setting('opengeni.subject_id', true), '') as subject_id,
+      nullif(current_setting('opengeni.memory_actor_kind', true), '') as actor_kind,
+      nullif(current_setting('opengeni.memory_actor_id', true), '') as actor_id,
+      nullif(current_setting('opengeni.memory_session_id', true), '') as session_id,
+      nullif(current_setting('opengeni.memory_role_key', true), '') as role_key
+  `)) as unknown as Array<{
+    account_id: string | null;
+    workspace_id: string | null;
+    subject_id: string | null;
+    actor_kind: string | null;
+    actor_id: string | null;
+    session_id: string | null;
+    role_key: string | null;
+  }>;
+  const applied = rows[0];
+  if (
+    !applied ||
+    applied.account_id !== authority.accountId ||
+    applied.workspace_id !== authority.workspaceId ||
+    applied.subject_id !== (authority.actorKind === "subject" ? authority.actorSubjectId : null) ||
+    applied.actor_kind !== authority.actorKind ||
+    applied.actor_id !== authority.actorSubjectId ||
+    applied.session_id !== authority.sessionId ||
+    applied.role_key !== authority.roleKey
+  ) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance authority was not applied on the active database backend",
+    );
+  }
+}
+
+async function resolveAttemptAuthority(
+  db: Database,
+  input: MemoryGovernanceAttemptAuthority,
+): Promise<ResolvedMemoryGovernanceAuthority> {
+  if (!Number.isSafeInteger(input.executionGeneration) || input.executionGeneration <= 0) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance attempt requires a positive execution generation",
+    );
+  }
+  const rows = (await db.execute(sql`
+    with locked_workspace as materialized (
+      select workspace.id, workspace.account_id
+      from workspaces workspace
+      where workspace.id = ${input.workspaceId}::uuid
+        and workspace.account_id = ${input.accountId}::uuid
+      for key share of workspace
+    ), locked_session as materialized (
+      select session.id, session.account_id, session.workspace_id,
+        session.active_turn_id, session.metadata ->> 'memoryRoleKey' as memory_role_key
+      from sessions session
+      join locked_workspace workspace
+        on workspace.id = session.workspace_id
+       and workspace.account_id = session.account_id
+      where session.id = ${input.sessionId}::uuid
+        and session.active_turn_id = ${input.turnId}::uuid
+      for share of session
+    ), locked_turn as materialized (
+      select turn.id, turn.account_id, turn.workspace_id, turn.session_id,
+        turn.active_attempt_id, turn.execution_generation,
+        turn.initiator_kind, turn.initiator_subject_id
+      from session_turns turn
+      join locked_session session
+        on session.id = turn.session_id
+       and session.workspace_id = turn.workspace_id
+       and session.account_id = turn.account_id
+      where turn.id = ${input.turnId}::uuid
+        and turn.active_attempt_id = ${input.attemptId}::uuid
+        and turn.execution_generation = ${input.executionGeneration}
+        and turn.status in ('running', 'requires_action', 'recovering', 'waiting_capacity')
+        and turn.initiator_kind in ('subject', 'service')
+        and length(btrim(turn.initiator_subject_id)) between 1 and 1024
+      for share of turn
+    ), locked_attempt as materialized (
+      select attempt.id, attempt.account_id, attempt.workspace_id,
+        attempt.session_id, attempt.turn_id, attempt.execution_generation
+      from session_turn_attempts attempt
+      join locked_turn turn
+        on turn.id = attempt.turn_id
+       and turn.session_id = attempt.session_id
+       and turn.workspace_id = attempt.workspace_id
+       and turn.account_id = attempt.account_id
+      where attempt.id = ${input.attemptId}::uuid
+        and attempt.execution_generation = ${input.executionGeneration}
+        and attempt.state in ('claimed', 'running')
+        and not exists (
+          select 1
+          from session_attempt_interruptions interruption
+          where interruption.workspace_id = attempt.workspace_id
+            and interruption.attempt_id = attempt.id
+            and interruption.state in ('pending', 'delivered', 'acknowledged')
+        )
+      for share of attempt
+    )
+    select turn.initiator_kind, turn.initiator_subject_id, session.memory_role_key
+    from locked_workspace workspace
+    join locked_session session on true
+    join locked_turn turn on true
+    join locked_attempt attempt on true
+    where workspace.account_id = attempt.account_id
+      and workspace.id = attempt.workspace_id
+      and session.id = attempt.session_id
+      and turn.id = attempt.turn_id
+  `)) as unknown as Array<{
+    initiator_kind: "subject" | "service";
+    initiator_subject_id: string;
+    memory_role_key: string | null;
+  }>;
+  const row = rows[0];
+  if (!row) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance requires the exact current attempt, generation, and immutable initiator",
+    );
+  }
+  let roleKey: string | null = null;
+  if (row.memory_role_key !== null) {
+    try {
+      roleKey = normalizeMemoryRoleKey(row.memory_role_key);
+    } catch {
+      throw new MemoryGovernanceAuthorityError(
+        "Persisted session memoryRoleKey is invalid; role-scoped authority fails closed",
+      );
+    }
+    if (roleKey !== row.memory_role_key) {
+      throw new MemoryGovernanceAuthorityError(
+        "Persisted session memoryRoleKey is not canonical; role-scoped authority fails closed",
+      );
+    }
+  }
+  return {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    actorKind: row.initiator_kind,
+    actorSubjectId: row.initiator_subject_id,
+    sessionId: input.sessionId,
+    turnId: input.turnId,
+    attemptId: input.attemptId,
+    executionGeneration: input.executionGeneration,
+    roleKey,
+  };
+}
+
+async function withMemoryGovernanceAuthority<T>(
+  db: Database,
+  authority: MemoryGovernanceAuthority,
+  fn: (db: Database, authority: ResolvedMemoryGovernanceAuthority) => Promise<T>,
+): Promise<T> {
+  return await withWorkspaceRls(db, authority.workspaceId, async (scopedDb) => {
+    let resolved: ResolvedMemoryGovernanceAuthority;
+    if (authority.kind === "attempt") {
+      resolved = await resolveAttemptAuthority(scopedDb, authority);
+    } else {
+      const actorSubjectId = requireBoundedActorId(
+        authority.kind === "subject" ? authority.subjectId : authority.serviceId,
+        authority.kind === "subject" ? "subject id" : "service id",
+      );
+      resolved = {
+        accountId: authority.accountId,
+        workspaceId: authority.workspaceId,
+        actorKind: authority.kind,
+        actorSubjectId,
+        sessionId: null,
+        turnId: null,
+        attemptId: null,
+        executionGeneration: null,
+        roleKey: null,
+      };
+    }
+    await setAndVerifyMemoryGovernanceContext(scopedDb, resolved);
+    return await fn(scopedDb, resolved);
+  });
+}
+
+export async function applyKnowledgeMemoryOperation(
+  db: Database,
+  input: {
+    authority: MemoryGovernanceAuthority;
+    plan: MemoryOperationPlanInput;
+  },
+): Promise<{ eventId: string; planHash: string }> {
+  const plan = normalizeMemoryOperationPlan(input.plan);
+  const planHash = hashMemoryOperationPlan(plan);
+  return await withMemoryGovernanceAuthority(db, input.authority, async (scopedDb, authority) => {
+    const rows = (await scopedDb.execute(sql`
+      select event_id
+      from knowledge_memory_apply_operation(
+        ${JSON.stringify(plan)}::jsonb,
+        ${planHash},
+        ${authority.actorKind},
+        ${authority.actorSubjectId},
+        ${authority.sessionId}::uuid,
+        ${authority.turnId}::uuid,
+        ${authority.attemptId}::uuid,
+        ${authority.executionGeneration}::integer
+      )
+    `)) as unknown as Array<{ event_id: string }>;
+    const eventId = rows[0]?.event_id;
+    if (!eventId) throw new Error("Memory governance apply operation returned no event");
+    return { eventId, planHash };
+  });
+}
+
+export async function revertKnowledgeMemoryOperation(
+  db: Database,
+  input: {
+    authority: MemoryGovernanceAuthority;
+    plan: MemoryRevertPlanInput;
+  },
+): Promise<{ eventId: string; planHash: string }> {
+  const plan = normalizeMemoryRevertPlan(input.plan);
+  const planHash = hashMemoryRevertPlan(plan);
+  return await withMemoryGovernanceAuthority(db, input.authority, async (scopedDb, authority) => {
+    const rows = (await scopedDb.execute(sql`
+      select event_id
+      from knowledge_memory_revert_operation(
+        ${plan.operationId}::uuid,
+        ${plan.appliedOperationId}::uuid,
+        ${planHash},
+        ${authority.actorKind},
+        ${authority.actorSubjectId},
+        ${authority.sessionId}::uuid,
+        ${authority.turnId}::uuid,
+        ${authority.attemptId}::uuid,
+        ${authority.executionGeneration}::integer
+      )
+    `)) as unknown as Array<{ event_id: string }>;
+    const eventId = rows[0]?.event_id;
+    if (!eventId) throw new Error("Memory governance revert operation returned no event");
+    return { eventId, planHash };
+  });
+}

package/src/provision-roles.ts

@@ -433,6 +433,30 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_memory_apply_operation(jsonb,text,text,text,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_memory_revert_operation(uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -445,6 +469,54 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_complete_sync(uuid,uuid,text,text,timestamptz,jsonb,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamptz, jsonb, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_advance_object_version(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
     EXECUTE format(
       'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',

package/src/runtime-posture.ts

@@ -42,7 +42,25 @@ export const FORCE_RLS_TABLES = [
   "host_export_outbox",
   "import_batches",
   "integration_oauth_state_nonces",
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_relations",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "knowledge_document_versions",
+  "knowledge_entities",
+  "knowledge_entity_aliases",
+  "knowledge_facts",
+  "knowledge_lifecycle_events",
   "knowledge_memories",
+  "knowledge_memory_lifecycle_events",
+  "knowledge_memory_relationships",
+  "knowledge_operation_receipts",
+  "knowledge_providers",
+  "knowledge_source_acl_versions",
+  "knowledge_source_objects",
+  "knowledge_sources",
+  "knowledge_sync_runs",
   "machine_metrics_latest",
   "machine_metrics_series",
   "model_call_facts",
@@ -229,6 +247,9 @@ export const RUNTIME_FULL_DML_TABLES = [
 
 /** Configuration and lifecycle-owned audit rows are read-only at runtime. */
 export const RUNTIME_READ_ONLY_TABLES = [
+  "knowledge_lifecycle_events",
+  "knowledge_memory_lifecycle_events",
+  "knowledge_memory_relationships",
   "nested_agent_depth_configuration",
   "preference_registry_events",
   "preference_registry_snapshots",
@@ -236,6 +257,21 @@ export const RUNTIME_READ_ONLY_TABLES = [
 
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */
 export const RUNTIME_READ_INSERT_TABLES = [
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_relations",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "knowledge_document_versions",
+  "knowledge_entities",
+  "knowledge_entity_aliases",
+  "knowledge_facts",
+  "knowledge_operation_receipts",
+  "knowledge_providers",
+  "knowledge_source_acl_versions",
+  "knowledge_source_objects",
+  "knowledge_sources",
+  "knowledge_sync_runs",
   "preference_registry_preferences",
   "preference_registry_revisions",
   "session_spawn_denials",

package/src/schema.ts

@@ -1,5 +1,6 @@
 import type {
   FirstPartyMcpToolName,
+  McpPersonalConnectionDelegation,
   McpServerConnectionRef,
   SessionMcpApprovalPolicy,
 } from "@opengeni/contracts";
@@ -1316,6 +1317,14 @@ export const sessions = pgTable(
     // Exact model-visible first-party tool selection. All catalogued tools are
     // selected by default; [] intentionally selects no broad-server tools.
     firstPartyMcpTools: jsonb("first_party_mcp_tools").$type<FirstPartyMcpToolName[]>().notNull(),
+    // Initial-command staging only. initializeSessionStartAtomically copies
+    // this immutable snapshot onto the first turn so create repair survives a
+    // crash between the session insert and first-turn transaction. Runtime
+    // credential authority must never read this session field.
+    initialPersonalConnectionDelegations: jsonb("initial_personal_connection_delegations")
+      .$type<McpPersonalConnectionDelegation[]>()
+      .notNull()
+      .default([]),
     // Durable tool-policy origin. Migration 0136 removes the old null/legacy
     // representation so every session has one explicit policy mode.
     toolPolicy: jsonb("tool_policy").$type<SessionToolPolicy>().notNull(),
@@ -1325,9 +1334,15 @@ export const sessions = pgTable(
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
     // When set, this worker's terminal-for-now transitions wake the parent so a
-    // manager can orchestrate workers without busy-polling. Self-referencing FK,
-    // ON DELETE SET NULL so deleting a manager never cascades into its workers.
+    // manager can orchestrate workers without busy-polling. The migration-owned
+    // self-reference uses ON DELETE RESTRICT so immutable hierarchy and
+    // authority lineage cannot be silently orphaned by a parent hard delete.
     parentSessionId: uuid("parent_session_id"),
+    // Exact parent turn whose worker-signed attempt created this child. This is
+    // private immutable authority lineage: child completion copies personal MCP
+    // authority from that turn, never from whichever parent turn ran most
+    // recently. Null for top-level and legacy child sessions.
+    parentTurnId: uuid("parent_turn_id"),
     // Workspace-scoped CREATE idempotency key. NULL means the create carried no
     // key (each such create is independent). When set, the partial unique index
     // below collapses concurrent/retried creates with the same key in the same
@@ -1885,6 +1900,21 @@ export const knowledgeMemories = pgTable(
     supersededById: uuid("superseded_by_id"),
     validFrom: timestamp("valid_from", { withTimezone: true }).notNull().defaultNow(),
     validUntil: timestamp("valid_until", { withTimezone: true }),
+    // Hierarchical memory foundation (migration 0152). `scope` remains the V1
+    // compatibility projection; typed selectors are the fail-closed authority.
+    scopeType: text("scope_type").notNull().default("workspace"),
+    scopeSubjectId: text("scope_subject_id"),
+    scopeRoleKey: text("scope_role_key"),
+    scopeSessionId: uuid("scope_session_id"),
+    namespace: text("namespace_key").notNull().default("general"),
+    labels: text("labels").array().notNull().default([]),
+    memoryVersion: integer("memory_version").notNull().default(1),
+    createdByKind: text("created_by_kind").notNull().default("service"),
+    createdBySubjectId: text("created_by_subject_id").notNull().default("unattributed-legacy"),
+    createdByContext: jsonb("created_by_context")
+      .$type<Record<string, unknown>>()
+      .notNull()
+      .default({ backfill: true }),
     // sha256(normalizeMemoryText(text)) — exact-dedup key; see memory-domain.
     textHash: text("text_hash"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -1901,6 +1931,18 @@ export const knowledgeMemories = pgTable(
       table.workspaceId,
       table.scope,
     ),
+    workspaceTypedScope: index("knowledge_memories_workspace_typed_scope_idx").on(
+      table.workspaceId,
+      table.scopeType,
+      table.scopeSubjectId,
+      table.scopeRoleKey,
+      table.scopeSessionId,
+    ),
+    workspaceNamespace: index("knowledge_memories_workspace_namespace_idx").on(
+      table.workspaceId,
+      table.namespace,
+    ),
+    labelsGin: index("knowledge_memories_labels_idx").using("gin", table.labels),
     createdBySession: index("knowledge_memories_workspace_created_by_session_idx").on(
       table.workspaceId,
       table.createdBySessionId,
@@ -1913,8 +1955,18 @@ export const knowledgeMemories = pgTable(
       table.workspaceId,
       table.textHash,
     ),
-    workspaceVisibleTextHashUnique: uniqueIndex("knowledge_memories_workspace_visible_text_hash_uq")
-      .on(table.workspaceId, table.textHash)
+    // Drizzle 0.45 cannot encode PostgreSQL `NULLS NOT DISTINCT`; migration
+    // 0152 owns that option so nullable scope selectors remain one identity.
+    scopeVisibleTextHashUnique: uniqueIndex("knowledge_memories_scope_visible_text_hash_uq")
+      .on(
+        table.workspaceId,
+        table.scopeType,
+        table.scopeSubjectId,
+        table.scopeRoleKey,
+        table.scopeSessionId,
+        table.namespace,
+        table.textHash,
+      )
       .where(sql`${table.status} in ('active', 'approved') and ${table.textHash} is not null`),
   }),
 );
@@ -1971,6 +2023,13 @@ export const sessionTurns = pgTable(
       .$type<Record<string, unknown>>()
       .notNull()
       .default({ backfill: true }),
+    // Immutable exact personal MCP authority for this logical turn. Recovery,
+    // approval, retries, and Toolspace reuse this row; no runtime may infer
+    // broader authority from the session creator or mutable session state.
+    personalConnectionDelegations: jsonb("personal_connection_delegations")
+      .$type<McpPersonalConnectionDelegation[]>()
+      .notNull()
+      .default([]),
     cancelledBy: text("cancelled_by"),
     cancelReason: text("cancel_reason"),
     // Atomic per-turn toolspace call budget counter (migration 0043). Incremented
@@ -2410,6 +2469,12 @@ export const sessionSystemUpdates = pgTable(
     summary: text("summary").notNull(),
     payload: jsonb("payload").$type<Record<string, unknown>>().notNull().default({}),
     lineage: jsonb("lineage").$type<Record<string, unknown>>().notNull().default({}),
+    // Private immutable authority frozen when this machine input is accepted.
+    // Public projections intentionally omit connection ids and owner subjects.
+    personalConnectionDelegations: jsonb("personal_connection_delegations")
+      .$type<McpPersonalConnectionDelegation[]>()
+      .notNull()
+      .default([]),
     // pending is visible queue truth; delivered means its exact model-memory
     // batch was durably claimed. Terminal cancellation/supersession is explicit.
     state: text("state").notNull().default("pending"),
@@ -2489,6 +2554,12 @@ export const sessionSystemUpdateOutbox = pgTable(
     summary: text("summary").notNull(),
     payload: jsonb("payload").$type<Record<string, unknown>>().notNull().default({}),
     lineage: jsonb("lineage").$type<Record<string, unknown>>().notNull().default({}),
+    // Exact private authority copied from the causal parent turn in the source
+    // terminal transaction. Delivery retries cannot replace this snapshot.
+    personalConnectionDelegations: jsonb("personal_connection_delegations")
+      .$type<McpPersonalConnectionDelegation[]>()
+      .notNull()
+      .default([]),
     status: text("status").notNull().default("pending"),
     attempts: integer("attempts").notNull().default(0),
     updateId: uuid("update_id"),
@@ -4288,6 +4359,16 @@ export const scheduledTasks = pgTable(
     runMode: text("run_mode").notNull().default("new_session_per_run"),
     overlapPolicy: text("overlap_policy").notNull().default("allow_concurrent"),
     agentConfig: jsonb("agent_config").$type<unknown>().notNull(),
+    createdByKind: text("created_by_kind").notNull().default("service"),
+    createdBySubjectId: text("created_by_subject_id").notNull().default("unattributed-legacy"),
+    createdByContext: jsonb("created_by_context")
+      .$type<Record<string, unknown>>()
+      .notNull()
+      .default({ backfill: true }),
+    personalConnectionDelegations: jsonb("personal_connection_delegations")
+      .$type<McpPersonalConnectionDelegation[]>()
+      .notNull()
+      .default([]),
     reusableSessionId: uuid("reusable_session_id").references(() => sessions.id, {
       onDelete: "set null",
     }),
@@ -5305,3 +5386,5 @@ export const rigChanges = pgTable(
 
 export * from "./workspace-instruction-policies-schema";
 export * from "./preference-registry-schema";
+export * from "./memory-governance-schema";
+export * from "./scoped-knowledge-schema";