@opengeni/db 0.23.0 → 0.27.0

package/src/schema.ts

@@ -720,6 +720,45 @@ export const connections = pgTable(
   }),
 );
 
+export const connectionDisconnectOperations = pgTable(
+  "connection_disconnect_operations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    subjectId: text("subject_id").notNull(),
+    idempotencyKey: text("idempotency_key").notNull(),
+    expectedVersion: integer("expected_version").notNull(),
+    resultVersion: integer("result_version").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceSubjectKey: uniqueIndex("connection_disconnect_operations_subject_key_uq").on(
+      table.workspaceId,
+      table.subjectId,
+      table.idempotencyKey,
+    ),
+    connectionGeneration: uniqueIndex(
+      "connection_disconnect_operations_connection_generation_uq",
+    ).on(table.workspaceId, table.connectionId, table.expectedVersion),
+    identityValid: check(
+      "connection_disconnect_operations_identity_check",
+      sql`length(${table.subjectId}) between 1 and 512
+        and length(${table.idempotencyKey}) between 1 and 200
+        and ${table.idempotencyKey} = btrim(${table.idempotencyKey})
+        and ${table.expectedVersion} > 0
+        and ${table.resultVersion} = ${table.expectedVersion} + 1`,
+    ),
+  }),
+);
+
 export const connectorActionPolicies = pgTable(
   "connector_action_policies",
   {
@@ -2150,6 +2189,11 @@ export const documents = pgTable(
     sourceUpdatedAt: timestamp("source_updated_at", { withTimezone: true }),
     sourceVersion: text("source_version"),
     aclTags: jsonb("acl_tags").$type<string[]>().notNull().default([]),
+    // Durable authorization tuple. The workspace_id above remains ingestion
+    // provenance; organization authority deliberately has no workspace owner.
+    authorityKind: text("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid("authority_workspace_id"),
+    authoritySubjectId: text("authority_subject_id"),
     // Per-document access controls. visibility 'private' restricts human reads to
     // created_by (a grant subject id, not a uuid); agent_access=false hides the
     // document from agent retrieval surfaces (docs MCP) while humans keep REST.
@@ -2187,6 +2231,28 @@ export const documents = pgTable(
       table.workspaceId,
       table.curationStatus,
     ),
+    authority: index("documents_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId,
+      table.status,
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "documents_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("restrict"),
+    authorityState: check(
+      "documents_authority_chk",
+      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ${table.authoritySubjectId} = ${table.createdBy})`,
+    ),
+    authorityVisibility: check(
+      "documents_authority_visibility_chk",
+      sql`(${table.authorityKind} = 'personal') = (${table.visibility} = 'private')`,
+    ),
     visibilityState: check(
       "documents_visibility_chk",
       sql`${table.visibility} in ('workspace', 'private')`,
@@ -2229,6 +2295,9 @@ export const documentChunks = pgTable(
     chunkIndex: integer("chunk_index").notNull(),
     text: text("text").notNull(),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
+    authorityKind: text("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid("authority_workspace_id"),
+    authoritySubjectId: text("authority_subject_id"),
     embedding: vector("embedding").notNull(),
     embeddingModel: text("embedding_model").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -2240,6 +2309,23 @@ export const documentChunks = pgTable(
       table.chunkIndex,
     ),
     base: index("document_chunks_workspace_base_idx").on(table.workspaceId, table.baseId),
+    authority: index("document_chunks_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId,
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "document_chunks_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("restrict"),
+    authorityState: check(
+      "document_chunks_authority_chk",
+      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024)`,
+    ),
   }),
 );
 

package/src/session-control.ts

@@ -10,6 +10,10 @@ import { and, eq, inArray, sql } from "drizzle-orm";
 import type { Database } from "./index";
 import * as schema from "./schema";
 import { closePendingSessionToolCallsInTransaction } from "./session-tool-call-settlement";
+import {
+  mirrorSessionRealtimeContextInTransaction,
+  renderRealtimeHumanInputResponseContext,
+} from "./session-realtime-mirror";
 
 export const SESSION_ANCESTRY_LIMIT = 10_000;
 
@@ -2088,7 +2092,12 @@ async function cancelSessionSubtreeInTransaction(
   }
   const immediatelyCancelledTurnIds = immediatelyCancelledTurns.map((turn) => turn.id);
   const now = new Date();
-  let cancelledHumanInputs: Array<{ id: string; sessionId: string; turnId: string }> = [];
+  let cancelledHumanInputs: Array<{
+    id: string;
+    sessionId: string;
+    turnId: string;
+    questions: (typeof schema.sessionHumanInputRequests.$inferSelect)["questions"];
+  }> = [];
   if (immediatelyCancelledTurnIds.length > 0) {
     await db
       .update(schema.sessionTurns)
@@ -2122,6 +2131,7 @@ async function cancelSessionSubtreeInTransaction(
         id: schema.sessionHumanInputRequests.id,
         sessionId: schema.sessionHumanInputRequests.sessionId,
         turnId: schema.sessionHumanInputRequests.turnId,
+        questions: schema.sessionHumanInputRequests.questions,
       });
     await db
       .update(schema.codexCapacityWaiters)
@@ -2247,8 +2257,45 @@ async function cancelSessionSubtreeInTransaction(
         ? await db.insert(schema.sessionEvents).values(eventValues).returning({
             id: schema.sessionEvents.id,
             sequence: schema.sessionEvents.sequence,
+            type: schema.sessionEvents.type,
+            turnId: schema.sessionEvents.turnId,
+            payload: schema.sessionEvents.payload,
           })
         : [];
+    const cancelledHumanInputsById = new Map(
+      cancelledHumanInputs
+        .filter((request) => request.sessionId === session.id)
+        .map((request) => [request.id, request]),
+    );
+    for (const event of inserted) {
+      if (event.type !== "user.humanInputResponse") continue;
+      const payload = event.payload as { requestId?: unknown };
+      const request =
+        typeof payload.requestId === "string"
+          ? cancelledHumanInputsById.get(payload.requestId)
+          : null;
+      if (!request) continue;
+      await mirrorSessionRealtimeContextInTransaction(db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sessionId: session.id,
+        sourceKind: "human_input_response",
+        sourceId: event.id,
+        turnId: event.turnId,
+        channel: null,
+        text: renderRealtimeHumanInputResponseContext({
+          requestId: request.id,
+          questions: request.questions,
+          response: { outcome: "cancelled" },
+        }),
+        payload: {
+          requestId: request.id,
+          outcome: "cancelled",
+          sourceEventId: event.id,
+        },
+        now,
+      });
+    }
     const liveTurnId =
       session.activeTurnId && liveTurnIds.has(session.activeTurnId) ? session.activeTurnId : null;
     await db

package/src/session-queue-commands.ts

@@ -35,6 +35,7 @@ import { sessionRealtimeIsActiveInTransaction } from "./session-realtime-state";
 import {
   mirrorSessionRealtimeContextInTransaction,
   renderRealtimeHumanInputContext,
+  renderRealtimeHumanInputResponseContext,
 } from "./session-realtime-mirror";
 import * as schema from "./schema";
 import {
@@ -284,23 +285,56 @@ export async function supersedeSessionCurrentDirectionInTransaction(
         eq(schema.sessionHumanInputRequests.status, "pending"),
       ),
     )
-    .returning({ id: schema.sessionHumanInputRequests.id });
+    .returning({
+      id: schema.sessionHumanInputRequests.id,
+      questions: schema.sessionHumanInputRequests.questions,
+    });
   let lastSequence = closedTools.sequence;
   if (cancelledHumanInputs.length > 0) {
-    await db.insert(schema.sessionEvents).values(
-      cancelledHumanInputs.map((request) => ({
+    const cancelledHumanInputEvents = await db
+      .insert(schema.sessionEvents)
+      .values(
+        cancelledHumanInputs.map((request) => ({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          sequence: ++lastSequence,
+          type: "user.humanInputResponse",
+          turnId: current.id,
+          turnGeneration: current.executionGeneration,
+          turnAssociation: "current",
+          payload: { requestId: request.id, response: { outcome: "cancelled" } },
+          occurredAt: now,
+        })),
+      )
+      .returning();
+    const requestsById = new Map(cancelledHumanInputs.map((request) => [request.id, request]));
+    for (const event of cancelledHumanInputEvents) {
+      const payload = event.payload as { requestId?: unknown };
+      const request =
+        typeof payload.requestId === "string" ? requestsById.get(payload.requestId) : null;
+      if (!request) continue;
+      await mirrorSessionRealtimeContextInTransaction(db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         sessionId: input.sessionId,
-        sequence: ++lastSequence,
-        type: "user.humanInputResponse",
+        sourceKind: "human_input_response",
+        sourceId: event.id,
         turnId: current.id,
-        turnGeneration: current.executionGeneration,
-        turnAssociation: "current",
-        payload: { requestId: request.id, response: { outcome: "cancelled" } },
-        occurredAt: now,
-      })),
-    );
+        channel: null,
+        text: renderRealtimeHumanInputResponseContext({
+          requestId: request.id,
+          questions: request.questions,
+          response: { outcome: "cancelled" },
+        }),
+        payload: {
+          requestId: request.id,
+          outcome: "cancelled",
+          sourceEventId: event.id,
+        },
+        now,
+      });
+    }
   }
   await db
     .update(schema.sessionTurns)

package/src/session-realtime-mirror.ts

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 
+import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
 import { and, desc, eq, gt, sql } from "drizzle-orm";
 
 import { sanitizeEventPayload } from "./event-payload-sanitizer";
@@ -16,7 +17,12 @@ export type MirrorSessionRealtimeContextInput = {
   accountId: string;
   workspaceId: string;
   sessionId: string;
-  sourceKind: "human_input" | "assistant_progress" | "assistant_terminal";
+  sourceKind:
+    | "human_input"
+    | "human_input_request"
+    | "human_input_response"
+    | "assistant_progress"
+    | "assistant_terminal";
   sourceId: string;
   text: string;
   channel: SessionRealtimeMirrorChannel;
@@ -155,6 +161,116 @@ export function renderRealtimeHumanInputContext(input: {
   ].join("\n");
 }
 
+export type RealtimeHumanInputRequestContext = {
+  id: string;
+  questions: HumanInputQuestion[];
+  allowSkip: boolean;
+  expiresAt?: Date | string | null;
+};
+
+/**
+ * Render the exact durable question contract for the conversational surface.
+ * The structured form remains authoritative, while a conversational answer is
+ * ordinary new user input that the realtime model delegates once with enough
+ * question context for the next underlying turn.
+ */
+export function renderRealtimeHumanInputRequestContext(input: {
+  requests: RealtimeHumanInputRequestContext[];
+}): string {
+  const lines = ["<session_human_input_request>", "  <status>waiting_for_user</status>"];
+  for (const request of input.requests) {
+    lines.push(
+      "  <request>",
+      `    <id>${escapeXmlText(request.id)}</id>`,
+      `    <allow_skip>${String(request.allowSkip)}</allow_skip>`,
+      `    <expires_at>${escapeXmlText(renderExpiry(request.expiresAt))}</expires_at>`,
+    );
+    for (const question of request.questions) {
+      lines.push(
+        "    <question>",
+        `      <id>${escapeXmlText(question.id)}</id>`,
+        `      <kind>${escapeXmlText(question.kind)}</kind>`,
+        `      <required>${String(question.required)}</required>`,
+      );
+      if (question.label) lines.push(`      <label>${escapeXmlText(question.label)}</label>`);
+      lines.push(`      <prompt>${escapeXmlText(question.prompt)}</prompt>`);
+      if (question.helpText) {
+        lines.push(`      <help_text>${escapeXmlText(question.helpText)}</help_text>`);
+      }
+      if (question.options.length > 0) {
+        lines.push("      <options>");
+        for (const option of question.options) {
+          lines.push(
+            "        <option>",
+            `          <id>${escapeXmlText(option.id)}</id>`,
+            `          <label>${escapeXmlText(option.label)}</label>`,
+          );
+          if (option.description) {
+            lines.push(`          <description>${escapeXmlText(option.description)}</description>`);
+          }
+          lines.push("        </option>");
+        }
+        lines.push("      </options>");
+      }
+      lines.push(
+        `      <allow_other>${String(question.allowOther)}</allow_other>`,
+        "    </question>",
+      );
+    }
+    lines.push("  </request>");
+  }
+  lines.push(
+    "  <instruction>The current work is waiting for the user's input. Ask the questions naturally, one at a time when useful, without changing their meaning or answering for the user. The user may answer in the visible form or answer conversationally here. If the user answers here, delegate exactly once with a complete message containing the relevant question and the user's answer. If the user changes direction instead, delegate that new direction normally. Do not claim the work resumed until a later session update confirms it.</instruction>",
+    "</session_human_input_request>",
+  );
+  return lines.join("\n");
+}
+
+export function renderRealtimeHumanInputResponseContext(input: {
+  requestId: string;
+  questions: HumanInputQuestion[];
+  response: HumanInputResponse;
+}): string {
+  const lines = [
+    "<session_human_input_response>",
+    `  <request_id>${escapeXmlText(input.requestId)}</request_id>`,
+    `  <outcome>${escapeXmlText(input.response.outcome)}</outcome>`,
+  ];
+  if (input.response.outcome === "answered") {
+    const questions = new Map(input.questions.map((question) => [question.id, question]));
+    lines.push("  <answers>");
+    for (const answer of input.response.answers) {
+      const question = questions.get(answer.questionId);
+      const optionLabels = new Map(
+        question?.options.map((option) => [option.id, option.label]) ?? [],
+      );
+      lines.push(
+        "    <answer>",
+        `      <question_id>${escapeXmlText(answer.questionId)}</question_id>`,
+      );
+      if (question) lines.push(`      <question>${escapeXmlText(question.prompt)}</question>`);
+      for (const value of answer.values) {
+        lines.push(`      <value>${escapeXmlText(optionLabels.get(value) ?? value)}</value>`);
+      }
+      if (answer.other) lines.push(`      <other>${escapeXmlText(answer.other)}</other>`);
+      lines.push("    </answer>");
+    }
+    lines.push("  </answers>");
+  }
+  lines.push(
+    input.response.outcome === "answered" || input.response.outcome === "skipped"
+      ? "  <instruction>This structured response was accepted through the session UI and the same work can resume. Treat it as authoritative user context, do not delegate it again, and acknowledge briefly only if useful.</instruction>"
+      : "  <instruction>This pending question is no longer active. Do not ask it again unless the user raises it.</instruction>",
+    "</session_human_input_response>",
+  );
+  return lines.join("\n");
+}
+
+function renderExpiry(value: Date | string | null | undefined): string {
+  if (value === null || value === undefined) return "none";
+  return value instanceof Date ? value.toISOString() : value;
+}
+
 function escapeXmlText(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }

package/src/session-realtime.ts

@@ -6,7 +6,7 @@ import type {
   SessionRealtimeMode,
   SessionRealtimeModel,
 } from "@opengeni/contracts";
-import { and, asc, eq, inArray } from "drizzle-orm";
+import { and, asc, eq, gt, inArray, isNull, or } from "drizzle-orm";
 
 import { sanitizeEventPayload } from "./event-payload-sanitizer";
 import type { Database } from "./index";
@@ -16,6 +16,10 @@ import {
   lockSessionEventWriteRows,
   registerSessionWorkflowWakeInTransaction,
 } from "./session-control";
+import {
+  mirrorSessionRealtimeContextInTransaction,
+  renderRealtimeHumanInputRequestContext,
+} from "./session-realtime-mirror";
 import * as schema from "./schema";
 
 export { sessionRealtimeIsActiveInTransaction } from "./session-realtime-state";
@@ -445,6 +449,50 @@ export async function beginSessionRealtimeInTransaction(
     now,
   );
   eventIds.push(event.id);
+  const pendingHumanInputs = await db
+    .select({
+      id: schema.sessionHumanInputRequests.id,
+      turnId: schema.sessionHumanInputRequests.turnId,
+      questions: schema.sessionHumanInputRequests.questions,
+      allowSkip: schema.sessionHumanInputRequests.allowSkip,
+      expiresAt: schema.sessionHumanInputRequests.expiresAt,
+    })
+    .from(schema.sessionHumanInputRequests)
+    .where(
+      and(
+        eq(schema.sessionHumanInputRequests.accountId, input.accountId),
+        eq(schema.sessionHumanInputRequests.workspaceId, input.workspaceId),
+        eq(schema.sessionHumanInputRequests.sessionId, input.sessionId),
+        eq(schema.sessionHumanInputRequests.status, "pending"),
+        or(
+          isNull(schema.sessionHumanInputRequests.expiresAt),
+          gt(schema.sessionHumanInputRequests.expiresAt, now),
+        ),
+      ),
+    )
+    .orderBy(
+      asc(schema.sessionHumanInputRequests.createdAt),
+      asc(schema.sessionHumanInputRequests.id),
+    );
+  if (pendingHumanInputs.length > 0) {
+    const sourceTurnIds = new Set(pendingHumanInputs.map((request) => request.turnId));
+    await mirrorSessionRealtimeContextInTransaction(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      sourceKind: "human_input_request",
+      sourceId: `startup:${pendingHumanInputs.map((request) => request.id).join(":")}`,
+      turnId: sourceTurnIds.size === 1 ? pendingHumanInputs[0]!.turnId : null,
+      channel: "speakable",
+      text: renderRealtimeHumanInputRequestContext({ requests: pendingHumanInputs }),
+      payload: {
+        status: "waiting_for_user",
+        requestIds: pendingHumanInputs.map((request) => request.id),
+        trigger: "realtime_start",
+      },
+      now,
+    });
+  }
   return {
     mode: mapRealtimeMode(row),
     replay: false,

package/src/workspace-instruction-policies-schema.ts

@@ -21,6 +21,8 @@ export const workspaceInstructionPolicyRevisions = pgTable(
   "workspace_instruction_policy_revisions",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     revision: bigint("revision", { mode: "number" })
@@ -38,6 +40,19 @@ export const workspaceInstructionPolicyRevisions = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_revisions_workspace_operation_uq")
+      .on(table.workspaceId, table.operationId)
+      .where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_revisions_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`,
+    ),
     workspaceRevision: uniqueIndex(
       "workspace_instruction_policy_revisions_workspace_revision_uq",
     ).on(table.workspaceId, table.revision),
@@ -99,6 +114,8 @@ export const workspaceInstructionPolicyActivationEvents = pgTable(
   "workspace_instruction_policy_activation_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     kind: text("kind").notNull(),
@@ -117,6 +134,19 @@ export const workspaceInstructionPolicyActivationEvents = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_events_workspace_operation_uq")
+      .on(table.workspaceId, table.operationId)
+      .where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_events_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`,
+    ),
     workspaceActivationVersion: uniqueIndex(
       "workspace_instruction_policy_events_target_version_uq",
     ).on(
@@ -142,6 +172,92 @@ export const workspaceInstructionPolicyActivationEvents = pgTable(
   }),
 );
 
+export const workspaceInstructionPolicyOnboardingProposals = pgTable(
+  "workspace_instruction_policy_onboarding_proposals",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    sourceId: text("source_id").notNull(),
+    sourceVersion: text("source_version").notNull(),
+    confidenceBps: integer("confidence_bps").notNull(),
+    baselineRevisionId: uuid("baseline_revision_id"),
+    baselineRevision: bigint("baseline_revision", { mode: "number" }),
+    baselineContentHash: text("baseline_content_hash"),
+    baselineActivationVersion: bigint("baseline_activation_version", { mode: "number" }).notNull(),
+    baselineActivatedAt: timestamp("baseline_activated_at", { withTimezone: true }),
+    draftRevisionId: uuid("draft_revision_id").notNull(),
+    draftRevision: bigint("draft_revision", { mode: "number" }).notNull(),
+    draftContentHash: text("draft_content_hash").notNull(),
+    status: text("status").notNull().default("proposed"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex(
+      "workspace_instruction_policy_onboarding_proposals_workspace_operation_uq",
+    ).on(table.workspaceId, table.operationId),
+    sourceVersionTarget: uniqueIndex(
+      "workspace_instruction_policy_onboarding_proposals_source_version_target_uq",
+    ).on(
+      table.workspaceId,
+      table.kind,
+      table.scope,
+      sql`coalesce(${table.roleKey}, '')`,
+      table.sourceId,
+      table.sourceVersion,
+    ),
+    workspaceTimeline: index(
+      "workspace_instruction_policy_onboarding_proposals_workspace_time_idx",
+    ).on(table.workspaceId, table.createdAt, table.id),
+    operationReceipt: check(
+      "workspace_instruction_policy_onboarding_proposals_operation_receipt_chk",
+      sql`${table.requestFingerprint} ~ '^[0-9a-f]{64}$'`,
+    ),
+    target: check(
+      "workspace_instruction_policy_onboarding_proposals_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`,
+    ),
+    source: check(
+      "workspace_instruction_policy_onboarding_proposals_source_chk",
+      sql`length(btrim(${table.sourceId})) between 1 and 512
+        and length(btrim(${table.sourceVersion})) between 1 and 256
+        and ${table.confidenceBps} between 0 and 10000`,
+    ),
+    baseline: check(
+      "workspace_instruction_policy_onboarding_proposals_baseline_chk",
+      sql`(
+        ${table.baselineRevisionId} is null
+        and ${table.baselineRevision} is null
+        and ${table.baselineContentHash} is null
+        and ${table.baselineActivationVersion} = 0
+        and ${table.baselineActivatedAt} is null
+      ) or (
+        ${table.baselineRevisionId} is not null
+        and ${table.baselineRevision} > 0
+        and ${table.baselineContentHash} ~ '^[0-9a-f]{64}$'
+        and ${table.baselineActivationVersion} > 0
+        and ${table.baselineActivatedAt} is not null
+      )`,
+    ),
+    draft: check(
+      "workspace_instruction_policy_onboarding_proposals_draft_chk",
+      sql`${table.draftRevision} > 0
+        and ${table.draftContentHash} ~ '^[0-9a-f]{64}$'
+        and ${table.status} = 'proposed'`,
+    ),
+  }),
+);
+
 export const workspaceInstructionPolicySnapshots = pgTable(
   "workspace_instruction_policy_snapshots",
   {