@opengeni/db 0.31.1 → 0.36.0

package/src/schema.ts

@@ -7,9 +7,14 @@ import type {
   McpServerConnectionRef,
   RigProviderImages,
   SessionMcpApprovalPolicy,
+  SessionGoalChangeKind,
+  SessionGoalMutationPolicy,
+  SessionGoalSnapshot,
   SlackUserLinkAccessRequest,
   TimelineAnnotation,
+  XaiProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
+import { WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 } from "@opengeni/contracts";
 import { sql } from "drizzle-orm";
 import type { SessionToolPolicy } from "@opengeni/contracts";
 import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
@@ -420,6 +425,165 @@ export const workspaceMemberships = pgTable(
   }),
 );
 
+// Organization membership is distinct from workspace access. `account_id` is
+// the physical organization identifier; `personal_workspace_id` is lifecycle
+// metadata only and never the ownership anchor for user resources.
+export const organizationMemberships = pgTable(
+  "organization_memberships",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    subjectId: text("subject_id").notNull(),
+    status: text("status").notNull().default("provisioning"),
+    personalWorkspaceId: uuid("personal_workspace_id"),
+    authorizationRevision: bigint("authorization_revision", { mode: "number" })
+      .notNull()
+      .default(1),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    personalRetentionUntil: timestamp("personal_retention_until", {
+      withTimezone: true,
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountIdentity: uniqueIndex("organization_memberships_id_account_idx").on(
+      table.id,
+      table.accountId,
+    ),
+    accountSubject: uniqueIndex("organization_memberships_account_subject_idx").on(
+      table.accountId,
+      table.subjectId,
+    ),
+    personalWorkspace: uniqueIndex("organization_memberships_personal_workspace_idx")
+      .on(table.accountId, table.personalWorkspaceId)
+      .where(sql`${table.personalWorkspaceId} is not null`),
+    personalWorkspaceAccount: foreignKey({
+      name: "organization_memberships_personal_workspace_account_fk",
+      columns: [table.personalWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("restrict"),
+    statusValid: check(
+      "organization_memberships_status_check",
+      sql`${table.status} in ('provisioning', 'active', 'suspended', 'revoked')`,
+    ),
+    activePersonalWorkspace: check(
+      "organization_memberships_active_personal_workspace_check",
+      sql`${table.status} <> 'active' or ${table.personalWorkspaceId} is not null`,
+    ),
+    subjectValid: check(
+      "organization_memberships_subject_check",
+      sql`length(btrim(${table.subjectId})) between 1 and 1024`,
+    ),
+    revisionValid: check(
+      "organization_memberships_revision_check",
+      sql`${table.authorizationRevision} > 0`,
+    ),
+    revocationValid: check(
+      "organization_memberships_revocation_check",
+      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
+        or (${table.status} <> 'revoked' and ${table.revokedAt} is null)`,
+    ),
+  }),
+);
+
+export const organizationUserRetentionPolicies = pgTable(
+  "organization_user_retention_policies",
+  {
+    accountId: uuid("account_id")
+      .primaryKey()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    mode: text("mode").notNull().default("retain"),
+    retentionDays: integer("retention_days"),
+    version: bigint("version", { mode: "number" }).notNull().default(1),
+    updatedByMembershipId: uuid("updated_by_membership_id"),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    updater: foreignKey({
+      name: "organization_user_retention_policies_updater_fk",
+      columns: [table.updatedByMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    modeValid: check(
+      "organization_user_retention_policies_mode_check",
+      sql`${table.mode} in ('retain', 'delete_after')`,
+    ),
+    durationValid: check(
+      "organization_user_retention_policies_duration_check",
+      sql`(${table.mode} = 'retain' and ${table.retentionDays} is null)
+        or (
+          ${table.mode} = 'delete_after'
+          and ${table.retentionDays} is not null
+          and ${table.retentionDays} between 1 and 3650
+        )`,
+    ),
+    versionValid: check(
+      "organization_user_retention_policies_version_check",
+      sql`${table.version} > 0`,
+    ),
+  }),
+);
+
+export const organizationUserResourceAuthorities = pgTable(
+  "organization_user_resource_authorities",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    organizationMembershipId: uuid("organization_membership_id").notNull(),
+    resourceKind: text("resource_kind").notNull(),
+    resourceId: uuid("resource_id").notNull(),
+    // Provenance only. The migration owns a composite same-organization FK
+    // whose delete action clears only this column, never account_id.
+    originWorkspaceId: uuid("origin_workspace_id"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountIdentity: uniqueIndex("organization_user_resource_authorities_id_account_idx").on(
+      table.id,
+      table.accountId,
+    ),
+    accountMembershipIdentity: uniqueIndex(
+      "organization_user_resource_authorities_id_account_membership_idx",
+    ).on(table.id, table.accountId, table.organizationMembershipId),
+    resourceIdentity: uniqueIndex(
+      "organization_user_resource_authorities_resource_identity_idx",
+    ).on(table.accountId, table.organizationMembershipId, table.resourceKind, table.resourceId),
+    membership: foreignKey({
+      name: "organization_user_resource_authorities_membership_fk",
+      columns: [table.organizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    resourceKindValid: check(
+      "organization_user_resource_authorities_kind_check",
+      sql`${table.resourceKind} = lower(btrim(${table.resourceKind}))
+        and length(${table.resourceKind}) between 1 and 64
+        and ${table.resourceKind} ~ '^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$'`,
+    ),
+    generationValid: check(
+      "organization_user_resource_authorities_generation_check",
+      sql`${table.generation} > 0`,
+    ),
+    statusValid: check(
+      "organization_user_resource_authorities_status_check",
+      sql`${table.status} in ('active', 'retained', 'revoked')`,
+    ),
+    revocationValid: check(
+      "organization_user_resource_authorities_revocation_check",
+      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
+        or (${table.status} <> 'revoked' and ${table.revokedAt} is null)`,
+    ),
+  }),
+);
+
 export const apiKeys = pgTable(
   "api_keys",
   {
@@ -460,6 +624,13 @@ export const workspaceVariableSets = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     name: text("name").notNull(),
     description: text("description"),
+    // Migration 0230 is schema-only: all shipped CRUD continues to omit these
+    // fields and therefore remains workspace-scoped. A later activation slice
+    // must provide the complete owner authority and runtime protocol.
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -472,6 +643,33 @@ export const workspaceVariableSets = pgTable(
       table.workspaceId,
       table.createdAt,
     ),
+    authorityShape: check(
+      "workspace_variable_sets_authority_shape_check",
+      sql`(
+          ${table.authorityScope} = 'workspace'
+          and ${table.authorityId} is null
+          and ${table.ownerOrganizationMembershipId} is null
+        ) or (
+          ${table.authorityScope} = 'user'
+          and ${table.authorityId} is not null
+          and ${table.ownerOrganizationMembershipId} is not null
+        )`,
+    ),
+    authorityScopeValid: check(
+      "workspace_variable_sets_authority_scope_check",
+      sql`${table.authorityScope} in ('workspace', 'user')`,
+    ),
+    authority: foreignKey({
+      name: "workspace_variable_sets_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    // PostgreSQL's column-subset SET NULL action preserves account_id; Drizzle
+    // cannot represent that action, so migration 0230 owns the origin FK.
   }),
 );
 
@@ -559,12 +757,16 @@ export const codexSubscriptionCredentials = pgTable(
     // continues to own `version`; quota/cache writes own neither counter.
     allocatorVersion: integer("allocator_version").notNull().default(1),
     allocatorUpdatedBySubjectId: text("allocator_updated_by_subject_id"),
-    allocatorUpdatedAt: timestamp("allocator_updated_at", { withTimezone: true }),
+    allocatorUpdatedAt: timestamp("allocator_updated_at", {
+      withTimezone: true,
+    }),
     // Authoritative count-only summary cached from /wham/usage. Detailed rows
     // are never persisted as redemption authority; every first POST preflights
     // the provider's fresh detail endpoint.
     resetCreditAvailableCount: integer("reset_credit_available_count"),
-    resetCreditsCheckedAt: timestamp("reset_credits_checked_at", { withTimezone: true }),
+    resetCreditsCheckedAt: timestamp("reset_credits_checked_at", {
+      withTimezone: true,
+    }),
     // Set only by a direct Better Auth cookie connection/reconnection. Legacy,
     // configured, delegated, API-key, and agent-created rows remain view-only.
     connectedBySubjectId: text("connected_by_subject_id"),
@@ -662,7 +864,9 @@ export const codexResetRedemptionAttempts = pgTable(
     outcome: text("outcome"),
     claimHolderId: uuid("claim_holder_id"),
     claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
-    confirmationExpiresAt: timestamp("confirmation_expires_at", { withTimezone: true }).notNull(),
+    confirmationExpiresAt: timestamp("confirmation_expires_at", {
+      withTimezone: true,
+    }).notNull(),
     providerStartedAt: timestamp("provider_started_at", { withTimezone: true }),
     completedAt: timestamp("completed_at", { withTimezone: true }),
     lastFailureKind: text("last_failure_kind"),
@@ -1143,10 +1347,17 @@ export const slackInteractionInbox = pgTable(
     slackThreadTs: text("slack_thread_ts"),
     triggerKind: text("trigger_kind")
       .$type<
-        "app_mention" | "dm" | "reaction" | "slash_command" | "message_shortcut" | "thread_reply"
+        | "app_mention"
+        | "dm"
+        | "reaction"
+        | "slash_command"
+        | "message_shortcut"
+        | "thread_reply"
+        | "block_action"
       >()
       .notNull(),
     text: text("text").notNull(),
+    hasFiles: boolean("has_files").notNull().default(false),
     status: text("status")
       .$type<"pending" | "processing" | "processed" | "failed">()
       .notNull()
@@ -1197,6 +1408,7 @@ export const slackInteractions = pgTable(
     slackThreadTs: text("slack_thread_ts").notNull(),
     routeKey: text("route_key").notNull(),
     triggeringProviderEventId: text("triggering_provider_event_id").notNull(),
+    initiatingSlackUserId: text("initiating_slack_user_id"),
     owningSubjectId: text("owning_subject_id").notNull(),
     visibility: text("visibility").$type<"private" | "workspace">().notNull(),
     sessionReservationId: uuid("session_reservation_id").notNull().defaultRandom(),
@@ -1245,6 +1457,73 @@ export const slackInteractions = pgTable(
   }),
 );
 
+export const slackInteractionActionHandles = pgTable(
+  "slack_interaction_action_handles",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    interactionId: uuid("interaction_id").notNull(),
+    sessionId: uuid("session_id")
+      .notNull()
+      .references(() => sessions.id, { onDelete: "cascade" }),
+    sessionEventSequence: integer("session_event_sequence").notNull(),
+    actionKind: text("action_kind")
+      .$type<
+        | "approval_approve"
+        | "approval_reject"
+        | "human_input_select"
+        | "human_input_skip"
+        | "session_status"
+        | "session_pause"
+        | "session_resume"
+        | "shared_result_publish"
+      >()
+      .notNull(),
+    actionKey: text("action_key").notNull(),
+    targetId: text("target_id"),
+    targetValue: text("target_value"),
+    authorizedSubjectId: text("authorized_subject_id").notNull(),
+    authorizedSlackUserId: text("authorized_slack_user_id").notNull(),
+    messageOperationId: uuid("message_operation_id").notNull(),
+    status: text("status").$type<"pending" | "completed" | "stale">().notNull().default("pending"),
+    result: text("result"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    interactionIdentity: foreignKey({
+      columns: [table.accountId, table.workspaceId, table.interactionId],
+      foreignColumns: [
+        slackInteractions.accountId,
+        slackInteractions.workspaceId,
+        slackInteractions.id,
+      ],
+      name: "slack_interaction_action_handles_interaction_fk",
+    }).onDelete("cascade"),
+    identity: uniqueIndex("slack_interaction_action_handles_identity_uq").on(
+      table.interactionId,
+      table.sessionEventSequence,
+      table.actionKey,
+    ),
+    pending: index("slack_interaction_action_handles_pending_idx").on(
+      table.workspaceId,
+      table.status,
+      table.expiresAt,
+      table.id,
+    ),
+  }),
+);
+
 export const slackInteractionProgressDeliveries = pgTable(
   "slack_interaction_progress_deliveries",
   {
@@ -1287,9 +1566,9 @@ export const slackInteractionProgressDeliveries = pgTable(
 );
 
 // Durable provider-operation identity for OpenGeni Slack bot posts. The
-// caller-supplied operation UUID is also Slack's client_msg_id; a bounded claim
-// serializes live attempts while an expired/released claim can safely retry the
-// same provider identity after response loss or process death.
+// server-owned durable operation UUID is also Slack's client_msg_id. `pending` is
+// safe to send, `provider_started` and `outcome_unknown` require provider read
+// reconciliation, and only `completed` may expose the provider result.
 export const slackBotPostOperations = pgTable(
   "slack_bot_post_operations",
   {
@@ -1308,9 +1587,12 @@ export const slackBotPostOperations = pgTable(
     targetKind: text("target_kind").$type<"channel" | "user">().notNull(),
     targetId: text("target_id").notNull(),
     requestDigest: text("request_digest").notNull(),
-    status: text("status").$type<"provider_started" | "completed">().notNull(),
+    status: text("status")
+      .$type<"pending" | "provider_started" | "outcome_unknown" | "completed">()
+      .notNull(),
     claimHolderId: uuid("claim_holder_id"),
     claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    claimMode: text("claim_mode").$type<"send" | "reconcile">(),
     attemptCount: integer("attempt_count").notNull().default(0),
     lastFailureCode: text("last_failure_code"),
     slackChannelId: text("slack_channel_id"),
@@ -1336,7 +1618,7 @@ export const slackBotPostOperations = pgTable(
     ),
     statusValid: check(
       "slack_bot_post_operations_status_check",
-      sql`${table.status} in ('provider_started', 'completed')`,
+      sql`${table.status} in ('pending', 'provider_started', 'outcome_unknown', 'completed')`,
     ),
     identityValid: check(
       "slack_bot_post_operations_identity_check",
@@ -1344,12 +1626,26 @@ export const slackBotPostOperations = pgTable(
         and length(${table.targetId}) between 1 and 64
         and ${table.requestDigest} ~ '^[0-9a-f]{64}$'
         and ${table.attemptCount} > 0
-        and ((${table.claimHolderId} is null) = (${table.claimExpiresAt} is null))`,
+        and (
+          (
+            ${table.claimHolderId} is null
+            and ${table.claimExpiresAt} is null
+            and ${table.claimMode} is null
+          )
+          or (
+            ${table.claimHolderId} is not null
+            and ${table.claimExpiresAt} is not null
+            and (
+              (${table.claimMode} = 'send' and ${table.status} in ('pending', 'provider_started'))
+              or (${table.claimMode} = 'reconcile' and ${table.status} = 'outcome_unknown')
+            )
+          )
+        )`,
     ),
     completionValid: check(
       "slack_bot_post_operations_completion_check",
       sql`(
-          ${table.status} = 'provider_started'
+          ${table.status} <> 'completed'
           and ${table.slackChannelId} is null
           and ${table.slackMessageTimestamp} is null
           and ${table.completedAt} is null
@@ -1365,6 +1661,46 @@ export const slackBotPostOperations = pgTable(
   }),
 );
 
+export const slackBotUpdateOperations = pgTable(
+  "slack_bot_update_operations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    operationId: uuid("operation_id").notNull(),
+    slackChannelId: text("slack_channel_id").notNull(),
+    slackMessageTimestamp: text("slack_message_timestamp").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    status: text("status").$type<"provider_started" | "completed">().notNull(),
+    claimHolderId: uuid("claim_holder_id"),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    lastFailureCode: text("last_failure_code"),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_bot_update_operations_workspace_operation_uq").on(
+      table.workspaceId,
+      table.connectionId,
+      table.operationId,
+    ),
+    workspaceStatus: index("slack_bot_update_operations_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+      table.updatedAt,
+    ),
+  }),
+);
+
 export const memorySlackPublicationConfigurations = pgTable(
   "memory_slack_publication_configurations",
   {
@@ -1438,7 +1774,9 @@ export const memorySlackPublications = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     configurationId: uuid("configuration_id")
       .notNull()
-      .references(() => memorySlackPublicationConfigurations.id, { onDelete: "restrict" }),
+      .references(() => memorySlackPublicationConfigurations.id, {
+        onDelete: "restrict",
+      }),
     configurationRevision: integer("configuration_revision").notNull(),
     connectionId: uuid("connection_id").notNull(),
     slackTeamId: text("slack_team_id").notNull(),
@@ -1901,6 +2239,218 @@ export const codexCredentialLeases = pgTable(
   }),
 );
 
+// Encrypted multi-account xAI/SuperGrok credentials. Provider tokens and
+// cookies live only inside credential_encrypted; every other column is bounded
+// allocation/health metadata. User-scoped rows are created only by the
+// migration-owned lifecycle function that also creates their exact generic
+// organization_user_resource_authorities row.
+export const xaiSubscriptionCredentials = pgTable(
+  "xai_subscription_credentials",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    credentialEncrypted: text("credential_encrypted").notNull(),
+    providerAccountId: text("provider_account_id"),
+    label: text("label"),
+    accountEmail: text("account_email"),
+    planType: text("plan_type"),
+    status: text("status").notNull().default("active"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    lastRefreshAt: timestamp("last_refresh_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    version: integer("version").notNull().default(1),
+    allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
+    allocatorVersion: integer("allocator_version").notNull().default(1),
+    allocatorUpdatedAt: timestamp("allocator_updated_at", {
+      withTimezone: true,
+    }),
+    quotaUsedPercent: integer("quota_used_percent"),
+    quotaResetAt: timestamp("quota_reset_at", { withTimezone: true }),
+    quotaCheckedAt: timestamp("quota_checked_at", { withTimezone: true }),
+    exhaustedUntil: timestamp("exhausted_until", { withTimezone: true }),
+    selectionCount: integer("selection_count").notNull().default(0),
+    lastSelectedAt: timestamp("last_selected_at", { withTimezone: true }),
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    organizationUserResourceAuthorityId: uuid("organization_user_resource_authority_id"),
+    organizationUserResourceKind: text("organization_user_resource_kind"),
+    organizationUserResourceAuthorityGeneration: bigint(
+      "organization_user_resource_authority_generation",
+      { mode: "number" },
+    ),
+    // Connection attribution only. Ownership/execution authority comes from
+    // the explicit authority tuple above and the frozen acceptance snapshot.
+    connectedBySubjectId: text("connected_by_subject_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceIdentity: uniqueIndex("xai_subscription_credentials_workspace_id_uq").on(
+      table.workspaceId,
+      table.id,
+    ),
+    workspaceAccountIdentity: uniqueIndex(
+      "xai_subscription_credentials_workspace_account_id_uq",
+    ).on(table.workspaceId, table.accountId, table.id),
+    providerIdentity: uniqueIndex("xai_subscription_credentials_provider_identity_uq")
+      .on(
+        table.workspaceId,
+        table.authorityScope,
+        table.ownerOrganizationMembershipId,
+        table.providerAccountId,
+      )
+      .where(sql`${table.providerAccountId} is not null`),
+    workspaceStatus: index("xai_subscription_credentials_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+      table.allocatorEnabled,
+    ),
+    scopeValid: check(
+      "xai_subscription_credentials_authority_scope_chk",
+      sql`${table.authorityScope} in ('workspace', 'user')`,
+    ),
+    authorityShapeValid: check(
+      "xai_subscription_credentials_authority_shape_chk",
+      sql`(
+          ${table.authorityScope} = 'workspace'
+          and ${table.ownerOrganizationMembershipId} is null
+          and ${table.organizationUserResourceAuthorityId} is null
+          and ${table.organizationUserResourceKind} is null
+          and ${table.organizationUserResourceAuthorityGeneration} is null
+        ) or (
+          ${table.authorityScope} = 'user'
+          and ${table.ownerOrganizationMembershipId} is not null
+          and ${table.organizationUserResourceAuthorityId} is not null
+          and ${table.organizationUserResourceKind} = 'xai_subscription'
+          and ${table.organizationUserResourceAuthorityGeneration} > 0
+        )`,
+    ),
+    statusValid: check(
+      "xai_subscription_credentials_status_chk",
+      sql`${table.status} in ('active', 'needs_relogin', 'error', 'disabled')`,
+    ),
+    versionValid: check(
+      "xai_subscription_credentials_version_chk",
+      sql`${table.version} > 0 and ${table.allocatorVersion} > 0`,
+    ),
+    quotaValid: check(
+      "xai_subscription_credentials_quota_chk",
+      sql`${table.quotaUsedPercent} is null or ${table.quotaUsedPercent} between 0 and 100`,
+    ),
+  }),
+);
+
+// One fair-allocation serialization row per workspace or exact user pool.
+export const xaiRotationSettings = pgTable(
+  "xai_rotation_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    activeCredentialId: uuid("active_credential_id"),
+    rotationEnabled: boolean("rotation_enabled").notNull().default(true),
+    fairnessCursor: bigint("fairness_cursor", { mode: "number" }).notNull().default(0),
+    version: integer("version").notNull().default(1),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspacePool: uniqueIndex("xai_rotation_settings_workspace_pool_uq").on(
+      table.workspaceId,
+      table.authorityScope,
+      table.ownerOrganizationMembershipId,
+    ),
+    scopeValid: check(
+      "xai_rotation_settings_authority_scope_chk",
+      sql`(${table.authorityScope} = 'workspace' and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityScope} = 'user' and ${table.ownerOrganizationMembershipId} is not null)`,
+    ),
+    countersValid: check(
+      "xai_rotation_settings_counters_chk",
+      sql`${table.fairnessCursor} >= 0 and ${table.version} > 0`,
+    ),
+  }),
+);
+
+// Exact logical-turn lease. A replacement holder for the same turn preserves
+// the credential and advances generation; stale holders must match both.
+export const xaiCredentialLeases = pgTable(
+  "xai_credential_leases",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    authorityScope: text("authority_scope").notNull(),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    credentialId: uuid("credential_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    holderId: text("holder_id").notNull(),
+    generation: integer("generation").notNull().default(1),
+    leasedUntil: timestamp("leased_until", { withTimezone: true }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceTurn: uniqueIndex("xai_credential_leases_workspace_turn_uq").on(
+      table.workspaceId,
+      table.turnId,
+    ),
+    activeCredential: index("xai_credential_leases_active_credential_idx").on(
+      table.workspaceId,
+      table.credentialId,
+      table.leasedUntil,
+    ),
+    expiry: index("xai_credential_leases_expiry_idx").on(table.leasedUntil),
+    scopeValid: check(
+      "xai_credential_leases_authority_scope_chk",
+      sql`(${table.authorityScope} = 'workspace' and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityScope} = 'user' and ${table.ownerOrganizationMembershipId} is not null)`,
+    ),
+    generationValid: check("xai_credential_leases_generation_chk", sql`${table.generation} > 0`),
+  }),
+);
+
+// Workspace-shared channels organize root sessions ("workstreams") by work
+// type in the rail. Pure organizational metadata: filing a session into a
+// channel never affects execution, authority, memory, or history.
+export const channels = pgTable(
+  "channels",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    // Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
+    createdBy: text("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    // The migration owns the case-insensitive lower(name) uniqueness.
+    workspaceIdentity: uniqueIndex("channels_workspace_id_uq").on(table.workspaceId, table.id),
+  }),
+);
+
 export const sessions = pgTable(
   "sessions",
   {
@@ -1944,6 +2494,21 @@ export const sessions = pgTable(
       .$type<Record<string, unknown>>()
       .notNull()
       .default({ backfill: true }),
+    // Generic tenancy metadata is additive foundation only. Existing rows are
+    // explicitly workspace-shared and have no owner membership, so absent
+    // fields can never manufacture user authority.
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    ownerSubjectId: text("owner_subject_id"),
+    visibility: text("visibility").notNull().default("workspace_shared"),
+    authorityEpoch: integer("authority_epoch").notNull().default(1),
+    // Independent-copy provenance. A destination may use either visibility and
+    // may live in another workspace in the same organization; no live process,
+    // credential, grant, or delegation is represented by these facts.
+    forkedFromSessionId: uuid("forked_from_session_id"),
+    forkedFromAuthorityEpoch: integer("forked_from_authority_epoch"),
+    forkedFromVisibility: text("forked_from_visibility"),
+    forkedAt: timestamp("forked_at", { withTimezone: true }),
+    forkedByOrganizationMembershipId: uuid("forked_by_organization_membership_id"),
     model: text("model").notNull(),
     sandboxBackend: text("sandbox_backend").notNull(),
     // The OS this session's box runs. Defaults to 'linux' (today's only OS, so
@@ -1992,6 +2557,12 @@ export const sessions = pgTable(
     // file (forward-reference pattern, same as activeSandboxId). Consumed in M3.
     rigId: uuid("rig_id"),
     rigVersionId: uuid("rig_version_id"),
+    // Workspace channel this session is filed under (rail organization only;
+    // the rail groups a tree by its ROOT session's channel). Null = unfiled
+    // (inbox). ON DELETE SET NULL detaches sessions when a channel is removed.
+    channelId: uuid("channel_id").references(() => channels.id, {
+      onDelete: "set null",
+    }),
     // Non-default first-party MCP token permissions (manager-style sessions);
     // null means the fixed worker default set in @opengeni/runtime.
     firstPartyMcpPermissions: jsonb("first_party_mcp_permissions").$type<string[]>(),
@@ -2006,6 +2577,12 @@ export const sessions = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    initialXaiProviderAccountAuthoritySnapshot: jsonb(
+      "initial_xai_provider_account_authority_snapshot",
+    )
+      .$type<XaiProviderAccountAuthoritySnapshotV1>()
+      .notNull()
+      .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     // Durable tool-policy origin. Migration 0136 removes the old null/legacy
     // representation so every session has one explicit policy mode.
     toolPolicy: jsonb("tool_policy").$type<SessionToolPolicy>().notNull(),
@@ -2094,9 +2671,12 @@ export const sessions = pgTable(
     activityRevision: bigint("activity_revision", { mode: "number" }).notNull().default(0),
     // Transaction ownership marker between the cheap row trigger and the
     // once-per-transaction commit gate. Committed rows must always be null.
-    activityRevisionPendingXid: bigint("activity_revision_pending_xid", { mode: "bigint" }),
+    activityRevisionPendingXid: bigint("activity_revision_pending_xid", {
+      mode: "bigint",
+    }),
   },
   (table) => ({
+    accountIdentity: uniqueIndex("sessions_id_account_idx").on(table.id, table.accountId),
     workspaceIdentity: uniqueIndex("sessions_workspace_id_idx").on(table.workspaceId, table.id),
     workspaceCreated: index("sessions_workspace_created_idx").on(
       table.workspaceId,
@@ -2124,6 +2704,47 @@ export const sessions = pgTable(
     workspaceActivityPending: index("sessions_workspace_activity_pending_idx")
       .on(table.workspaceId, table.activityRevisionPendingXid, table.id)
       .where(sql`${table.activityRevisionPendingXid} is not null`),
+    ownerOrganizationMembership: foreignKey({
+      name: "sessions_owner_organization_membership_fk",
+      columns: [table.ownerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    forkedFromSession: foreignKey({
+      name: "sessions_forked_from_session_account_fk",
+      columns: [table.forkedFromSessionId, table.accountId],
+      foreignColumns: [table.id, table.accountId],
+    }).onDelete("restrict"),
+    forkedByOrganizationMembership: foreignKey({
+      name: "sessions_forked_by_organization_membership_fk",
+      columns: [table.forkedByOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    visibilityValid: check(
+      "sessions_visibility_check",
+      sql`${table.visibility} in ('user_private', 'workspace_shared')`,
+    ),
+    privateOwnerValid: check(
+      "sessions_private_owner_check",
+      sql`${table.visibility} <> 'user_private' or ${table.ownerOrganizationMembershipId} is not null`,
+    ),
+    authorityEpochValid: check("sessions_authority_epoch_check", sql`${table.authorityEpoch} > 0`),
+    forkProvenanceValid: check(
+      "sessions_fork_provenance_check",
+      sql`(
+          ${table.forkedFromSessionId} is null
+          and ${table.forkedFromAuthorityEpoch} is null
+          and ${table.forkedFromVisibility} is null
+          and ${table.forkedAt} is null
+          and ${table.forkedByOrganizationMembershipId} is null
+        ) or (
+          ${table.forkedFromSessionId} is not null
+          and ${table.forkedFromAuthorityEpoch} is not null
+          and ${table.forkedFromAuthorityEpoch} > 0
+          and ${table.forkedFromVisibility} in ('user_private', 'workspace_shared')
+          and ${table.forkedAt} is not null
+          and ${table.forkedByOrganizationMembershipId} is not null
+        )`,
+    ),
     variableSet: index("sessions_variable_set_idx").on(table.workspaceId, table.variableSetId),
     parent: index("sessions_parent_idx").on(table.workspaceId, table.parentSessionId),
     // Routing index: resolve session_id -> sandbox_group_id at every lease entry
@@ -2144,6 +2765,114 @@ export const sessions = pgTable(
   }),
 );
 
+export const organizationUserResourceGrants = pgTable(
+  "organization_user_resource_grants",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    authorityId: uuid("authority_id").notNull(),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id"),
+    action: text("action").notNull(),
+    mode: text("mode").notNull(),
+    context: text("context").notNull(),
+    authorityEpoch: integer("authority_epoch"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountIdentity: uniqueIndex("organization_user_resource_grants_id_account_idx").on(
+      table.id,
+      table.accountId,
+    ),
+    authorityWorkspace: index("organization_user_resource_grants_authority_workspace_idx").on(
+      table.authorityId,
+      table.workspaceId,
+      table.status,
+    ),
+    authority: foreignKey({
+      name: "organization_user_resource_grants_authority_fk",
+      columns: [table.authorityId, table.accountId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+      ],
+    }).onDelete("restrict"),
+    ownerMembership: foreignKey({
+      name: "organization_user_resource_grants_owner_membership_fk",
+      columns: [table.ownerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    authorityOwner: foreignKey({
+      name: "organization_user_resource_grants_authority_owner_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    workspaceAccount: foreignKey({
+      name: "organization_user_resource_grants_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    sessionWorkspace: foreignKey({
+      name: "organization_user_resource_grants_session_workspace_fk",
+      columns: [table.workspaceId, table.sessionId],
+      foreignColumns: [sessions.workspaceId, sessions.id],
+    }).onDelete("restrict"),
+    actionValid: check(
+      "organization_user_resource_grants_action_check",
+      sql`${table.action} = lower(btrim(${table.action}))
+        and length(${table.action}) between 1 and 64
+        and ${table.action} ~ '^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$'`,
+    ),
+    modeValid: check(
+      "organization_user_resource_grants_mode_check",
+      sql`${table.mode} in ('once', 'session', 'always')`,
+    ),
+    contextValid: check(
+      "organization_user_resource_grants_context_check",
+      sql`${table.context} in ('user_private', 'workspace_shared')`,
+    ),
+    sessionFenceValid: check(
+      "organization_user_resource_grants_session_fence_check",
+      sql`(
+          ${table.mode} = 'always'
+          and ${table.sessionId} is null
+          and ${table.authorityEpoch} is null
+        ) or (
+          ${table.mode} in ('once', 'session')
+          and
+          ${table.sessionId} is not null
+          and ${table.authorityEpoch} is not null
+          and ${table.authorityEpoch} > 0
+        )`,
+    ),
+    generationValid: check(
+      "organization_user_resource_grants_generation_check",
+      sql`${table.generation} > 0`,
+    ),
+    statusValid: check(
+      "organization_user_resource_grants_status_check",
+      sql`${table.status} in ('active', 'consumed', 'revoked', 'expired')`,
+    ),
+    revocationValid: check(
+      "organization_user_resource_grants_revocation_check",
+      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
+        or (${table.status} <> 'revoked' and ${table.revokedAt} is null)`,
+    ),
+  }),
+);
+
 // One temporary realtime owner for an ordinary session. Terminal rows remain
 // as lifecycle evidence; the partial unique index admits only one active owner.
 export const sessionRealtimeModes = pgTable(
@@ -2161,15 +2890,21 @@ export const sessionRealtimeModes = pgTable(
     state: text("state").notNull().default("active"),
     version: integer("version").notNull().default(1),
     connectionEpoch: integer("connection_epoch").notNull().default(1),
-    leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }).notNull(),
-    lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }).notNull(),
+    leaseExpiresAt: timestamp("lease_expires_at", {
+      withTimezone: true,
+    }).notNull(),
+    lastHeartbeatAt: timestamp("last_heartbeat_at", {
+      withTimezone: true,
+    }).notNull(),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     endedAt: timestamp("ended_at", { withTimezone: true }),
     endReason: text("end_reason"),
     // The rolling migration owns this forward reference. End commits at most
     // one canonical transcript-tail Steer and binds its audit projection here.
     contextProjectionId: uuid("context_projection_id"),
-    contextProjectedAt: timestamp("context_projected_at", { withTimezone: true }),
+    contextProjectedAt: timestamp("context_projected_at", {
+      withTimezone: true,
+    }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -2203,6 +2938,7 @@ export const sessionRealtimeModes = pgTable(
       "session_realtime_modes_model_check",
       sql`${table.model} in (
         'gpt-live-1-boulder-alpha',
+        'supergrok/grok-voice-think-fast-2.0',
         'opengeni-gateway/openai/gpt-realtime-2.1',
         'opengeni-gateway/openai/gpt-realtime-mini',
         'opengeni-gateway/xai/grok-voice-think-fast-2.0',
@@ -2260,7 +2996,9 @@ export const sessionRealtimeConnections = pgTable(
     failureCode: text("failure_code"),
     providerSessionId: text("provider_session_id"),
     startupEventId: text("startup_event_id"),
-    startupAcknowledgedAt: timestamp("startup_acknowledged_at", { withTimezone: true }),
+    startupAcknowledgedAt: timestamp("startup_acknowledged_at", {
+      withTimezone: true,
+    }),
     negotiatedAt: timestamp("negotiated_at", { withTimezone: true }),
     closedAt: timestamp("closed_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -2729,7 +3467,9 @@ export const generatedImageArtifacts = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid("session_id").references(() => sessions.id, {
+      onDelete: "set null",
+    }),
     // Turn/attempt foreign keys are installed by the migration; those tables
     // are declared later in this monolithic schema module.
     turnId: uuid("turn_id"),
@@ -2944,7 +3684,7 @@ export const workspaceVideoGenerationPolicies = pgTable(
     ),
     fundingSourceValid: check(
       "workspace_video_generation_policies_funding_source_chk",
-      sql`${table.fundingSource} in ('opengeni_credits', 'workspace_gateway')`,
+      sql`${table.fundingSource} in ('opengeni_credits', 'workspace_gateway', 'supergrok_subscription')`,
     ),
   }),
 );
@@ -2990,7 +3730,9 @@ export const videoGenerationOperations = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid("session_id").references(() => sessions.id, {
+      onDelete: "set null",
+    }),
     turnId: uuid("turn_id"),
     attemptId: uuid("attempt_id"),
     toolCallId: text("tool_call_id").notNull(),
@@ -3012,7 +3754,9 @@ export const videoGenerationOperations = pgTable(
     /** Exact provider start body, encrypted before the first network byte. */
     providerRequestEncrypted: text("provider_request_encrypted"),
     /** Bearer URLs inside the frozen body are unusable after this instant. */
-    providerRequestExpiresAt: timestamp("provider_request_expires_at", { withTimezone: true }),
+    providerRequestExpiresAt: timestamp("provider_request_expires_at", {
+      withTimezone: true,
+    }),
     expectedArtifactId: uuid("expected_artifact_id").notNull(),
     expectedFileId: uuid("expected_file_id").notNull(),
     reservedBytes: bigint("reserved_bytes", { mode: "number" }).notNull(),
@@ -3023,13 +3767,21 @@ export const videoGenerationOperations = pgTable(
     terminalUpdateId: uuid("terminal_update_id"),
     reconcileRevision: bigint("reconcile_revision", { mode: "number" }).notNull().default(0),
     reconcileLeaseOwner: text("reconcile_lease_owner"),
-    reconcileLeaseExpiresAt: timestamp("reconcile_lease_expires_at", { withTimezone: true }),
+    reconcileLeaseExpiresAt: timestamp("reconcile_lease_expires_at", {
+      withTimezone: true,
+    }),
     nextReconcileAt: timestamp("next_reconcile_at", { withTimezone: true }),
-    providerRequestSentAt: timestamp("provider_request_sent_at", { withTimezone: true }),
+    providerRequestSentAt: timestamp("provider_request_sent_at", {
+      withTimezone: true,
+    }),
     providerStartedAt: timestamp("provider_started_at", { withTimezone: true }),
-    recoveryDeadlineAt: timestamp("recovery_deadline_at", { withTimezone: true }).notNull(),
+    recoveryDeadlineAt: timestamp("recovery_deadline_at", {
+      withTimezone: true,
+    }).notNull(),
     terminalAt: timestamp("terminal_at", { withTimezone: true }),
-    privateDataEraseAfter: timestamp("private_data_erase_after", { withTimezone: true }),
+    privateDataEraseAfter: timestamp("private_data_erase_after", {
+      withTimezone: true,
+    }),
     boundedPublicReason: text("bounded_public_reason"),
     lastError: text("last_error"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -3105,11 +3857,15 @@ export const videoGenerationOperations = pgTable(
               and ((${table.status} in ('provider_failed','cancelled_before_submit','outcome_unknown','retention_failed')
                     and ${table.creditState} = 'refunded')
                 or (${table.status} not in ('provider_failed','cancelled_before_submit','outcome_unknown','retention_failed')
-                    and ${table.creditState} = 'debited')))))`,
+                    and ${table.creditState} = 'debited'))))
+        or (${table.fundingSource} = 'supergrok_subscription'
+          and ${table.connectionId} is null
+          and ${table.pricedCostMicros} = 0
+          and ${table.creditState} = 'not_applicable'))`,
     ),
     fundingValuesValid: check(
       "video_generation_operations_funding_values_chk",
-      sql`${table.fundingSource} in ('opengeni_credits','workspace_gateway')
+      sql`${table.fundingSource} in ('opengeni_credits','workspace_gateway','supergrok_subscription')
         and ${table.pricedCostMicros} between 0 and 1000000000
         and ${table.creditState} in ('not_applicable','debited','refunded')`,
     ),
@@ -3181,7 +3937,9 @@ export const generatedVideoArtifacts = pgTable(
     operationId: uuid("operation_id")
       .notNull()
       .references(() => videoGenerationOperations.id, { onDelete: "restrict" }),
-    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid("session_id").references(() => sessions.id, {
+      onDelete: "set null",
+    }),
     turnId: uuid("turn_id"),
     attemptId: uuid("attempt_id"),
     modelId: text("model_id").notNull(),
@@ -3317,12 +4075,16 @@ export const retainedScreenshotArtifacts = pgTable(
     sha256: text("sha256").notNull(),
     width: integer("width").notNull(),
     height: integer("height").notNull(),
-    retentionExpiresAt: timestamp("retention_expires_at", { withTimezone: true }).notNull(),
+    retentionExpiresAt: timestamp("retention_expires_at", {
+      withTimezone: true,
+    }).notNull(),
     readyAt: timestamp("ready_at", { withTimezone: true }),
     cleanupReason: text("cleanup_reason"),
     lastError: text("last_error"),
     maintenanceClaimId: uuid("maintenance_claim_id"),
-    maintenanceClaimedAt: timestamp("maintenance_claimed_at", { withTimezone: true }),
+    maintenanceClaimedAt: timestamp("maintenance_claimed_at", {
+      withTimezone: true,
+    }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -3773,6 +4535,10 @@ export const sessionTurns = pgTable(
     // causal turn's value while retaining a service initiator. Null means the
     // turn has no human preference authority.
     initiatingHumanSubjectId: text("initiating_human_subject_id"),
+    // Exact goal authority frozen when the logical turn is accepted. The
+    // migration trigger fills this for old and rolling writers; claim only
+    // reconstructs legacy nulls from events as-of created_at.
+    goalSnapshot: jsonb("goal_snapshot").$type<SessionGoalSnapshot>(),
     // Immutable exact personal MCP authority for this logical turn. Recovery,
     // approval, retries, and Codemode reuse this row; no runtime may infer
     // broader authority from the session creator or mutable session state.
@@ -3780,6 +4546,10 @@ export const sessionTurns = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    xaiProviderAccountAuthoritySnapshot: jsonb("xai_provider_account_authority_snapshot")
+      .$type<XaiProviderAccountAuthoritySnapshotV1>()
+      .notNull()
+      .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     cancelledBy: text("cancelled_by"),
     cancelReason: text("cancel_reason"),
     // Atomic per-turn codemode call budget counter (migration 0043). Incremented
@@ -3890,6 +4660,16 @@ export const sessionTurnAttempts = pgTable(
     verifiedControlRevision: bigint("verified_control_revision", {
       mode: "number",
     }).notNull(),
+    // Immutable generic session-tenancy authority admitted with this exact
+    // attempt. A later visibility/ownership epoch change fences the attempt;
+    // these are snapshots, never live lookups or mutable metadata.
+    // Pre-0222 SQL writers may omit these columns; the migration-owned BEFORE
+    // INSERT trigger fills them from the exact session row. Current claim
+    // writers pass both explicitly, so no client-side default may bypass the
+    // trigger and manufacture stale authority.
+    authorityEpoch: integer("authority_epoch").notNull(),
+    authorityVisibility: text("authority_visibility").notNull(),
+    authorityOwnerOrganizationMembershipId: uuid("authority_owner_organization_membership_id"),
     // Immutable policy snapshot captured under the session lock at claim.
     mcpApprovalPolicies: jsonb("mcp_approval_policies")
       .$type<Record<string, SessionMcpApprovalPolicy>>()
@@ -3947,6 +4727,11 @@ export const sessionTurnAttempts = pgTable(
       table.startedAt.desc(),
       table.id.desc(),
     ),
+    authorityEpoch: index("session_turn_attempts_authority_epoch_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.authorityEpoch,
+    ),
     dispatch: uniqueIndex("session_turn_attempts_dispatch_uq").on(
       table.workspaceId,
       table.temporalWorkflowRunId,
@@ -3972,6 +4757,28 @@ export const sessionTurnAttempts = pgTable(
       sql`(${table.state} = 'closed' and ${table.outcome} is not null and ${table.closedAt} is not null)
         or (${table.state} <> 'closed' and ${table.outcome} is null and ${table.closedAt} is null)`,
     ),
+    authorityEpochValid: check(
+      "session_turn_attempts_authority_epoch_check",
+      sql`${table.authorityEpoch} is not null
+        and ${table.authorityVisibility} is not null
+        and ${table.authorityEpoch} > 0`,
+    ),
+    authorityVisibilityValid: check(
+      "session_turn_attempts_authority_visibility_check",
+      sql`${table.authorityEpoch} is not null
+        and ${table.authorityVisibility} is not null
+        and ${table.authorityVisibility} in ('user_private', 'workspace_shared')`,
+    ),
+    authorityOwnerShape: check(
+      "session_turn_attempts_authority_owner_shape_check",
+      sql`${table.authorityVisibility} <> 'user_private'
+        or ${table.authorityOwnerOrganizationMembershipId} is not null`,
+    ),
+    authorityOwner: foreignKey({
+      name: "session_turn_attempts_authority_owner_fk",
+      columns: [table.authorityOwnerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
   }),
 );
 
@@ -4085,7 +4892,9 @@ export const sessionAttemptCodemodeCalls = pgTable(
     errorMessage: text("error_message"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     claimedAt: timestamp("claimed_at", { withTimezone: true }),
-    executionStartedAt: timestamp("execution_started_at", { withTimezone: true }),
+    executionStartedAt: timestamp("execution_started_at", {
+      withTimezone: true,
+    }),
     claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
     completedAt: timestamp("completed_at", { withTimezone: true }),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -4258,8 +5067,12 @@ export const connectorActionRequests = pgTable(
     decisionBySubjectId: text("decision_by_subject_id"),
     decisionEventId: uuid("decision_event_id"),
     decidedAt: timestamp("decided_at", { withTimezone: true }),
-    executionStartedAt: timestamp("execution_started_at", { withTimezone: true }),
-    executionFinishedAt: timestamp("execution_finished_at", { withTimezone: true }),
+    executionStartedAt: timestamp("execution_started_at", {
+      withTimezone: true,
+    }),
+    executionFinishedAt: timestamp("execution_finished_at", {
+      withTimezone: true,
+    }),
     outcome: text("outcome"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -4642,6 +5455,10 @@ export const sessionSystemUpdates = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    xaiProviderAccountAuthoritySnapshot: jsonb("xai_provider_account_authority_snapshot")
+      .$type<XaiProviderAccountAuthoritySnapshotV1>()
+      .notNull()
+      .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     // pending is visible queue truth; delivered means its exact model-memory
     // batch was durably claimed. Terminal cancellation/supersession is explicit.
     state: text("state").notNull().default("pending"),
@@ -4729,6 +5546,10 @@ export const sessionSystemUpdateOutbox = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    xaiProviderAccountAuthoritySnapshot: jsonb("xai_provider_account_authority_snapshot")
+      .$type<XaiProviderAccountAuthoritySnapshotV1>()
+      .notNull()
+      .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     status: text("status").notNull().default("pending"),
     attempts: integer("attempts").notNull().default(0),
     updateId: uuid("update_id"),
@@ -4831,6 +5652,13 @@ export const sessionGoals = pgTable(
     pausedReason: text("paused_reason"), // agent | user_pause | api | no_progress | max_auto_continuations | limits
     createdBy: text("created_by").notNull().default("api"), // api | agent | scheduled_task
     version: integer("version").notNull().default(1), // bumped on every set/update; progress signal
+    // Semantic objective changes use a separate fence. `version` remains the
+    // established lifecycle/wake identity for continuation compatibility.
+    objectiveRevision: integer("objective_revision").notNull().default(1),
+    mutationPolicy: text("mutation_policy")
+      .$type<SessionGoalMutationPolicy>()
+      .notNull()
+      .default("preserve_intent"),
     autoContinuations: integer("auto_continuations").notNull().default(0),
     noProgressStreak: integer("no_progress_streak").notNull().default(0),
     maxAutoContinuations: integer("max_auto_continuations"), // per-goal override; a configured settings cap (if any) remains the hard ceiling
@@ -4842,10 +5670,14 @@ export const sessionGoals = pgTable(
     // update, timeline events, usage row, and workflow-wake outbox row.
     // Temporal signals and workflow history are replaceable nudges over these
     // monotonic revisions.
-    continuationWakeRevision: bigint("continuation_wake_revision", { mode: "number" })
+    continuationWakeRevision: bigint("continuation_wake_revision", {
+      mode: "number",
+    })
       .notNull()
       .default(0),
-    continuationObservedRevision: bigint("continuation_observed_revision", { mode: "number" })
+    continuationObservedRevision: bigint("continuation_observed_revision", {
+      mode: "number",
+    })
       .notNull()
       .default(0),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
@@ -4869,6 +5701,88 @@ export const sessionGoals = pgTable(
   }),
 );
 
+/**
+ * Immutable semantic goal history. A proposal is never model-visible until a
+ * later applied row references it; rejection is another immutable decision
+ * row rather than mutation of the original proposal.
+ */
+export const sessionGoalRevisions = pgTable(
+  "session_goal_revisions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    goalId: uuid("goal_id").notNull(),
+    disposition: text("disposition").$type<"applied" | "proposed" | "rejected">().notNull(),
+    changeKind: text("change_kind").$type<SessionGoalChangeKind>().notNull(),
+    baseObjectiveRevision: integer("base_objective_revision").notNull(),
+    resultObjectiveRevision: integer("result_objective_revision"),
+    text: text("text").notNull(),
+    successCriteria: text("success_criteria"),
+    mutationPolicy: text("mutation_policy").$type<SessionGoalMutationPolicy>().notNull(),
+    rationale: text("rationale").notNull(),
+    actor: text("actor").$type<"agent" | "api" | "scheduled_task">().notNull(),
+    actorTurnId: uuid("actor_turn_id"),
+    actorAttemptId: uuid("actor_attempt_id"),
+    proposalId: uuid("proposal_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "session_goal_revisions_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    workspaceSession: foreignKey({
+      name: "session_goal_revisions_workspace_session_fk",
+      columns: [table.workspaceId, table.sessionId],
+      foreignColumns: [sessions.workspaceId, sessions.id],
+    }).onDelete("cascade"),
+    actorTurn: foreignKey({
+      name: "session_goal_revisions_actor_turn_fk",
+      columns: [table.workspaceId, table.actorTurnId],
+      foreignColumns: [sessionTurns.workspaceId, sessionTurns.id],
+    }).onDelete("restrict"),
+    actorAttempt: foreignKey({
+      name: "session_goal_revisions_actor_attempt_fk",
+      columns: [table.workspaceId, table.actorAttemptId],
+      foreignColumns: [sessionTurnAttempts.workspaceId, sessionTurnAttempts.id],
+    }).onDelete("restrict"),
+    proposal: foreignKey({
+      name: "session_goal_revisions_proposal_fk",
+      columns: [table.workspaceId, table.proposalId],
+      foreignColumns: [table.workspaceId, table.id],
+    }).onDelete("restrict"),
+    appliedRevision: uniqueIndex("session_goal_revisions_applied_revision_uq")
+      .on(table.workspaceId, table.goalId, table.resultObjectiveRevision)
+      .where(sql`${table.disposition} = 'applied'`),
+    goalTimeline: index("session_goal_revisions_goal_timeline_idx").on(
+      table.workspaceId,
+      table.goalId,
+      table.createdAt,
+      table.id,
+    ),
+    dispositionValid: check(
+      "session_goal_revisions_disposition_chk",
+      sql`${table.disposition} in ('applied', 'proposed', 'rejected')`,
+    ),
+    changeKindValid: check(
+      "session_goal_revisions_change_kind_chk",
+      sql`${table.changeKind} in ('refinement', 'adaptation', 'replacement')`,
+    ),
+    policyValid: check(
+      "session_goal_revisions_policy_chk",
+      sql`${table.mutationPolicy} in ('review_changes', 'preserve_intent', 'autonomous_adaptation')`,
+    ),
+    revisionShape: check(
+      "session_goal_revisions_revision_shape_chk",
+      sql`(${table.disposition} = 'applied' and ${table.resultObjectiveRevision} = ${table.baseObjectiveRevision} + 1)
+        or (${table.disposition} in ('proposed', 'rejected') and ${table.resultObjectiveRevision} is null)`,
+    ),
+  }),
+);
+
 // credential allocator: one durable, coalescing capacity waiter per session. The row is both
 // the wait state and the commit->signal outbox: capacity mutations increment
 // wakeRevision in the SAME transaction as the mutation, while the session
@@ -4936,6 +5850,126 @@ export const codexCapacityWaiters = pgTable(
   }),
 );
 
+// Per-session pin and last-account state is kept outside the shared session row
+// so user-scoped account identifiers remain behind the same exact-subject RLS
+// policy as every other xAI persistence table.
+export const xaiSessionAccountPins = pgTable(
+  "xai_session_account_pins",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    sessionId: uuid("session_id").notNull(),
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    pinnedCredentialId: uuid("pinned_credential_id"),
+    pinSource: text("pin_source"),
+    lastCredentialId: uuid("last_credential_id"),
+    version: integer("version").notNull().default(1),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    // Migration 0231 adds NULLS NOT DISTINCT so workspace scope is also a
+    // singleton; Drizzle 0.45 cannot encode that PostgreSQL index modifier.
+    workspaceSessionPool: uniqueIndex("xai_session_account_pins_workspace_session_uq").on(
+      table.workspaceId,
+      table.sessionId,
+      table.authorityScope,
+      table.ownerOrganizationMembershipId,
+    ),
+    scopeValid: check(
+      "xai_session_account_pins_authority_scope_chk",
+      sql`(${table.authorityScope} = 'workspace' and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityScope} = 'user' and ${table.ownerOrganizationMembershipId} is not null)`,
+    ),
+    pinValid: check(
+      "xai_session_account_pins_pin_chk",
+      sql`(${table.pinnedCredentialId} is null and ${table.pinSource} is null)
+        or (${table.pinnedCredentialId} is not null and ${table.pinSource} in ('manual', 'policy'))`,
+    ),
+    versionValid: check("xai_session_account_pins_version_chk", sql`${table.version} > 0`),
+  }),
+);
+
+// Durable same-turn capacity wait. The blocked turn owns the immutable xAI
+// authority snapshot; this row carries only pool scope and wake/retry metadata.
+export const xaiCapacityWaiters = pgTable(
+  "xai_capacity_waiters",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    sessionId: uuid("session_id").notNull(),
+    goalId: uuid("goal_id"),
+    goalVersion: integer("goal_version"),
+    blockedTurnId: uuid("blocked_turn_id").notNull(),
+    blockedTurnGeneration: integer("blocked_turn_generation").notNull(),
+    workflowId: text("workflow_id").notNull(),
+    authorityScope: text("authority_scope").notNull(),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    status: text("status").notNull().default("waiting"),
+    generation: integer("generation").notNull().default(1),
+    earliestResetAt: timestamp("earliest_reset_at", { withTimezone: true }),
+    nextCheckAt: timestamp("next_check_at", { withTimezone: true }).notNull(),
+    wakeRevision: integer("wake_revision").notNull().default(1),
+    observedWakeRevision: integer("observed_wake_revision").notNull().default(0),
+    lastWakeReason: text("last_wake_reason").notNull().default("capacity_wait_armed"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    // Migration 0234 uses NULLS NOT DISTINCT so workspace scope is also a
+    // singleton; Drizzle 0.45 cannot encode that PostgreSQL index modifier.
+    workspaceSessionPool: uniqueIndex("xai_capacity_waiters_workspace_session_uq").on(
+      table.workspaceId,
+      table.sessionId,
+      table.authorityScope,
+      table.ownerOrganizationMembershipId,
+    ),
+    pending: index("xai_capacity_waiters_pending_idx").on(
+      table.workspaceId,
+      table.status,
+      table.nextCheckAt,
+    ),
+    wakeRepair: index("xai_capacity_waiters_wake_repair_idx").on(
+      table.status,
+      table.wakeRevision,
+      table.observedWakeRevision,
+    ),
+    scopeValid: check(
+      "xai_capacity_waiters_authority_scope_chk",
+      sql`(${table.authorityScope} = 'workspace' and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityScope} = 'user' and ${table.ownerOrganizationMembershipId} is not null)`,
+    ),
+    statusValid: check(
+      "xai_capacity_waiters_status_chk",
+      sql`${table.status} in ('waiting', 'resumed', 'superseded')`,
+    ),
+    countersValid: check(
+      "xai_capacity_waiters_counters_chk",
+      sql`${table.blockedTurnGeneration} >= 0
+        and ${table.generation} > 0
+        and ${table.wakeRevision} > 0
+        and ${table.observedWakeRevision} >= 0
+        and ${table.observedWakeRevision} <= ${table.wakeRevision}`,
+    ),
+    goalFenceValid: check(
+      "xai_capacity_waiters_goal_fence_chk",
+      sql`(${table.goalId} is null and ${table.goalVersion} is null)
+        or (${table.goalId} is not null and ${table.goalVersion} > 0)`,
+    ),
+  }),
+);
+
 export const sessionEvents = pgTable(
   "session_events",
   {
@@ -5225,6 +6259,8 @@ export const sessionPendingToolCalls = pgTable(
     modelToolOutputTruncationTokens: integer("model_tool_output_truncation_tokens"),
     resultItem: losslessJsonb("result_item").$type<Record<string, unknown>>(),
     resultItemCodecVersion: losslessCodecVersion("result_item_codec_version"),
+    eventOutput: losslessJsonb("event_output").$type<{ value: unknown }>(),
+    eventOutputCodecVersion: losslessCodecVersion("event_output_codec_version"),
     resultRecordedAt: timestamp("result_recorded_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -5459,6 +6495,11 @@ export const sandboxLeases = pgTable(
     // data_plane_url.
     terminalDataPlaneUrl: text("terminal_data_plane_url"),
 
+    // Cached browserd HTTP/WebSocket tunnel (7682). Controller requests use
+    // this epoch-fenced endpoint directly after the first provider resolution;
+    // provider-handle coordination remains limited to lifecycle/provisioning.
+    controllerDataPlaneUrl: text("controller_data_plane_url"),
+
     // integer (NOT bigint): the lease-epoch spike proved a raw int8 read returns a
     // JS STRING from postgres-js, breaking the strict epoch-fence comparison (it
     // was always-true → every turn fenced); int4 returns a JS number, the fix.
@@ -5718,7 +6759,9 @@ export const sandboxWorkspaceMutationAdmissions = pgTable(
       .references(() => sandboxLeases.id, { onDelete: "cascade" }),
     sandboxGroupId: uuid("sandbox_group_id").notNull(),
     sessionId: uuid("session_id").notNull(),
-    actorKind: text("actor_kind", { enum: sandboxWorkspaceMutationActorKindValues }).notNull(),
+    actorKind: text("actor_kind", {
+      enum: sandboxWorkspaceMutationActorKindValues,
+    }).notNull(),
     actorId: uuid("actor_id").notNull(),
     // Exact turn authority is present only for actor_kind='turn'. Direct HTTP
     // requests and retained processes never invent a turn or quiescence owner.
@@ -5865,7 +6908,9 @@ export const sandboxRetainedProcesses = pgTable(
     sandboxGroupId: uuid("sandbox_group_id").notNull(),
     parentAdmissionId: uuid("parent_admission_id").notNull(),
     holderId: text("holder_id").notNull(),
-    ownerActorKind: text("owner_actor_kind", { enum: ["turn", "direct"] }).notNull(),
+    ownerActorKind: text("owner_actor_kind", {
+      enum: ["turn", "direct"],
+    }).notNull(),
     ownerActorId: uuid("owner_actor_id").notNull(),
     ownerTurnId: uuid("owner_turn_id"),
     ownerAttemptId: uuid("owner_attempt_id"),
@@ -5893,13 +6938,19 @@ export const sandboxRetainedProcesses = pgTable(
     // never exit/loss proof.
     reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
     reconcileClaimId: uuid("reconcile_claim_id"),
-    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", {
+      withTimezone: true,
+    }),
     reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
     lastReconcileOutcome: text("last_reconcile_outcome"),
-    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofOutcome: text("reconcile_proof_outcome", {
+      enum: ["exited", "lost"],
+    }),
     reconcileProofExitCode: integer("reconcile_proof_exit_code"),
     reconcileProofReason: text("reconcile_proof_reason"),
-    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true }),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", {
+      withTimezone: true,
+    }),
   },
   (table) => ({
     workspaceAccount: foreignKey({
@@ -6373,7 +7424,9 @@ export const machineRemovalOperations = pgTable(
       .references(() => enrollments.id, { onDelete: "restrict" }),
     operationKey: text("operation_key").notNull(),
     requestFingerprint: text("request_fingerprint").notNull(),
-    outcome: text("outcome", { enum: machineRemovalOperationOutcomeValues }).notNull(),
+    outcome: text("outcome", {
+      enum: machineRemovalOperationOutcomeValues,
+    }).notNull(),
     result: jsonb("result").$type<Record<string, unknown>>().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -6639,6 +7692,10 @@ export const scheduledTasks = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    xaiProviderAccountAuthoritySnapshot: jsonb("xai_provider_account_authority_snapshot")
+      .$type<XaiProviderAccountAuthoritySnapshotV1>()
+      .notNull()
+      .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     reusableSessionId: uuid("reusable_session_id").references(() => sessions.id, {
       onDelete: "set null",
     }),
@@ -6776,8 +7833,12 @@ export const githubInstallations = pgTable(
     githubActorId: bigint("github_actor_id", { mode: "number" }),
     githubActorLogin: text("github_actor_login"),
     authorityKind: text("authority_kind"),
-    authorityCheckedAt: timestamp("authority_checked_at", { withTimezone: true }),
-    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }),
+    authorityCheckedAt: timestamp("authority_checked_at", {
+      withTimezone: true,
+    }),
+    authorityExpiresAt: timestamp("authority_expires_at", {
+      withTimezone: true,
+    }),
     authorityNonce: text("authority_nonce"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -6995,7 +8056,9 @@ export const modelCallFacts = pgTable(
     reasoningTokens: bigint("reasoning_tokens", { mode: "number" }),
     totalTokens: bigint("total_tokens", { mode: "number" }),
     pricedCostMicros: bigint("priced_cost_micros", { mode: "number" }).notNull().default(0),
-    estimatedProviderCostMicros: bigint("estimated_provider_cost_micros", { mode: "number" }),
+    estimatedProviderCostMicros: bigint("estimated_provider_cost_micros", {
+      mode: "number",
+    }),
     pricingSource: text("pricing_source"),
     occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
     recordedAt: timestamp("recorded_at", { withTimezone: true }).notNull().defaultNow(),
@@ -7121,7 +8184,9 @@ export const hostExportOutbox = pgTable(
     payloadCodecVersion: losslessCodecVersion("payload_codec_version"),
     envelopeBytes: integer("envelope_bytes").notNull(),
     occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
-    sourceRecordedAt: timestamp("source_recorded_at", { withTimezone: true }).notNull(),
+    sourceRecordedAt: timestamp("source_recorded_at", {
+      withTimezone: true,
+    }).notNull(),
     enqueuedAt: timestamp("enqueued_at", { withTimezone: true }).notNull(),
   },
   (table) => ({
@@ -7505,6 +8570,7 @@ export const capabilityCatalogItems = pgTable(
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    kindAuthority: check("capability_catalog_items_kind_authority_chk", sql`${table.kind} = 'mcp'`),
     workspaceCapability: uniqueIndex("capability_catalog_items_workspace_capability_idx").on(
       table.workspaceId,
       table.id,
@@ -7551,6 +8617,7 @@ export const capabilityInstallations = pgTable(
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    kindAuthority: check("capability_installations_kind_authority_chk", sql`${table.kind} = 'mcp'`),
     workspaceCapability: uniqueIndex("capability_installations_workspace_capability_idx").on(
       table.workspaceId,
       table.capabilityId,
@@ -7563,17 +8630,21 @@ export const capabilityInstallations = pgTable(
   }),
 );
 
-// --- Capabilities platform v2 ------------------------------------------------
-// Expand-only normalized state. The v1 catalog/installations remain intact
-// while adapters shadow-read and migrate exact owners into this model.
+// --- Capabilities platform ---------------------------------------------------
+// Authoritative Plugin, immutable Version, Facet, installation, and ownership
+// state. The generic catalog/installations ledger is reserved for MCP.
 
 export const capabilityPlugins = pgTable(
   "capability_plugins",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     pluginKey: text("plugin_key").notNull(),
-    accountId: uuid("account_id").references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    accountId: uuid("account_id").references(() => managedAccounts.id, {
+      onDelete: "cascade",
+    }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade",
+    }),
     name: text("name").notNull(),
     description: text("description"),
     category: text("category").notNull(),
@@ -7785,7 +8856,9 @@ export const capabilityFacetInstallations = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     pluginInstallationId: uuid("plugin_installation_id")
       .notNull()
-      .references(() => capabilityPluginInstallations.id, { onDelete: "cascade" }),
+      .references(() => capabilityPluginInstallations.id, {
+        onDelete: "cascade",
+      }),
     facetId: uuid("facet_id")
       .notNull()
       .references(() => capabilityFacets.id, { onDelete: "restrict" }),
@@ -7823,7 +8896,9 @@ export const capabilityComponentOwners = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     facetInstallationId: uuid("facet_installation_id")
       .notNull()
-      .references(() => capabilityFacetInstallations.id, { onDelete: "cascade" }),
+      .references(() => capabilityFacetInstallations.id, {
+        onDelete: "cascade",
+      }),
     ownerKind: text("owner_kind").notNull(),
     ownerId: text("owner_id").notNull(),
     removable: boolean("removable").notNull().default(true),
@@ -7892,33 +8967,35 @@ export const integrationTools = pgTable(
   }),
 );
 
-export const integrationFeatureFacets = pgTable(
-  "integration_feature_facets",
+export const integrationFacetDefinitions = pgTable(
+  "integration_facet_definitions",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     integrationFacetId: uuid("integration_facet_id")
       .notNull()
-      .references(() => capabilityIntegrationFacets.facetId, { onDelete: "cascade" }),
-    featureKey: text("feature_key").notNull(),
+      .references(() => capabilityIntegrationFacets.facetId, {
+        onDelete: "cascade",
+      }),
+    facetKey: text("facet_key").notNull(),
     kind: text("kind").notNull(),
     configSchema: jsonb("config_schema").$type<Record<string, unknown>>().notNull().default({}),
     capabilities: jsonb("capabilities").$type<Record<string, unknown>>().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    integrationFeature: uniqueIndex("integration_feature_facets_integration_feature_idx").on(
+    integrationFacet: uniqueIndex("integration_facet_definitions_integration_facet_idx").on(
       table.integrationFacetId,
-      table.featureKey,
+      table.facetKey,
     ),
-    integrationKind: index("integration_feature_facets_integration_kind_idx").on(
+    integrationKind: index("integration_facet_definitions_integration_kind_idx").on(
       table.integrationFacetId,
       table.kind,
     ),
   }),
 );
 
-export const integrationFeatureBindings = pgTable(
-  "integration_feature_bindings",
+export const integrationFacetBindings = pgTable(
+  "integration_facet_bindings",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
@@ -7927,12 +9004,16 @@ export const integrationFeatureBindings = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    featureFacetId: uuid("feature_facet_id")
+    facetDefinitionId: uuid("facet_definition_id")
       .notNull()
-      .references(() => integrationFeatureFacets.id, { onDelete: "restrict" }),
+      .references(() => integrationFacetDefinitions.id, {
+        onDelete: "restrict",
+      }),
     integrationFacetInstallationId: uuid("integration_facet_installation_id")
       .notNull()
-      .references(() => capabilityFacetInstallations.id, { onDelete: "cascade" }),
+      .references(() => capabilityFacetInstallations.id, {
+        onDelete: "cascade",
+      }),
     bindingKey: text("binding_key").notNull(),
     displayName: text("display_name").notNull(),
     runtimeKey: text("runtime_key"),
@@ -7950,26 +9031,24 @@ export const integrationFeatureBindings = pgTable(
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    installationFeatureKey: uniqueIndex(
-      "integration_feature_bindings_installation_feature_key_idx",
-    ).on(
+    installationFacetKey: uniqueIndex("integration_facet_bindings_installation_facet_key_idx").on(
       table.workspaceId,
       table.integrationFacetInstallationId,
-      table.featureFacetId,
+      table.facetDefinitionId,
       table.bindingKey,
     ),
-    workspaceRuntime: uniqueIndex("integration_feature_bindings_workspace_runtime_idx")
+    workspaceRuntime: uniqueIndex("integration_facet_bindings_workspace_runtime_idx")
       .on(table.workspaceId, table.runtimeKey)
       .where(sql`${table.runtimeKey} is not null`),
-    workspaceStatus: index("integration_feature_bindings_workspace_status_idx").on(
+    workspaceStatus: index("integration_facet_bindings_workspace_status_idx").on(
       table.workspaceId,
       table.status,
     ),
   }),
 );
 
-export const integrationFeatureBindingOwners = pgTable(
-  "integration_feature_binding_owners",
+export const integrationFacetBindingOwners = pgTable(
+  "integration_facet_binding_owners",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
@@ -7980,19 +9059,19 @@ export const integrationFeatureBindingOwners = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     bindingId: uuid("binding_id")
       .notNull()
-      .references(() => integrationFeatureBindings.id, { onDelete: "cascade" }),
+      .references(() => integrationFacetBindings.id, { onDelete: "cascade" }),
     ownerKind: text("owner_kind").notNull(),
     ownerId: text("owner_id").notNull(),
     removable: boolean("removable").notNull().default(true),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    uniqueOwner: uniqueIndex("integration_feature_binding_owners_unique_idx").on(
+    uniqueOwner: uniqueIndex("integration_facet_binding_owners_unique_idx").on(
       table.bindingId,
       table.ownerKind,
       table.ownerId,
     ),
-    workspaceOwner: index("integration_feature_binding_owners_workspace_owner_idx").on(
+    workspaceOwner: index("integration_facet_binding_owners_workspace_owner_idx").on(
       table.workspaceId,
       table.ownerKind,
       table.ownerId,
@@ -8144,12 +9223,44 @@ export const rigs = pgTable(
     description: text("description"),
     // Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
     createdBy: text("created_by"),
+    // Inert migration-0230 identity foundation. Existing DAO/API/runtime paths
+    // omit these fields and keep their historical workspace authority.
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
     workspaceName: uniqueIndex("rigs_workspace_name_idx").on(table.workspaceId, table.name),
     workspaceCreated: index("rigs_workspace_created_idx").on(table.workspaceId, table.createdAt),
+    authorityShape: check(
+      "rigs_authority_shape_check",
+      sql`(
+          ${table.authorityScope} = 'workspace'
+          and ${table.authorityId} is null
+          and ${table.ownerOrganizationMembershipId} is null
+        ) or (
+          ${table.authorityScope} = 'user'
+          and ${table.authorityId} is not null
+          and ${table.ownerOrganizationMembershipId} is not null
+        )`,
+    ),
+    authorityScopeValid: check(
+      "rigs_authority_scope_check",
+      sql`${table.authorityScope} in ('workspace', 'user')`,
+    ),
+    authority: foreignKey({
+      name: "rigs_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    // Migration 0230 owns the origin-workspace FK's column-subset SET NULL.
   }),
 );
 
@@ -8251,9 +9362,11 @@ export const rigChanges = pgTable(
 export * from "./workspace-instruction-policies-schema";
 export * from "./company-profile-schema";
 export * from "./workspace-learning-policy-schema";
+export * from "./slack-task-policy-schema";
 export * from "./preference-registry-schema";
 export * from "./memory-governance-schema";
 export * from "./scoped-knowledge-schema";
+export * from "./task-notes-schema";
 export * from "./knowledge-source-sync-schema";
 export * from "./transcription-recordings-schema";
 export * from "./interaction-schema";