@opengeni/db 0.6.1 → 0.7.1

package/drizzle/0051_codex_pin_source.sql

@@ -0,0 +1,48 @@
+-- 0051_codex_pin_source.sql
+-- Sharded codex rotation (AM-2): a SOURCE discriminator for the per-session codex pin.
+-- `codex_pin_source` is 'manual' (the user's in-session account switcher — SACRED, no
+-- policy path ever moves it) or 'policy' (the sharded strategy's deterministic home
+-- assignment — MAY be re-sharded when its account caps). NULL means no pin. Plaintext
+-- metadata, NEVER a token. Additive only; RLS is row-level so the existing sessions
+-- workspace_isolation policy already covers the column — NO policy change. Runs under the
+-- runner's advisory lock (no app traffic sees the ALTER/backfill window).
+
+ALTER TABLE "sessions" ADD COLUMN IF NOT EXISTS "codex_pin_source" text;
+
+-- Backfill: every PRE-EXISTING pin is a MANUAL pin. INVARIANT — before this migration the
+-- ONLY writer of sessions.codex_pinned_credential_id was setSessionCodexPin via the manual
+-- in-session account-switcher API route (no rotation/policy path wrote a pin). So a
+-- currently-pinned session is, by construction, a user's manual pin and must be stamped
+-- 'manual' — otherwise a NULL source would strip it of its sacredness the moment the
+-- sharded strategy is enabled (a policy path could re-shard the user's chosen account).
+-- Migrations run as the table owner; FORCE RLS would subject this UPDATE to the
+-- workspace-scoped policy (matching zero rows, no GUCs set), so drop FORCE only for the
+-- owner around the backfill (precedent 0009/0028) — the app role stays policy-bound and
+-- FORCE is restored in the same implicit transaction.
+ALTER TABLE "sessions" NO FORCE ROW LEVEL SECURITY;
+UPDATE "sessions"
+  SET "codex_pin_source" = 'manual'
+  WHERE "codex_pinned_credential_id" IS NOT NULL AND "codex_pin_source" IS NULL;
+ALTER TABLE "sessions" FORCE ROW LEVEL SECURITY;
+
+-- Constrain to the two known sources (or NULL). IF NOT EXISTS guard so a re-run is a no-op.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'sessions_codex_pin_source_check') THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_codex_pin_source_check"
+      CHECK ("codex_pin_source" IS NULL OR "codex_pin_source" IN ('manual', 'policy'));
+  END IF;
+END $$;
+
+-- Re-grant (schema-agnostic, matching 0049/0050) so opengeni_app keeps DML on the altered
+-- table under a dedicated (non-public) schema too.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END $$;

package/drizzle/0052_file_upload_cleanup.sql

@@ -0,0 +1,91 @@
+-- Reclaim direct-upload objects whose signed PUT completed but whose client
+-- disappeared before finalize. The global worker cannot enumerate FORCE-RLS
+-- workspaces directly, so this tightly-scoped SECURITY DEFINER function is the
+-- sanctioned cross-workspace claim seam. It returns only storage routing ids;
+-- no user content or signed URL is exposed.
+--
+-- Claims are leased, not terminal: a provider delete failure or worker crash
+-- leaves cleanup_pending rows reclaimable after p_claim_timeout_ms. The caller
+-- settles a successful idempotent delete through the ordinary workspace-RLS DB
+-- helper. Pending rows are not eligible until their signed URL has expired plus
+-- p_grace_ms, so cleanup never races a live draft/upload.
+
+CREATE INDEX IF NOT EXISTS "file_uploads_pending_expiry_cleanup_idx"
+  ON "file_uploads" ("expires_at", "id")
+  WHERE "status" = 'pending';
+
+CREATE INDEX IF NOT EXISTS "file_uploads_claim_recovery_idx"
+  ON "file_uploads" ("updated_at", "id")
+  WHERE "status" = 'cleanup_pending';
+
+CREATE OR REPLACE FUNCTION opengeni_private.claim_expired_file_upload_cleanup(
+  p_grace_ms bigint,
+  p_claim_timeout_ms bigint,
+  p_limit integer
+)
+RETURNS TABLE (
+  upload_id uuid,
+  account_id uuid,
+  workspace_id uuid,
+  file_id uuid,
+  object_key text
+)
+LANGUAGE sql
+SECURITY DEFINER
+-- EMBED-SAFE: the data tables live in the caller-selected public or dedicated
+-- schema. Match the repository's existing global-reaper convention by
+-- inheriting that schema-aware search_path; opengeni_private is absolute.
+AS $$
+  WITH candidates AS (
+    SELECT U.id
+    FROM file_uploads U
+    WHERE
+      (
+        U.status = 'pending'
+        AND U.expires_at <= clock_timestamp() - (
+          greatest(p_grace_ms, 0)::double precision * interval '1 millisecond'
+        )
+      )
+      OR
+      (
+        U.status = 'cleanup_pending'
+        AND U.updated_at <= clock_timestamp() - (
+          greatest(p_claim_timeout_ms, 0)::double precision * interval '1 millisecond'
+        )
+      )
+    ORDER BY U.expires_at, U.id
+    -- Defense in depth: the worker asks for 100, but the privileged function
+    -- itself stays bounded even if an application caller passes a huge limit.
+    LIMIT least(greatest(p_limit, 0), 1000)
+    FOR UPDATE SKIP LOCKED
+  ), claimed AS (
+    UPDATE file_uploads U
+    SET status = 'cleanup_pending', updated_at = clock_timestamp()
+    FROM candidates C
+    WHERE U.id = C.id
+    RETURNING U.id, U.account_id, U.workspace_id, U.file_id
+  ), failed_files AS (
+    UPDATE files F
+    SET status = 'failed', updated_at = clock_timestamp()
+    FROM claimed C
+    WHERE F.id = C.file_id AND F.workspace_id = C.workspace_id
+    RETURNING F.id, F.object_key
+  )
+  SELECT C.id, C.account_id, C.workspace_id, C.file_id, F.object_key
+  FROM claimed C
+  JOIN failed_files F ON F.id = C.file_id;
+$$;
+
+-- PostgreSQL grants new functions to PUBLIC by default. This function bypasses
+-- workspace RLS, so only the migration owner and the explicit application role
+-- may execute it.
+REVOKE ALL ON FUNCTION opengeni_private.claim_expired_file_upload_cleanup(bigint, bigint, integer)
+  FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_expired_file_upload_cleanup(bigint, bigint, integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0053_codex_credential_leases.sql

@@ -0,0 +1,230 @@
+-- 0053_codex_credential_leases.sql
+-- OPE-21: fair, atomic Codex subscription selection across worker replicas.
+--
+-- Every field in this migration is workspace-local. In particular, the same
+-- external ChatGPT subscription connected in two workspaces is intentionally
+-- usable concurrently: no provider identity hash, lease, cooldown, usage row, or
+-- cursor crosses the workspace boundary.
+
+-- Server-held fairness metadata. Provider usage headers remain useful capacity
+-- hints, but are never the allocator's only state: live DB leases are ranked
+-- first and this cursor breaks equal-load/equal-capacity ties.
+ALTER TABLE "codex_subscription_credentials"
+  ADD COLUMN IF NOT EXISTS "allocator_enabled" boolean NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS "selection_count" integer NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS "last_selected_at" timestamptz;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_subscription_credentials_workspace_id_idx"
+  ON "codex_subscription_credentials" ("workspace_id", "id");
+
+-- Never flip the legacy bit's default. Old workers only understand
+-- rotation_enabled; keeping it false makes schema-first rollout and binary
+-- rollback safe. New compatible code may explicitly set the separate allocator
+-- bit only after every replica understands leases.
+ALTER TABLE "codex_rotation_settings"
+  ALTER COLUMN "rotation_enabled" SET DEFAULT false,
+  ADD COLUMN IF NOT EXISTS "lease_rotation_enabled" boolean NOT NULL DEFAULT false;
+
+-- Composite target for the lease turn FK. The id is already globally unique,
+-- but including workspace_id makes tenant integrity independently enforceable.
+CREATE UNIQUE INDEX IF NOT EXISTS "session_turns_workspace_id_idx"
+  ON "session_turns" ("workspace_id", "id");
+
+CREATE TABLE IF NOT EXISTS "codex_credential_leases" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "credential_id" uuid NOT NULL,
+  "turn_id" uuid NOT NULL,
+  "holder_id" text NOT NULL,
+  "generation" integer NOT NULL DEFAULT 1,
+  "leased_until" timestamptz NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "codex_credential_leases_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  CONSTRAINT "codex_credential_leases_workspace_credential_fk"
+    FOREIGN KEY ("workspace_id", "credential_id")
+    REFERENCES "codex_subscription_credentials"("workspace_id", "id")
+    ON DELETE CASCADE,
+  CONSTRAINT "codex_credential_leases_workspace_turn_fk"
+    FOREIGN KEY ("workspace_id", "turn_id")
+    REFERENCES "session_turns"("workspace_id", "id")
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_credential_leases_workspace_turn_idx"
+  ON "codex_credential_leases" ("workspace_id", "turn_id");
+CREATE INDEX IF NOT EXISTS "codex_credential_leases_active_credential_idx"
+  ON "codex_credential_leases" ("workspace_id", "credential_id", "leased_until");
+CREATE INDEX IF NOT EXISTS "codex_credential_leases_expiry_idx"
+  ON "codex_credential_leases" ("leased_until");
+
+ALTER TABLE "codex_credential_leases" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_credential_leases" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'codex_credential_leases'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "codex_credential_leases";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "codex_credential_leases"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- One durable capacity wait per session. This row is also the coalescing
+-- commit->signal outbox: an eligibility-affecting mutation increments
+-- wake_revision in the same transaction; the session workflow advances
+-- observed_wake_revision only after allocator re-evaluation. A lost/duplicate
+-- Temporal signal therefore cannot lose or duplicate the continuation.
+CREATE UNIQUE INDEX IF NOT EXISTS "session_goals_workspace_id_idx"
+  ON "session_goals" ("workspace_id", "id");
+CREATE UNIQUE INDEX IF NOT EXISTS "sessions_workspace_id_idx"
+  ON "sessions" ("workspace_id", "id");
+
+CREATE TABLE IF NOT EXISTS "codex_capacity_waiters" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "session_id" uuid NOT NULL,
+  "goal_id" uuid NOT NULL,
+  "blocked_turn_id" uuid NOT NULL,
+  "workflow_id" text NOT NULL,
+  "generation" integer NOT NULL DEFAULT 1,
+  "status" text NOT NULL DEFAULT 'waiting',
+  "goal_version" integer NOT NULL,
+  "control_generation" integer NOT NULL DEFAULT 0,
+  "policy_hash" text,
+  "earliest_reset_at" timestamptz,
+  "next_check_at" timestamptz NOT NULL,
+  "reset_kind" text NOT NULL,
+  "refresh_attempt" integer NOT NULL DEFAULT 0,
+  "wake_revision" integer NOT NULL DEFAULT 1,
+  "observed_wake_revision" integer NOT NULL DEFAULT 0,
+  "last_wake_reason" text NOT NULL DEFAULT 'capacity_wait_armed',
+  "resumed_turn_id" uuid,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "codex_capacity_waiters_status_check"
+    CHECK (status IN ('waiting', 'resumed', 'superseded')),
+  CONSTRAINT "codex_capacity_waiters_reset_kind_check"
+    CHECK (reset_kind IN ('authoritative', 'bounded_refresh')),
+  CONSTRAINT "codex_capacity_waiters_generation_check"
+    CHECK (generation > 0 AND goal_version > 0 AND control_generation >= 0),
+  CONSTRAINT "codex_capacity_waiters_revision_check"
+    CHECK (wake_revision > 0 AND observed_wake_revision >= 0
+      AND observed_wake_revision <= wake_revision),
+  CONSTRAINT "codex_capacity_waiters_refresh_attempt_check"
+    CHECK (refresh_attempt >= 0),
+  CONSTRAINT "codex_capacity_waiters_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "codex_capacity_waiters_workspace_session_fk"
+    FOREIGN KEY ("workspace_id", "session_id")
+    REFERENCES "sessions"("workspace_id", "id") ON DELETE CASCADE,
+  CONSTRAINT "codex_capacity_waiters_workspace_goal_fk"
+    FOREIGN KEY ("workspace_id", "goal_id")
+    REFERENCES "session_goals"("workspace_id", "id") ON DELETE CASCADE,
+  CONSTRAINT "codex_capacity_waiters_workspace_blocked_turn_fk"
+    FOREIGN KEY ("workspace_id", "blocked_turn_id")
+    REFERENCES "session_turns"("workspace_id", "id") ON DELETE CASCADE,
+  CONSTRAINT "codex_capacity_waiters_workspace_resumed_turn_fk"
+    FOREIGN KEY ("workspace_id", "resumed_turn_id")
+    REFERENCES "session_turns"("workspace_id", "id") ON DELETE SET NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_capacity_waiters_workspace_session_idx"
+  ON "codex_capacity_waiters" ("workspace_id", "session_id");
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_capacity_waiters_workspace_id_idx"
+  ON "codex_capacity_waiters" ("workspace_id", "id");
+CREATE INDEX IF NOT EXISTS "codex_capacity_waiters_pending_idx"
+  ON "codex_capacity_waiters" ("workspace_id", "status", "next_check_at");
+CREATE INDEX IF NOT EXISTS "codex_capacity_waiters_wake_repair_idx"
+  ON "codex_capacity_waiters" ("status", "wake_revision", "observed_wake_revision");
+
+ALTER TABLE "codex_capacity_waiters" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_capacity_waiters" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'codex_capacity_waiters'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "codex_capacity_waiters";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "codex_capacity_waiters"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Defense in depth for legacy id-only pin/last/active FKs. Normal API/worker
+-- accessors already validate workspace ownership; these triggers reject a
+-- malformed internal/maintenance write too.
+CREATE OR REPLACE FUNCTION opengeni_private.enforce_codex_credential_workspace()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  referenced_workspace uuid;
+  candidate uuid;
+BEGIN
+  IF TG_TABLE_NAME = 'codex_rotation_settings' THEN
+    candidate := NEW.active_credential_id;
+  ELSIF TG_ARGV[0] = 'pinned' THEN
+    candidate := NEW.codex_pinned_credential_id;
+  ELSE
+    candidate := NEW.codex_last_credential_id;
+  END IF;
+  IF candidate IS NULL THEN
+    RETURN NEW;
+  END IF;
+  EXECUTE format(
+    'SELECT workspace_id FROM %I.codex_subscription_credentials WHERE id = $1',
+    TG_TABLE_SCHEMA
+  ) INTO referenced_workspace USING candidate;
+  IF referenced_workspace IS DISTINCT FROM NEW.workspace_id THEN
+    RAISE EXCEPTION 'Codex credential reference must remain in the row workspace'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS codex_rotation_settings_workspace_guard ON "codex_rotation_settings";
+CREATE TRIGGER codex_rotation_settings_workspace_guard
+BEFORE INSERT OR UPDATE OF active_credential_id, workspace_id ON "codex_rotation_settings"
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.enforce_codex_credential_workspace();
+DROP TRIGGER IF EXISTS sessions_codex_pinned_workspace_guard ON "sessions";
+CREATE TRIGGER sessions_codex_pinned_workspace_guard
+BEFORE INSERT OR UPDATE OF codex_pinned_credential_id, workspace_id ON "sessions"
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.enforce_codex_credential_workspace('pinned');
+DROP TRIGGER IF EXISTS sessions_codex_last_workspace_guard ON "sessions";
+CREATE TRIGGER sessions_codex_last_workspace_guard
+BEFORE INSERT OR UPDATE OF codex_last_credential_id, workspace_id ON "sessions"
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.enforce_codex_credential_workspace('last');
+
+DO $$
+DECLARE
+  target_schema text := current_schema();
+  app_role text := 'opengeni_app';
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = app_role) THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I',
+      target_schema,
+      app_role
+    );
+  END IF;
+END $$;

package/drizzle/0054_session_pins.sql

@@ -0,0 +1,85 @@
+-- Personal, server-authoritative session pins. A pin belongs to the authenticated
+-- member (`subject_id`), never to the session itself: shared workspace members
+-- independently organize the same durable session rows. Deleting a session or
+-- workspace cleans pins through FKs; no session activity/history field changes.
+
+-- Bound the brief catalog/table locks needed for the additive table and foreign keys
+-- so production migration contention fails closed and retries rather than blocking
+-- API writes indefinitely. The composite sessions parent index is owned by the
+-- preceding 0053 migration on current main.
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE TABLE IF NOT EXISTS "session_pins" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "subject_id" text NOT NULL,
+  "session_id" uuid NOT NULL REFERENCES "sessions"("id") ON DELETE CASCADE,
+  "pinned" boolean NOT NULL DEFAULT true,
+  "pinned_at" timestamptz DEFAULT now(),
+  "version" integer NOT NULL DEFAULT 1,
+  CONSTRAINT "session_pins_subject_nonempty" CHECK (length(btrim("subject_id")) > 0),
+  CONSTRAINT "session_pins_version_positive" CHECK ("version" >= 1),
+  CONSTRAINT "session_pins_state_consistent" CHECK (
+    ("pinned" AND "pinned_at" IS NOT NULL)
+    OR (NOT "pinned" AND "pinned_at" IS NULL)
+  ),
+  CONSTRAINT "session_pins_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  CONSTRAINT "session_pins_workspace_session_fk"
+    FOREIGN KEY ("workspace_id", "session_id")
+    REFERENCES "sessions"("workspace_id", "id")
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "session_pins_subject_workspace_session_idx"
+  ON "session_pins" ("subject_id", "workspace_id", "session_id");
+CREATE INDEX IF NOT EXISTS "session_pins_workspace_subject_pinned_idx"
+  ON "session_pins" ("workspace_id", "subject_id", "pinned", "pinned_at" DESC, "session_id" DESC);
+
+ALTER TABLE "session_pins" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_pins" FORCE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION opengeni_private.current_subject_id()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT nullif(current_setting('opengeni.subject_id', true), '');
+$$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema() AND tablename = 'session_pins' AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "session_pins";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "session_pins"
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  );
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END $$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0055_session_list_snapshots.sql

@@ -0,0 +1,73 @@
+-- Short-lived server-owned activity-order snapshots for stable session cursors.
+-- The snapshot is subject-scoped as well as workspace-scoped: one member's
+-- continuation chain must never disclose or affect another member's view.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE TABLE IF NOT EXISTS "session_list_snapshots" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "subject_id" text NOT NULL,
+  "parent_session_filter" text NOT NULL DEFAULT 'all',
+  "search" text,
+  "ordinary_session_ids" uuid[] NOT NULL DEFAULT '{}'::uuid[],
+  "expires_at" timestamptz NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_list_snapshots_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  CONSTRAINT "session_list_snapshots_subject_nonempty"
+    CHECK (length(btrim("subject_id")) > 0),
+  CONSTRAINT "session_list_snapshots_parent_filter_valid"
+    CHECK (
+      "parent_session_filter" = 'all'
+      OR "parent_session_filter" = 'null'
+      OR "parent_session_filter" ~ '^[0-9a-fA-F-]{36}$'
+    ),
+  CONSTRAINT "session_list_snapshots_search_length"
+    CHECK ("search" IS NULL OR length("search") <= 200)
+);
+
+CREATE INDEX IF NOT EXISTS "session_list_snapshots_workspace_expiry_idx"
+  ON "session_list_snapshots" ("workspace_id", "subject_id", "expires_at");
+
+ALTER TABLE "session_list_snapshots" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_list_snapshots" FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'session_list_snapshots'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "session_list_snapshots";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "session_list_snapshots"
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND subject_id = opengeni_private.current_subject_id()
+  );
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END $$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0056_workspace_model_policies.sql

@@ -0,0 +1,48 @@
+-- Per-workspace model/provider availability policy: the HARD blocker deciding
+-- which providers/models may serve a turn in a workspace at all. NULL columns =
+-- unrestricted (exactly today's behavior; no row is ever required). A non-null
+-- allowed_providers is a strict allowlist over resolved provider identities
+-- (the built-in OpenAI/Azure client — including the legacy null-resolution
+-- fallback — maps to one well-known id); allowed_models is an additional exact
+-- model-id allowlist. Enforced at the API model choke points (422) and
+-- authoritatively in the worker after turn model resolution, so a
+-- codex-subscription workspace can be fail-closed to codex: a blocked turn
+-- waits or fails loud, it never falls through to the paid built-in provider.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE TABLE IF NOT EXISTS "workspace_model_policies" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "allowed_providers" text[],
+  "allowed_models" text[],
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "workspace_model_policies_workspace_idx"
+  ON "workspace_model_policies" ("workspace_id");
+
+-- RLS — verbatim pattern from 0028_codex_multi_account.sql (codex_rotation_settings).
+ALTER TABLE "workspace_model_policies" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "workspace_model_policies" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema() AND tablename = 'workspace_model_policies' AND policyname = 'workspace_isolation') THEN
+    DROP POLICY workspace_isolation ON "workspace_model_policies";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "workspace_model_policies"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Re-grant (verbatim from 0028/0024): new tables are not covered by prior grants.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;