@opengeni/db 0.9.3 → 0.10.7

package/drizzle/0064_rotation_strategy_sharded_backfill.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-36: the strategy picker is gone — rotation-enabled always behaves as
+-- tracking-36: the strategy picker is gone — rotation-enabled always behaves as
 -- sticky-sharded (worker-side effectiveRotationStrategy normalizes every read).
 -- Backfill stored legacy values so the column tells the truth going forward.
 -- The column itself is KEPT (old-binary rollback safety): an old worker reading

package/drizzle/0065_codex_subscription_overview.sql

@@ -0,0 +1,168 @@
+-- deployment-mode: maintenance
+-- Codex quota: trustworthy Codex subscription overview, allocator OCC/audit, and
+-- owning-human reset-credit redemption.
+--
+-- Old API binaries do not write connected_by_subject_id and do not fence
+-- disconnect/reconnect against unresolved provider attempts. Drain every old
+-- API replica before applying this migration, then start only this revision;
+-- mixed-version writers would invalidate the owning-human redemption boundary.
+--
+-- tracking-21 exclusively owns allocator_enabled in migration 0053. This migration
+-- only adds the independent OCC/audit fields, provider summary cache, connecting
+-- human attribution, and the durable ambiguity-safe redemption state machine.
+
+ALTER TABLE "codex_subscription_credentials"
+  ADD COLUMN IF NOT EXISTS "allocator_version" integer NOT NULL DEFAULT 1,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_by_subject_id" text,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "reset_credit_available_count" integer,
+  ADD COLUMN IF NOT EXISTS "reset_credits_checked_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "connected_by_subject_id" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_allocator_version_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_allocator_version_check"
+      CHECK (allocator_version > 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_reset_count_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_reset_count_check"
+      CHECK (reset_credit_available_count IS NULL OR reset_credit_available_count >= 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_human_owner_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_human_owner_check"
+      CHECK (connected_by_subject_id IS NULL OR connected_by_subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_allocator_version_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_reset_count_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_human_owner_check";
+
+CREATE TABLE IF NOT EXISTS "codex_reset_redemption_attempts" (
+  -- Browser-generated logical id. Reusing it is what prevents one ambiguous
+  -- click/reload/retry from becoming a second logical redemption.
+  "id" uuid PRIMARY KEY NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "credential_id" uuid NOT NULL,
+  "subject_id" text NOT NULL,
+  -- SHA-256 of the Better Auth session id. The raw session id and cookies never
+  -- enter product tables, logs, audit metadata, or browser responses.
+  "browser_session_hash" text NOT NULL,
+  -- Required for an ambiguity retry. It is intentionally absent from audit and
+  -- event metadata; provider opaque ids are not observability dimensions.
+  "credit_id" text NOT NULL,
+  -- Generated once by the server and reused for every upstream retry.
+  "upstream_idempotency_key" uuid NOT NULL DEFAULT gen_random_uuid(),
+  "status" text NOT NULL DEFAULT 'processing',
+  "outcome" text,
+  "claim_holder_id" uuid,
+  "claim_expires_at" timestamptz,
+  "confirmation_expires_at" timestamptz NOT NULL,
+  "provider_started_at" timestamptz,
+  "completed_at" timestamptz,
+  "last_failure_kind" text,
+  "retry_count" integer NOT NULL DEFAULT 0,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "codex_reset_redemption_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  -- Deliberately no credential FK: a disconnect must never cascade-delete the
+  -- only durable upstream redeem_request_id after provider work may have begun.
+  -- Accessors validate and lock the workspace credential before every send;
+  -- completed history may outlive a later safe credential disconnect.
+  CONSTRAINT "codex_reset_redemption_status_check"
+    CHECK (status IN ('processing', 'provider_started', 'completed')),
+  CONSTRAINT "codex_reset_redemption_outcome_check"
+    CHECK (outcome IS NULL OR outcome IN ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')),
+  CONSTRAINT "codex_reset_redemption_completed_check"
+    CHECK ((status = 'completed') = (outcome IS NOT NULL AND completed_at IS NOT NULL)),
+  CONSTRAINT "codex_reset_redemption_retry_count_check"
+    CHECK (retry_count >= 0),
+  CONSTRAINT "codex_reset_redemption_human_subject_check"
+    CHECK (subject_id LIKE 'user:_%')
+);
+
+-- Keep this additive/idempotent for forward recovery from a previously completed
+-- equivalent schema state.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_reset_redemption_human_subject_check'
+      AND conrelid = 'codex_reset_redemption_attempts'::regclass
+  ) THEN
+    ALTER TABLE "codex_reset_redemption_attempts"
+      ADD CONSTRAINT "codex_reset_redemption_human_subject_check"
+      CHECK (subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+ALTER TABLE "codex_reset_redemption_attempts"
+  VALIDATE CONSTRAINT "codex_reset_redemption_human_subject_check";
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_upstream_key_idx"
+  ON "codex_reset_redemption_attempts" ("upstream_idempotency_key");
+-- A provider credit can have only one active or successfully consumed logical
+-- attempt. Provider outcomes nothingToReset/noCredit are explicitly non-success
+-- outcomes and must not permanently prevent a later, newly confirmed attempt.
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_credential_credit_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "credit_id")
+  WHERE status <> 'completed' OR outcome IN ('reset', 'alreadyRedeemed');
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_workspace_credential_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "created_at" DESC);
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_claim_expiry_idx"
+  ON "codex_reset_redemption_attempts" ("claim_expires_at")
+  WHERE status <> 'completed';
+
+ALTER TABLE "codex_reset_redemption_attempts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_reset_redemption_attempts" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'codex_reset_redemption_attempts'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "codex_reset_redemption_attempts";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "codex_reset_redemption_attempts"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+DECLARE
+  target_schema text := current_schema();
+  app_role text := 'opengeni_app';
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = app_role) THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I',
+      target_schema,
+      app_role
+    );
+  END IF;
+END $$;

package/drizzle/0065_session_tool_policy.sql

@@ -0,0 +1,38 @@
+-- deployment-mode: rolling
+-- Persist the origin of a session's tool allow-list. NULL is a
+-- deliberate legacy marker for rows created before policy provenance existed.
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "tool_policy" jsonb;
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT IF EXISTS "sessions_tool_policy_shape_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_tool_policy_shape_check"
+  CHECK (
+    "tool_policy" IS NULL
+    OR (
+      jsonb_typeof("tool_policy") = 'object'
+      AND "tool_policy" ? 'mode'
+      AND ("tool_policy" ->> 'mode') IN ('workspace_default', 'explicit', 'inherited', 'legacy')
+      AND "tool_policy" ? 'inheritedFromSessionId'
+      AND (
+        ("tool_policy" ->> 'inheritedFromSessionId') IS NULL
+        OR ("tool_policy" ->> 'inheritedFromSessionId') ~ '^[0-9a-fA-F-]{36}$'
+      )
+    )
+  ) NOT VALID;
+
+-- Follow-up turns also need provenance: an omitted tools key inherits the
+-- session policy, while an explicit array replaces it for that turn (subject
+-- to the session subset fence). Existing turns used merge semantics and their
+-- selected refs are already materialized on sessions.tools, so false preserves
+-- their effective allow-list during the rolling upgrade.
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;
+
+-- Human composer drafts need the same provenance across reloads. Without this,
+-- [] cannot distinguish "inherit the session policy" from an intentional
+-- per-turn empty selection.
+ALTER TABLE "composer_drafts"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;

package/drizzle/0067_session_event_payload_bounds.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: session_events is the lossy human/audit projection, not a blob store.
+-- tracking-64: session_events is the lossy human/audit projection, not a blob store.
 -- Install the BEFORE trigger before the NOT VALID check so an older pod in the
 -- same rolling deployment is normalized instead of having an oversized write
 -- rejected. Historical oversized rows stay readable and can be defensively
@@ -206,4 +206,4 @@ ALTER TABLE session_events
   NOT VALID,
   ADD CONSTRAINT session_events_duplicate_reason_bytes_check
   CHECK (duplicate_reason IS NULL OR octet_length(duplicate_reason) <= 4096)
-  NOT VALID;
+  NOT VALID;

package/drizzle/0068_workspace_control_event_bounds.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: workspace-control rows are compact invalidations, not evidence blobs.
+-- tracking-64: workspace-control rows are compact invalidations, not evidence blobs.
 -- Preserve exact source byte counts while bounding the two free-form fields so
 -- old binaries and direct writers cannot create a durable replay poison row.
 
@@ -131,4 +131,4 @@ ALTER TABLE workspace_control_events
   VALIDATE CONSTRAINT workspace_control_events_reason_bytes_check,
   VALIDATE CONSTRAINT workspace_control_events_actor_bytes_check,
   VALIDATE CONSTRAINT workspace_control_events_original_bytes_check,
-  VALIDATE CONSTRAINT workspace_control_events_actor_original_bytes_check;
+  VALIDATE CONSTRAINT workspace_control_events_actor_original_bytes_check;

package/drizzle/0069_session_event_history_backfill.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: finish the 0067 expand/contract sequence. The trigger has bounded
+-- tracking-64: finish the 0067 expand/contract sequence. The trigger has bounded
 -- every new/updated row since 0067; now rewrite only legacy violations through
 -- that trigger and validate the durable storage invariant.
 
@@ -29,4 +29,4 @@ ALTER TABLE session_events
   VALIDATE CONSTRAINT session_events_client_event_id_bytes_check,
   VALIDATE CONSTRAINT session_events_producer_id_bytes_check,
   VALIDATE CONSTRAINT session_events_turn_association_bytes_check,
-  VALIDATE CONSTRAINT session_events_duplicate_reason_bytes_check;
+  VALIDATE CONSTRAINT session_events_duplicate_reason_bytes_check;

package/drizzle/0074_session_activity_revisions.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-65: transactional workspace revisions make updated-order discovery and
+-- tracking-65: transactional workspace revisions make updated-order discovery and
 -- its next incremental scan one gap-free handoff independent of application
 -- clocks. Existing sessions remain revision zero until their next activity.
 
@@ -69,4 +69,4 @@ BEGIN
 END $grants$;
 
 RESET statement_timeout;
-RESET lock_timeout;
+RESET lock_timeout;

package/drizzle/0106_session_attempt_mcp_approval_policies.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: maintenance
+-- Workers are drained before this migration so no executable attempt can cross
+-- the boundary without an immutable approval-policy snapshot. Closed attempts
+-- are historical evidence only and receive an inert empty snapshot.
+SET lock_timeout = '5s';
+SET statement_timeout = '5min';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "session_turn_attempts"
+    WHERE "state" <> 'closed'
+    LIMIT 1
+  ) THEN
+    RAISE EXCEPTION
+      'live session turn attempts must be drained before the MCP approval-policy cutover';
+  END IF;
+END
+$$;
+
+ALTER TABLE "session_turn_attempts"
+  ADD COLUMN "mcp_approval_policies" jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+-- PostgreSQL installs a constant default without rewriting the historical
+-- table. Remove the default immediately: every new attempt must provide its
+-- claim-time snapshot explicitly.
+ALTER TABLE "session_turn_attempts"
+  ALTER COLUMN "mcp_approval_policies" DROP DEFAULT;

package/drizzle/0107_host_export_lineage_contract.sql

@@ -0,0 +1,381 @@
+-- deployment-mode: rolling
+-- Forward-only repair for published 0097/0103/0104 histories. Immutable root
+-- capture already exists after 0103; this migration linearizes first-consumer
+-- enablement with deferred producers and validates the session/root invariant.
+-- It never derives or rewrites historical lineage. Rows that may have been
+-- populated by the old 0104 backfill require explicit evidence-backed
+-- disposition before retry.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- Replacing these SECURITY DEFINER functions preserves their identity, owner,
+-- and existing exporter ACL while making the config-row lock the commit-order
+-- boundary between first-consumer registration and deferred source capture.
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_session_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb;
+      v_context jsonb := '{}'::jsonb;
+      v_origin text;
+      v_payload_bytes integer;
+    BEGIN
+      IF NEW.type IN (
+        'agent.message.delta', 'agent.reasoning.delta',
+        'sandbox.command.output.delta', 'terminal.pty.output.delta'
+      ) THEN
+        RETURN NEW;
+      END IF;
+
+      SELECT c.session_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      IF NEW.turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.workspace_id = NEW.workspace_id AND t.id = NEW.turn_id;
+      ELSIF NEW.type = 'session.created' THEN
+        SELECT
+          CASE WHEN octet_length(s.created_by_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', s.created_by_kind,
+              'subjectId', s.created_by_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+                THEN left(s.created_by_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+              THEN left(s.created_by_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'backfill') = 'boolean'
+              THEN s.created_by_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(s.created_by_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          NULL
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = NEW.workspace_id AND s.id = NEW.session_id;
+      END IF;
+
+      v_payload_bytes := octet_length(NEW.payload::text)
+        + octet_length(NEW.type)
+        + coalesce(octet_length(NEW.client_event_id), 0)
+        + coalesce(octet_length(NEW.turn_association), 0)
+        + coalesce(octet_length(NEW.duplicate_reason), 0)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_generation, turn_attempt_id, session_sequence,
+        client_event_id, turn_association, duplicate_of_event_id, duplicate_reason,
+        event_type, idempotency_key, initiator, initiator_context, origin,
+        payload, envelope_bytes, occurred_at, source_recorded_at, enqueued_at
+      ) VALUES (
+        'session_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_generation, NEW.turn_attempt_id, NEW.sequence,
+        NEW.client_event_id, NEW.turn_association, NEW.duplicate_of_event_id,
+        NEW.duplicate_reason,
+        NEW.type, 'session_event:' || NEW.id::text, v_initiator,
+        coalesce(v_context, '{}'::jsonb), v_origin, NEW.payload,
+        greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.created_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_usage_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb := CASE
+        WHEN NEW.initiator_kind IS NOT NULL THEN jsonb_strip_nulls(jsonb_build_object(
+          'kind', NEW.initiator_kind,
+          'subjectId', NEW.initiator_subject_id,
+          'label', CASE
+            WHEN jsonb_typeof(NEW.initiator_context -> 'label') = 'string'
+            THEN left(NEW.initiator_context ->> 'label', 256)
+            ELSE NULL
+          END
+        ))
+        ELSE NULL
+      END;
+      v_context jsonb := jsonb_strip_nulls(jsonb_build_object(
+        'label', CASE
+          WHEN jsonb_typeof(NEW.initiator_context -> 'label') = 'string'
+          THEN left(NEW.initiator_context ->> 'label', 256)
+          ELSE NULL
+        END,
+        'backfill', CASE
+          WHEN jsonb_typeof(NEW.initiator_context -> 'backfill') = 'boolean'
+          THEN NEW.initiator_context -> 'backfill'
+          ELSE NULL
+        END
+      ));
+      v_origin text := NEW.origin;
+      v_payload jsonb;
+      v_payload_bytes integer;
+    BEGIN
+      SELECT c.usage_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      -- Export-specific bounds apply only while the optional host stream is
+      -- enabled. Standalone/custom usage writers retain their historical
+      -- behavior; an embedded writer that cannot be represented fails its
+      -- source transaction visibly instead of committing a poison outbox row.
+      IF octet_length(NEW.event_type) NOT BETWEEN 1 AND 256
+        OR octet_length(NEW.unit) NOT BETWEEN 1 AND 128
+        OR (NEW.subject_id IS NOT NULL AND octet_length(NEW.subject_id) > 1024)
+        OR (NEW.source_resource_type IS NOT NULL
+          AND octet_length(NEW.source_resource_type) > 256)
+        OR (NEW.source_resource_id IS NOT NULL
+          AND octet_length(NEW.source_resource_id) > 2048)
+        OR octet_length(NEW.idempotency_key) NOT BETWEEN 1 AND 2048
+        OR (NEW.billing_provider_event_id IS NOT NULL
+          AND octet_length(NEW.billing_provider_event_id) > 2048) THEN
+        RAISE EXCEPTION 'usage event exceeds the enabled host-export wire bounds'
+          USING ERRCODE = '22001';
+      END IF;
+
+      IF NEW.turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.workspace_id = NEW.workspace_id AND t.id = NEW.turn_id;
+      ELSIF v_initiator IS NULL AND NEW.subject_id IS NOT NULL
+        AND octet_length(NEW.subject_id) <= 1024 THEN
+        v_initiator := jsonb_build_object('kind', 'subject', 'subjectId', NEW.subject_id);
+      END IF;
+
+      v_payload := jsonb_build_object(
+        'id', NEW.id,
+        'workspaceId', NEW.workspace_id,
+        'accountId', NEW.account_id,
+        'subjectId', NEW.subject_id,
+        'eventType', NEW.event_type,
+        'quantity', NEW.quantity,
+        'unit', NEW.unit,
+        'sourceResourceType', NEW.source_resource_type,
+        'sourceResourceId', NEW.source_resource_id,
+        'idempotencyKey', NEW.idempotency_key,
+        'occurredAt', NEW.occurred_at,
+        'recordedAt', NEW.recorded_at,
+        'exportedToBillingAt', NEW.exported_to_billing_at,
+        'billingProviderEventId', NEW.billing_provider_event_id
+      );
+      v_payload_bytes := octet_length(v_payload::text)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_attempt_id, event_type, idempotency_key, initiator,
+        initiator_context, origin, payload, envelope_bytes, occurred_at,
+        source_recorded_at, enqueued_at
+      ) VALUES (
+        'usage_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_attempt_id, NEW.event_type, NEW.idempotency_key,
+        v_initiator, coalesce(v_context, '{}'::jsonb), v_origin, v_payload,
+        greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.recorded_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.enqueue_host_session_event_export() FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.enqueue_host_usage_event_export() FROM PUBLIC;
+
+-- The old 0104 backfill resolved lineage from then-current session ancestry.
+-- A session-scoped row enqueued before 0103's durable ledger boundary therefore
+-- lacks immutable-capture provenance even when its root is non-null. Reject the
+-- candidate without touching data. The single-row probe is bounded by the
+-- migration statement timeout; operators must disposition suspect history
+-- separately and rerun the same migration.
+DO $migration$
+DECLARE
+  capture_applied_at timestamptz;
+  capture_ledger_rows integer;
+  suspect_source_id uuid;
+BEGIN
+  SELECT min(m.applied_at), count(*)::integer
+  INTO capture_applied_at, capture_ledger_rows
+  FROM "schema_migrations" m
+  WHERE m.name = '0103_host_export_root_session.sql';
+
+  IF capture_ledger_rows <> 1 OR capture_applied_at IS NULL THEN
+    RAISE EXCEPTION '0107 requires the exact 0103 schema-migration ledger boundary'
+      USING ERRCODE = '55000',
+        HINT = 'Apply migrations through immutable 0104 with the canonical runner before retrying 0107.';
+  END IF;
+
+  SELECT o.source_id
+  INTO suspect_source_id
+  FROM "host_export_outbox" o
+  WHERE o.session_id IS NOT NULL
+    AND (
+      o.root_session_id IS NULL
+      OR o.enqueued_at < capture_applied_at
+    )
+  ORDER BY o.enqueued_at, o.source_id
+  LIMIT 1;
+
+  IF suspect_source_id IS NOT NULL THEN
+    RAISE EXCEPTION '0107 found host-export lineage without immutable-capture provenance'
+      USING ERRCODE = '23514',
+        HINT = 'Do not derive lineage from current sessions; use an evidence-backed maintenance disposition, then retry 0107.';
+  END IF;
+END $migration$;
+
+DO $migration$
+DECLARE
+  existing_expression text;
+  normalized_expression text;
+BEGIN
+  SELECT pg_get_expr(c.conbin, c.conrelid, true)
+  INTO existing_expression
+  FROM pg_catalog.pg_constraint c
+  WHERE c.conname = 'host_export_outbox_root_session_check'
+    AND c.conrelid = 'host_export_outbox'::regclass
+    AND c.contype = 'c'
+    AND NOT c.connoinherit;
+
+  IF existing_expression IS NULL THEN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_catalog.pg_constraint c
+      WHERE c.conname = 'host_export_outbox_root_session_check'
+        AND c.conrelid = 'host_export_outbox'::regclass
+    ) THEN
+      RAISE EXCEPTION 'host_export_outbox_root_session_check has an incompatible constraint type'
+        USING ERRCODE = '55000';
+    END IF;
+
+    ALTER TABLE "host_export_outbox"
+      ADD CONSTRAINT "host_export_outbox_root_session_check"
+      CHECK ("session_id" IS NULL OR "root_session_id" IS NOT NULL)
+      NOT VALID;
+  ELSE
+    normalized_expression := lower(regexp_replace(
+      existing_expression,
+      '["()[:space:]]',
+      '',
+      'g'
+    ));
+    IF normalized_expression <> 'session_idisnullorroot_session_idisnotnull' THEN
+      RAISE EXCEPTION 'host_export_outbox_root_session_check has an incompatible expression'
+        USING ERRCODE = '55000';
+    END IF;
+  END IF;
+END $migration$;
+
+-- VALIDATE takes SHARE UPDATE EXCLUSIVE, which permits ordinary reads/writes.
+-- Both lock acquisition and the read-only table scan are source-bounded above;
+-- timeout is a retryable operator disposition, never permission to rewrite data.
+DO $migration$
+BEGIN
+  ALTER TABLE "host_export_outbox"
+    VALIDATE CONSTRAINT "host_export_outbox_root_session_check";
+EXCEPTION
+  WHEN check_violation THEN
+    RAISE EXCEPTION '0107 cannot validate host-export lineage without historical provenance'
+      USING ERRCODE = '23514',
+        HINT = 'Do not derive lineage from current sessions; use an evidence-backed maintenance disposition, then retry 0107.';
+END $migration$;