@opengeni/db 0.9.3 → 0.12.0

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { n as agentRunStates, o as apiKeys, p as auditEvents, q as billingCustomers, r as capabilityCatalogItems, t as capabilityInstallations, u as codexCapacityWaiters, v as codexCredentialLeases, x as codexRotationSettings, y as codexSubscriptionCredentials, d as composerDrafts, z as connections, A as creditLedgerEntries, B as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, C as documentBases, D as documentChunks, E as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, F as enrollments, G as fileUploads, H as files, I as githubInstallationRepositories, J as githubInstallations, K as hostExportConfig, L as hostExportConsumers, M as hostExportCursorState, N as hostExportDeadLetters, O as hostExportOutbox, P as importBatches, Q as integrationOauthClients, R as integrationOauthStateNonces, S as knowledgeMemories, T as machineMetricsLatest, U as machineMetricsSeries, V as managedAccounts, W as packInstallations, X as rigChanges, Y as rigVersions, Z as rigs, j as sandboxKindValues, _ as sandboxLeaseHolders, $ as sandboxLeaseLivenessValues, a0 as sandboxLeases, a1 as sandboxPtySessions, a2 as sandboxSessionEnvelopes, a3 as sandboxes, a4 as scheduledTaskRuns, a5 as scheduledTasks, a6 as sessionAttemptInterruptions, s as sessionCommandReceipts, a7 as sessionEvents, a8 as sessionGoals, a9 as sessionHistoryItems, aa as sessionHumanInputRequests, ab as sessionListSnapshots, ac as sessionMcpServers, ad as sessionPendingToolCalls, ae as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, af as sessionRecordings, ag as sessionSystemUpdateOutbox, ah as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, ai as sessionWorkflowWakeOutbox, a as sessions, aj as socialConnections, ak as socialPosts, al as stripeWebhookEvents, am as usageEvents, an as workspaceCaptures, ao as workspaceControlEvents, ap as workspaceInferenceControls, aq as workspaceMemberships, ar as workspaceModelPolicies, as as workspacePacks, at as workspaceSessionActivityRevisions, au as workspaceVariableSetVariables, av as workspaceVariableSets, w as workspaces } from './schema-CdPGTHlD.js';
+export { o as agentRunStates, p as apiKeys, q as auditEvents, r as billingCustomers, t as capabilityCatalogItems, u as capabilityInstallations, v as codexCapacityWaiters, x as codexCredentialLeases, y as codexResetRedemptionAttempts, z as codexRotationSettings, A as codexSubscriptionCredentials, d as composerDrafts, B as connections, C as creditLedgerEntries, D as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, E as documentBases, F as documentChunks, G as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, H as enrollments, I as fileUploads, J as files, K as githubInstallationRepositories, L as githubInstallations, M as hostExportConfig, N as hostExportConsumers, O as hostExportCursorState, P as hostExportDeadLetters, Q as hostExportOutbox, R as importBatches, S as integrationOauthClients, T as integrationOauthStateNonces, U as knowledgeMemories, V as machineMetricsLatest, W as machineMetricsSeries, X as managedAccounts, Y as nestedAgentDepthConfiguration, n as newSessionDrafts, Z as packInstallations, _ as rigChanges, $ as rigVersions, a0 as rigs, j as sandboxKindValues, a1 as sandboxLeaseHolders, a2 as sandboxLeaseLivenessValues, a3 as sandboxLeases, a4 as sandboxPtySessions, a5 as sandboxRetainedProcessStateValues, a6 as sandboxRetainedProcesses, a7 as sandboxSessionEnvelopes, a8 as sandboxWorkspaceMutationActorKindValues, a9 as sandboxWorkspaceMutationAdmissions, aa as sandboxWorkspaceMutationHolderKindValues, ab as sandboxes, ac as scheduledTaskRuns, ad as scheduledTasks, ae as sessionAttemptInterruptions, s as sessionCommandReceipts, af as sessionEvents, ag as sessionGoals, ah as sessionHistoryItems, ai as sessionHumanInputRequests, aj as sessionListSnapshots, ak as sessionMcpServers, al as sessionPendingToolCalls, am as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, an as sessionRecordings, ao as sessionSpawnDenials, ap as sessionSystemUpdateOutbox, aq as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, ar as sessionWorkflowWakeOutbox, a as sessions, as as socialConnections, at as socialPosts, au as stripeWebhookEvents, av as usageEvents, aw as workspaceCaptures, ax as workspaceControlEvents, ay as workspaceInferenceControls, az as workspaceMemberships, aA as workspaceModelPolicies, aB as workspacePacks, aC as workspaceSessionActivityRevisions, aD as workspaceVariableSetVariables, aE as workspaceVariableSets, w as workspaces } from './schema-CnpD6BcX.js';

package/dist/schema.js

@@ -7,6 +7,7 @@ import {
   capabilityInstallations,
   codexCapacityWaiters,
   codexCredentialLeases,
+  codexResetRedemptionAttempts,
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
@@ -37,6 +38,8 @@ import {
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
+  nestedAgentDepthConfiguration,
+  newSessionDrafts,
   packInstallations,
   rigChanges,
   rigVersions,
@@ -46,7 +49,12 @@ import {
   sandboxLeaseLivenessValues,
   sandboxLeases,
   sandboxPtySessions,
+  sandboxRetainedProcessStateValues,
+  sandboxRetainedProcesses,
   sandboxSessionEnvelopes,
+  sandboxWorkspaceMutationActorKindValues,
+  sandboxWorkspaceMutationAdmissions,
+  sandboxWorkspaceMutationHolderKindValues,
   sandboxes,
   scheduledTaskRuns,
   scheduledTasks,
@@ -64,6 +72,7 @@ import {
   sessionRecordingModeValues,
   sessionRecordingStateValues,
   sessionRecordings,
+  sessionSpawnDenials,
   sessionSystemUpdateOutbox,
   sessionSystemUpdates,
   sessionTurnAttempts,
@@ -84,7 +93,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-4LG5NBTC.js";
+} from "./chunk-VUKRIBO5.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -95,6 +104,7 @@ export {
   capabilityInstallations,
   codexCapacityWaiters,
   codexCredentialLeases,
+  codexResetRedemptionAttempts,
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
@@ -125,6 +135,8 @@ export {
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
+  nestedAgentDepthConfiguration,
+  newSessionDrafts,
   packInstallations,
   rigChanges,
   rigVersions,
@@ -134,7 +146,12 @@ export {
   sandboxLeaseLivenessValues,
   sandboxLeases,
   sandboxPtySessions,
+  sandboxRetainedProcessStateValues,
+  sandboxRetainedProcesses,
   sandboxSessionEnvelopes,
+  sandboxWorkspaceMutationActorKindValues,
+  sandboxWorkspaceMutationAdmissions,
+  sandboxWorkspaceMutationHolderKindValues,
   sandboxes,
   scheduledTaskRuns,
   scheduledTasks,
@@ -152,6 +169,7 @@ export {
   sessionRecordingModeValues,
   sessionRecordingStateValues,
   sessionRecordings,
+  sessionSpawnDenials,
   sessionSystemUpdateOutbox,
   sessionSystemUpdates,
   sessionTurnAttempts,

package/drizzle/0053_codex_credential_leases.sql

@@ -1,5 +1,5 @@
 -- 0053_codex_credential_leases.sql
--- OPE-21: fair, atomic Codex subscription selection across worker replicas.
+-- tracking-21: fair, atomic Codex subscription selection across worker replicas.
 --
 -- Every field in this migration is workspace-local. In particular, the same
 -- external ChatGPT subscription connected in two workspaces is intentionally
@@ -227,4 +227,4 @@ BEGIN
       app_role
     );
   END IF;
-END $$;
+END $$;

package/drizzle/0057_durable_queue_control.sql

@@ -1,4 +1,4 @@
--- OPE-18/OPE-21/OPE-22: one prompt queue, one current inference, portable
+-- tracking-18/tracking-21/tracking-22: one prompt queue, one current inference, portable
 -- compaction, attempt-fenced publication, coalesced internal updates, and
 -- session/workspace Pause.
 --

package/drizzle/0061_session_workflow_wake_outbox.sql

@@ -1,4 +1,4 @@
--- OPE-50: replace the blind periodic scan of "enrollable" sessions with a
+-- tracking-50: replace the blind periodic scan of "enrollable" sessions with a
 -- transactional, revisioned, coalescing delivery ledger. Postgres is the
 -- durable work source; a Temporal signal is an idempotent nudge.
 

package/drizzle/0062_session_list_snapshot_reaper.sql

@@ -1,4 +1,4 @@
--- OPE-44: session list reads are serializable and subject-scoped. Performing a
+-- tracking-44: session list reads are serializable and subject-scoped. Performing a
 -- global expired-row delete inside every read makes concurrent API replicas
 -- conflict on the same rows. Move TTL cleanup to one bounded SKIP LOCKED
 -- reaper operation and keep the request transaction strictly request-local.

package/drizzle/0063_session_control_mega_foundation.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: maintenance
--- OPE-18/OPE-54: one-way queue/control maintenance cutover. Old workers are
+-- tracking-18/tracking-54: one-way queue/control maintenance cutover. Old workers are
 -- drained before this migration; obsolete columns are removed in this same
 -- transaction so no mixed runtime architecture can survive deployment.
 

package/drizzle/0064_rotation_strategy_sharded_backfill.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-36: the strategy picker is gone — rotation-enabled always behaves as
+-- tracking-36: the strategy picker is gone — rotation-enabled always behaves as
 -- sticky-sharded (worker-side effectiveRotationStrategy normalizes every read).
 -- Backfill stored legacy values so the column tells the truth going forward.
 -- The column itself is KEPT (old-binary rollback safety): an old worker reading

package/drizzle/0065_codex_subscription_overview.sql

@@ -0,0 +1,168 @@
+-- deployment-mode: maintenance
+-- Codex quota: trustworthy Codex subscription overview, allocator OCC/audit, and
+-- owning-human reset-credit redemption.
+--
+-- Old API binaries do not write connected_by_subject_id and do not fence
+-- disconnect/reconnect against unresolved provider attempts. Drain every old
+-- API replica before applying this migration, then start only this revision;
+-- mixed-version writers would invalidate the owning-human redemption boundary.
+--
+-- tracking-21 exclusively owns allocator_enabled in migration 0053. This migration
+-- only adds the independent OCC/audit fields, provider summary cache, connecting
+-- human attribution, and the durable ambiguity-safe redemption state machine.
+
+ALTER TABLE "codex_subscription_credentials"
+  ADD COLUMN IF NOT EXISTS "allocator_version" integer NOT NULL DEFAULT 1,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_by_subject_id" text,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "reset_credit_available_count" integer,
+  ADD COLUMN IF NOT EXISTS "reset_credits_checked_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "connected_by_subject_id" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_allocator_version_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_allocator_version_check"
+      CHECK (allocator_version > 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_reset_count_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_reset_count_check"
+      CHECK (reset_credit_available_count IS NULL OR reset_credit_available_count >= 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_human_owner_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_human_owner_check"
+      CHECK (connected_by_subject_id IS NULL OR connected_by_subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_allocator_version_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_reset_count_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_human_owner_check";
+
+CREATE TABLE IF NOT EXISTS "codex_reset_redemption_attempts" (
+  -- Browser-generated logical id. Reusing it is what prevents one ambiguous
+  -- click/reload/retry from becoming a second logical redemption.
+  "id" uuid PRIMARY KEY NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "credential_id" uuid NOT NULL,
+  "subject_id" text NOT NULL,
+  -- SHA-256 of the Better Auth session id. The raw session id and cookies never
+  -- enter product tables, logs, audit metadata, or browser responses.
+  "browser_session_hash" text NOT NULL,
+  -- Required for an ambiguity retry. It is intentionally absent from audit and
+  -- event metadata; provider opaque ids are not observability dimensions.
+  "credit_id" text NOT NULL,
+  -- Generated once by the server and reused for every upstream retry.
+  "upstream_idempotency_key" uuid NOT NULL DEFAULT gen_random_uuid(),
+  "status" text NOT NULL DEFAULT 'processing',
+  "outcome" text,
+  "claim_holder_id" uuid,
+  "claim_expires_at" timestamptz,
+  "confirmation_expires_at" timestamptz NOT NULL,
+  "provider_started_at" timestamptz,
+  "completed_at" timestamptz,
+  "last_failure_kind" text,
+  "retry_count" integer NOT NULL DEFAULT 0,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "codex_reset_redemption_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  -- Deliberately no credential FK: a disconnect must never cascade-delete the
+  -- only durable upstream redeem_request_id after provider work may have begun.
+  -- Accessors validate and lock the workspace credential before every send;
+  -- completed history may outlive a later safe credential disconnect.
+  CONSTRAINT "codex_reset_redemption_status_check"
+    CHECK (status IN ('processing', 'provider_started', 'completed')),
+  CONSTRAINT "codex_reset_redemption_outcome_check"
+    CHECK (outcome IS NULL OR outcome IN ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')),
+  CONSTRAINT "codex_reset_redemption_completed_check"
+    CHECK ((status = 'completed') = (outcome IS NOT NULL AND completed_at IS NOT NULL)),
+  CONSTRAINT "codex_reset_redemption_retry_count_check"
+    CHECK (retry_count >= 0),
+  CONSTRAINT "codex_reset_redemption_human_subject_check"
+    CHECK (subject_id LIKE 'user:_%')
+);
+
+-- Keep this additive/idempotent for forward recovery from a previously completed
+-- equivalent schema state.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_reset_redemption_human_subject_check'
+      AND conrelid = 'codex_reset_redemption_attempts'::regclass
+  ) THEN
+    ALTER TABLE "codex_reset_redemption_attempts"
+      ADD CONSTRAINT "codex_reset_redemption_human_subject_check"
+      CHECK (subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+ALTER TABLE "codex_reset_redemption_attempts"
+  VALIDATE CONSTRAINT "codex_reset_redemption_human_subject_check";
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_upstream_key_idx"
+  ON "codex_reset_redemption_attempts" ("upstream_idempotency_key");
+-- A provider credit can have only one active or successfully consumed logical
+-- attempt. Provider outcomes nothingToReset/noCredit are explicitly non-success
+-- outcomes and must not permanently prevent a later, newly confirmed attempt.
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_credential_credit_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "credit_id")
+  WHERE status <> 'completed' OR outcome IN ('reset', 'alreadyRedeemed');
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_workspace_credential_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "created_at" DESC);
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_claim_expiry_idx"
+  ON "codex_reset_redemption_attempts" ("claim_expires_at")
+  WHERE status <> 'completed';
+
+ALTER TABLE "codex_reset_redemption_attempts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_reset_redemption_attempts" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'codex_reset_redemption_attempts'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "codex_reset_redemption_attempts";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "codex_reset_redemption_attempts"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+DECLARE
+  target_schema text := current_schema();
+  app_role text := 'opengeni_app';
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = app_role) THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I',
+      target_schema,
+      app_role
+    );
+  END IF;
+END $$;

package/drizzle/0065_session_tool_policy.sql

@@ -0,0 +1,38 @@
+-- deployment-mode: rolling
+-- Persist the origin of a session's tool allow-list. NULL is a
+-- deliberate legacy marker for rows created before policy provenance existed.
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "tool_policy" jsonb;
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT IF EXISTS "sessions_tool_policy_shape_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_tool_policy_shape_check"
+  CHECK (
+    "tool_policy" IS NULL
+    OR (
+      jsonb_typeof("tool_policy") = 'object'
+      AND "tool_policy" ? 'mode'
+      AND ("tool_policy" ->> 'mode') IN ('workspace_default', 'explicit', 'inherited', 'legacy')
+      AND "tool_policy" ? 'inheritedFromSessionId'
+      AND (
+        ("tool_policy" ->> 'inheritedFromSessionId') IS NULL
+        OR ("tool_policy" ->> 'inheritedFromSessionId') ~ '^[0-9a-fA-F-]{36}$'
+      )
+    )
+  ) NOT VALID;
+
+-- Follow-up turns also need provenance: an omitted tools key inherits the
+-- session policy, while an explicit array replaces it for that turn (subject
+-- to the session subset fence). Existing turns used merge semantics and their
+-- selected refs are already materialized on sessions.tools, so false preserves
+-- their effective allow-list during the rolling upgrade.
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;
+
+-- Human composer drafts need the same provenance across reloads. Without this,
+-- [] cannot distinguish "inherit the session policy" from an intentional
+-- per-turn empty selection.
+ALTER TABLE "composer_drafts"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;

package/drizzle/0067_session_event_payload_bounds.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: session_events is the lossy human/audit projection, not a blob store.
+-- tracking-64: session_events is the lossy human/audit projection, not a blob store.
 -- Install the BEFORE trigger before the NOT VALID check so an older pod in the
 -- same rolling deployment is normalized instead of having an oversized write
 -- rejected. Historical oversized rows stay readable and can be defensively
@@ -206,4 +206,4 @@ ALTER TABLE session_events
   NOT VALID,
   ADD CONSTRAINT session_events_duplicate_reason_bytes_check
   CHECK (duplicate_reason IS NULL OR octet_length(duplicate_reason) <= 4096)
-  NOT VALID;
+  NOT VALID;

package/drizzle/0068_workspace_control_event_bounds.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: workspace-control rows are compact invalidations, not evidence blobs.
+-- tracking-64: workspace-control rows are compact invalidations, not evidence blobs.
 -- Preserve exact source byte counts while bounding the two free-form fields so
 -- old binaries and direct writers cannot create a durable replay poison row.
 
@@ -131,4 +131,4 @@ ALTER TABLE workspace_control_events
   VALIDATE CONSTRAINT workspace_control_events_reason_bytes_check,
   VALIDATE CONSTRAINT workspace_control_events_actor_bytes_check,
   VALIDATE CONSTRAINT workspace_control_events_original_bytes_check,
-  VALIDATE CONSTRAINT workspace_control_events_actor_original_bytes_check;
+  VALIDATE CONSTRAINT workspace_control_events_actor_original_bytes_check;

package/drizzle/0069_session_event_history_backfill.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-64: finish the 0067 expand/contract sequence. The trigger has bounded
+-- tracking-64: finish the 0067 expand/contract sequence. The trigger has bounded
 -- every new/updated row since 0067; now rewrite only legacy violations through
 -- that trigger and validate the durable storage invariant.
 
@@ -29,4 +29,4 @@ ALTER TABLE session_events
   VALIDATE CONSTRAINT session_events_client_event_id_bytes_check,
   VALIDATE CONSTRAINT session_events_producer_id_bytes_check,
   VALIDATE CONSTRAINT session_events_turn_association_bytes_check,
-  VALIDATE CONSTRAINT session_events_duplicate_reason_bytes_check;
+  VALIDATE CONSTRAINT session_events_duplicate_reason_bytes_check;

package/drizzle/0074_session_activity_revisions.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: rolling
--- OPE-65: transactional workspace revisions make updated-order discovery and
+-- tracking-65: transactional workspace revisions make updated-order discovery and
 -- its next incremental scan one gap-free handoff independent of application
 -- clocks. Existing sessions remain revision zero until their next activity.
 
@@ -69,4 +69,4 @@ BEGIN
 END $grants$;
 
 RESET statement_timeout;
-RESET lock_timeout;
+RESET lock_timeout;

package/drizzle/0106_session_attempt_mcp_approval_policies.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: maintenance
+-- Workers are drained before this migration so no executable attempt can cross
+-- the boundary without an immutable approval-policy snapshot. Closed attempts
+-- are historical evidence only and receive an inert empty snapshot.
+SET lock_timeout = '5s';
+SET statement_timeout = '5min';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "session_turn_attempts"
+    WHERE "state" <> 'closed'
+    LIMIT 1
+  ) THEN
+    RAISE EXCEPTION
+      'live session turn attempts must be drained before the MCP approval-policy cutover';
+  END IF;
+END
+$$;
+
+ALTER TABLE "session_turn_attempts"
+  ADD COLUMN "mcp_approval_policies" jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+-- PostgreSQL installs a constant default without rewriting the historical
+-- table. Remove the default immediately: every new attempt must provide its
+-- claim-time snapshot explicitly.
+ALTER TABLE "session_turn_attempts"
+  ALTER COLUMN "mcp_approval_policies" DROP DEFAULT;