@opengeni/db 3.6.0 → 3.7.4

package/drizzle/0374_session_event_cursors.sql

@@ -0,0 +1,315 @@
+-- deployment-mode: rolling
+-- Phase A of the narrow session-event sequencer: mirror and verify every
+-- committed append before any writer stops using sessions.last_sequence.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE session_event_cursors (
+  session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  last_sequence integer NOT NULL DEFAULT 0,
+  revision bigint NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT session_event_cursors_sequence_check CHECK (last_sequence >= 0),
+  CONSTRAINT session_event_cursors_revision_check CHECK (revision >= 0),
+  CONSTRAINT session_event_cursors_workspace_account_fk
+    FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id)
+    ON DELETE CASCADE,
+  CONSTRAINT session_event_cursors_workspace_session_fk
+    FOREIGN KEY (workspace_id, session_id)
+    REFERENCES sessions(workspace_id, id)
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX session_event_cursors_workspace_session_idx
+  ON session_event_cursors(workspace_id, session_id);
+
+COMMENT ON TABLE session_event_cursors IS
+  'Narrow exact per-session event cursor. Migration 0374 mirrors sessions.last_sequence; a later activation may make this row the allocator and admission gate.';
+COMMENT ON COLUMN session_event_cursors.revision IS
+  'Monotonic count of successful event-insert statements that advanced this cursor.';
+
+ALTER TABLE session_event_cursors ENABLE ROW LEVEL SECURITY;
+ALTER TABLE session_event_cursors FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON session_event_cursors
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- The cursor is a direct session reference and must preserve private-session
+-- visibility just like every other FORCE-RLS session-owned runtime table.
+CREATE POLICY session_visibility_isolation ON session_event_cursors AS RESTRICTIVE
+  USING (session_reference_visible(account_id, workspace_id, session_id))
+  WITH CHECK (session_reference_visible(account_id, workspace_id, session_id));
+
+DO $session_event_cursor_owner_policies$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+  target_schema_oid oid := pg_catalog.current_schema()::pg_catalog.regnamespace;
+  migration_owner text := current_user;
+BEGIN
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY session_tenancy_fence_inventory_read ON %I.session_event_cursors '
+      || 'FOR SELECT USING ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, true))',
+    target_schema,
+    target_schema,
+    migration_owner,
+    target_schema_oid
+  );
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY session_tenancy_fenced_owner_write ON %I.session_event_cursors '
+      || 'FOR ALL USING ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, false)) '
+      || 'WITH CHECK ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, false))',
+    target_schema,
+    target_schema,
+    migration_owner,
+    target_schema_oid,
+    target_schema,
+    migration_owner,
+    target_schema_oid
+  );
+END
+$session_event_cursor_owner_policies$;
+
+-- FORCE RLS remains enabled for runtime roles. Temporarily let the table owner
+-- inspect all existing rows while the migration transaction holds the DDL
+-- locks, then restore FORCE before commit.
+ALTER TABLE sessions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_event_cursors NO FORCE ROW LEVEL SECURITY;
+
+DO $session_event_cursor_parity$
+DECLARE
+  mismatch record;
+BEGIN
+  SELECT
+    sessions.id AS session_id,
+    sessions.last_sequence AS stored_sequence,
+    COUNT(session_events.sequence)::integer AS event_count,
+    MIN(session_events.sequence)::integer AS first_event_sequence,
+    MAX(session_events.sequence)::integer AS last_event_sequence
+  INTO mismatch
+  FROM sessions
+  LEFT JOIN session_events
+    ON session_events.workspace_id = sessions.workspace_id
+   AND session_events.session_id = sessions.id
+  GROUP BY sessions.id, sessions.last_sequence
+  HAVING COUNT(session_events.sequence)::integer <> sessions.last_sequence
+    OR (
+      sessions.last_sequence = 0
+      AND (
+        MIN(session_events.sequence) IS NOT NULL
+        OR MAX(session_events.sequence) IS NOT NULL
+      )
+    )
+    OR (
+      sessions.last_sequence > 0
+      AND (
+        MIN(session_events.sequence)::integer <> 1
+        OR MAX(session_events.sequence)::integer <> sessions.last_sequence
+      )
+    )
+  LIMIT 1;
+
+  IF FOUND THEN
+    RAISE EXCEPTION USING
+      ERRCODE = '55000',
+      MESSAGE = 'session event cursor backfill refused because sessions.last_sequence diverges from durable event history',
+      DETAIL = pg_catalog.format(
+        'session_id=%s stored_sequence=%s event_count=%s first_event_sequence=%s last_event_sequence=%s',
+        mismatch.session_id,
+        mismatch.stored_sequence,
+        mismatch.event_count,
+        mismatch.first_event_sequence,
+        mismatch.last_event_sequence
+      );
+  END IF;
+END
+$session_event_cursor_parity$;
+
+INSERT INTO session_event_cursors (
+  session_id,
+  account_id,
+  workspace_id,
+  last_sequence
+)
+SELECT id, account_id, workspace_id, last_sequence
+FROM sessions;
+
+ALTER TABLE session_event_cursors FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events FORCE ROW LEVEL SECURITY;
+ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
+
+CREATE FUNCTION initialize_session_event_cursors_for_inserted_sessions()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path FROM CURRENT
+AS $initialize_session_event_cursors$
+BEGIN
+  INSERT INTO session_event_cursors (
+    session_id,
+    account_id,
+    workspace_id,
+    last_sequence
+  )
+  -- A session row must exist before any event can reference it, so a newly
+  -- inserted session has no durable event history yet. Some lifecycle
+  -- functions pre-seed sessions.last_sequence for events they insert later in
+  -- the same transaction; copying that future projection here would make the
+  -- first real event look like a duplicate.
+  SELECT id, account_id, workspace_id, 0
+  FROM inserted_sessions
+  ON CONFLICT (session_id) DO NOTHING;
+  RETURN NULL;
+END
+$initialize_session_event_cursors$;
+
+CREATE TRIGGER sessions_initialize_event_cursors
+AFTER INSERT ON sessions
+REFERENCING NEW TABLE AS inserted_sessions
+FOR EACH STATEMENT
+EXECUTE FUNCTION initialize_session_event_cursors_for_inserted_sessions();
+
+CREATE FUNCTION advance_session_event_cursors_for_inserted_events()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $advance_session_event_cursors$
+DECLARE
+  fenced_access_capability_id uuid;
+  inserted_group record;
+  current_sequence integer;
+BEGIN
+  -- Runtime writers already hold the exact workspace tenancy fence before an
+  -- event insert. Open only the transaction-local owner capability needed for
+  -- this trigger to inspect and advance the FORCE-RLS cursor under that fence.
+  fenced_access_capability_id :=
+    opengeni_private.open_session_tenancy_fenced_access(
+      session_tenancy_fence_target_schema()
+    );
+  FOR inserted_group IN
+    SELECT
+      account_id,
+      workspace_id,
+      session_id,
+      MIN(sequence)::integer AS first_sequence,
+      MAX(sequence)::integer AS last_sequence,
+      COUNT(*)::integer AS sequence_count,
+      COUNT(DISTINCT sequence)::integer AS distinct_sequence_count
+    FROM inserted_session_events
+    GROUP BY account_id, workspace_id, session_id
+    ORDER BY workspace_id, session_id
+  LOOP
+    SELECT last_sequence
+    INTO current_sequence
+    FROM session_event_cursors
+    WHERE account_id = inserted_group.account_id
+      AND workspace_id = inserted_group.workspace_id
+      AND session_id = inserted_group.session_id
+    FOR UPDATE;
+
+    IF NOT FOUND THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '55000',
+        MESSAGE = 'session event cursor is missing for an inserted event',
+        DETAIL = pg_catalog.format(
+          'workspace_id=%s session_id=%s',
+          inserted_group.workspace_id,
+          inserted_group.session_id
+        );
+    END IF;
+
+    IF inserted_group.distinct_sequence_count <> inserted_group.sequence_count
+      OR inserted_group.first_sequence <> current_sequence + 1
+      OR inserted_group.last_sequence <> current_sequence + inserted_group.sequence_count
+    THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '55000',
+        MESSAGE = 'session event insert does not exactly continue the durable cursor',
+        DETAIL = pg_catalog.format(
+          'workspace_id=%s session_id=%s current=%s first=%s last=%s count=%s distinct=%s',
+          inserted_group.workspace_id,
+          inserted_group.session_id,
+          current_sequence,
+          inserted_group.first_sequence,
+          inserted_group.last_sequence,
+          inserted_group.sequence_count,
+          inserted_group.distinct_sequence_count
+        );
+    END IF;
+
+    UPDATE session_event_cursors
+    SET last_sequence = inserted_group.last_sequence,
+        revision = revision + 1,
+        updated_at = now()
+    WHERE account_id = inserted_group.account_id
+      AND workspace_id = inserted_group.workspace_id
+      AND session_id = inserted_group.session_id
+      AND last_sequence = current_sequence;
+
+    IF NOT FOUND THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '40001',
+        MESSAGE = 'session event cursor changed while applying an inserted event statement';
+    END IF;
+  END LOOP;
+  PERFORM opengeni_private.close_session_tenancy_fenced_access(
+    fenced_access_capability_id
+  );
+  RETURN NULL;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM opengeni_private.close_session_tenancy_fenced_access(
+    fenced_access_capability_id
+  );
+  RAISE;
+END
+$advance_session_event_cursors$;
+
+-- Trigger functions may resolve target-schema relations, but pg_temp must not
+-- precede those relations. In particular, the SECURITY DEFINER event trigger
+-- must not be redirected through caller-owned temporary objects.
+DO $session_event_cursor_function_paths$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.initialize_session_event_cursors_for_inserted_sessions() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.advance_session_event_cursors_for_inserted_events() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+END
+$session_event_cursor_function_paths$;
+
+REVOKE ALL ON FUNCTION advance_session_event_cursors_for_inserted_events() FROM PUBLIC;
+
+CREATE TRIGGER session_events_advance_event_cursors
+AFTER INSERT ON session_events
+REFERENCING NEW TABLE AS inserted_session_events
+FOR EACH STATEMENT
+EXECUTE FUNCTION advance_session_event_cursors_for_inserted_events();
+
+DO $session_event_cursor_runtime_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON session_event_cursors TO opengeni_app;
+  END IF;
+END
+$session_event_cursor_runtime_grants$;

package/drizzle/0375_session_recovery_observability.sql

@@ -0,0 +1,73 @@
+-- deployment-mode: rolling
+-- Expose one content-free, bounded-cardinality aggregate for durable recovery
+-- states that process-local turn gauges cannot see.
+
+CREATE OR REPLACE FUNCTION opengeni_private.count_session_recovery_backlog()
+RETURNS TABLE (state text, count bigint)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $count_session_recovery_backlog$
+  WITH recovery_states(state) AS (
+    VALUES ('quiescence_missing'::text), ('projection_stale'::text)
+  ), candidates AS (
+    SELECT CASE
+      WHEN attempt.quiesced_at IS NULL THEN 'quiescence_missing'::text
+      ELSE 'projection_stale'::text
+    END AS state
+    FROM sessions session
+    JOIN session_turns turn
+      ON turn.workspace_id = session.workspace_id
+     AND turn.session_id = session.id
+     AND turn.id = session.active_turn_id
+    JOIN LATERAL (
+      SELECT candidate.id, candidate.state, candidate.outcome, candidate.quiesced_at
+      FROM session_turn_attempts candidate
+      WHERE candidate.workspace_id = turn.workspace_id
+        AND candidate.session_id = turn.session_id
+        AND candidate.turn_id = turn.id
+      ORDER BY candidate.execution_generation DESC, candidate.updated_at DESC, candidate.id DESC
+      LIMIT 1
+    ) attempt ON true
+    WHERE session.status = 'recovering'
+      AND turn.status = 'recovering'
+      AND turn.active_attempt_id IS NULL
+      AND attempt.state = 'closed'
+      AND attempt.outcome = 'interrupted_recoverable'
+      AND (
+        EXISTS (
+          SELECT 1
+          FROM session_attempt_interruptions interruption
+          WHERE interruption.workspace_id = session.workspace_id
+            AND interruption.session_id = session.id
+            AND interruption.attempt_id = attempt.id
+            AND interruption.state IN ('settled', 'rejected_stale')
+        )
+        OR EXISTS (
+          SELECT 1
+          FROM session_events event
+          WHERE event.workspace_id = session.workspace_id
+            AND event.session_id = session.id
+            AND event.turn_id = turn.id
+            AND event.turn_attempt_id = attempt.id
+            AND event.type = 'turn.recovery.requested'
+        )
+      )
+  )
+  SELECT recovery_states.state, count(candidates.state)::bigint
+  FROM recovery_states
+  LEFT JOIN candidates USING (state)
+  GROUP BY recovery_states.state
+  ORDER BY recovery_states.state;
+$count_session_recovery_backlog$;
+
+REVOKE ALL ON FUNCTION opengeni_private.count_session_recovery_backlog() FROM PUBLIC;
+
+DO $session_recovery_observability_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.count_session_recovery_backlog() TO opengeni_app;
+  END IF;
+END
+$session_recovery_observability_grants$;

package/drizzle/0376_organization_workspace_inventory.sql

@@ -0,0 +1,88 @@
+-- deployment-mode: rolling
+-- Account-scoped organization API keys need one complete shared-workspace
+-- inventory without direct runtime access to organization membership rows.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE FUNCTION list_organization_workspace_ids(p_account_id uuid)
+RETURNS TABLE (workspace_id uuid)
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  previous_lifecycle text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF p_account_id IS NULL
+    OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR opengeni_private.current_workspace_id() IS NOT NULL
+  THEN
+    RAISE EXCEPTION 'organization workspace inventory authority required'
+      USING ERRCODE = '42501';
+  END IF;
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle',
+    'organization_membership_lifecycle', true
+  );
+
+  RETURN QUERY
+  SELECT workspace.id
+  FROM workspaces workspace
+  WHERE workspace.account_id = p_account_id
+    AND NOT EXISTS (
+      SELECT 1
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.personal_workspace_id = workspace.id
+    );
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+  );
+  RETURN;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+  );
+  RAISE;
+END
+$body$;
+
+REVOKE ALL ON FUNCTION list_organization_workspace_ids(uuid) FROM PUBLIC;
+
+DO $pin_and_grant_organization_workspace_inventory$
+DECLARE
+  data_schema text := current_schema();
+  application_role text;
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.list_organization_workspace_ids(uuid) '
+      'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+
+  FOR application_role IN
+    SELECT role_value.rolname
+    FROM pg_catalog.jsonb_array_elements_text(
+      coalesce(
+        nullif(current_setting('opengeni.migration_application_roles', true), ''),
+        '[]'
+      )::jsonb
+    ) configured(value)
+    JOIN pg_catalog.pg_roles role_value
+      ON role_value.rolname = configured.value
+    UNION
+    SELECT 'opengeni_app'
+    WHERE EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app')
+  LOOP
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.list_organization_workspace_ids(uuid) TO %I',
+      data_schema, application_role
+    );
+  END LOOP;
+END
+$pin_and_grant_organization_workspace_inventory$;
+
+COMMENT ON FUNCTION list_organization_workspace_ids(uuid) IS
+  'Complete content-free organization workspace inventory. Canonical personal-workspace pointers are excluded under exact account scope.';

package/drizzle/0377_scoped_rig_health_projection.sql

@@ -0,0 +1,80 @@
+-- deployment-mode: rolling
+-- Keep the access-controlled Rig projection in parity with the ordinary
+-- workspace query: terminal verification evidence for the active version must
+-- be visible to REST and first-party MCP callers instead of staying unknown.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE OR REPLACE FUNCTION scoped_rig_json(p_rig_id uuid) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path FROM CURRENT AS $$
+  SELECT pg_catalog.jsonb_build_object(
+    'id', rig.id, 'accountId', rig.account_id, 'workspaceId', rig.workspace_id,
+    'scope', rig.authority_scope, 'generation', rig.generation, 'status', rig.status,
+    'name', rig.name, 'description', rig.description, 'createdBy', rig.created_by,
+    'activeVersion', (
+      SELECT pg_catalog.jsonb_build_object(
+        'id', version.id, 'rigId', version.rig_id, 'version', version.version,
+        'image', version.image, 'setupScript', version.setup_script,
+        'checks', version.checks, 'credentialHooks', version.credential_hooks,
+        'defaultVariableSetIds', version.default_variable_set_ids,
+        'changelog', version.changelog, 'providerImages', version.provider_images,
+        'createdBy', version.created_by, 'active', version.active,
+        'createdAt', version.created_at
+      ) FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id
+        AND version.active = true LIMIT 1
+    ),
+    'activeVersionHealth', (
+      SELECT pg_catalog.jsonb_build_object(
+        'checkHealth', coalesce(health.check_health, 'unknown'),
+        'lastVerifiedAt', health.verified_at
+      )
+      FROM rig_versions active_version
+      LEFT JOIN LATERAL (
+        SELECT candidate.check_health, candidate.verified_at
+        FROM (
+          SELECT CASE change.verification ->> 'passed'
+              WHEN 'true' THEN 'passing' WHEN 'false' THEN 'failing' END AS check_health,
+            coalesce(
+              nullif(change.verification ->> 'finishedAt', '')::timestamptz,
+              change.updated_at
+            ) AS verified_at
+          FROM rig_changes change
+          WHERE change.account_id = active_version.account_id
+            AND change.workspace_id = active_version.workspace_id
+            AND change.result_version_id = active_version.id
+            AND change.verification ->> 'passed' IN ('true', 'false')
+          UNION ALL
+          SELECT CASE event.action WHEN 'rig.verification.passed' THEN 'passing'
+              ELSE 'failing' END,
+            coalesce(
+              nullif(event.metadata ->> 'finishedAt', '')::timestamptz,
+              event.occurred_at
+            )
+          FROM audit_events event
+          WHERE event.account_id = active_version.account_id
+            AND event.workspace_id = active_version.workspace_id
+            AND event.target_type = 'rig'
+            AND event.target_id = rig.id::text
+            AND event.action IN ('rig.verification.passed', 'rig.verification.failed')
+            AND event.metadata ->> 'versionId' = active_version.id::text
+        ) candidate
+        ORDER BY candidate.verified_at DESC
+        LIMIT 1
+      ) health ON true
+      WHERE active_version.rig_id = rig.id
+        AND active_version.account_id = rig.account_id
+        AND active_version.active = true
+      LIMIT 1
+    ),
+    'versionCount', (SELECT count(*)::integer FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id),
+    'createdAt', rig.created_at, 'updatedAt', rig.updated_at
+  ) FROM rigs rig WHERE rig.id = p_rig_id
+$$;
+
+REVOKE ALL ON FUNCTION scoped_rig_json(uuid) FROM PUBLIC;
+
+COMMENT ON FUNCTION scoped_rig_json(uuid) IS
+  'Access-controlled Rig projection with active-version health from the latest terminal change or audit verification evidence.';

package/drizzle/0378_scoped_rig_health_audit_timestamp.sql

@@ -0,0 +1,77 @@
+-- deployment-mode: rolling
+-- Repair the already-ledgered scoped Rig health projection so generic audit
+-- metadata can never abort a SECURITY DEFINER read. Audit occurrence time is
+-- the trusted ordering and display timestamp for audit-backed evidence.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE OR REPLACE FUNCTION scoped_rig_json(p_rig_id uuid) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path FROM CURRENT AS $$
+  SELECT pg_catalog.jsonb_build_object(
+    'id', rig.id, 'accountId', rig.account_id, 'workspaceId', rig.workspace_id,
+    'scope', rig.authority_scope, 'generation', rig.generation, 'status', rig.status,
+    'name', rig.name, 'description', rig.description, 'createdBy', rig.created_by,
+    'activeVersion', (
+      SELECT pg_catalog.jsonb_build_object(
+        'id', version.id, 'rigId', version.rig_id, 'version', version.version,
+        'image', version.image, 'setupScript', version.setup_script,
+        'checks', version.checks, 'credentialHooks', version.credential_hooks,
+        'defaultVariableSetIds', version.default_variable_set_ids,
+        'changelog', version.changelog, 'providerImages', version.provider_images,
+        'createdBy', version.created_by, 'active', version.active,
+        'createdAt', version.created_at
+      ) FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id
+        AND version.active = true LIMIT 1
+    ),
+    'activeVersionHealth', (
+      SELECT pg_catalog.jsonb_build_object(
+        'checkHealth', coalesce(health.check_health, 'unknown'),
+        'lastVerifiedAt', health.verified_at
+      )
+      FROM rig_versions active_version
+      LEFT JOIN LATERAL (
+        SELECT candidate.check_health, candidate.verified_at
+        FROM (
+          SELECT CASE change.verification ->> 'passed'
+              WHEN 'true' THEN 'passing' WHEN 'false' THEN 'failing' END AS check_health,
+            coalesce(
+              nullif(change.verification ->> 'finishedAt', '')::timestamptz,
+              change.updated_at
+            ) AS verified_at
+          FROM rig_changes change
+          WHERE change.account_id = active_version.account_id
+            AND change.workspace_id = active_version.workspace_id
+            AND change.result_version_id = active_version.id
+            AND change.verification ->> 'passed' IN ('true', 'false')
+          UNION ALL
+          SELECT CASE event.action WHEN 'rig.verification.passed' THEN 'passing'
+              ELSE 'failing' END,
+            event.occurred_at
+          FROM audit_events event
+          WHERE event.account_id = active_version.account_id
+            AND event.workspace_id = active_version.workspace_id
+            AND event.target_type = 'rig'
+            AND event.target_id = rig.id::text
+            AND event.action IN ('rig.verification.passed', 'rig.verification.failed')
+            AND event.metadata ->> 'versionId' = active_version.id::text
+        ) candidate
+        ORDER BY candidate.verified_at DESC
+        LIMIT 1
+      ) health ON true
+      WHERE active_version.rig_id = rig.id
+        AND active_version.account_id = rig.account_id
+        AND active_version.active = true
+      LIMIT 1
+    ),
+    'versionCount', (SELECT count(*)::integer FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id),
+    'createdAt', rig.created_at, 'updatedAt', rig.updated_at
+  ) FROM rigs rig WHERE rig.id = p_rig_id
+$$;
+
+REVOKE ALL ON FUNCTION scoped_rig_json(uuid) FROM PUBLIC;
+
+COMMENT ON FUNCTION scoped_rig_json(uuid) IS
+  'Access-controlled Rig projection with active-version health from terminal evidence and trusted audit occurrence timestamps.';