@opengeni/db 4.2.2 → 4.3.0-canary.0

package/drizzle/0450_external_identity_link_work.sql

@@ -0,0 +1,179 @@
+-- deployment-mode: maintenance
+-- Link provenance is separate from ownership and from historical creator audit.
+-- An inherited revoked link remains attached: omission must never turn old work
+-- into an unrestricted native-user operation.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0450 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0450 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0450 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE external_link_turn_authorities (
+  turn_id uuid PRIMARY KEY REFERENCES session_turns(id) ON DELETE CASCADE,
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL,
+  session_id uuid NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  link_id uuid NOT NULL REFERENCES external_identity_links(id),
+  link_revision bigint NOT NULL CHECK (link_revision BETWEEN 1 AND 9007199254740991),
+  canonical_snapshot jsonb NOT NULL CHECK (jsonb_typeof(canonical_snapshot) = 'object' AND octet_length(canonical_snapshot::text) <= 65536),
+  source_kind text NOT NULL CHECK (source_kind IN ('direct','causal','child','scheduled')),
+  source_turn_id uuid REFERENCES session_turns(id),
+  source_task_id uuid REFERENCES scheduled_tasks(id),
+  source_task_revision bigint,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  FOREIGN KEY (workspace_id, account_id) REFERENCES workspaces(id, account_id),
+  CHECK ((source_kind = 'direct' AND source_turn_id IS NULL AND source_task_id IS NULL AND source_task_revision IS NULL)
+    OR (source_kind IN ('causal','child') AND source_turn_id IS NOT NULL AND source_task_id IS NULL AND source_task_revision IS NULL)
+    OR (source_kind = 'scheduled' AND source_turn_id IS NULL AND source_task_id IS NOT NULL AND source_task_revision > 0))
+);
+CREATE TABLE external_link_task_authorities (
+  task_id uuid NOT NULL REFERENCES scheduled_tasks(id) ON DELETE CASCADE,
+  task_revision bigint NOT NULL CHECK (task_revision BETWEEN 1 AND 9007199254740991),
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL,
+  link_id uuid NOT NULL REFERENCES external_identity_links(id),
+  link_revision bigint NOT NULL CHECK (link_revision BETWEEN 1 AND 9007199254740991),
+  canonical_snapshot jsonb NOT NULL CHECK (jsonb_typeof(canonical_snapshot) = 'object' AND octet_length(canonical_snapshot::text) <= 65536),
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  PRIMARY KEY (task_id, task_revision),
+  FOREIGN KEY (workspace_id, account_id) REFERENCES workspaces(id, account_id)
+);
+ALTER TABLE external_link_turn_authorities ENABLE ROW LEVEL SECURITY;
+ALTER TABLE external_link_turn_authorities FORCE ROW LEVEL SECURITY;
+CREATE POLICY session_visibility_isolation ON external_link_turn_authorities AS RESTRICTIVE
+  USING (session_reference_visible(account_id, workspace_id, session_id))
+  WITH CHECK (session_reference_visible(account_id, workspace_id, session_id));
+ALTER TABLE external_link_task_authorities ENABLE ROW LEVEL SECURITY;
+ALTER TABLE external_link_task_authorities FORCE ROW LEVEL SECURITY;
+CREATE POLICY external_link_turn_authorities_scope ON external_link_turn_authorities
+  USING (account_id = opengeni_private.current_account_id() AND workspace_id = opengeni_private.current_workspace_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id() AND workspace_id = opengeni_private.current_workspace_id());
+CREATE POLICY external_link_task_authorities_scope ON external_link_task_authorities
+  USING (account_id = opengeni_private.current_account_id() AND workspace_id = opengeni_private.current_workspace_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id() AND workspace_id = opengeni_private.current_workspace_id());
+
+CREATE FUNCTION opengeni_private.guard_external_link_work_snapshot() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+DECLARE
+  l external_identity_links%ROWTYPE;
+  t session_turns%ROWTYPE;
+  s sessions%ROWTYPE;
+  source_snapshot jsonb;
+  revision_authority jsonb;
+BEGIN
+  IF TG_OP <> 'INSERT' OR NEW.account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR NEW.workspace_id IS DISTINCT FROM opengeni_private.current_workspace_id() THEN
+    RAISE EXCEPTION 'external link work scope unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO l FROM external_identity_links WHERE id = NEW.link_id AND account_id = NEW.account_id;
+  IF NOT FOUND OR l.native_subject_id IS NULL
+    OR NEW.canonical_snapshot #>> '{actor,accountId}' IS DISTINCT FROM NEW.account_id::text
+    OR NEW.canonical_snapshot #>> '{actor,linkId}' IS DISTINCT FROM NEW.link_id::text
+    OR NEW.canonical_snapshot #>> '{actor,linkRevision}' IS DISTINCT FROM NEW.link_revision::text
+    OR NEW.canonical_snapshot #>> '{actor,actingMode}' IS DISTINCT FROM 'linked_native'
+    OR NEW.canonical_snapshot #>> '{actor,effectiveSubjectId}' IS DISTINCT FROM l.native_subject_id
+    OR NEW.canonical_snapshot #>> '{actor,externalIdentityId}' IS DISTINCT FROM l.external_identity_id::text
+    OR NEW.canonical_snapshot #>> '{actor,externalSubjectId}' IS DISTINCT FROM l.external_subject_id
+    OR NEW.canonical_snapshot #>> '{actor,externalAuthorizationRevision}' IS DISTINCT FROM l.external_authorization_revision::text
+    OR jsonb_typeof(NEW.canonical_snapshot -> 'permissions') IS DISTINCT FROM 'array'
+    OR NOT (NEW.canonical_snapshot -> 'permissions') <@ l.permissions THEN
+    RAISE EXCEPTION 'invalid external link work snapshot' USING ERRCODE = '42501';
+  END IF;
+  IF TG_TABLE_NAME = 'external_link_task_authorities' THEN
+    IF NOT EXISTS (SELECT 1 FROM scheduled_tasks task WHERE task.id = NEW.task_id
+      AND task.account_id = NEW.account_id AND task.workspace_id = NEW.workspace_id
+      AND task.authority_revision = NEW.task_revision) THEN
+      RAISE EXCEPTION 'external link task revision unavailable' USING ERRCODE = '42501';
+    END IF;
+    revision_authority := scheduled_task_revision_authority_snapshot(NEW.account_id, NEW.workspace_id, NEW.task_id, NEW.task_revision);
+    IF revision_authority IS NULL OR revision_authority ->> 'subjectId' IS DISTINCT FROM l.native_subject_id
+      OR revision_authority ->> 'organizationMembershipId' IS DISTINCT FROM l.native_membership_id::text
+      OR revision_authority ->> 'membershipAuthorizationRevision' IS DISTINCT FROM l.native_authorization_revision::text THEN
+      RAISE EXCEPTION 'external link task owner changed' USING ERRCODE = '42501';
+    END IF;
+    RETURN NEW;
+  END IF;
+  SELECT * INTO t FROM session_turns WHERE id = NEW.turn_id AND session_id = NEW.session_id
+    AND account_id = NEW.account_id AND workspace_id = NEW.workspace_id;
+  SELECT * INTO s FROM sessions WHERE id = NEW.session_id AND account_id = NEW.account_id AND workspace_id = NEW.workspace_id;
+  IF t.id IS NULL OR s.id IS NULL OR t.initiating_human_subject_id IS DISTINCT FROM l.native_subject_id
+    OR EXISTS (SELECT 1 FROM session_turn_attempts a WHERE a.turn_id = t.id) THEN
+    RAISE EXCEPTION 'external link turn admission unavailable' USING ERRCODE = '42501';
+  END IF;
+  IF NEW.source_kind = 'direct' THEN
+    IF t.source NOT IN ('user','api') OR t.status <> 'queued' OR t.active_attempt_id IS NOT NULL
+      OR l.status <> 'active' OR l.revision <> NEW.link_revision
+      OR (l.expires_at IS NOT NULL AND l.expires_at <= clock_timestamp()) THEN
+      RAISE EXCEPTION 'external link direct admission unavailable' USING ERRCODE = '42501';
+    END IF;
+  ELSIF NEW.source_kind IN ('causal','child') THEN
+    SELECT a.canonical_snapshot INTO source_snapshot FROM external_link_turn_authorities a
+      WHERE a.turn_id = NEW.source_turn_id AND a.account_id = NEW.account_id AND a.workspace_id = NEW.workspace_id;
+    IF source_snapshot IS DISTINCT FROM NEW.canonical_snapshot THEN
+      RAISE EXCEPTION 'external link source snapshot changed' USING ERRCODE = '42501';
+    END IF;
+    IF NEW.source_kind = 'child' AND (s.parent_turn_id IS DISTINCT FROM NEW.source_turn_id OR t.status <> 'queued') THEN
+      RAISE EXCEPTION 'external link child source unavailable' USING ERRCODE = '42501';
+    END IF;
+    IF NEW.source_kind = 'child' AND NOT EXISTS (SELECT 1 FROM session_turns source
+      WHERE source.id = NEW.source_turn_id AND source.session_id = s.parent_session_id) THEN
+      RAISE EXCEPTION 'external link child parent mismatch' USING ERRCODE = '42501';
+    END IF;
+    IF NEW.source_kind = 'causal' AND (t.source NOT IN ('goal','system') OR t.status <> 'running'
+      OR NOT EXISTS (SELECT 1 FROM session_turns source WHERE source.id = NEW.source_turn_id AND source.session_id = t.session_id)) THEN
+      RAISE EXCEPTION 'external link causal source unavailable' USING ERRCODE = '42501';
+    END IF;
+    IF NEW.source_kind = 'causal' AND NOT EXISTS (SELECT 1 FROM session_system_updates u
+      WHERE u.account_id = NEW.account_id AND u.workspace_id = NEW.workspace_id AND u.session_id = NEW.session_id
+        AND u.delivered_turn_id = NEW.turn_id AND u.state = 'delivered' AND u.delivered_history_item_id IS NOT NULL
+        AND ((u.kind = 'goal_continuation' AND u.lineage ->> 'causalTurnId' = NEW.source_turn_id::text)
+          OR (u.kind IN ('child_terminal_result','child_requires_action','child_requires_action_resolved','child_paused','child_waiting_capacity','child_progress')
+            AND u.lineage ->> 'parentTurnId' = NEW.source_turn_id::text))) THEN
+      RAISE EXCEPTION 'external link exact causal delivery unavailable' USING ERRCODE = '42501';
+    END IF;
+  ELSE
+    SELECT a.canonical_snapshot INTO source_snapshot FROM external_link_task_authorities a
+      WHERE a.task_id = NEW.source_task_id AND a.task_revision = NEW.source_task_revision
+        AND a.account_id = NEW.account_id AND a.workspace_id = NEW.workspace_id;
+    IF source_snapshot IS DISTINCT FROM NEW.canonical_snapshot OR t.source <> 'system' OR t.status <> 'running' THEN
+      RAISE EXCEPTION 'external link scheduled source unavailable' USING ERRCODE = '42501';
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM scheduled_task_runs r WHERE r.id = t.scheduled_task_run_id
+      AND r.task_id = NEW.source_task_id AND r.task_authority_revision = NEW.source_task_revision
+      AND r.account_id = NEW.account_id AND r.workspace_id = NEW.workspace_id AND r.session_id = NEW.session_id
+      AND r.accepted_execution #>> '{causalHuman,subjectId}' = l.native_subject_id) THEN
+      RAISE EXCEPTION 'external link scheduled run mismatch' USING ERRCODE = '42501';
+    END IF;
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER external_link_turn_snapshot_guard BEFORE INSERT OR UPDATE ON external_link_turn_authorities
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_external_link_work_snapshot();
+CREATE TRIGGER external_link_task_snapshot_guard BEFORE INSERT OR UPDATE ON external_link_task_authorities
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_external_link_work_snapshot();
+REVOKE ALL ON TABLE external_link_turn_authorities, external_link_task_authorities FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.guard_external_link_work_snapshot() FROM PUBLIC;
+DO $drain$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0450 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;

package/drizzle/0451_external_link_preview_and_permission_ceiling.sql

@@ -0,0 +1,82 @@
+-- deployment-mode: maintenance
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0451 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0451 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0451 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+-- Preserve all 0426 exact-work guards. Replace one asserted clause, not a
+-- best-effort search, so divergence from that immutable routine aborts migration.
+DO $ceiling$
+DECLARE
+  definition text := pg_get_functiondef('opengeni_private.guard_external_link_work_snapshot()'::regprocedure);
+  prior text := 'OR NOT (NEW.canonical_snapshot -> ''permissions'') <@ l.permissions THEN';
+  replacement text := $clause$OR EXISTS (
+      SELECT 1 FROM jsonb_array_elements(NEW.canonical_snapshot -> 'permissions') p
+      WHERE jsonb_typeof(p) <> 'string' OR NOT (
+        l.permissions ? (p #>> '{}') OR
+        (l.permissions ? 'workspace:admin' AND p #>> '{}' <> 'secrets:read')
+      )
+    ) THEN$clause$;
+BEGIN
+  IF length(definition) - length(replace(definition, prior, '')) <> length(prior) THEN
+    RAISE EXCEPTION '0451 expected exactly one 0426 permission clause' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, prior, replacement);
+END
+$ceiling$;
+
+-- The app role cannot SELECT external_identities directly. Expose only the
+-- challenged request's display reference to an active native organization member.
+CREATE FUNCTION get_external_identity_link_reference(p_account_id uuid, p_link_id uuid, p_challenge_digest text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $body$
+DECLARE
+  result jsonb;
+  prior text := coalesce(current_setting('opengeni.organization_tenancy_lifecycle', true), '');
+  subject text := opengeni_private.current_subject_id();
+BEGIN
+  IF p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR subject IS NULL OR subject !~ '^user:[^\r\n]+$'
+    OR p_challenge_digest !~ '^[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'native identity link preview authority required' USING ERRCODE = '42501';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM jsonb_array_elements(list_self_organization_memberships(subject)) m
+    WHERE m ->> 'organizationId' = p_account_id::text AND m ->> 'status' = 'active') THEN
+    RAISE EXCEPTION 'native identity link organization unavailable' USING ERRCODE = '42501';
+  END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  SELECT jsonb_build_object('source', e.source, 'externalId', e.external_id) INTO result
+    FROM external_identity_links l JOIN external_identities e
+      ON e.id = l.external_identity_id AND e.account_id = l.account_id
+    WHERE l.account_id = p_account_id AND l.id = p_link_id AND l.challenge_digest = p_challenge_digest
+      AND l.status = 'pending' AND l.confirm_before > clock_timestamp()
+      AND (l.expires_at IS NULL OR l.expires_at > clock_timestamp())
+      AND e.status = 'active' AND e.authorization_revision = l.external_authorization_revision;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', prior, true);
+  RETURN result;
+END
+$body$;
+REVOKE ALL ON FUNCTION get_external_identity_link_reference(uuid, uuid, text) FROM PUBLIC;
+DO $drain$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0451 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;

package/drizzle/0452_external_link_scheduled_origin.sql

@@ -0,0 +1,34 @@
+-- deployment-mode: maintenance
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $migration$
+DECLARE
+  roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+  definition text := pg_get_functiondef('opengeni_private.guard_external_link_work_snapshot()'::regprocedure);
+  prior text := 'AND r.accepted_execution #>> ''{causalHuman,subjectId}'' = l.native_subject_id';
+  replacement text := $clause$AND r.status = 'dispatched'
+      AND r.accepted_execution_snapshot ->> 'causalHumanSubjectId' = l.native_subject_id
+      AND validate_scheduled_agent_run_live_authority(NEW.account_id, NEW.workspace_id, r.id) IS NULL$clause$;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0452 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0452 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0452 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+  IF length(definition) - length(replace(definition, prior, '')) <> length(prior) THEN
+    RAISE EXCEPTION '0452 expected exactly one scheduled origin clause' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, prior, replacement);
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0452 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$migration$;

package/drizzle/0453_host_mcp_native_owner.sql

@@ -0,0 +1,35 @@
+-- deployment-mode: maintenance
+-- Host ownership follows the effective organization member. Linking creates no
+-- ownership transfer: old external bindings remain external, new native bindings
+-- are independent. Accepted linked work retains its separate revocable link.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0453 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0453 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0453 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+ALTER TABLE host_mcp_bindings
+  DROP CONSTRAINT host_mcp_bindings_external_owner_fk,
+  ADD CONSTRAINT host_mcp_bindings_member_owner_fk FOREIGN KEY (account_id, owner_subject_id)
+    REFERENCES organization_memberships(account_id, subject_id),
+  ADD CONSTRAINT host_mcp_bindings_human_owner_check CHECK (
+    owner_subject_id ~ '^(external_user:|user:)[^\r\n]+$');
+ALTER TABLE host_mcp_delegations
+  DROP CONSTRAINT host_mcp_delegations_external_owner_fk,
+  ADD CONSTRAINT host_mcp_delegations_member_owner_fk FOREIGN KEY (account_id, owner_subject_id)
+    REFERENCES organization_memberships(account_id, subject_id),
+  ADD CONSTRAINT host_mcp_delegations_human_owner_check CHECK (
+    owner_subject_id ~ '^(external_user:|user:)[^\r\n]+$');

package/drizzle/0454_connect_origin_authority.sql

@@ -0,0 +1,42 @@
+-- deployment-mode: maintenance
+-- Preserve the initiating external restriction separately from the effective
+-- resource owner. This is credential-free provenance, never a bearer token.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0454 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0454 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0454 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+ALTER TABLE connect_attempts ADD COLUMN external_continuation jsonb
+  CHECK (external_continuation IS NULL OR (jsonb_typeof(external_continuation) = 'object'
+    AND octet_length(external_continuation::text) <= 32768
+    AND external_continuation #>> '{actor,accountId}' = account_id::text
+    AND external_continuation #>> '{actor,effectiveSubjectId}' = subject_id));
+CREATE FUNCTION opengeni_private.guard_connect_attempt_origin() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  IF ROW(NEW.id, NEW.account_id, NEW.workspace_id, NEW.subject_id, NEW.idempotency_key_hash,
+      NEW.request_digest, NEW.return_url, NEW.external_continuation, NEW.expires_at, NEW.created_at)
+    IS DISTINCT FROM ROW(OLD.id, OLD.account_id, OLD.workspace_id, OLD.subject_id, OLD.idempotency_key_hash,
+      OLD.request_digest, OLD.return_url, OLD.external_continuation, OLD.expires_at, OLD.created_at) THEN
+    RAISE EXCEPTION 'Connect origin is immutable' USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+REVOKE ALL ON FUNCTION opengeni_private.guard_connect_attempt_origin() FROM PUBLIC;
+CREATE TRIGGER connect_attempt_origin_guard BEFORE UPDATE ON connect_attempts
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_connect_attempt_origin();

package/drizzle/0455_external_link_inventory_labels.sql

@@ -0,0 +1,44 @@
+-- deployment-mode: maintenance
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' OR jsonb_array_length(roles) NOT BETWEEN 1 AND 16 THEN
+    RAISE EXCEPTION '0455 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0455 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+-- No SELECT grant on external_identities. Only a current participant can resolve
+-- labels for the bounded links already returned by the participant inventory.
+CREATE FUNCTION get_external_identity_link_inventory_references(p_account_id uuid, p_link_ids uuid[])
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $body$
+DECLARE
+  result jsonb;
+  prior text := coalesce(current_setting('opengeni.organization_tenancy_lifecycle', true), '');
+  subject text := opengeni_private.current_subject_id();
+BEGIN
+  IF p_account_id IS DISTINCT FROM opengeni_private.current_account_id() OR subject IS NULL
+    OR p_link_ids IS NULL OR coalesce(cardinality(p_link_ids), 0) > 50 THEN
+    RAISE EXCEPTION 'identity link inventory authority required' USING ERRCODE = '42501';
+  END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  IF NOT EXISTS (SELECT 1 FROM organization_memberships m WHERE m.account_id = p_account_id
+      AND m.subject_id = subject AND m.status = 'active') THEN
+    RAISE EXCEPTION 'identity link organization unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT coalesce(jsonb_object_agg(l.id::text, jsonb_build_object('source', e.source, 'externalId', e.external_id)), '{}'::jsonb)
+    INTO result FROM external_identity_links l JOIN external_identities e
+      ON e.id = l.external_identity_id AND e.account_id = l.account_id
+    WHERE l.account_id = p_account_id AND l.id = ANY(p_link_ids)
+      AND (l.external_subject_id = subject OR l.native_subject_id = subject);
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', prior, true);
+  RETURN result;
+END
+$body$;
+REVOKE ALL ON FUNCTION get_external_identity_link_inventory_references(uuid, uuid[]) FROM PUBLIC;

package/drizzle/0456_social_connection_versions.sql

@@ -0,0 +1,14 @@
+-- deployment-mode: maintenance
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+ALTER TABLE social_connections ADD COLUMN version integer NOT NULL DEFAULT 1 CHECK (version > 0);
+CREATE FUNCTION bump_social_connection_version() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  NEW.version := OLD.version + 1;
+  RETURN NEW;
+END
+$body$;
+REVOKE ALL ON FUNCTION bump_social_connection_version() FROM PUBLIC;
+CREATE TRIGGER social_connection_version BEFORE UPDATE ON social_connections
+FOR EACH ROW EXECUTE FUNCTION bump_social_connection_version();

package/drizzle/0457_canonical_session_scope_subject.sql

@@ -0,0 +1,46 @@
+-- deployment-mode: maintenance
+-- Deploy with the embedding maintenance cutover: stop old API/worker writers
+-- before activation and never restart a label-authority binary afterward.
+-- New sessions bind agent scope to canonical authenticated user authority.
+-- Do not infer a user from historical end_user labels or promote old private
+-- memory rows. Old sessions remain readable under their existing visibility;
+-- a null scope cannot grant cross-tree user access. Their old labels and
+-- session-scoped memory records are retained as historical data only.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $drain$
+DECLARE
+  roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0457 requires an explicit application database role list' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item
+    WHERE jsonb_typeof(item) <> 'string' OR btrim(item #>> '{}') = ''
+      OR item #>> '{}' <> btrim(item #>> '{}') OR octet_length(item #>> '{}') > 63
+  ) THEN
+    RAISE EXCEPTION '0457 received invalid application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(roles) role_name ON role_name = activity.usename
+    WHERE activity.datname = current_database() AND activity.pid <> pg_backend_pid()
+  ) THEN
+    RAISE EXCEPTION '0457 requires all application database sessions stopped' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+ALTER TABLE sessions ADD COLUMN scope_subject_id text,
+  ADD CONSTRAINT sessions_scope_subject_id_check CHECK (
+    scope_subject_id IS NULL OR (
+      octet_length(scope_subject_id) BETWEEN 1 AND 1024
+      AND scope_subject_id ~ '^(user:|external_user:).+'
+    )
+  );
+
+CREATE INDEX sessions_workspace_scope_subject_idx
+  ON sessions (workspace_id, scope_subject_id)
+  WHERE scope_subject_id IS NOT NULL;

package/drizzle/0458_skill_review_wire_compatibility.sql

@@ -0,0 +1,36 @@
+-- deployment-mode: rolling
+-- No pending cards or historical answers are rewritten. Compatibility applies
+-- only to an explicit Save/Don't save answer admitted by the canonical human
+-- path, with all existing immutable-receipt, tenant, turn and revision fences.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '1min';
+
+DO $patch$
+DECLARE
+  definition text := pg_get_functiondef('skill_apply_lifecycle(uuid,uuid,jsonb,jsonb)'::regprocedure);
+  anchor text;
+  replacement text;
+BEGIN
+  -- The old generic choice serializer forced Other on. It is not consent:
+  -- retain a typed boolean shape, and independently forbid Other in the answer.
+  anchor := $old$AND coalesce(h.questions->0->'allowOther','false'::jsonb)='false'::jsonb$old$;
+  replacement := $new$AND coalesce(h.questions->0->'allowOther','false'::jsonb) IN ('false'::jsonb,'true'::jsonb)
+        AND (answer->'other' IS NULL OR answer->'other'='null'::jsonb OR answer->'other'='""'::jsonb)$new$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0458 Skill Other compatibility anchor mismatch';
+  END IF;
+  definition := replace(definition,anchor,replacement);
+
+  -- Null optional descriptions are the same absent presentation value. Keep
+  -- exact option count/order/ids/labels and reject every non-null extra field.
+  anchor := $old$AND h.questions->0->'options'='[{"id":"save","label":"Save"},{"id":"skip","label":"Don''t save"}]'::jsonb$old$;
+  replacement := $new$AND jsonb_array_length(h.questions->0->'options')=2
+        AND ((h.questions->0->'options'->0) - 'description')='{"id":"save","label":"Save"}'::jsonb
+        AND ((h.questions->0->'options'->1) - 'description')='{"id":"skip","label":"Don''t save"}'::jsonb
+        AND coalesce(h.questions->0->'options'->0->'description','null'::jsonb)='null'::jsonb
+        AND coalesce(h.questions->0->'options'->1->'description','null'::jsonb)='null'::jsonb$new$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0458 Skill option compatibility anchor mismatch';
+  END IF;
+  EXECUTE replace(definition,anchor,replacement);
+END $patch$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.2.2",
+  "version": "4.3.0-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -94,11 +94,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.3",
-    "@opengeni/codex": "^0.2.22",
-    "@opengeni/config": "^1.0.4",
-    "@opengeni/contracts": "^2.15.2",
-    "@opengeni/network": "^0.3.1",
+    "@opengeni/codemode": "^0.5.4-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.6",
+    "@opengeni/config": "^1.1.0-canary.0",
+    "@opengeni/contracts": "^3.0.0-canary.0",
+    "@opengeni/network": "^0.3.1-canary.6",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },