@opengeni/db 4.2.2 → 4.3.0-canary.0

package/src/live-session-attempt.ts

@@ -0,0 +1,85 @@
+import { and, eq, inArray, sql } from "drizzle-orm";
+import { withWorkspaceRls, type Database } from "./database";
+import * as schema from "./schema";
+import { getExternalLinkTurnAuthorization } from "./external-link-work";
+import { initiatorFromStorage } from "./turn-initiator";
+
+/** Shared physical-attempt fence. Does not mutate goal/execution snapshots. */
+export async function getLiveSessionAttemptTurn(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  attemptId: string,
+) {
+  return withWorkspaceRls(db, workspaceId, async (tx) => {
+    const [row] = await tx
+      .select({ turn: schema.sessionTurns })
+      .from(schema.sessionTurnAttempts)
+      .innerJoin(
+        schema.sessionTurns,
+        and(
+          eq(schema.sessionTurns.workspaceId, schema.sessionTurnAttempts.workspaceId),
+          eq(schema.sessionTurns.id, schema.sessionTurnAttempts.turnId),
+        ),
+      )
+      .innerJoin(
+        schema.sessions,
+        and(
+          eq(schema.sessions.workspaceId, schema.sessionTurnAttempts.workspaceId),
+          eq(schema.sessions.id, schema.sessionTurnAttempts.sessionId),
+        ),
+      )
+      .where(
+        and(
+          eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+          eq(schema.sessionTurnAttempts.sessionId, sessionId),
+          eq(schema.sessionTurnAttempts.id, attemptId),
+          inArray(schema.sessionTurnAttempts.state, ["claimed", "running"]),
+          eq(schema.sessionTurns.activeAttemptId, attemptId),
+          eq(schema.sessions.activeTurnId, schema.sessionTurns.id),
+          inArray(schema.sessionTurns.status, [
+            "running",
+            "requires_action",
+            "recovering",
+            "waiting_capacity",
+          ]),
+          sql`not exists (
+          select 1 from ${schema.sessionAttemptInterruptions} interruption
+          where interruption.workspace_id = ${workspaceId}
+            and interruption.attempt_id = ${attemptId}
+            and interruption.state in ('pending', 'delivered', 'acknowledged')
+        )`,
+        ),
+      )
+      .limit(1);
+    if (!row) return null;
+    const linked = await getExternalLinkTurnAuthorization(
+      tx,
+      { accountId: row.turn.accountId, workspaceId },
+      row.turn.id,
+    );
+    if (linked && !linked.authorized) return null;
+    return row.turn;
+  });
+}
+
+/** Host credential reads need provenance and live authority, not a runnable
+ * execution projection or a write to the turn's frozen goal snapshot. */
+export async function getHostMcpLiveAttempt(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  attemptId: string,
+) {
+  const row = await getLiveSessionAttemptTurn(db, workspaceId, sessionId, attemptId);
+  if (!row) return null;
+  return {
+    ...row,
+    initiator: initiatorFromStorage(
+      row.initiatorKind,
+      row.initiatorSubjectId,
+      row.initiatorContext ?? {},
+    ),
+    initiatorContext: row.initiatorContext ?? {},
+  };
+}

package/src/managed-human-provisioning.ts

@@ -37,6 +37,7 @@ export async function ensureManagedHumanPersonalWorkspace(
       and(
         eq(schema.workspaces.externalSource, personalWorkspaceExternalSource),
         eq(schema.workspaces.externalId, personalWorkspaceExternalId),
+        eq(schema.workspaces.accountId, input.accountId),
       ),
     )
     .limit(1);
@@ -51,7 +52,11 @@ export async function ensureManagedHumanPersonalWorkspace(
         externalId: personalWorkspaceExternalId,
       })
       .onConflictDoUpdate({
-        target: [schema.workspaces.externalSource, schema.workspaces.externalId],
+        target: [
+          schema.workspaces.accountId,
+          schema.workspaces.externalSource,
+          schema.workspaces.externalId,
+        ],
         set: { updatedAt: new Date() },
       })
       .returning();

package/src/memory-domain.ts

@@ -282,7 +282,7 @@ export function isMemoryScopeApplicable(
 // its narrowest configured layer. `off` registers no Memory tools at all.
 // ---------------------------------------------------------------------------
 
-export type MemoryAgentScopeMode = "workspace" | "user" | "session" | "off";
+export type MemoryAgentScopeMode = "workspace" | "user" | "off";
 
 /**
  * The agent-side Memory selector resolved from one session row. The end-user
@@ -292,16 +292,16 @@ export type MemoryAgentScopeMode = "workspace" | "user" | "session" | "off";
  */
 export type MemoryAgentScope = {
   mode: MemoryAgentScopeMode;
-  endUserSubjectId: string | null;
+  userSubjectId: string | null;
   rootSessionId: string | null;
 };
 
 export const END_USER_MEMORY_SUBJECT_PREFIX = "end_user:v1:";
 
 /** The typed `user` selector for an opaque session end-user label. */
-export function endUserMemorySubjectId(endUser: { source: string; id: string }): string {
+export function endUserMemorySubjectId(scopeSubjectId: { source: string; id: string }): string {
   const digest = createHash("sha256")
-    .update(JSON.stringify([endUser.source, endUser.id]), "utf8")
+    .update(JSON.stringify([scopeSubjectId.source, scopeSubjectId.id]), "utf8")
     .digest("hex");
   return `${END_USER_MEMORY_SUBJECT_PREFIX}${digest}`;
 }
@@ -319,15 +319,10 @@ export function memoryWriteScopeForAgentScope(scope: MemoryAgentScope): MemorySc
     case "workspace":
       return { type: "workspace" };
     case "user":
-      if (!scope.endUserSubjectId) {
+      if (!scope.userSubjectId) {
         throw new Error("memory scope user requires an end-user subject id");
       }
-      return { type: "user", subjectId: scope.endUserSubjectId };
-    case "session":
-      if (!scope.rootSessionId) {
-        throw new Error("memory scope session requires a root session id");
-      }
-      return { type: "session", sessionId: scope.rootSessionId };
+      return { type: "user", subjectId: scope.userSubjectId };
   }
 }
 

package/src/provision-roles.ts

@@ -524,6 +524,9 @@ async function grantAppRoleIfSchemaExists(
   const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
   const workClaimCapabilityRoutines = `ARRAY[${WORK_CLAIM_CAPABILITY_ROUTINES.map(literal).join(", ")}]`;
   const organizationMembershipLifecycleRoutines = `ARRAY[${[
+    "ensure_external_identity(uuid,text,text)",
+    "get_external_identity_link_reference(uuid,uuid,text)",
+    "get_external_identity_link_inventory_references(uuid,uuid[])",
     "list_self_organization_memberships(text)",
     "list_self_organization_invitations(text)",
     "list_self_organization_invitations(text,uuid,integer)",

package/src/runtime-posture.ts

@@ -86,6 +86,9 @@ const MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE =
 const ADDITIONAL_ORGANIZATION_CREATION_ROUTINE =
   "create_additional_managed_organization(text, text, text, text, uuid)";
 const ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
+  "get_external_identity_link_reference(uuid, uuid, text)",
+  "get_external_identity_link_inventory_references(uuid, uuid[])",
+  "ensure_external_identity(uuid, text, text)",
   "list_self_organization_memberships(text)",
   "list_self_organization_invitations(text)",
   "list_self_organization_invitations(text, uuid, integer)",
@@ -700,6 +703,7 @@ export const FORCE_RLS_TABLES = [
   "composer_drafts",
   "computer_session_associations",
   "computer_sessions",
+  "connect_attempts",
   "connection_disconnect_operations",
   "connection_use_audit_facts",
   "connection_use_once_consumption_receipts",
@@ -732,6 +736,10 @@ export const FORCE_RLS_TABLES = [
   "editable_artifact_versions",
   "editable_artifacts",
   "enrollments",
+  "external_identities",
+  "external_identity_links",
+  "external_link_task_authorities",
+  "external_link_turn_authorities",
   "feedback_submissions",
   "file_uploads",
   "files",
@@ -749,6 +757,10 @@ export const FORCE_RLS_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "host_mcp_bindings",
+  "host_mcp_delegations",
+  "host_mcp_task_authorities",
+  "host_mcp_turn_authorities",
   "image_generation_operations",
   "import_batches",
   "integration_facet_binding_owners",
@@ -1068,6 +1080,7 @@ export const RUNTIME_FULL_DML_TABLES = [
   "codex_subscription_credentials",
   "composer_drafts",
   "computer_session_associations",
+  "connect_attempts",
   "connection_disconnect_operations",
   "connections",
   "connector_action_policies",
@@ -1085,6 +1098,8 @@ export const RUNTIME_FULL_DML_TABLES = [
   "generated_video_artifacts",
   "github_installation_repositories",
   "github_installations",
+  "host_mcp_bindings",
+  "host_mcp_delegations",
   "image_generation_operations",
   "import_batches",
   "integration_facet_binding_owners",
@@ -1249,9 +1264,13 @@ export const RUNTIME_READ_INSERT_TABLES = [
   "editable_artifact_transactions",
   "editable_artifact_undo_claims",
   "editable_artifact_versions",
+  "external_link_task_authorities",
+  "external_link_turn_authorities",
   "feedback_submissions",
   "google_drive_object_acl_evidence",
   "google_drive_object_acl_principals",
+  "host_mcp_task_authorities",
+  "host_mcp_turn_authorities",
   "knowledge_change_proposals",
   "knowledge_claim_evidence",
   "knowledge_claim_relations",
@@ -1304,6 +1323,7 @@ export const RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "computer_sessions",
   "editable_artifact_session_links",
   "editable_artifacts",
+  "external_identity_links",
   "integration_facet_definitions",
   "integration_spec_revisions",
   "integration_tools",
@@ -1344,6 +1364,7 @@ export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "document_default_collection_backfill_runs",
   "editable_artifact_live_tickets",
   "editable_artifact_scope_authorization_heads",
+  "external_identities",
   "governed_learning_activation_receipts",
   "governed_learning_activation_undo_receipts",
   "governed_learning_decision_receipts",
@@ -2233,6 +2254,32 @@ export function evaluateRuntimeDatabasePosture(
           );
         }
       }
+    } else if (
+      [
+        "ensure_external_identity(uuid, text, text)",
+        "get_external_identity_link_reference(uuid, uuid, text)",
+        "get_external_identity_link_inventory_references(uuid, uuid[])",
+      ].includes(routine.name)
+    ) {
+      const names =
+        routine.name !== "ensure_external_identity(uuid, text, text)"
+          ? ["external_identity_links", "external_identities", "organization_memberships"]
+          : [
+              "external_identities",
+              "organization_memberships",
+              "workspaces",
+              "workspace_inference_controls",
+            ];
+      const missing = names.filter((name) => !tableByName.has(name));
+      if (missing.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missing.join(", ")}`,
+        );
+      } else if (names.some((name) => tableByName.get(name)!.owner !== routine.owner)) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match`,
+        );
+      }
     } else if (routine.name === MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE) {
       const authorityTables = MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES.filter(
         (tableName) => tableByName.has(tableName),

package/src/scheduled-task-revision-authority.ts

@@ -0,0 +1,30 @@
+import { sql } from "drizzle-orm";
+import { ScheduledTaskRunAcceptedExecution } from "@opengeni/contracts";
+import { rawRows, withRlsContext, type Database } from "./database";
+
+export async function getScheduledTaskRevisionAuthority(
+  db: Database,
+  input: { accountId: string; workspaceId: string; taskId: string; taskAuthorityRevision: number },
+): Promise<{
+  subjectId: string;
+  organizationMembershipId: string;
+  membershipAuthorizationRevision: number;
+} | null> {
+  return withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (tx) => {
+      const [row] = await rawRows<{ authority: unknown }>(
+        tx,
+        sql`
+      select scheduled_task_revision_authority_snapshot(
+        ${input.accountId}::uuid, ${input.workspaceId}::uuid,
+        ${input.taskId}::uuid, ${input.taskAuthorityRevision}::bigint
+      ) as authority`,
+      );
+      return row?.authority
+        ? ScheduledTaskRunAcceptedExecution.shape.causalHumanAuthority.parse(row.authority)
+        : null;
+    },
+  );
+}

package/src/schema.ts

@@ -150,7 +150,11 @@ export const workspaces = pgTable(
     accountSlug: uniqueIndex("workspaces_account_slug_idx")
       .on(table.accountId, table.slug)
       .where(sql`${table.slug} is not null`),
-    external: uniqueIndex("workspaces_external_idx").on(table.externalSource, table.externalId),
+    external: uniqueIndex("workspaces_external_idx").on(
+      table.accountId,
+      table.externalSource,
+      table.externalId,
+    ),
     sandboxViewerForceDrain: index("workspaces_sandbox_viewer_force_drain_idx")
       .on(table.id)
       .where(sql`${table.sandboxViewerForceDrainReason} is not null`),
@@ -519,6 +523,46 @@ export const workspaceMemberships = pgTable(
 // Organization membership is distinct from workspace access. `account_id` is
 // the physical organization identifier; `personal_workspace_id` is lifecycle
 // metadata only and never the ownership anchor for user resources.
+export const externalIdentities = pgTable(
+  "external_identities",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    source: text("source").notNull(),
+    externalId: text("external_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    organizationMembershipId: uuid("organization_membership_id").notNull(),
+    personalWorkspaceId: uuid("personal_workspace_id").notNull(),
+    status: text("status").notNull().default("active"),
+    authorizationRevision: bigint("authorization_revision", { mode: "number" })
+      .notNull()
+      .default(1),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    mapping: uniqueIndex("external_identities_account_id_source_external_id_key").on(
+      table.accountId,
+      table.source,
+      table.externalId,
+    ),
+    subject: uniqueIndex("external_identities_account_id_subject_id_key").on(
+      table.accountId,
+      table.subjectId,
+    ),
+    membership: foreignKey({
+      columns: [table.organizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }),
+    personalWorkspace: foreignKey({
+      columns: [table.personalWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }),
+  }),
+);
+
 export const organizationMemberships = pgTable(
   "organization_memberships",
   {
@@ -895,7 +939,8 @@ export const organizationMembershipLifecycleEvents = pgTable(
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     operationId: uuid("operation_id").notNull(),
-    actorMembershipId: uuid("actor_membership_id").notNull(),
+    actorMembershipId: uuid("actor_membership_id"),
+    actorServiceSubject: text("actor_service_subject"),
     targetMembershipId: uuid("target_membership_id"),
     kind: text("kind").notNull(),
     priorAuthorizationRevision: bigint("prior_authorization_revision", {
@@ -926,6 +971,10 @@ export const organizationMembershipLifecycleEvents = pgTable(
       "organization_membership_lifecycle_events_kind_check",
       sql`${table.kind} in ('invite', 'accept', 'revoke_invitation', 'change_role', 'suspend', 'reactivate', 'offboard', 'retention')`,
     ),
+    actorKindValid: check(
+      "organization_membership_lifecycle_events_actor_kind_check",
+      sql`(${table.actorMembershipId} is not null and ${table.actorServiceSubject} is null) or (${table.actorMembershipId} is null and ${table.actorServiceSubject} is not null and ${table.actorServiceSubject} ~ '^api_key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')`,
+    ),
   }),
 );
 
@@ -3543,6 +3592,49 @@ export const integrationOauthClients = pgTable(
 
 // Consumed OAuth state nonces. Rows are inserted only on callback; the primary
 // key makes a verified state single-use across API instances.
+export const hostMcpTurnAuthorities = pgTable(
+  "host_mcp_turn_authorities",
+  {
+    turnId: uuid("turn_id")
+      .notNull()
+      .references(() => sessionTurns.id, { onDelete: "cascade" }),
+    serverId: text("server_id").notNull(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id")
+      .notNull()
+      .references(() => sessions.id, { onDelete: "cascade" }),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    bindingId: uuid("binding_id")
+      .notNull()
+      .references(() => hostMcpBindings.id),
+    delegationId: uuid("delegation_id")
+      .notNull()
+      .references(() => hostMcpDelegations.id),
+    canonicalSnapshot: jsonb("canonical_snapshot")
+      .$type<import("@opengeni/contracts/host-mcp-bindings").HostMcpAcceptedAuthority>()
+      .notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.turnId, table.serverId] }),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    serverBounds: check(
+      "host_mcp_turn_authorities_server_id_check",
+      sql`octet_length(${table.serverId}) between 1 and 1024`,
+    ),
+    snapshotBounds: check(
+      "host_mcp_turn_authorities_canonical_snapshot_check",
+      sql`jsonb_typeof(${table.canonicalSnapshot}) = 'object' and octet_length(${table.canonicalSnapshot}::text) <= 262144`,
+    ),
+  }),
+);
+
 export const integrationOauthStateNonces = pgTable(
   "integration_oauth_state_nonces",
   {
@@ -3564,6 +3656,135 @@ export const integrationOauthStateNonces = pgTable(
   }),
 );
 
+export const hostMcpBindings = pgTable(
+  "host_mcp_bindings",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").notNull(),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    authorizationRevision: bigint("authorization_revision", { mode: "number" }).notNull(),
+    operationId: uuid("operation_id").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    definition: jsonb("definition").notNull(),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+  },
+  (table) => ({
+    workspace: foreignKey({
+      name: "host_mcp_bindings_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    owner: foreignKey({
+      name: "host_mcp_bindings_member_owner_fk",
+      columns: [table.accountId, table.ownerSubjectId],
+      foreignColumns: [organizationMemberships.accountId, organizationMemberships.subjectId],
+    }),
+    operation: uniqueIndex("host_mcp_bindings_workspace_id_owner_subject_id_operation_id_key").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.operationId,
+    ),
+    inventory: index("host_mcp_bindings_owner_idx").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.createdAt,
+      table.id,
+    ),
+  }),
+);
+
+export const hostMcpDelegations = pgTable(
+  "host_mcp_delegations",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").notNull(),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    ownerAuthorizationRevision: bigint("owner_authorization_revision", {
+      mode: "number",
+    }).notNull(),
+    bindingId: uuid("binding_id")
+      .notNull()
+      .references(() => hostMcpBindings.id),
+    bindingGeneration: bigint("binding_generation", { mode: "number" }).notNull(),
+    operationId: uuid("operation_id").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    grantDefinition: jsonb("grant_definition").notNull(),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+  },
+  (table) => ({
+    workspace: foreignKey({
+      name: "host_mcp_delegations_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    owner: foreignKey({
+      name: "host_mcp_delegations_member_owner_fk",
+      columns: [table.accountId, table.ownerSubjectId],
+      foreignColumns: [organizationMemberships.accountId, organizationMemberships.subjectId],
+    }),
+    operation: uniqueIndex(
+      "host_mcp_delegations_workspace_id_owner_subject_id_operation_id_key",
+    ).on(table.workspaceId, table.ownerSubjectId, table.operationId),
+    inventory: index("host_mcp_delegations_owner_idx").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.bindingId,
+      table.id,
+    ),
+  }),
+);
+
+export const connectAttempts = pgTable(
+  "connect_attempts",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    idempotencyKeyHash: text("idempotency_key_hash").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    returnUrl: text("return_url").notNull(),
+    externalContinuation: jsonb("external_continuation"),
+    projection: jsonb("projection").notNull(),
+    operationId: text("operation_id"),
+    operationDigest: text("operation_digest"),
+    receipts: jsonb("receipts").notNull().default({}),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "connect_attempts_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    idempotency: uniqueIndex("connect_attempts_actor_idempotency_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.idempotencyKeyHash,
+    ),
+    pending: index("connect_attempts_actor_pending_idx")
+      .on(table.workspaceId, table.subjectId, table.createdAt.desc(), table.id.desc())
+      .where(sql`${table.projection}->>'state' not in ('complete','cancelled','expired')`),
+    expiry: index("connect_attempts_expiry_idx").on(table.expiresAt, table.id),
+  }),
+);
+
 export const mcpOauthClients = pgTable(
   "mcp_oauth_clients",
   {
@@ -4175,6 +4396,9 @@ export const sessions = pgTable(
     // sessions carrying the same end-user label; 'session' limits it to the
     // own root tree. Enforced only in the core session-authorization seam.
     agentAccess: text("agent_access").notNull().default("workspace"),
+    // Canonical authenticated user for the frozen cross-session agent scope.
+    // Independent of per-turn initiating users and historical external labels.
+    scopeSubjectId: text("scope_subject_id"),
     // Opaque end-user label (both set or both null). This is a product label
     // used for scoping and filtering, never a subject and never authority.
     endUserSource: text("end_user_source"),
@@ -10814,7 +11038,7 @@ export const scheduledTasks = pgTable(
     >(),
     creatorSessionPolicy: jsonb("creator_session_policy").$type<{
       agentAccess: string | null;
-      endUser: { source: string; id: string } | null;
+      scopeSubjectId: string | null;
       memoryScope: string | null;
     }>(),
     deletedAt: timestamp("deleted_at", { withTimezone: true }),
@@ -12934,6 +13158,7 @@ export const socialConnections = pgTable(
   "social_connections",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    version: integer("version").notNull().default(1),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),

package/src/session-control.ts

@@ -12,6 +12,7 @@ import { and, eq, inArray, sql } from "drizzle-orm";
 import type { Database, SessionActivityDatabase } from "./database";
 import { withLosslessContentWriteVersion } from "./lossless-json";
 import { nestedPostgresSqlState } from "./persistence-errors";
+import { getExternalLinkTurnAuthorization } from "./external-link-work";
 import * as schema from "./schema";
 import {
   boundedChildPausedReason,
@@ -333,6 +334,19 @@ export async function assertAgentCommandAuthorityInTransaction(
       "The calling agent attempt is being interrupted",
     );
   }
+  const linked = await getExternalLinkTurnAuthorization(
+    db,
+    {
+      accountId: callerSession.accountId,
+      workspaceId: input.workspaceId,
+    },
+    input.actor.turnId,
+  );
+  if (linked && !linked.authorized)
+    throw new AgentCommandAuthorityError(
+      "CALLER_STALE",
+      "The calling agent's native identity link is no longer active",
+    );
   if (input.action === "steer" && input.targetSessionId === input.actor.sessionId) {
     throw new AgentCommandAuthorityError("SELF_STEER", "An agent cannot steer its own session");
   }

package/src/session-queue-commands.ts

@@ -1767,6 +1767,13 @@ export async function submitHumanPromptInTransaction(
     /** Trusted database-only admission seam. It runs only after a completed
      * operation replay has been ruled out; throwing rolls the prompt back. */
     beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
+    /** Backend-only authority capture, atomic with the newly accepted turn. */
+    captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
+    selectedHostMcpDelegations?: Array<{
+      serverId: string;
+      delegationId: string;
+      generation: number;
+    }>;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
   },
@@ -1823,6 +1830,9 @@ export async function submitHumanPromptInTransaction(
     mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
     personalConnectionDelegations: input.personalConnectionDelegations ?? [],
     personalResourceAttachment: input.personalResourceAttachment ?? null,
+    ...(input.selectedHostMcpDelegations?.length
+      ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
+      : {}),
     ...(input.actor.type === "service"
       ? {
           serviceInitiator: {
@@ -2194,6 +2204,7 @@ export async function submitHumanPromptInTransaction(
     )
     .returning();
   if (!turn) throw new SessionControlInvariantError("Prompt turn was not inserted");
+  await input.captureTurnAuthority?.(db, turn.id);
   let committedTurn = turn;
   const personalResourceExpectedAuthorityEpoch =
     input.personalResourceAttachment?.expectedAuthorityEpoch;