@opengeni/db 4.2.2 → 4.3.2-canary.0

package/dist/schema.js

@@ -55,6 +55,7 @@ import {
   composerDrafts,
   computerSessionAssociations,
   computerSessions,
+  connectAttempts,
   connectionDisconnectOperations,
   connectionUseAuditFacts,
   connectionUseOnceConsumptionReceipts,
@@ -87,6 +88,7 @@ import {
   enrollmentOsValues,
   enrollmentStatusValues,
   enrollments,
+  externalIdentities,
   feedbackSubmissions,
   fileUploads,
   files,
@@ -104,6 +106,9 @@ import {
   hostExportCursorState,
   hostExportDeadLetters,
   hostExportOutbox,
+  hostMcpBindings,
+  hostMcpDelegations,
+  hostMcpTurnAuthorities,
   imageGenerationOperations,
   importBatches,
   integrationFacetBindingOwners,
@@ -354,7 +359,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-S4Y42VSX.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -413,6 +418,7 @@ export {
   composerDrafts,
   computerSessionAssociations,
   computerSessions,
+  connectAttempts,
   connectionDisconnectOperations,
   connectionUseAuditFacts,
   connectionUseOnceConsumptionReceipts,
@@ -445,6 +451,7 @@ export {
   enrollmentOsValues,
   enrollmentStatusValues,
   enrollments,
+  externalIdentities,
   feedbackSubmissions,
   fileUploads,
   files,
@@ -462,6 +469,9 @@ export {
   hostExportCursorState,
   hostExportDeadLetters,
   hostExportOutbox,
+  hostMcpBindings,
+  hostMcpDelegations,
+  hostMcpTurnAuthorities,
   imageGenerationOperations,
   importBatches,
   integrationFacetBindingOwners,

package/dist/session-background-commands.js

@@ -22,10 +22,10 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-6GAPAYZR.js";
-import "./chunk-MGVOYVPS.js";
-import "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-6GAPAYZR.js";
-import "./chunk-MGVOYVPS.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-B2KR3TEM.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   fromPostgresLosslessJson,
   sandboxRetainedProcesses,
@@ -12,7 +12,7 @@ import {
   sessionEvents,
   sessions,
   withLosslessContentWriteVersion
-} from "./chunk-S4Y42VSX.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-command-output.ts

package/dist/session-event-slices.js

@@ -1,13 +1,13 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-B2KR3TEM.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson,
   sessionEvents,
   sessionTurns
-} from "./chunk-S4Y42VSX.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-event-slices.ts

package/dist/session-queue-commands.d.ts

@@ -230,6 +230,13 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
     /** Trusted database-only admission seam. It runs only after a completed
      * operation replay has been ruled out; throwing rolls the prompt back. */
     beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
+    /** Backend-only authority capture, atomic with the newly accepted turn. */
+    captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
+    selectedHostMcpDelegations?: Array<{
+        serverId: string;
+        delegationId: string;
+        generation: number;
+    }>;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
 }): Promise<SubmitHumanPromptResult>;

package/dist/session-tenancy.d.ts

@@ -33,6 +33,7 @@ export type TransitionSessionVisibilityInput = {
     targetVisibility: SessionTenancyVisibility;
     expectedAuthorityEpoch: number;
     operationKey: string;
+    beforeCommit?: (tx: Database) => Promise<void>;
 };
 export type TransitionSessionVisibilityResult = {
     operationId: string;
@@ -60,6 +61,7 @@ export type ForkSessionContentInput = {
     operationKey: string;
     runtimeRequest?: ForkSessionRuntimeRequest;
     runtimeConfiguration?: ForkSessionRuntimeConfiguration;
+    beforeCommit?: (tx: Database) => Promise<void>;
 };
 export type ForkSessionRuntimeRequest = {
     variableSetIds: string[];

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-7WX3R3YL.js";
-import "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-XBXANJQS.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-MGVOYVPS.js";
-import "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-authority.d.ts

@@ -51,10 +51,10 @@ import { type Database } from "./database.js";
  * adding a caller, that stamp is the part you have to get right; this function
  * will happily answer `true` for any subject you scope a transaction to.
  *
- * Non-`user:` subjects (API keys, delegated service principals, configured and
- * local principals) can never own an organization membership, so they
- * short-circuit to the plain membership answer instead of tripping
- * `list_self_organization_memberships`' `42501`.
+ * Persisted `external_user:` subjects also have an organization membership and
+ * an exact Personal pointer. They use the same consistency check only after the
+ * API's dedicated verified external proof, never a native-cookie stamp. Other
+ * service/configured/local subjects retain the plain membership answer.
  */
 export declare function subjectHasLiveWorkspaceAuthorityInScope(scopedDb: Database, input: {
     accountId: string;

package/dist/workspace-tool-defaults.js

@@ -1,11 +1,11 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-6GAPAYZR.js";
-import "./chunk-MGVOYVPS.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withWorkspaceRls
-} from "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/workspace-tool-defaults.ts

package/drizzle/0437_organization_scoped_external_workspaces.sql

@@ -0,0 +1,71 @@
+-- deployment-mode: maintenance
+-- Stop every old API and worker before activation. Old binaries use a global
+-- conflict target and must not restart after this organization-scoped cutover.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $drain$
+DECLARE
+  roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0437 requires an explicit application database role list' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item
+    WHERE jsonb_typeof(item) <> 'string' OR btrim(item #>> '{}') = ''
+      OR item #>> '{}' <> btrim(item #>> '{}') OR octet_length(item #>> '{}') > 63
+  ) THEN
+    RAISE EXCEPTION '0437 received invalid application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(roles) role_name ON role_name = activity.usename
+    WHERE activity.datname = current_database() AND activity.pid <> pg_backend_pid()
+  ) THEN
+    RAISE EXCEPTION '0437 requires all application database sessions stopped' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+LOCK TABLE workspaces IN ACCESS EXCLUSIVE MODE;
+
+DO $cutover$
+DECLARE
+  definition text;
+  old_target constant text := 'ON CONFLICT (external_source, external_id) DO UPDATE';
+  new_target constant text := 'ON CONFLICT (account_id, external_source, external_id) DO UPDATE';
+  old_personal_guard constant text := 'WHERE conflicting_workspace.external_source = ''opengeni:organization-membership''';
+  new_personal_guard constant text := 'WHERE conflicting_workspace.account_id = p_account_id AND conflicting_workspace.external_source = ''opengeni:organization-membership''';
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) role_name
+      ON role_name = activity.usename
+    WHERE activity.datname = current_database() AND activity.pid <> pg_backend_pid()
+  ) THEN
+    RAISE EXCEPTION '0437 requires all application database sessions stopped' USING ERRCODE = '55000';
+  END IF;
+  -- Preserve the deployed lifecycle function, including its security attributes
+  -- and all intervening fixes. Fail closed if its one reviewed target drifted.
+  SELECT pg_get_functiondef('organization_membership_command(jsonb)'::regprocedure) INTO definition;
+  IF strpos(definition, 'RETURN organization_membership_command_0263(p_command);') = 0 THEN
+    RAISE EXCEPTION '0437 organization membership wrapper drifted' USING ERRCODE = '55000';
+  END IF;
+  -- The live wrapper retains the newer offboarding/session-tenancy fences;
+  -- invitation acceptance delegates to this separately named implementation.
+  SELECT pg_get_functiondef('organization_membership_command_0263(jsonb)'::regprocedure) INTO definition;
+  IF (length(definition) - length(replace(definition, old_target, ''))) / length(old_target) <> 1 THEN
+    RAISE EXCEPTION '0437 organization membership conflict target drifted' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, old_target, new_target);
+  SELECT pg_get_functiondef('ensure_managed_human_personal_workspace(uuid,text,uuid)'::regprocedure) INTO definition;
+  IF (length(definition) - length(replace(definition, old_personal_guard, ''))) / length(old_personal_guard) <> 1 THEN
+    RAISE EXCEPTION '0437 personal workspace conflict guard drifted' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, old_personal_guard, new_personal_guard);
+END
+$cutover$;
+
+DROP INDEX workspaces_external_idx;
+CREATE UNIQUE INDEX workspaces_external_idx ON workspaces (account_id, external_source, external_id);

package/drizzle/0438_durable_connect_attempts.sql

@@ -0,0 +1,95 @@
+-- deployment-mode: maintenance
+-- The exact runtime table/RLS/grant contract changes. Drain all old API and
+-- worker logins and provision only the matching binary's role after migration.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $drain$
+DECLARE
+  roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0438 requires an explicit application database role list' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item
+    WHERE jsonb_typeof(item) <> 'string' OR btrim(item #>> '{}') = ''
+      OR item #>> '{}' <> btrim(item #>> '{}') OR octet_length(item #>> '{}') > 63
+  ) THEN
+    RAISE EXCEPTION '0438 received invalid application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(roles) role_name ON role_name = activity.usename
+    WHERE activity.datname = current_database() AND activity.pid <> pg_backend_pid()
+  ) THEN
+    RAISE EXCEPTION '0438 requires all application database sessions stopped' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE connect_attempts (
+  id uuid PRIMARY KEY,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL,
+  subject_id text NOT NULL CHECK (octet_length(subject_id) BETWEEN 1 AND 1024),
+  idempotency_key_hash text NOT NULL CHECK (idempotency_key_hash ~ '^[0-9a-f]{64}$'),
+  request_digest text NOT NULL CHECK (request_digest ~ '^[0-9a-f]{64}$'),
+  return_url text NOT NULL CHECK (octet_length(return_url) BETWEEN 1 AND 4096),
+  projection jsonb NOT NULL CHECK (jsonb_typeof(projection) = 'object' AND octet_length(projection::text) <= 1048576),
+  operation_id text CHECK (octet_length(operation_id) BETWEEN 1 AND 512),
+  operation_digest text CHECK (operation_digest ~ '^[0-9a-f]{64}$'),
+  receipts jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(receipts) = 'object' AND octet_length(receipts::text) <= 4194304),
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT connect_attempts_workspace_account_fk FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT connect_attempts_operation_pair_check CHECK ((operation_id IS NULL) = (operation_digest IS NULL)),
+  CONSTRAINT connect_attempts_projection_identity_check CHECK (
+    projection ?& ARRAY['id', 'workspaceId', 'revision', 'state', 'expiresAt']
+    AND projection->>'id' = id::text AND projection->>'workspaceId' = workspace_id::text
+    AND (projection->>'revision')::bigint > 0
+    AND (projection->>'expiresAt')::timestamptz = expires_at
+  )
+);
+CREATE UNIQUE INDEX connect_attempts_actor_idempotency_idx ON connect_attempts
+  (workspace_id, subject_id, idempotency_key_hash);
+CREATE INDEX connect_attempts_actor_pending_idx ON connect_attempts
+  (workspace_id, subject_id, created_at DESC, id DESC)
+  WHERE projection->>'state' NOT IN ('complete','cancelled','expired');
+CREATE INDEX connect_attempts_expiry_idx ON connect_attempts (expires_at, id);
+
+ALTER TABLE connect_attempts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE connect_attempts FORCE ROW LEVEL SECURITY;
+CREATE POLICY connect_attempts_actor_scope ON connect_attempts
+  USING (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND subject_id = opengeni_private.current_subject_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND subject_id = opengeni_private.current_subject_id());
+
+-- New-table defaults must not leave privileges for old or unrelated logins.
+REVOKE ALL ON TABLE connect_attempts FROM PUBLIC;
+DO $acl$
+DECLARE target_role record;
+BEGIN
+  FOR target_role IN
+    SELECT DISTINCT role.rolname FROM pg_class relation
+    CROSS JOIN LATERAL aclexplode(coalesce(relation.relacl, acldefault('r', relation.relowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE relation.oid = 'connect_attempts'::regclass AND privilege.grantee <> relation.relowner
+  LOOP
+    EXECUTE format('REVOKE ALL ON TABLE connect_attempts FROM %I', target_role.rolname);
+  END LOOP;
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) role_name
+      ON role_name = activity.usename
+    WHERE activity.datname = current_database() AND activity.pid <> pg_backend_pid()
+  ) THEN
+    RAISE EXCEPTION '0438 requires all application database sessions stopped' USING ERRCODE = '55000';
+  END IF;
+END
+$acl$;

package/drizzle/0439_external_identity_provisioning.sql

@@ -0,0 +1,128 @@
+-- deployment-mode: maintenance
+-- External identity storage/provisioning only. Does not grant workspace access,
+-- activate private sessions, link native users, or change authentication.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0439 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0439 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0439 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE external_identities (
+  id uuid PRIMARY KEY,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  source text NOT NULL CHECK (char_length(source) BETWEEN 1 AND 200),
+  external_id text NOT NULL CHECK (char_length(external_id) BETWEEN 1 AND 1024),
+  subject_id text NOT NULL CHECK (subject_id = 'external_user:' || id::text),
+  organization_membership_id uuid NOT NULL,
+  personal_workspace_id uuid NOT NULL,
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active','disabled','revoked')),
+  authorization_revision bigint NOT NULL DEFAULT 1 CHECK (authorization_revision > 0),
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (account_id, source, external_id),
+  UNIQUE (account_id, subject_id),
+  FOREIGN KEY (organization_membership_id, account_id) REFERENCES organization_memberships(id, account_id),
+  FOREIGN KEY (personal_workspace_id, account_id) REFERENCES workspaces(id, account_id)
+);
+ALTER TABLE external_identities ENABLE ROW LEVEL SECURITY;
+ALTER TABLE external_identities FORCE ROW LEVEL SECURITY;
+CREATE POLICY external_identity_lifecycle ON external_identities
+  USING (account_id = opengeni_private.current_account_id()
+    AND current_setting('opengeni.organization_tenancy_lifecycle', true) = 'external_identity_provisioning')
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND current_setting('opengeni.organization_tenancy_lifecycle', true) = 'external_identity_provisioning');
+CREATE POLICY external_identity_provisioning ON organization_memberships
+  USING (account_id = opengeni_private.current_account_id()
+    AND current_setting('opengeni.organization_tenancy_lifecycle', true) = 'external_identity_provisioning')
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND current_setting('opengeni.organization_tenancy_lifecycle', true) = 'external_identity_provisioning');
+REVOKE ALL ON external_identities FROM PUBLIC;
+
+-- Account scope is established by the authenticated API before this call.
+-- Like other lifecycle functions, this is not itself an HTTP authenticator.
+CREATE FUNCTION ensure_external_identity(p_account_id uuid, p_source text, p_external_id text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  identity_row external_identities%ROWTYPE;
+  membership_row organization_memberships%ROWTYPE;
+  identity_id uuid;
+  personal_id uuid;
+  membership_id uuid;
+  subject text;
+  previous_marker text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+  previous_workspace text := current_setting('opengeni.workspace_id', true);
+BEGIN
+  IF p_account_id IS NULL OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_source IS NULL OR char_length(p_source) NOT BETWEEN 1 AND 200
+    OR p_external_id IS NULL OR char_length(p_external_id) NOT BETWEEN 1 AND 1024
+  THEN RAISE EXCEPTION 'invalid external identity scope' USING ERRCODE = '42501'; END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  -- Serialize a tuple without relying on delimiters in opaque host identifiers.
+  PERFORM pg_advisory_xact_lock(hashtextextended(jsonb_build_array(p_account_id,p_source,p_external_id)::text, 0));
+  SELECT * INTO identity_row FROM external_identities
+    WHERE account_id = p_account_id AND source = p_source AND external_id = p_external_id FOR UPDATE;
+  IF NOT FOUND THEN
+    identity_id := gen_random_uuid();
+    subject := 'external_user:' || identity_id::text;
+    PERFORM set_config('opengeni.workspace_id', '', true);
+    INSERT INTO workspaces (account_id, name, external_source, external_id)
+      VALUES (p_account_id, 'Personal workspace', 'opengeni:organization-membership', p_account_id::text || ':' || subject)
+      RETURNING id INTO personal_id;
+    PERFORM set_config('opengeni.workspace_id', personal_id::text, true);
+    INSERT INTO workspace_inference_controls (workspace_id, account_id) VALUES (personal_id, p_account_id);
+    INSERT INTO organization_memberships (account_id, subject_id, role, status, personal_workspace_id)
+      VALUES (p_account_id, subject, 'member', 'active', personal_id) RETURNING id INTO membership_id;
+    INSERT INTO external_identities (id, account_id, source, external_id, subject_id, organization_membership_id, personal_workspace_id)
+      VALUES (identity_id, p_account_id, p_source, p_external_id, subject, membership_id, personal_id)
+      RETURNING * INTO identity_row;
+  END IF;
+  SELECT * INTO membership_row FROM organization_memberships
+    WHERE id = identity_row.organization_membership_id AND account_id = p_account_id FOR UPDATE;
+  IF NOT FOUND OR identity_row.status <> 'active' OR membership_row.status <> 'active'
+    OR membership_row.subject_id IS DISTINCT FROM identity_row.subject_id
+    OR membership_row.personal_workspace_id IS DISTINCT FROM identity_row.personal_workspace_id
+  THEN RAISE EXCEPTION 'external identity is unavailable' USING ERRCODE = '42501'; END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker,''), true);
+  PERFORM set_config('opengeni.workspace_id', coalesce(previous_workspace,''), true);
+  RETURN jsonb_build_object('id', identity_row.id, 'accountId', identity_row.account_id,
+    'source', identity_row.source, 'externalId', identity_row.external_id,
+    'subjectId', identity_row.subject_id, 'organizationMembershipId', identity_row.organization_membership_id,
+    'personalWorkspaceId', identity_row.personal_workspace_id, 'status', identity_row.status,
+    'authorizationRevision', identity_row.authorization_revision);
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker,''), true);
+  PERFORM set_config('opengeni.workspace_id', coalesce(previous_workspace,''), true);
+  RAISE;
+END
+$body$;
+REVOKE ALL ON FUNCTION ensure_external_identity(uuid,text,text) FROM PUBLIC;
+DO $acl$
+DECLARE target_role record;
+BEGIN
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_class relation
+    CROSS JOIN LATERAL aclexplode(coalesce(relation.relacl, acldefault('r', relation.relowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE relation.oid = 'external_identities'::regclass AND privilege.grantee <> relation.relowner
+  LOOP EXECUTE format('REVOKE ALL ON external_identities FROM %I', target_role.rolname); END LOOP;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0439 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$acl$;

package/drizzle/0440_external_workspace_member_removal.sql

@@ -0,0 +1,59 @@
+-- deployment-mode: rolling
+-- Extend the existing fenced teardown, never replace its settlement or lock
+-- protocol. Service authority is limited to external members in shared workspaces.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $patch$
+DECLARE
+  definition text;
+  anchor text;
+  replacement text;
+BEGIN
+  definition := pg_get_functiondef(
+    'opengeni_private.assert_workspace_membership_removal_actor(uuid,uuid,text,text)'::regprocedure);
+  anchor := '  actor_can_administer boolean;';
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0440 removal declaration drift' USING ERRCODE = '55000';
+  END IF;
+  definition := replace(definition, anchor, anchor || E'\n  service_permissions jsonb;\n  service_can_administer boolean := false;');
+  anchor := '  SELECT actor_is_organization_administrator OR EXISTS (';
+  replacement := $service$
+  IF p_actor_subject LIKE 'api_key:%' THEN
+    -- The API authenticates the key before supplying this subject. This is a
+    -- live consistency fence, not authentication from an arbitrary UUID.
+    SELECT credential.permissions INTO service_permissions
+    FROM api_keys credential
+    WHERE credential.account_id = p_account_id
+      AND 'api_key:' || credential.id::text = p_actor_subject
+      AND credential.workspace_id IS NULL
+      AND credential.credential_kind = 'organization'
+      AND credential.revoked_at IS NULL
+      AND (credential.expires_at IS NULL OR credential.expires_at > clock_timestamp())
+    FOR SHARE;
+    service_can_administer := coalesce(
+      service_permissions ?| ARRAY['workspace:admin', 'members:manage'], false
+    ) AND EXISTS (
+      SELECT 1 FROM organization_memberships target
+      WHERE target.account_id = p_account_id
+        AND target.subject_id = p_target_subject
+        AND target.subject_id ~ '^external_user:[0-9a-f-]{36}$'
+    );
+  END IF;
+  SELECT actor_is_organization_administrator OR service_can_administer OR EXISTS (
+$service$;
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0440 removal authority drift' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, anchor, replacement);
+
+  definition := pg_get_functiondef('workspace_membership_removal_command(jsonb)'::regprocedure);
+  anchor := '''human'', actor_subject, ''workspace.membership.remove''';
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1
+    OR strpos(definition, 'acquire_session_tenancy_fence') = 0 THEN
+    RAISE EXCEPTION '0440 removal receipt or fence drift' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, anchor,
+    'CASE WHEN actor_subject LIKE ''api_key:%'' THEN ''service'' ELSE ''human'' END, actor_subject, ''workspace.membership.remove''');
+END
+$patch$;