@opengeni/db 4.2.2 → 4.3.2-canary.0

package/drizzle/0441_external_identity_membership_lifecycle.sql

@@ -0,0 +1,163 @@
+-- deployment-mode: rolling
+-- Add attributable service administration to the canonical organization
+-- lifecycle. No copied teardown, new retention policy, or native member proxy.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE organization_membership_lifecycle_events
+  ALTER COLUMN actor_membership_id DROP NOT NULL,
+  ADD COLUMN actor_service_subject text,
+  ADD CONSTRAINT organization_membership_lifecycle_events_actor_kind_check CHECK (
+    (actor_membership_id IS NOT NULL AND actor_service_subject IS NULL)
+    OR (actor_membership_id IS NULL AND actor_service_subject IS NOT NULL
+      AND actor_service_subject ~ '^api_key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')
+  );
+
+-- Only the existing definer lifecycle routines invoke this private helper.
+-- UUID knowledge is not authentication; API resolution supplies the subject.
+CREATE FUNCTION opengeni_private.external_membership_service_authority(p_command jsonb)
+RETURNS boolean LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  actor_subject text := p_command ->> 'actorSubjectId';
+  account_id_value uuid := (p_command ->> 'organizationId')::uuid;
+  membership_id_value uuid := (p_command ->> 'membershipId')::uuid;
+  permissions_value jsonb;
+  allowed boolean;
+  previous_marker text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF actor_subject NOT LIKE 'api_key:%' THEN RETURN false; END IF;
+  IF actor_subject IS DISTINCT FROM opengeni_private.current_subject_id()
+    OR account_id_value IS DISTINCT FROM opengeni_private.current_account_id()
+    OR (p_command ->> 'action') IS NULL
+    OR (p_command ->> 'action') NOT IN ('suspend', 'reactivate', 'offboard')
+    OR account_id_value IS NULL OR membership_id_value IS NULL
+  THEN RAISE EXCEPTION 'external lifecycle authority invalid' USING ERRCODE = '42501'; END IF;
+  SELECT credential.permissions INTO permissions_value FROM api_keys credential
+  WHERE credential.account_id = account_id_value
+    AND 'api_key:' || credential.id::text = actor_subject
+    AND credential.workspace_id IS NULL AND credential.credential_kind = 'organization'
+    AND credential.revoked_at IS NULL
+    AND (credential.expires_at IS NULL OR credential.expires_at > clock_timestamp())
+  FOR SHARE;
+  IF NOT coalesce(permissions_value ? 'account:admin', false) THEN
+    RAISE EXCEPTION 'external lifecycle service administration required' USING ERRCODE = '42501';
+  END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  SELECT EXISTS (
+    SELECT 1 FROM external_identities identity_row
+    JOIN organization_memberships membership
+      ON membership.id = identity_row.organization_membership_id
+      AND membership.account_id = identity_row.account_id
+      AND membership.subject_id = identity_row.subject_id
+      AND membership.personal_workspace_id = identity_row.personal_workspace_id
+    WHERE identity_row.account_id = account_id_value
+      AND membership.id = membership_id_value AND membership.role = 'member'
+  ) INTO allowed;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  IF NOT allowed THEN
+    RAISE EXCEPTION 'external lifecycle target unavailable' USING ERRCODE = '42501';
+  END IF;
+  RETURN true;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  RAISE;
+END
+$body$;
+REVOKE ALL ON FUNCTION opengeni_private.external_membership_service_authority(jsonb) FROM PUBLIC;
+
+-- Native and service lifecycle writes invalidate the same external admission
+-- generation. Reactivation never restores the shared memberships or durable
+-- grants that the canonical suspension/offboarding protocol already revoked.
+CREATE FUNCTION opengeni_private.sync_external_membership_lifecycle()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT
+AS $body$
+DECLARE previous_marker text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF NEW.subject_id NOT LIKE 'external_user:%' THEN RETURN NEW; END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  UPDATE external_identities SET
+    status = CASE NEW.status WHEN 'active' THEN 'active' WHEN 'revoked' THEN 'revoked' ELSE 'disabled' END,
+    authorization_revision = authorization_revision + 1,
+    updated_at = clock_timestamp()
+  WHERE account_id = NEW.account_id AND organization_membership_id = NEW.id
+    AND subject_id = NEW.subject_id;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  RAISE;
+END
+$body$;
+REVOKE ALL ON FUNCTION opengeni_private.sync_external_membership_lifecycle() FROM PUBLIC;
+CREATE TRIGGER organization_membership_external_lifecycle
+AFTER UPDATE OF status, authorization_revision ON organization_memberships
+FOR EACH ROW WHEN (OLD.status IS DISTINCT FROM NEW.status OR OLD.authorization_revision IS DISTINCT FROM NEW.authorization_revision)
+EXECUTE FUNCTION opengeni_private.sync_external_membership_lifecycle();
+
+DO $patch$
+DECLARE
+  signature text;
+  definition text;
+  anchor text;
+  replacement text;
+BEGIN
+  FOREACH signature IN ARRAY ARRAY[
+    'prepare_organization_membership_protocol_settlements(jsonb)',
+    'organization_membership_command_0263(jsonb)'
+  ] LOOP
+    definition := pg_get_functiondef(signature::regprocedure);
+    anchor := '  input_hash_value text;';
+    IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1
+      OR strpos(definition, 'acquire_organization_session_tenancy_fences') = 0 THEN
+      RAISE EXCEPTION '0441 lifecycle declaration or fence drift: %', signature USING ERRCODE = '55000';
+    END IF;
+    definition := replace(definition, anchor, anchor || E'\n  service_authorized boolean := false;');
+    anchor := '  input_hash_value := pg_catalog.encode(';
+    IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+      RAISE EXCEPTION '0441 lifecycle admission drift: %', signature USING ERRCODE = '55000';
+    END IF;
+    definition := replace(definition, anchor,
+      E'  service_authorized := opengeni_private.external_membership_service_authority(p_command);\n' || anchor);
+    IF signature = 'prepare_organization_membership_protocol_settlements(jsonb)' THEN
+      anchor := 'IF actor.id IS NULL OR actor.status <> ''active'' OR actor.role NOT IN (''owner'', ''admin'') THEN';
+      replacement := 'IF NOT service_authorized AND (actor.id IS NULL OR actor.status <> ''active'' OR actor.role NOT IN (''owner'', ''admin'')) THEN';
+    ELSE
+      anchor := 'IF NOT FOUND OR actor.status <> ''active'' THEN';
+      replacement := 'IF NOT service_authorized AND (NOT FOUND OR actor.status <> ''active'') THEN';
+    END IF;
+    IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+      RAISE EXCEPTION '0441 lifecycle actor guard drift: %', signature USING ERRCODE = '55000';
+    END IF;
+    definition := replace(definition, anchor, replacement);
+    IF signature = 'organization_membership_command_0263(jsonb)' THEN
+      -- All service actions were strictly constrained before receipt replay;
+      -- native administration checks stay byte-for-byte for native actors.
+      anchor := 'IF actor.role NOT IN (''owner'', ''admin'') THEN';
+      IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 3 THEN
+        RAISE EXCEPTION '0441 lifecycle role guard drift' USING ERRCODE = '55000';
+      END IF;
+      definition := replace(definition, anchor, 'IF NOT service_authorized AND actor.role NOT IN (''owner'', ''admin'') THEN');
+      anchor := 'account_id, operation_id, actor_membership_id, target_membership_id, kind,';
+      IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+        RAISE EXCEPTION '0441 lifecycle audit columns drift' USING ERRCODE = '55000';
+      END IF;
+      definition := replace(definition, anchor,
+        'account_id, operation_id, actor_membership_id, actor_service_subject, target_membership_id, kind,');
+      anchor := 'account_id_value, operation_id_value, actor.id,';
+      IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+        RAISE EXCEPTION '0441 lifecycle audit values drift' USING ERRCODE = '55000';
+      END IF;
+      definition := replace(definition, anchor,
+        'account_id_value, operation_id_value, actor.id, CASE WHEN service_authorized THEN actor_subject ELSE NULL END,');
+      anchor := '''human'', actor_subject, ''organization.membership.'' || action_name';
+      IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+        RAISE EXCEPTION '0441 lifecycle interruption audit drift' USING ERRCODE = '55000';
+      END IF;
+      definition := replace(definition, anchor,
+        'CASE WHEN service_authorized THEN ''service'' ELSE ''human'' END, actor_subject, ''organization.membership.'' || action_name');
+    END IF;
+    EXECUTE definition;
+  END LOOP;
+END
+$patch$;

package/drizzle/0442_external_owning_user_authority.sql

@@ -0,0 +1,81 @@
+-- deployment-mode: rolling
+-- Database consistency checks for externally authenticated owning users.
+-- Authentication remains in the API's dedicated external resolver proof.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- The native xAI lifecycle locks the owning membership with SELECT FOR UPDATE.
+-- FORCE RLS requires an UPDATE policy for that lock in addition to SELECT.
+-- Permit only the table owner's private transaction-local lifecycle capability;
+-- WITH CHECK false forbids using this policy to actually rewrite a membership.
+CREATE POLICY xai_subscription_membership_lock ON organization_memberships
+  FOR UPDATE USING (
+    current_user = pg_catalog.pg_get_userbyid(
+      (SELECT relowner FROM pg_catalog.pg_class
+       WHERE oid = 'organization_memberships'::regclass)
+    )
+    AND EXISTS (
+      SELECT 1 FROM opengeni_private.xai_subscription_runtime_capabilities capability
+      WHERE capability.backend_pid = pg_catalog.pg_backend_pid()
+        AND capability.transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+        AND capability.capability_kind = 'lifecycle'
+    )
+  ) WITH CHECK (false);
+
+CREATE FUNCTION opengeni_private.active_external_owning_subject(p_account_id uuid, p_subject_id text)
+RETURNS boolean LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  result boolean;
+  previous_marker text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF p_account_id IS NULL OR p_subject_id IS NULL
+    OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_subject_id IS DISTINCT FROM opengeni_private.current_subject_id()
+  THEN RETURN false; END IF;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'external_identity_provisioning', true);
+  SELECT EXISTS (
+    SELECT 1 FROM external_identities identity_row
+    JOIN organization_memberships membership
+      ON membership.id = identity_row.organization_membership_id
+      AND membership.account_id = identity_row.account_id
+      AND membership.subject_id = identity_row.subject_id
+      AND membership.personal_workspace_id = identity_row.personal_workspace_id
+    WHERE identity_row.account_id = p_account_id AND identity_row.subject_id = p_subject_id
+      AND identity_row.status = 'active' AND membership.status = 'active'
+  ) INTO result;
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  RETURN result;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+  RAISE;
+END
+$body$;
+REVOKE ALL ON FUNCTION opengeni_private.active_external_owning_subject(uuid,text) FROM PUBLIC;
+
+DO $patch$
+DECLARE definition text; anchor text;
+BEGIN
+  definition := pg_get_functiondef('list_self_organization_memberships(text)'::regprocedure);
+  anchor := 'OR p_subject_id NOT LIKE ''user:%''';
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0442 self membership guard drift' USING ERRCODE = '55000';
+  END IF;
+  definition := replace(definition, anchor,
+    'OR (p_subject_id NOT LIKE ''user:%'' AND NOT opengeni_private.active_external_owning_subject(opengeni_private.current_account_id(), p_subject_id))');
+  anchor := 'WHERE membership.subject_id = p_subject_id;';
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+    RAISE EXCEPTION '0442 self membership scope drift' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, anchor,
+    'WHERE membership.subject_id = p_subject_id AND (p_subject_id LIKE ''user:%'' OR membership.account_id = opengeni_private.current_account_id());');
+  definition := pg_get_functiondef('open_private_session_create_capability(uuid,uuid,uuid,text)'::regprocedure);
+  anchor := 'OR p_actor_subject_id NOT LIKE ''user:%''';
+  IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1
+    OR strpos(definition, 'organization_private_sessions_enabled') = 0 THEN
+    RAISE EXCEPTION '0442 private create policy drift' USING ERRCODE = '55000';
+  END IF;
+  EXECUTE replace(definition, anchor,
+    'OR (p_actor_subject_id NOT LIKE ''user:%'' AND NOT opengeni_private.active_external_owning_subject(p_account_id, p_actor_subject_id))');
+END
+$patch$;

package/drizzle/0443_host_mcp_binding_registry.sql

@@ -0,0 +1,93 @@
+-- deployment-mode: maintenance
+-- Optional, credential-free host authority. Existing inline and host refs do
+-- not opt in automatically. Drain old runtimes before changing the role contract.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0443 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0443 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0443 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE host_mcp_bindings (
+  id uuid PRIMARY KEY,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL,
+  owner_subject_id text NOT NULL,
+  authorization_revision bigint NOT NULL CHECK (authorization_revision BETWEEN 1 AND 9007199254740991),
+  operation_id uuid NOT NULL,
+  request_digest text NOT NULL CHECK (request_digest ~ '^[0-9a-f]{64}$'),
+  definition jsonb NOT NULL CHECK (jsonb_typeof(definition) = 'object' AND octet_length(definition::text) <= 131072),
+  generation bigint NOT NULL DEFAULT 1 CHECK (generation BETWEEN 1 AND 9007199254740991),
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active','revoked')),
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  revoked_at timestamptz,
+  CONSTRAINT host_mcp_bindings_workspace_account_fk FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT host_mcp_bindings_external_owner_fk FOREIGN KEY (account_id, owner_subject_id)
+    REFERENCES external_identities(account_id, subject_id),
+  CHECK ((status = 'active' AND revoked_at IS NULL) OR (status = 'revoked' AND revoked_at IS NOT NULL)),
+  UNIQUE (workspace_id, owner_subject_id, operation_id)
+);
+CREATE INDEX host_mcp_bindings_owner_idx ON host_mcp_bindings(workspace_id, owner_subject_id, created_at, id);
+ALTER TABLE host_mcp_bindings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE host_mcp_bindings FORCE ROW LEVEL SECURITY;
+CREATE POLICY host_mcp_bindings_owner_scope ON host_mcp_bindings
+  USING (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id());
+
+CREATE FUNCTION opengeni_private.guard_host_mcp_binding_update() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  IF ROW(NEW.id, NEW.account_id, NEW.workspace_id, NEW.owner_subject_id,
+      NEW.authorization_revision, NEW.operation_id, NEW.request_digest, NEW.definition, NEW.created_at)
+    IS DISTINCT FROM ROW(OLD.id, OLD.account_id, OLD.workspace_id, OLD.owner_subject_id,
+      OLD.authorization_revision, OLD.operation_id, OLD.request_digest, OLD.definition, OLD.created_at)
+    OR OLD.status <> 'active' OR NEW.status <> 'revoked'
+    OR NEW.generation <> OLD.generation + 1 OR NEW.revoked_at IS NULL THEN
+    RAISE EXCEPTION 'host binding identity is immutable and revocation is terminal' USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER host_mcp_binding_immutable BEFORE UPDATE ON host_mcp_bindings
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_host_mcp_binding_update();
+REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_binding_update() FROM PUBLIC;
+REVOKE ALL ON TABLE host_mcp_bindings FROM PUBLIC;
+DO $acl$
+DECLARE target_role record;
+BEGIN
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_class relation
+    CROSS JOIN LATERAL aclexplode(coalesce(relation.relacl, acldefault('r', relation.relowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE relation.oid = 'host_mcp_bindings'::regclass AND privilege.grantee <> relation.relowner
+  LOOP EXECUTE format('REVOKE ALL ON TABLE host_mcp_bindings FROM %I', target_role.rolname); END LOOP;
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_proc routine
+    CROSS JOIN LATERAL aclexplode(coalesce(routine.proacl, acldefault('f', routine.proowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE routine.oid = 'opengeni_private.guard_host_mcp_binding_update()'::regprocedure
+      AND privilege.grantee <> routine.proowner
+  LOOP EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_binding_update() FROM %I', target_role.rolname); END LOOP;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0443 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$acl$;

package/drizzle/0444_host_mcp_delegations.sql

@@ -0,0 +1,129 @@
+-- deployment-mode: maintenance
+-- Owner-scoped delegation metadata. This does not admit execution.
+-- Accepted-work capture and runtime authorization are separate seams.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0444 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0444 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0444 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE host_mcp_delegations (
+  id uuid PRIMARY KEY,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL,
+  owner_subject_id text NOT NULL,
+  owner_authorization_revision bigint NOT NULL CHECK (owner_authorization_revision BETWEEN 1 AND 9007199254740991),
+  binding_id uuid NOT NULL REFERENCES host_mcp_bindings(id),
+  binding_generation bigint NOT NULL CHECK (binding_generation BETWEEN 1 AND 9007199254740991),
+  operation_id uuid NOT NULL,
+  request_digest text NOT NULL CHECK (request_digest ~ '^[0-9a-f]{64}$'),
+  grant_definition jsonb NOT NULL CHECK (jsonb_typeof(grant_definition) = 'object' AND octet_length(grant_definition::text) <= 4096),
+  generation bigint NOT NULL DEFAULT 1 CHECK (generation BETWEEN 1 AND 9007199254740991),
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  revoked_at timestamptz,
+  CONSTRAINT host_mcp_delegations_workspace_account_fk FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT host_mcp_delegations_external_owner_fk FOREIGN KEY (account_id, owner_subject_id)
+    REFERENCES external_identities(account_id, subject_id),
+  CHECK ((status = 'active' AND revoked_at IS NULL) OR (status = 'revoked' AND revoked_at IS NOT NULL)),
+  UNIQUE (workspace_id, owner_subject_id, operation_id)
+);
+CREATE INDEX host_mcp_delegations_owner_idx ON host_mcp_delegations(workspace_id, owner_subject_id, binding_id, id);
+ALTER TABLE host_mcp_delegations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE host_mcp_delegations FORCE ROW LEVEL SECURITY;
+CREATE POLICY host_mcp_delegations_owner_scope ON host_mcp_delegations
+  USING (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id());
+
+CREATE FUNCTION opengeni_private.guard_host_mcp_delegation() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+DECLARE binding host_mcp_bindings%ROWTYPE;
+BEGIN
+  IF TG_OP = 'UPDATE' THEN
+    IF ROW(NEW.id, NEW.account_id, NEW.workspace_id, NEW.owner_subject_id,
+        NEW.owner_authorization_revision, NEW.binding_id, NEW.binding_generation,
+        NEW.operation_id, NEW.request_digest, NEW.grant_definition, NEW.created_at)
+      IS DISTINCT FROM ROW(OLD.id, OLD.account_id, OLD.workspace_id, OLD.owner_subject_id,
+        OLD.owner_authorization_revision, OLD.binding_id, OLD.binding_generation,
+        OLD.operation_id, OLD.request_digest, OLD.grant_definition, OLD.created_at)
+      OR OLD.status <> 'active' OR NEW.status <> 'revoked'
+      OR NEW.generation <> OLD.generation + 1 OR NEW.revoked_at IS NULL THEN
+      RAISE EXCEPTION 'host delegation identity is immutable and revocation is terminal' USING ERRCODE = '42501';
+    END IF;
+    RETURN NEW;
+  END IF;
+  SELECT b.* INTO binding FROM host_mcp_bindings b WHERE b.id = NEW.binding_id FOR SHARE;
+  IF NOT FOUND OR binding.status <> 'active' OR binding.revoked_at IS NOT NULL
+    OR binding.account_id <> NEW.account_id OR binding.workspace_id <> NEW.workspace_id
+    OR binding.owner_subject_id <> NEW.owner_subject_id
+    OR binding.authorization_revision <> NEW.owner_authorization_revision
+    OR binding.generation <> NEW.binding_generation
+    OR NEW.status <> 'active' OR NEW.generation <> 1 OR NEW.revoked_at IS NOT NULL THEN
+    RAISE EXCEPTION 'host delegation binding unavailable' USING ERRCODE = '42501';
+  END IF;
+  IF (NEW.grant_definition ->> 'scope') IS DISTINCT FROM 'user'
+    OR coalesce(NEW.grant_definition ->> 'mode', '') NOT IN ('session','always')
+    OR coalesce(NEW.grant_definition ->> 'context', '') NOT IN ('user_private','workspace_shared')
+    OR jsonb_typeof(NEW.grant_definition -> 'workspaceSharedAcknowledged') IS DISTINCT FROM 'boolean'
+    OR (NEW.grant_definition ->> 'context' = 'workspace_shared'
+      AND NEW.grant_definition -> 'workspaceSharedAcknowledged' <> 'true'::jsonb)
+    OR NEW.grant_definition - ARRAY['scope','mode','context','sessionId','expectedAuthorityEpoch','workspaceSharedAcknowledged'] <> '{}'::jsonb
+    OR ((NEW.grant_definition ->> 'sessionId') IS NULL) IS DISTINCT FROM
+       ((NEW.grant_definition ->> 'expectedAuthorityEpoch') IS NULL)
+    OR (NEW.grant_definition ->> 'mode' = 'session' AND NEW.grant_definition ->> 'sessionId' IS NULL)
+    OR (NEW.grant_definition ->> 'mode' = 'always' AND NEW.grant_definition ->> 'sessionId' IS NOT NULL)
+  THEN RAISE EXCEPTION 'invalid host delegation scope' USING ERRCODE = '22023'; END IF;
+  IF NEW.grant_definition ->> 'sessionId' IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM sessions s WHERE s.id = (NEW.grant_definition ->> 'sessionId')::uuid
+      AND s.account_id = NEW.account_id AND s.workspace_id = NEW.workspace_id
+      AND s.visibility = NEW.grant_definition ->> 'context'
+      AND s.authority_epoch = (NEW.grant_definition ->> 'expectedAuthorityEpoch')::bigint
+      AND (s.visibility = 'workspace_shared' OR s.owner_subject_id = NEW.owner_subject_id)
+  ) THEN RAISE EXCEPTION 'host delegation session unavailable' USING ERRCODE = '42501'; END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER host_mcp_delegation_guard BEFORE INSERT OR UPDATE ON host_mcp_delegations
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_host_mcp_delegation();
+REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_delegation() FROM PUBLIC;
+REVOKE ALL ON TABLE host_mcp_delegations FROM PUBLIC;
+DO $acl$
+DECLARE target_role record;
+BEGIN
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_class relation
+    CROSS JOIN LATERAL aclexplode(coalesce(relation.relacl, acldefault('r', relation.relowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE relation.oid = 'host_mcp_delegations'::regclass AND privilege.grantee <> relation.relowner
+  LOOP EXECUTE format('REVOKE ALL ON TABLE host_mcp_delegations FROM %I', target_role.rolname); END LOOP;
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_proc routine
+    CROSS JOIN LATERAL aclexplode(coalesce(routine.proacl, acldefault('f', routine.proowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE routine.oid = 'opengeni_private.guard_host_mcp_delegation()'::regprocedure
+      AND privilege.grantee <> routine.proowner
+  LOOP EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_delegation() FROM %I', target_role.rolname); END LOOP;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0444 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$acl$;

package/drizzle/0445_host_mcp_turn_authorities.sql

@@ -0,0 +1,145 @@
+-- deployment-mode: maintenance
+-- Direct-turn capture only. Runtime consumption and inherited admission are separate.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' THEN
+    RAISE EXCEPTION '0445 requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF jsonb_array_length(roles) NOT BETWEEN 1 AND 16 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+      OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}')
+      OR octet_length(item #>> '{}') > 63
+  ) THEN RAISE EXCEPTION '0445 invalid application roles' USING ERRCODE = '55000'; END IF;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0445 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$drain$;
+
+CREATE TABLE host_mcp_turn_authorities (
+  turn_id uuid NOT NULL REFERENCES session_turns(id) ON DELETE CASCADE,
+  server_id text NOT NULL CHECK (octet_length(server_id) BETWEEN 1 AND 1024),
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL,
+  session_id uuid NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  owner_subject_id text NOT NULL,
+  binding_id uuid NOT NULL REFERENCES host_mcp_bindings(id),
+  delegation_id uuid NOT NULL REFERENCES host_mcp_delegations(id),
+  canonical_snapshot jsonb NOT NULL CHECK (jsonb_typeof(canonical_snapshot) = 'object' AND octet_length(canonical_snapshot::text) <= 262144),
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  PRIMARY KEY (turn_id, server_id),
+  FOREIGN KEY (workspace_id, account_id) REFERENCES workspaces(id, account_id) ON DELETE CASCADE
+);
+ALTER TABLE host_mcp_turn_authorities ENABLE ROW LEVEL SECURITY;
+ALTER TABLE host_mcp_turn_authorities FORCE ROW LEVEL SECURITY;
+CREATE POLICY session_visibility_isolation ON host_mcp_turn_authorities AS RESTRICTIVE
+  USING (session_reference_visible(account_id, workspace_id, session_id))
+  WITH CHECK (session_reference_visible(account_id, workspace_id, session_id));
+CREATE POLICY host_mcp_turn_authorities_owner_scope ON host_mcp_turn_authorities
+  USING (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id()
+    AND workspace_id = opengeni_private.current_workspace_id()
+    AND owner_subject_id = opengeni_private.current_subject_id());
+
+CREATE FUNCTION opengeni_private.guard_host_mcp_turn_authority() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+DECLARE
+  s sessions%ROWTYPE;
+  t session_turns%ROWTYPE;
+  d host_mcp_delegations%ROWTYPE;
+  b host_mcp_bindings%ROWTYPE;
+  membership jsonb;
+  expected jsonb;
+BEGIN
+  IF TG_OP <> 'INSERT' THEN
+    RAISE EXCEPTION 'accepted host authority is immutable' USING ERRCODE = '42501';
+  END IF;
+  IF NEW.account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR NEW.workspace_id IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR NEW.owner_subject_id IS DISTINCT FROM opengeni_private.current_subject_id() THEN
+    RAISE EXCEPTION 'host authority scope unavailable' USING ERRCODE = '42501';
+  END IF;
+  PERFORM pg_advisory_xact_lock(hashtextextended('organization-membership:' || NEW.account_id::text, 0));
+  SELECT value INTO membership FROM jsonb_array_elements(list_self_organization_memberships(NEW.owner_subject_id))
+    WHERE value ->> 'organizationId' = NEW.account_id::text AND value ->> 'status' = 'active';
+  IF membership IS NULL OR NOT (EXISTS (
+    SELECT 1 FROM workspace_memberships w WHERE w.workspace_id = NEW.workspace_id AND w.subject_id = NEW.owner_subject_id
+  ) OR coalesce(membership ->> 'personalWorkspaceId' = NEW.workspace_id::text, false)) THEN
+    RAISE EXCEPTION 'host authority membership unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO s FROM sessions WHERE id = NEW.session_id AND account_id = NEW.account_id AND workspace_id = NEW.workspace_id FOR UPDATE;
+  IF NOT FOUND OR (s.visibility = 'user_private' AND s.owner_subject_id IS DISTINCT FROM NEW.owner_subject_id) THEN
+    RAISE EXCEPTION 'host authority session unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO t FROM session_turns WHERE id = NEW.turn_id AND session_id = NEW.session_id
+    AND account_id = NEW.account_id AND workspace_id = NEW.workspace_id FOR UPDATE;
+  IF NOT FOUND OR t.status <> 'queued' OR t.active_attempt_id IS NOT NULL
+    OR t.source NOT IN ('user','api') OR t.initiator_kind <> 'subject'
+    OR t.initiator_subject_id <> NEW.owner_subject_id
+    OR (t.initiating_human_subject_id IS NOT NULL AND t.initiating_human_subject_id <> NEW.owner_subject_id)
+    OR t.initiator_context ?| ARRAY['via','viaTruncated','provenanceError','backfill']
+    OR EXISTS (SELECT 1 FROM session_turn_attempts a WHERE a.turn_id = t.id AND a.workspace_id = NEW.workspace_id) THEN
+    RAISE EXCEPTION 'host direct turn unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO d FROM host_mcp_delegations WHERE id = NEW.delegation_id AND account_id = NEW.account_id
+    AND workspace_id = NEW.workspace_id AND owner_subject_id = NEW.owner_subject_id FOR SHARE;
+  IF NOT FOUND OR d.status <> 'active' OR d.revoked_at IS NOT NULL OR d.binding_id <> NEW.binding_id
+    OR d.owner_authorization_revision::text IS DISTINCT FROM membership ->> 'authorizationRevision'
+    OR d.grant_definition ->> 'context' IS DISTINCT FROM s.visibility
+    OR (d.grant_definition ->> 'mode' = 'session' AND (
+      d.grant_definition ->> 'sessionId' IS DISTINCT FROM s.id::text
+      OR d.grant_definition ->> 'expectedAuthorityEpoch' IS DISTINCT FROM s.authority_epoch::text)) THEN
+    RAISE EXCEPTION 'host delegation unavailable' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO b FROM host_mcp_bindings WHERE id = NEW.binding_id AND account_id = NEW.account_id
+    AND workspace_id = NEW.workspace_id AND owner_subject_id = NEW.owner_subject_id FOR SHARE;
+  IF NOT FOUND OR b.status <> 'active' OR b.revoked_at IS NOT NULL
+    OR b.generation <> d.binding_generation OR b.authorization_revision <> d.owner_authorization_revision
+    OR b.definition ->> 'serverId' IS DISTINCT FROM NEW.server_id THEN
+    RAISE EXCEPTION 'host binding unavailable' USING ERRCODE = '42501';
+  END IF;
+  expected := jsonb_build_object(
+    'version', 1, 'accountId', NEW.account_id, 'workspaceId', NEW.workspace_id,
+    'targetSessionId', s.id, 'targetSessionVisibility', s.visibility, 'targetSessionAuthorityEpoch', s.authority_epoch,
+    'acceptedWork', jsonb_build_object('kind','turn','turnId',t.id),
+    'bindingId', b.id, 'bindingGeneration', b.generation, 'definition', b.definition,
+    'ownerSubjectId', NEW.owner_subject_id, 'ownerOrganizationMembershipId', membership ->> 'id',
+    'ownerMembershipAuthorizationRevision', (membership ->> 'authorizationRevision')::bigint,
+    'delegationId', d.id, 'delegationGeneration', d.generation, 'source', jsonb_build_object('kind','direct')
+  );
+  IF NEW.canonical_snapshot IS DISTINCT FROM expected THEN
+    RAISE EXCEPTION 'host authority snapshot is not canonical' USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER host_mcp_turn_authority_guard BEFORE INSERT OR UPDATE ON host_mcp_turn_authorities
+  FOR EACH ROW EXECUTE FUNCTION opengeni_private.guard_host_mcp_turn_authority();
+REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_turn_authority() FROM PUBLIC;
+REVOKE ALL ON TABLE host_mcp_turn_authorities FROM PUBLIC;
+DO $acl$
+DECLARE target_role record;
+BEGIN
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_class relation
+    CROSS JOIN LATERAL aclexplode(coalesce(relation.relacl, acldefault('r', relation.relowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE relation.oid = 'host_mcp_turn_authorities'::regclass AND privilege.grantee <> relation.relowner
+  LOOP EXECUTE format('REVOKE ALL ON TABLE host_mcp_turn_authorities FROM %I', target_role.rolname); END LOOP;
+  FOR target_role IN SELECT DISTINCT role.rolname FROM pg_proc routine
+    CROSS JOIN LATERAL aclexplode(coalesce(routine.proacl, acldefault('f', routine.proowner))) privilege
+    JOIN pg_roles role ON role.oid = privilege.grantee
+    WHERE routine.oid = 'opengeni_private.guard_host_mcp_turn_authority()'::regprocedure AND privilege.grantee <> routine.proowner
+  LOOP EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.guard_host_mcp_turn_authority() FROM %I', target_role.rolname); END LOOP;
+  IF EXISTS (SELECT 1 FROM pg_stat_activity a
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) r ON r = a.usename
+    WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION '0445 requires stopped application sessions' USING ERRCODE = '55000';
+  END IF;
+END
+$acl$;