@opengeni/db 4.4.0-canary.0 → 4.4.0-canary.2

package/src/knowledge-source-sync.ts

@@ -1,6 +1,6 @@
+import { requireScheduledTaskKnowledgeSource } from "@opengeni/contracts";
 import {
   type FileAsset,
-  KnowledgeSourceSyncAction,
   KnowledgeSourceSyncRunSummary,
   type ScheduledTask,
 } from "@opengeni/contracts";
@@ -108,7 +108,7 @@ export async function ensureKnowledgeSourceSyncState(
   db: Database,
   task: ScheduledTask,
 ): Promise<KnowledgeSourceSyncState> {
-  const action = KnowledgeSourceSyncAction.parse(task.action);
+  const action = requireScheduledTaskKnowledgeSource(task);
   return await withRlsContext(
     db,
     { accountId: task.accountId, workspaceId: task.workspaceId },
@@ -151,6 +151,12 @@ export async function ensureKnowledgeSourceSyncState(
             destination: action.destination,
             updatedAt: new Date(),
           },
+          // A frozen older run must never rewind a newer connector selection.
+          setWhere: sql`${schema.knowledgeSourceSyncStates.sourceLifecycleGeneration} <= ${action.sourceLifecycleGeneration}
+            AND (${schema.knowledgeSourceSyncStates.sourceConfigGeneration} < ${action.sourceConfigGeneration}
+              OR (${schema.knowledgeSourceSyncStates.sourceConfigGeneration} = ${action.sourceConfigGeneration}
+                AND ${schema.knowledgeSourceSyncStates.connectionId} = ${action.connection.connectionId}::uuid
+                AND ${schema.knowledgeSourceSyncStates.connectionVersion} <= ${action.connection.connectionVersion}))`,
         })
         .returning();
       if (!row) throw new Error("Failed to persist knowledge source sync state");
@@ -303,7 +309,12 @@ export async function claimKnowledgeSourceSyncLease(
           await tx
             .update(schema.scheduledTaskRuns)
             .set({ status: "skipped", completedAt: new Date(), updatedAt: new Date() })
-            .where(eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId));
+            .where(
+              and(
+                eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId),
+                eq(schema.scheduledTaskRuns.actionKind, "knowledge_source_sync"),
+              ),
+            );
           const [state] = await tx
             .select()
             .from(schema.knowledgeSourceSyncStates)
@@ -325,7 +336,12 @@ export async function claimKnowledgeSourceSyncLease(
             await tx
               .update(schema.scheduledTaskRuns)
               .set({ status: "skipped", completedAt: new Date(), updatedAt: new Date() })
-              .where(eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId));
+              .where(
+                and(
+                  eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId),
+                  eq(schema.scheduledTaskRuns.actionKind, "knowledge_source_sync"),
+                ),
+              );
             await tx
               .update(schema.knowledgeSourceSyncWakes)
               .set({ coalesced: true, claimedAt: new Date(), completedAt: new Date() })
@@ -344,7 +360,12 @@ export async function claimKnowledgeSourceSyncLease(
             await tx
               .update(schema.scheduledTaskRuns)
               .set({ status: "skipped", completedAt: new Date(), updatedAt: new Date() })
-              .where(eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId));
+              .where(
+                and(
+                  eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId),
+                  eq(schema.scheduledTaskRuns.actionKind, "knowledge_source_sync"),
+                ),
+              );
             await tx
               .update(schema.knowledgeSourceSyncWakes)
               .set({ coalesced: true, claimedAt: new Date(), completedAt: new Date() })
@@ -608,6 +629,19 @@ export async function settleKnowledgeSourceSyncLease(
           throw new Error("Knowledge source generation changed before lease settlement");
         }
         const completedAt = new Date();
+        await tx
+          .update(schema.scheduledTaskRuns)
+          .set({
+            knowledgeSyncRunId: input.knowledgeSyncRunId ?? null,
+            knowledgeSummary: summary,
+            updatedAt: completedAt,
+          })
+          .where(
+            and(
+              eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId),
+              eq(schema.scheduledTaskRuns.actionKind, "agent_turn"),
+            ),
+          );
         await tx
           .update(schema.scheduledTaskRuns)
           .set({
@@ -618,7 +652,12 @@ export async function settleKnowledgeSourceSyncLease(
             error: input.error ?? null,
             updatedAt: completedAt,
           })
-          .where(eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId));
+          .where(
+            and(
+              eq(schema.scheduledTaskRuns.id, input.scheduledTaskRunId),
+              eq(schema.scheduledTaskRuns.actionKind, "knowledge_source_sync"),
+            ),
+          );
         await tx
           .update(schema.knowledgeSourceSyncStates)
           .set({
@@ -673,7 +712,7 @@ export async function settleKnowledgeSourceSyncLease(
             .update(schema.scheduledTaskRuns)
             .set({ status: "skipped", completedAt, updatedAt: completedAt })
             .where(
-              sql`${schema.scheduledTaskRuns.id} in (${sql.join(
+              sql`${schema.scheduledTaskRuns.actionKind} = 'knowledge_source_sync' AND ${schema.scheduledTaskRuns.id} in (${sql.join(
                 supersededWakes.map((wake) => sql`${wake.scheduledTaskRunId}::uuid`),
                 sql`, `,
               )})`,

package/src/migrate.ts

@@ -2,6 +2,7 @@ import { readdir, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import postgres from "postgres";
+import { KNOWLEDGE_MIGRATION_MARKER, migrateRetainedKnowledge } from "./knowledge-migration";
 import { migrateLegacySkillConfigurations } from "./skill-config-migration";
 import { batchedBackfillTransactionLocalSetting } from "./migration-runner-settings";
 import {
@@ -193,6 +194,24 @@ export async function executeMigrationFile(
     });
     return;
   }
+  if (sqlText.includes(KNOWLEDGE_MIGRATION_MARKER)) {
+    if (file !== "0461_unified_knowledge.sql")
+      throw new Error("Knowledge conversion is restricted to migration 0461");
+    const parts = sqlText.split(KNOWLEDGE_MIGRATION_MARKER);
+    if (parts.length !== 2) throw new Error("0461 requires exactly one Knowledge conversion stage");
+    await sql.begin(async (transaction) => {
+      await transaction`CREATE TEMP TABLE knowledge_conversion_0461(completed boolean NOT NULL) ON COMMIT DROP`;
+      await transaction`SELECT
+        pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2','1',true),
+        pg_catalog.set_config('opengeni.session_variable_set_attachments_v1','1',true)`;
+      await transaction.unsafe(parts[0]!);
+      await migrateRetainedKnowledge(transaction);
+      await transaction`INSERT INTO pg_temp.knowledge_conversion_0461 VALUES(true)`;
+      await transaction.unsafe(parts[1]!);
+      await transaction`INSERT INTO schema_migrations(name) VALUES(${file}) ON CONFLICT DO NOTHING`;
+    });
+    return;
+  }
   const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);
   if (batchedBackfill) {
     await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;

package/src/provision-roles.ts

@@ -525,6 +525,9 @@ async function grantAppRoleIfSchemaExists(
   const workClaimCapabilityRoutines = `ARRAY[${WORK_CLAIM_CAPABILITY_ROUTINES.map(literal).join(", ")}]`;
   const organizationMembershipLifecycleRoutines = `ARRAY[${[
     "ensure_external_identity(uuid,text,text)",
+    "lookup_external_identity(uuid,text,text,text)",
+    "prepare_external_workspace_membership_operation(jsonb)",
+    "record_external_workspace_membership_operation(jsonb,jsonb)",
     "get_external_identity_link_reference(uuid,uuid,text)",
     "get_external_identity_link_inventory_references(uuid,uuid[])",
     "list_self_organization_memberships(text)",
@@ -826,6 +829,17 @@ BEGIN
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.skill_apply_lifecycle(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.skill_files_valid(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
     END IF;
+    IF to_regprocedure(format('%I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_claim(text,integer,integer) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_work(uuid,uuid,uuid,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.agent_instruction_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_confirm_legacy(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_read(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_prepare_file(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_document_prepare(uuid,uuid,uuid,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.agent_learning_manage(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+    END IF;
     IF to_regprocedure(
       format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -835,30 +849,8 @@ BEGIN
         ${literal(role)}
       );
     END IF;
-    IF to_regprocedure(
-      format(
-        '%I.knowledge_memory_apply_operation(jsonb,text,text,text,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.knowledge_memory_revert_operation(uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
+
+
     IF to_regprocedure(
       format(
         '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -944,6 +936,9 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- Older-schema fixtures and the maintenance conversion can still prepare
+    -- historical evidence; current runtimes receive only the undo/read seam.
+    IF to_regclass(format('%I.knowledge_entries', ${literal(schema)})) IS NULL THEN
     IF to_regprocedure(
       format(
         '%I.evaluate_governed_learning_proposal(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid,uuid,uuid)',
@@ -974,28 +969,10 @@ BEGIN
         ${literal(role)}
       );
     END IF;
-    IF to_regprocedure(
-      format('%I.confirm_remember_knowledge_claim(uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format('%I.materialize_remember_knowledge_memory(uuid,uuid,uuid)', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
+
+
     END IF;
+
     IF to_regprocedure(
       format('%I.undo_governed_learning_activation(uuid,uuid,uuid,uuid)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -1165,18 +1142,7 @@ BEGIN
         ${literal(role)}
       );
     END IF;
-    IF to_regprocedure(
-      format(
-        '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
+
     IF to_regprocedure(
       format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})
     ) IS NOT NULL THEN

package/src/runtime-posture.ts

@@ -106,6 +106,9 @@ const ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "get_external_identity_link_reference(uuid, uuid, text)",
   "get_external_identity_link_inventory_references(uuid, uuid[])",
   "ensure_external_identity(uuid, text, text)",
+  "lookup_external_identity(uuid, text, text, text)",
+  "prepare_external_workspace_membership_operation(jsonb)",
+  "record_external_workspace_membership_operation(jsonb, jsonb)",
   "list_self_organization_memberships(text)",
   "list_self_organization_invitations(text)",
   "list_self_organization_invitations(text, uuid, integer)",
@@ -424,10 +427,6 @@ const COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE =
 const GOVERNED_LEARNING_EVALUATION_ROUTINE =
   "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)";
 const GOVERNED_LEARNING_ACTIVATION_ROUTINES = [
-  "activate_governed_learning_decision(uuid, uuid, uuid, uuid)",
-  "activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)",
-  "confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
-  "materialize_remember_knowledge_memory(uuid, uuid, uuid)",
   "undo_governed_learning_activation(uuid, uuid, uuid, uuid)",
 ] as const;
 const GOVERNED_LEARNING_INSPECTION_ROUTINES = [
@@ -573,13 +572,48 @@ const XAI_AUTHORITY_TABLES = [
   "xai_subscription_credentials",
 ] as const;
 
+const UNIFIED_KNOWLEDGE_ROUTINES = [
+  "knowledge_index_claim(text, integer, integer)",
+  "knowledge_index_work(uuid, uuid, uuid, jsonb)",
+  "knowledge_entry_apply(uuid, uuid, jsonb, jsonb)",
+  "knowledge_entry_confirm_legacy(uuid, uuid, jsonb, jsonb)",
+  "agent_instruction_apply(uuid, uuid, jsonb, jsonb)",
+  "knowledge_entry_read(uuid, uuid, jsonb, jsonb)",
+  "knowledge_entry_prepare_file(uuid, uuid, jsonb, jsonb)",
+  "knowledge_document_prepare(uuid, uuid, uuid, jsonb)",
+  "agent_learning_manage(uuid, uuid, jsonb, jsonb)",
+] as const;
+const UNIFIED_KNOWLEDGE_ROUTINE_SET = new Set<string>(UNIFIED_KNOWLEDGE_ROUTINES);
+const UNIFIED_KNOWLEDGE_AUTHORITY_TABLES = [
+  "knowledge_entries",
+  "knowledge_entry_revisions",
+  "knowledge_entry_decisions",
+  "knowledge_entry_links",
+  "knowledge_entry_operations",
+  "knowledge_entry_search",
+  "knowledge_index_jobs",
+  "knowledge_entry_vectors",
+  "knowledge_review_batches",
+  "agent_learning_revisions",
+  "agent_learning_snapshots",
+  "agent_instruction_operations",
+  "workspace_instruction_policy_revisions",
+  "workspace_instruction_policy_heads",
+  "workspace_instruction_policy_activation_events",
+  "workspaces",
+  "sessions",
+  "session_turns",
+  "session_turn_attempts",
+  "files",
+  "documents",
+] as const;
 export const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
+  ...UNIFIED_KNOWLEDGE_ROUTINES,
   MCP_OPERATION_CAPABILITY_ROUTINE,
   "skill_apply_lifecycle(uuid, uuid, jsonb, jsonb)",
   COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE,
   COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,
   ...COMPANY_PROFILE_AGENT_ADMIN_ROUTINES,
-  GOVERNED_LEARNING_EVALUATION_ROUTINE,
   ...GOVERNED_LEARNING_ACTIVATION_ROUTINES,
   ...GOVERNED_LEARNING_INSPECTION_ROUTINES,
   FORK_SESSION_CONTENT_ROUTINE,
@@ -663,6 +697,9 @@ const RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set<string>(
  */
 export const FORCE_RLS_TABLES = [
   "additional_organization_creation_receipts",
+  "agent_instruction_operations",
+  "agent_learning_revisions",
+  "agent_learning_snapshots",
   "agent_run_states",
   "api_keys",
   "attached_browser_devices",
@@ -777,6 +814,8 @@ export const FORCE_RLS_TABLES = [
   "host_export_outbox",
   "host_mcp_bindings",
   "host_mcp_delegations",
+  "host_mcp_resolver_operations",
+  "host_mcp_resolvers",
   "host_mcp_task_authorities",
   "host_mcp_turn_authorities",
   "image_generation_operations",
@@ -798,13 +837,22 @@ export const FORCE_RLS_TABLES = [
   "knowledge_document_versions",
   "knowledge_entities",
   "knowledge_entity_aliases",
+  "knowledge_entries",
+  "knowledge_entry_decisions",
+  "knowledge_entry_links",
+  "knowledge_entry_operations",
+  "knowledge_entry_revisions",
+  "knowledge_entry_search",
+  "knowledge_entry_vectors",
   "knowledge_facts",
+  "knowledge_index_jobs",
   "knowledge_lifecycle_events",
   "knowledge_memories",
   "knowledge_memory_lifecycle_events",
   "knowledge_memory_relationships",
   "knowledge_operation_receipts",
   "knowledge_providers",
+  "knowledge_review_batches",
   "knowledge_source_acl_versions",
   "knowledge_source_objects",
   "knowledge_source_sync_index_obligations",
@@ -1125,7 +1173,6 @@ export const RUNTIME_FULL_DML_TABLES = [
   "integration_facet_bindings",
   "integration_oauth_clients",
   "integration_oauth_state_nonces",
-  "knowledge_memories",
   "knowledge_source_sync_index_obligations",
   "knowledge_source_sync_item_outcomes",
   "knowledge_source_sync_object_observations",
@@ -1244,6 +1291,7 @@ export const RUNTIME_READ_ONLY_TABLES = [
   "deployment_model_catalog",
   "document_authority_reclassifications",
   "knowledge_lifecycle_events",
+  "knowledge_memories",
   "knowledge_memory_lifecycle_events",
   "knowledge_memory_relationships",
   "nested_agent_depth_configuration",
@@ -1261,6 +1309,7 @@ export const RUNTIME_READ_ONLY_TABLES = [
   "workspace_instruction_policy_snapshots",
   "workspace_learning_policy_activation_events",
   "workspace_learning_policy_heads",
+  "workspace_learning_policy_revisions",
   "workspace_learning_policy_snapshots",
 ] as const;
 
@@ -1288,6 +1337,7 @@ export const RUNTIME_READ_INSERT_TABLES = [
   "feedback_submissions",
   "google_drive_object_acl_evidence",
   "google_drive_object_acl_principals",
+  "host_mcp_resolver_operations",
   "host_mcp_task_authorities",
   "host_mcp_turn_authorities",
   "knowledge_change_proposals",
@@ -1319,7 +1369,6 @@ export const RUNTIME_READ_INSERT_TABLES = [
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_onboarding_proposals",
   "workspace_instruction_policy_revisions",
-  "workspace_learning_policy_revisions",
 ] as const;
 
 /** Durable operation journals are append/read plus claim/settle updates, never deletes. */
@@ -1343,6 +1392,7 @@ export const RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "editable_artifact_session_links",
   "editable_artifacts",
   "external_identity_links",
+  "host_mcp_resolvers",
   "integration_facet_definitions",
   "integration_spec_revisions",
   "integration_tools",
@@ -1366,6 +1416,9 @@ export const RUNTIME_READ_INSERT_UPDATE_TABLES = [
  */
 export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "additional_organization_creation_receipts",
+  "agent_instruction_operations",
+  "agent_learning_revisions",
+  "agent_learning_snapshots",
   "canonical_human_identities",
   "canonical_human_identity_operations",
   "canonical_human_identity_subjects",
@@ -1392,6 +1445,15 @@ export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "knowledge_entries",
+  "knowledge_entry_decisions",
+  "knowledge_entry_links",
+  "knowledge_entry_operations",
+  "knowledge_entry_revisions",
+  "knowledge_entry_search",
+  "knowledge_entry_vectors",
+  "knowledge_index_jobs",
+  "knowledge_review_batches",
   "managed_auth_actor_mutation_leases",
   "managed_auth_browser_installations",
   "managed_auth_login_return_intents",
@@ -2287,6 +2349,28 @@ export function evaluateRuntimeDatabasePosture(
           );
         }
       }
+    } else if (
+      [
+        "lookup_external_identity(uuid, text, text, text)",
+        "prepare_external_workspace_membership_operation(jsonb)",
+        "record_external_workspace_membership_operation(jsonb, jsonb)",
+      ].includes(routine.name)
+    ) {
+      const names = [
+        "external_identities",
+        "organization_memberships",
+        "organization_workspace_operation_receipts",
+        "api_keys",
+      ];
+      if (
+        names.some(
+          (name) => !tableByName.has(name) || tableByName.get(name)!.owner !== routine.owner,
+        )
+      ) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match`,
+        );
+      }
     } else if (
       [
         "ensure_external_identity(uuid, text, text)",
@@ -2512,6 +2596,18 @@ export function evaluateRuntimeDatabasePosture(
           );
         }
       }
+    } else if (UNIFIED_KNOWLEDGE_ROUTINE_SET.has(routine.name)) {
+      // PostgreSQL 15+ public is owned by pg_database_owner while migrated
+      // tables/functions share the concrete migrator. Check the authority graph,
+      // as for the native Skill lifecycle, rather than the schema label.
+      for (const name of UNIFIED_KNOWLEDGE_AUTHORITY_TABLES) {
+        const table = tableByName.get(name);
+        if (!table) violations.push(`Knowledge authority table ${name} is missing`);
+        else if (routine.owner !== table.owner)
+          violations.push(
+            `Knowledge capability ${routine.name} owner ${routine.owner} does not match ${name} owner ${table.owner}`,
+          );
+      }
     } else if (routine.name === "skill_apply_lifecycle(uuid, uuid, jsonb, jsonb)") {
       const authorityTables = [
         "preference_registry_preferences",

package/src/schema.ts

@@ -26,6 +26,7 @@ import type {
 } from "@opengeni/contracts";
 import { WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 } from "@opengeni/contracts";
 import { sql } from "drizzle-orm";
+export * from "./knowledge-entries-schema";
 import type { SessionToolPolicy } from "@opengeni/contracts";
 import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
 import {
@@ -5479,13 +5480,15 @@ export const sessionMcpServers = pgTable(
 export const files = pgTable(
   "files",
   {
+    privateOwnerSubjectIds: text("private_owner_subject_ids").array().default(sql`CASE
+      WHEN nullif(current_setting('opengeni.private_file_owner',true),'') IS NULL THEN NULL
+      ELSE ARRAY[current_setting('opengeni.private_file_owner',true)] END`),
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id")
-      .notNull()
-      .references(() => workspaces.id, { onDelete: "cascade" }),
+    // Origin only for personal originals; SQL owns the generated retention FK.
+    workspaceId: uuid("workspace_id").notNull(),
     status: text("status").notNull().default("pending_upload"),
     filename: text("filename").notNull(),
     safeFilename: text("safe_filename").notNull(),
@@ -5522,6 +5525,9 @@ export const fileUploads = pgTable(
     fileId: uuid("file_id")
       .notNull()
       .references(() => files.id, { onDelete: "cascade" }),
+    privateFileOwnerSubjectId: text("private_file_owner_subject_id").default(
+      sql`nullif(current_setting('opengeni.private_file_owner',true),'')`,
+    ),
     status: text("status").notNull().default("pending"),
     expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
     completedAt: timestamp("completed_at", { withTimezone: true }),
@@ -5809,6 +5815,9 @@ export const videoGenerationOperations = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
+    privateFileOwnerSubjectId: text("private_file_owner_subject_id").default(
+      sql`nullif(current_setting('opengeni.private_file_owner',true),'')`,
+    ),
     sessionId: uuid("session_id").references(() => sessions.id, {
       onDelete: "set null",
     }),
@@ -6121,6 +6130,9 @@ export const retainedScreenshotArtifacts = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
+    privateFileOwnerSubjectId: text("private_file_owner_subject_id").default(
+      sql`nullif(current_setting('opengeni.private_file_owner',true),'')`,
+    ),
     sessionId: uuid("session_id").references(() => sessions.id, {
       onDelete: "set null",
     }),

package/src/skills.ts

@@ -56,6 +56,7 @@ export async function applySkillLifecycle(
       content = main?.content;
     } else if (
       request.operation === "approve" ||
+      request.operation === "reject" ||
       request.operation === "restore" ||
       request.operation === "confirm_response"
     ) {
@@ -216,6 +217,9 @@ export async function listSkillRecords(
           FROM skill_write_receipts pending WHERE pending.account_id=h.account_id
             AND pending.workspace_id=${context.workspaceId}::uuid AND pending.receipt->>'skillId'=h.id::text
             AND pending.receipt->>'outcome'='pending'
+            AND coalesce(pending.receipt->>'pendingReason','approval')='approval'
+            AND (pending.receipt->>'revisionId')::uuid=(SELECT newest.id FROM preference_registry_revisions newest
+              WHERE newest.account_id=h.account_id AND newest.preference_id=h.id ORDER BY newest.revision DESC LIMIT 1)
             AND NOT EXISTS(SELECT 1 FROM preference_registry_events e WHERE e.preference_id=h.id
               AND e.new_revision_id=(pending.receipt->>'revisionId')::uuid
               AND e.type IN ('activated','corrected','rejected'))),'[]'::jsonb),

package/src/video-generation.ts

@@ -926,6 +926,11 @@ export async function settleVideoGenerationReady(
         if (operation.expectedArtifactId === operation.expectedFileId) {
           throw new Error("Video artifact and File identities must be distinct");
         }
+        // The durable provider operation owns this write, including when its
+        // original session has since disappeared. Ordinary file reads stay scoped.
+        await tx.execute(
+          sql`SELECT set_config('opengeni.private_file_owner',${operation.privateFileOwnerSubjectId ?? ""},true)`,
+        );
         const now = new Date();
         await tx.insert(schema.files).values({
           id: input.fileId,
@@ -1265,6 +1270,15 @@ export async function getVideoGenerationOperationSummary(
 ): Promise<import("@opengeni/contracts").VideoGenerationOperationSummary | null> {
   const operation = await getVideoGenerationOperation(db, workspaceId, operationId);
   if (!operation) return null;
+  if (operation.privateFileOwnerSubjectId) {
+    const [context] = await withWorkspaceRls(db, workspaceId, (tx) =>
+      rawRows<{ owner: string | null }>(
+        tx,
+        sql`SELECT nullif(current_setting('opengeni.private_file_owner',true),'') AS owner`,
+      ),
+    );
+    if (context?.owner !== operation.privateFileOwnerSubjectId) return null;
+  }
   const terminal = inArrayValue(operation.status, [
     "completed",
     "provider_failed",

package/src/workspace-artifacts.ts

@@ -376,6 +376,7 @@ export async function getWorkspaceArtifactContentRef(
   versionId?: string,
 ): Promise<{
   artifactId: string;
+  status: WorkspaceArtifact["status"];
   version: WorkspaceArtifactVersion;
   contentKey: string;
   sourceKey: string | null;
@@ -399,6 +400,7 @@ export async function getWorkspaceArtifactContentRef(
     if (!version) throw new WorkspaceArtifactNotFoundError("Artifact version not found");
     return {
       artifactId,
+      status: artifact.status,
       version: versionFromRow(version),
       contentKey: version.contentKey,
       sourceKey: version.sourceKey,

package/src/workspace-instruction-policies-schema.ts

@@ -35,6 +35,7 @@ export const workspaceInstructionPolicyRevisions = pgTable(
     contentHash: text("content_hash").notNull(),
     provenanceSource: text("provenance_source").notNull(),
     provenanceSourceId: text("provenance_source_id"),
+    agentLearningContext: jsonb("agent_learning_context").$type<Record<string, unknown>>(),
     supersedesRevisionId: uuid("supersedes_revision_id"),
     createdBySubjectId: text("created_by_subject_id").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),