@opengeni/db 4.4.0-canary.2 → 5.0.0-canary.0

package/drizzle/0466_agent_instruction_activation_preservation.sql

@@ -0,0 +1,190 @@
+-- deployment-mode: rolling
+-- Agent instruction writes are additive or localized. Older application
+-- instances may still omit editMode while this migration rolls out, but their
+-- complete-content request is accepted only when it contains the active
+-- instruction byte-for-byte. Existing unsafe pending revisions and explicit
+-- replacement revisions are fenced again at the central activation ledger.
+
+ALTER FUNCTION agent_instruction_apply(uuid,uuid,jsonb,jsonb)
+  RENAME TO agent_instruction_apply_0462_unsafe;
+
+CREATE FUNCTION agent_instruction_apply(p_account uuid,p_workspace uuid,p_actor jsonb,p_request jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE
+  operation text:=p_request->>'operation';
+  edit_mode text;
+  current_state jsonb;
+  current_content text;
+  requested_content text;
+  old_text text;
+  new_text text;
+  expected_content text;
+  first_position integer;
+  second_position integer;
+  preservation jsonb;
+  effective_actor jsonb:=p_actor;
+BEGIN
+  IF operation='save' THEN
+    -- Preserve the exact fingerprint of operations first executed by either
+    -- side of this rolling boundary. New receipts carry the derived marker in
+    -- their stored actor; older receipts intentionally do not.
+    IF p_request->>'operationId' IS NOT NULL THEN
+      SELECT op.actor->'_instructionPreservation' INTO preservation
+        FROM agent_instruction_operations op
+        WHERE op.account_id=p_account
+          AND op.operation_id=(p_request->>'operationId')::uuid;
+      IF FOUND THEN
+        IF preservation IS NOT NULL THEN
+          effective_actor:=p_actor||jsonb_build_object(
+            '_instructionPreservation',preservation);
+        END IF;
+        RETURN agent_instruction_apply_0462_unsafe(
+          p_account,p_workspace,effective_actor,p_request);
+      END IF;
+    END IF;
+    current_state:=agent_instruction_apply_0462_unsafe(
+      p_account,p_workspace,p_actor,
+      jsonb_build_object('operation','get','target',p_request->'target'));
+    current_content:=current_state->>'content';
+    IF p_request ? 'editMode' THEN
+      edit_mode:=p_request->>'editMode';
+      IF edit_mode IS NULL OR edit_mode NOT IN ('append','edit') THEN
+        RAISE EXCEPTION 'Agents cannot replace the complete workspace instruction'
+          USING ERRCODE='22023';
+      END IF;
+      IF edit_mode='append' THEN
+        requested_content:=p_request->>'content';
+        expected_content:=CASE
+          WHEN current_content IS NULL THEN requested_content
+          WHEN right(current_content,2)=E'\n\n' THEN current_content||requested_content
+          WHEN right(current_content,1)=E'\n' THEN current_content||E'\n'||requested_content
+          ELSE current_content||E'\n\n'||requested_content
+        END;
+      ELSE
+        old_text:=p_request->>'oldText';
+        new_text:=p_request->>'newText';
+        IF current_content IS NOT NULL AND old_text IS NOT DISTINCT FROM current_content THEN
+          RAISE EXCEPTION 'Exact instruction edits must be localized; the complete instruction cannot be replaced'
+            USING ERRCODE='22023';
+        END IF;
+        first_position:=strpos(current_content,old_text);
+        IF first_position=0 THEN
+          RAISE EXCEPTION 'Exact instruction edit anchor was not found' USING ERRCODE='22023';
+        END IF;
+        second_position:=strpos(substring(current_content FROM first_position+1),old_text);
+        IF second_position>0 THEN
+          RAISE EXCEPTION 'Exact instruction edit anchor is ambiguous' USING ERRCODE='22023';
+        END IF;
+        expected_content:=overlay(current_content PLACING new_text FROM first_position FOR length(old_text));
+      END IF;
+    ELSE
+      -- A pre-0462 caller already constructed a complete proposed document.
+      -- Preserve rolling availability for additive requests without allowing
+      -- that compatibility path to discard any active byte.
+      requested_content:=p_request->>'content';
+      IF current_content IS NOT NULL
+        AND (requested_content IS NULL OR strpos(requested_content,current_content)=0) THEN
+        RAISE EXCEPTION 'Legacy instruction replacement would discard active workspace instructions'
+          USING ERRCODE='22023';
+      END IF;
+      edit_mode:='legacy_safe';
+      expected_content:=requested_content;
+    END IF;
+    preservation:=jsonb_strip_nulls(jsonb_build_object(
+      'saveOperationId',p_request->>'operationId',
+      'baselineContentHash',CASE WHEN current_content IS NULL THEN NULL
+        ELSE encode(sha256(convert_to(current_content,'UTF8')),'hex') END,
+      'resultContentHash',CASE WHEN expected_content IS NULL THEN NULL
+        ELSE encode(sha256(convert_to(expected_content,'UTF8')),'hex') END,
+      'editMode',edit_mode));
+    effective_actor:=p_actor||jsonb_build_object(
+      '_instructionPreservation',preservation);
+  END IF;
+  RETURN agent_instruction_apply_0462_unsafe(
+    p_account,p_workspace,effective_actor,p_request);
+END $$;
+
+CREATE FUNCTION agent_instruction_activation_preserves_baseline()
+RETURNS trigger LANGUAGE plpgsql SET search_path FROM CURRENT AS $$
+DECLARE
+  proposed workspace_instruction_policy_revisions%ROWTYPE;
+  baseline_content text;
+  baseline_hash text;
+  proposed_hash text;
+  preservation jsonb;
+BEGIN
+  IF NEW.type<>'activate' OR NEW.old_revision_id IS NULL THEN RETURN NEW; END IF;
+  SELECT * INTO proposed FROM workspace_instruction_policy_revisions r
+    WHERE r.account_id=NEW.account_id AND r.workspace_id=NEW.workspace_id
+      AND r.id=NEW.new_revision_id;
+  IF NOT FOUND OR proposed.provenance_source<>'agent_learning' THEN RETURN NEW; END IF;
+  SELECT r.content INTO baseline_content FROM workspace_instruction_policy_revisions r
+    WHERE r.account_id=NEW.account_id AND r.workspace_id=NEW.workspace_id
+      AND r.id=NEW.old_revision_id;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'The active instruction baseline is unavailable'
+      USING ERRCODE='22023';
+  END IF;
+  -- Compatibility revisions that retain the complete baseline are safe even
+  -- when they predate the wrapper-derived preservation metadata below.
+  IF baseline_content IS NOT NULL AND strpos(proposed.content,baseline_content)>0 THEN
+    RETURN NEW;
+  END IF;
+  baseline_hash:=encode(sha256(convert_to(baseline_content,'UTF8')),'hex');
+  proposed_hash:=encode(sha256(convert_to(proposed.content,'UTF8')),'hex');
+  preservation:=proposed.agent_learning_context#>'{actor,_instructionPreservation}';
+  IF preservation->>'saveOperationId'=proposed.operation_id::text
+    AND preservation->>'baselineContentHash'=baseline_hash
+    AND preservation->>'resultContentHash'=proposed_hash
+    AND preservation->>'editMode' IN ('append','edit','legacy_safe') THEN
+    RETURN NEW;
+  END IF;
+  RAISE EXCEPTION 'Unsafe whole-instruction agent replacement cannot be activated; reject it and create an append or localized edit'
+    USING ERRCODE='22023';
+END $$;
+
+DROP TRIGGER IF EXISTS agent_instruction_activation_preservation
+  ON workspace_instruction_policy_activation_events;
+CREATE TRIGGER agent_instruction_activation_preservation
+  BEFORE INSERT ON workspace_instruction_policy_activation_events
+  FOR EACH ROW EXECUTE FUNCTION agent_instruction_activation_preserves_baseline();
+
+DO $secure$
+DECLARE grantee text; runtime_role text;
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.agent_instruction_apply_0462_unsafe(uuid,uuid,jsonb,jsonb) SET search_path = %I, pg_catalog, pg_temp',
+    current_schema(),current_schema());
+  EXECUTE format(
+    'ALTER FUNCTION %I.agent_instruction_apply(uuid,uuid,jsonb,jsonb) SET search_path = %I, pg_catalog, pg_temp',
+    current_schema(),current_schema());
+  EXECUTE format(
+    'ALTER FUNCTION %I.agent_instruction_activation_preserves_baseline() SET search_path = %I, pg_catalog, pg_temp',
+    current_schema(),current_schema());
+  REVOKE ALL ON FUNCTION agent_instruction_apply_0462_unsafe(uuid,uuid,jsonb,jsonb) FROM PUBLIC;
+  REVOKE ALL ON FUNCTION agent_instruction_apply(uuid,uuid,jsonb,jsonb) FROM PUBLIC;
+  REVOKE ALL ON FUNCTION agent_instruction_activation_preserves_baseline() FROM PUBLIC;
+  FOR grantee IN SELECT DISTINCT role.rolname FROM pg_proc proc,
+    LATERAL aclexplode(coalesce(proc.proacl,acldefault('f',proc.proowner))) acl
+    JOIN pg_roles role ON role.oid=acl.grantee
+    WHERE proc.pronamespace=current_schema()::regnamespace
+      AND proc.proname='agent_instruction_apply_0462_unsafe'
+      AND acl.grantee<>proc.proowner
+  LOOP
+    EXECUTE format(
+      'REVOKE ALL ON FUNCTION %I.agent_instruction_apply_0462_unsafe(uuid,uuid,jsonb,jsonb) FROM %I',
+      current_schema(),grantee);
+  END LOOP;
+  FOR runtime_role IN SELECT jsonb_array_elements_text(
+    current_setting('opengeni.migration_application_roles')::jsonb)
+  LOOP
+    IF runtime_role<>current_user AND EXISTS(SELECT 1 FROM pg_roles WHERE rolname=runtime_role) THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.agent_instruction_apply_0462_unsafe(uuid,uuid,jsonb,jsonb) FROM %I',
+        current_schema(),runtime_role);
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.agent_instruction_apply(uuid,uuid,jsonb,jsonb) TO %I',
+        current_schema(),runtime_role);
+    END IF;
+  END LOOP;
+END $secure$;

package/drizzle/0467_host_resolver_full_organization_keys.sql

@@ -0,0 +1,34 @@
+-- deployment-mode: rolling
+-- Align the existing resolver write fence with public full organization keys.
+-- No grants, ownership, row policies, or stored credentials change.
+CREATE OR REPLACE FUNCTION opengeni_private.guard_host_mcp_resolver_write() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+DECLARE permissions_value jsonb;
+BEGIN
+  SELECT credential.permissions INTO permissions_value FROM api_keys credential
+  WHERE credential.account_id = NEW.account_id
+    AND 'api_key:' || credential.id::text = opengeni_private.current_subject_id()
+    AND credential.workspace_id IS NULL AND credential.credential_kind = 'organization'
+    AND credential.revoked_at IS NULL
+    AND (credential.expires_at IS NULL OR credential.expires_at > clock_timestamp())
+  FOR SHARE;
+  IF NEW.account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR NOT coalesce(permissions_value ? 'workspace:admin', false) THEN
+    RAISE EXCEPTION 'organization service administration required' USING ERRCODE = '42501';
+  END IF;
+  IF TG_TABLE_NAME = 'host_mcp_resolvers' THEN
+    IF TG_OP = 'UPDATE' THEN
+      IF ROW(NEW.id, NEW.account_id, NEW.external_source, NEW.created_at)
+        IS DISTINCT FROM ROW(OLD.id, OLD.account_id, OLD.external_source, OLD.created_at)
+        OR NEW.generation <> OLD.generation + 1 THEN
+        RAISE EXCEPTION 'resolver identity or generation conflict' USING ERRCODE = '40001';
+      END IF;
+    ELSIF NEW.generation <> 1 THEN
+      RAISE EXCEPTION 'initial resolver generation invalid' USING ERRCODE = '22023';
+    END IF;
+  ELSIF NEW.actor_subject_id IS DISTINCT FROM opengeni_private.current_subject_id() THEN
+    RAISE EXCEPTION 'resolver operation actor invalid' USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.4.0-canary.2",
+  "version": "5.0.0-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -102,11 +102,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.7-canary.2",
-    "@opengeni/codex": "^0.2.22-canary.14",
-    "@opengeni/config": "^1.2.0-canary.2",
-    "@opengeni/contracts": "^3.1.0-canary.2",
-    "@opengeni/network": "^0.3.1-canary.14",
+    "@opengeni/codemode": "^0.5.8-canary.0",
+    "@opengeni/codex": "^0.2.23-canary.0",
+    "@opengeni/config": "^1.2.1-canary.0",
+    "@opengeni/contracts": "^4.0.0-canary.0",
+    "@opengeni/network": "^0.3.1-canary.15",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/artifact-catalog.ts

@@ -0,0 +1,121 @@
+import type { ArtifactCatalogKind, ArtifactCatalogListQuery } from "@opengeni/contracts";
+import { sql, type SQL } from "drizzle-orm";
+import { withRlsContext, type Database } from "./database";
+
+export type ArtifactCatalogPosition = { key: string; kind: ArtifactCatalogKind; id: string };
+/** Internal candidates are NOT an authorized public projection. */
+export type ArtifactCatalogCandidate = {
+  id: string;
+  kind: ArtifactCatalogKind;
+  /** Internal adapter identity; never exposed as public provenance. */
+  origin: "site" | "editable_artifact" | "generated_image" | "sandbox_file";
+  title: string;
+  status: "active" | "archived";
+  created_at: Date | string;
+  updated_at: Date | string;
+  source_session_id: string | null;
+  version_id: string | null;
+  sort_key: string;
+};
+
+/** Called only after immutable bytes have been retained by explicit publication. */
+export async function recordSandboxFilePublication(
+  db: Database,
+  input: { accountId: string; workspaceId: string; fileId: string; sourceSessionId: string },
+): Promise<void> {
+  await withRlsContext(db, input, async (tx) => {
+    await tx.execute(
+      sql`select opengeni_private.record_sandbox_file_publication(${input.accountId}::uuid, ${input.workspaceId}::uuid, ${input.fileId}::uuid, ${input.sourceSessionId}::uuid)`,
+    );
+  });
+}
+
+/** Bounded keyset projection over existing domains; no universal content store.
+ * The caller must still perform editable application and file access checks.
+ */
+export async function listArtifactCatalogCandidates(
+  db: Database,
+  scope: { accountId: string; workspaceId: string },
+  input: {
+    query: ArtifactCatalogListQuery;
+    kinds: readonly ArtifactCatalogKind[];
+    snapshotAt: string;
+    after?: ArtifactCatalogPosition;
+    limit: number;
+  },
+): Promise<ArtifactCatalogCandidate[]> {
+  if (!input.kinds.length) return [];
+  if (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 201)
+    throw new Error("Invalid catalog candidate limit");
+  const { query } = input;
+  const source = query.sourceSessionId;
+  const branches: SQL[] = [];
+  if (input.kinds.includes("site"))
+    branches.push(sql`
+    SELECT a.id::text, 'site'::text AS kind, a.title, a.status, a.created_at, a.updated_at,
+      ${source ? sql`${source}::uuid` : sql`v.source_session_id`} AS source_session_id,
+      a.current_version_id::text AS version_id, 'site'::text AS origin
+    FROM workspace_artifacts a LEFT JOIN workspace_artifact_versions v
+      ON v.workspace_id = a.workspace_id AND v.artifact_id = a.id AND v.id = a.current_version_id
+    WHERE a.account_id = ${scope.accountId}::uuid AND a.workspace_id = ${scope.workspaceId}::uuid
+      ${source ? sql`AND EXISTS (SELECT 1 FROM workspace_artifact_versions sv WHERE sv.workspace_id = a.workspace_id AND sv.artifact_id = a.id AND sv.source_session_id = ${source}::uuid)` : sql``}`);
+  const editableKinds = input.kinds.filter((kind) =>
+    ["document", "spreadsheet", "presentation"].includes(kind),
+  );
+  if (editableKinds.length)
+    branches.push(sql`
+    SELECT a.id, a.modality AS kind, a.title, a.lifecycle_state AS status, a.created_at, a.updated_at,
+      ${source ? sql`${source}::uuid` : sql`NULL::uuid`} AS source_session_id, NULL::text AS version_id, 'editable_artifact'::text AS origin
+    FROM editable_artifacts a WHERE a.account_id = ${scope.accountId}::uuid AND a.workspace_id = ${scope.workspaceId}::uuid
+      AND a.modality IN (${sql.join(
+        editableKinds.map((kind) => sql`${kind}`),
+        sql`, `,
+      )})
+      ${source ? sql`AND EXISTS (SELECT 1 FROM editable_artifact_session_links l WHERE l.account_id = a.account_id AND l.workspace_id = a.workspace_id AND l.artifact_id = a.id AND l.session_id = ${source}::uuid)` : sql``}`);
+  if (input.kinds.includes("image"))
+    branches.push(sql`
+    SELECT f.id::text, 'image'::text AS kind, f.filename AS title, 'active'::text AS status,
+      g.created_at, g.updated_at, g.session_id AS source_session_id, NULL::text AS version_id, 'generated_image'::text AS origin
+    FROM generated_image_artifacts g JOIN files f ON f.account_id = g.account_id AND f.workspace_id = g.workspace_id AND f.id = g.artifact_id
+    WHERE g.account_id = ${scope.accountId}::uuid AND g.workspace_id = ${scope.workspaceId}::uuid AND g.status = 'ready' AND f.status = 'ready'
+      ${source ? sql`AND g.session_id = ${source}::uuid` : sql``}`);
+  const publishedKinds = input.kinds.filter((kind) => kind === "file" || kind === "image");
+  if (publishedKinds.length)
+    branches.push(sql`
+    SELECT p.file_id::text AS id, p.kind, p.title, 'active'::text AS status,
+      p.published_at AS created_at, p.published_at AS updated_at, p.source_session_id, NULL::text AS version_id, 'sandbox_file'::text AS origin
+    FROM opengeni_private.list_sandbox_file_publications(${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
+      ${JSON.stringify({ sourceSessionId: source, q: query.q, kinds: publishedKinds, sort: query.sort, snapshotAt: input.snapshotAt, after: input.after, limit: input.limit })}::jsonb) p`);
+  if (!branches.length) return [];
+  const sort =
+    query.sort === "title"
+      ? sql`lower(title)`
+      : query.sort === "newest"
+        ? sql`to_char(created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US')`
+        : sql`to_char(updated_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US')`;
+  const descending = query.sort !== "title";
+  const position = input.after;
+  const keyset = !position
+    ? sql`true`
+    : sql`(
+    sort_key COLLATE "C" ${descending ? sql`<` : sql`>`} ${position.key} COLLATE "C"
+    OR (sort_key = ${position.key} AND (kind COLLATE "C", id COLLATE "C") > (${position.kind}, ${position.id})))`;
+  return withRlsContext(
+    db,
+    scope,
+    async (tx) => {
+      const result = await tx.execute(sql`
+      WITH candidates AS (${sql.join(branches, sql` UNION ALL `)}),
+      ordered AS (SELECT *, ${sort} AS sort_key FROM candidates
+        WHERE status = ${query.status} AND created_at <= ${input.snapshotAt}::timestamptz
+          ${query.q ? sql`AND strpos(lower(title), lower(${query.q})) > 0` : sql``})
+      SELECT * FROM ordered WHERE ${keyset}
+      ORDER BY sort_key COLLATE "C" ${descending ? sql`DESC` : sql`ASC`}, kind COLLATE "C", id COLLATE "C"
+      LIMIT ${input.limit}`);
+      return (
+        Array.isArray(result) ? result : (result as { rows: ArtifactCatalogCandidate[] }).rows
+      ) as ArtifactCatalogCandidate[];
+    },
+    { isolationLevel: "repeatable read", accessMode: "read only" },
+  );
+}

package/src/host-mcp-resolvers.ts

@@ -58,7 +58,7 @@ async function administered<T>(
       sql`select id from api_keys where account_id = ${actor.accountId}::uuid
       and 'api_key:' || id::text = ${actor.subjectId} and workspace_id is null and credential_kind = 'organization'
       and revoked_at is null and (expires_at is null or expires_at > clock_timestamp())
-      and permissions ? 'account:admin' for share`,
+      and permissions ? 'workspace:admin' for share`,
     );
     if (!key) throw new HostMcpResolverError(403, "organization service administration required");
     await tx.execute(

package/src/index.ts

@@ -1,3 +1,4 @@
+export * from "./artifact-catalog";
 import { grantWorkspaceAccess } from "./workspace-membership-access";
 export { grantWorkspaceAccess, listWorkspaceMembers } from "./workspace-membership-access";
 import { codexSelectionDiagnostics } from "./codex-selection-diagnostics";

package/src/provision-roles.ts

@@ -2089,6 +2089,12 @@ BEGIN
     EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
     EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
     EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
+    IF to_regclass('opengeni_private.sandbox_file_publications') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.sandbox_file_publications FROM %I', ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.sandbox_file_publications FROM PUBLIC;
+      REVOKE ALL ON FUNCTION opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION opengeni_private.list_sandbox_file_publications(uuid,uuid,jsonb) FROM PUBLIC;
+    END IF;
     FOREACH routine_signature IN ARRAY ARRAY[
       'guard_mcp_operation_immutable()',
       'mcp_operation_command_scoped(jsonb,text,jsonb)',

package/src/runtime-posture.ts

@@ -48,6 +48,11 @@ const AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE =
 const AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE =
   "enforce_automatic_session_title_policy_v1()";
 const AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE = "automatic_session_title_fanout_outbox_v1";
+export const SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES = [
+  "record_sandbox_file_publication(uuid, uuid, uuid, uuid)",
+  "list_sandbox_file_publications(uuid, uuid, jsonb)",
+] as const;
+const SANDBOX_FILE_PUBLICATIONS_TABLE = "sandbox_file_publications";
 const AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE =
   "acquire_automatic_session_title_quarantine_fences_v1(integer)";
 
@@ -1630,6 +1635,7 @@ export type RuntimeRoutinePosture = {
   execute: boolean;
   publicExecute?: boolean;
   securityDefiner: boolean;
+  configuration?: string[] | null;
 };
 
 export type RuntimeTargetRoutinePosture = RuntimeRoutinePosture & {
@@ -1952,6 +1958,7 @@ export async function inspectRuntimeDatabasePosture(
               ${DOCUMENT_MIGRATION_CAPABILITY_TABLE},
               ${SCOPED_COMPUTE_CAPABILITY_TABLE},
               ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE},
+              ${SANDBOX_FILE_PUBLICATIONS_TABLE},
               ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE}
             )
         `),
@@ -2018,6 +2025,7 @@ export async function inspectRuntimeDatabasePosture(
         can_execute: boolean;
         public_execute: boolean;
         security_definer: boolean;
+        configuration: string[] | null;
       }>(
         await tx.execute(sql`
           select
@@ -2029,7 +2037,8 @@ export async function inspectRuntimeDatabasePosture(
               from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
               where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
             ) as public_execute,
-            p.prosecdef as security_definer
+            p.prosecdef as security_definer,
+            p.proconfig as configuration
           from pg_proc p
           join pg_namespace n on n.oid = p.pronamespace
           where n.nspname = 'opengeni_private'
@@ -2042,6 +2051,7 @@ export async function inspectRuntimeDatabasePosture(
         execute: row.can_execute,
         publicExecute: row.public_execute,
         securityDefiner: row.security_definer,
+        configuration: row.configuration,
       }));
 
       return {
@@ -3509,6 +3519,49 @@ export function evaluateRuntimeDatabasePosture(
     }
   }
 
+  const publicationTables = posture.privateTables.filter(
+    (table) => table.name === SANDBOX_FILE_PUBLICATIONS_TABLE,
+  );
+  if (publicationTables.length !== 1) {
+    if (!options.protectedTables)
+      violations.push("sandbox file publication private relation is missing or ambiguous");
+  } else {
+    const table = publicationTables[0]!;
+    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 2) {
+      violations.push("sandbox file publication relation lacks active FORCE-RLS file isolation");
+    }
+    if (
+      table.select ||
+      table.insert ||
+      table.update ||
+      table.delete ||
+      table.owner === expectedRole
+    ) {
+      violations.push("runtime role has forbidden direct sandbox file publication authority");
+    }
+    const filesOwner = tableByName.get("files")?.owner;
+    if (filesOwner && table.owner !== filesOwner)
+      violations.push("sandbox file publication owner does not match file authority");
+    for (const name of SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES) {
+      const routines = posture.privateRoutines.filter((routine) => routine.name === name);
+      const quotedSchema = `"${targetSchema.replaceAll('"', '""')}"`;
+      const searchPaths = new Set([
+        `search_path=pg_catalog, ${quotedSchema}, pg_temp`,
+        `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,
+      ]);
+      if (
+        routines.length !== 1 ||
+        !routines[0]!.execute ||
+        routines[0]!.publicExecute ||
+        !routines[0]!.securityDefiner ||
+        routines[0]!.owner !== table.owner ||
+        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))
+      ) {
+        violations.push(`sandbox file publication capability ${name} is missing or unsafe`);
+      }
+    }
+  }
+
   for (const routine of posture.privateRoutines) {
     if (routine.owner === expectedRole) {
       violations.push(`runtime role owns private routine ${routine.name}`);

package/src/schema.ts

@@ -5512,6 +5512,36 @@ export const files = pgTable(
   }),
 );
 
+/** Immutable publication receipt; content and ownership remain in files. */
+export const sandboxFilePublications = opengeniPrivateSchema.table(
+  "sandbox_file_publications",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    fileId: uuid("file_id").notNull(),
+    sourceSessionId: uuid("source_session_id"),
+    publishedAt: timestamp("published_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "sandbox_file_publications_pk",
+      columns: [table.accountId, table.workspaceId, table.fileId],
+    }),
+    file: foreignKey({
+      name: "sandbox_file_publications_file_fk",
+      columns: [table.accountId, table.workspaceId, table.fileId],
+      foreignColumns: [files.accountId, files.workspaceId, files.id],
+    }).onDelete("cascade"),
+    // SQL owns the composite session FK with column-specific SET NULL.
+    session: index("sandbox_file_publications_session_idx").on(
+      table.workspaceId,
+      table.sourceSessionId,
+      table.publishedAt,
+      table.fileId,
+    ),
+  }),
+);
+
 export const fileUploads = pgTable(
   "file_uploads",
   {