@opengeni/db 5.0.1 → 6.0.0

package/drizzle/0470_organization_integration_policy.sql

@@ -0,0 +1,151 @@
+-- deployment-mode: maintenance
+-- Foundation only: new binaries must opt acquisition writers into the guard.
+-- The runtime table/grant contract changes; old processes must be drained.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles', true), '')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles) <> 'array' OR jsonb_array_length(roles) NOT BETWEEN 1 AND 16 THEN
+    RAISE EXCEPTION 'integration policy migration requires application database roles' USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (SELECT 1 FROM jsonb_array_elements(roles) item WHERE jsonb_typeof(item) <> 'string'
+    OR btrim(item #>> '{}') = '' OR item #>> '{}' <> btrim(item #>> '{}') OR octet_length(item #>> '{}') > 63)
+    OR EXISTS (SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON r = a.usename
+      WHERE a.datname = current_database() AND a.pid <> pg_backend_pid()) THEN
+    RAISE EXCEPTION 'integration policy migration requires valid stopped application roles' USING ERRCODE = '55000';
+  END IF;
+END $drain$;
+
+CREATE TABLE organization_integration_policies (
+  account_id uuid PRIMARY KEY REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  mode text NOT NULL CHECK (mode IN ('unrestricted', 'restricted')),
+  allowed_integration_keys jsonb NOT NULL CHECK (jsonb_typeof(allowed_integration_keys) = 'array'),
+  revision bigint NOT NULL CHECK (revision BETWEEN 1 AND 9007199254740991)
+);
+CREATE TABLE organization_integration_policy_operations (
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  operation_id uuid NOT NULL,
+  actor_subject_id text NOT NULL,
+  request jsonb NOT NULL,
+  result jsonb NOT NULL,
+  PRIMARY KEY (account_id, operation_id)
+);
+ALTER TABLE organization_integration_policies ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization_integration_policies FORCE ROW LEVEL SECURITY;
+ALTER TABLE organization_integration_policy_operations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization_integration_policy_operations FORCE ROW LEVEL SECURITY;
+REVOKE ALL ON organization_integration_policies, organization_integration_policy_operations FROM PUBLIC;
+CREATE POLICY organization_integration_policy_account ON organization_integration_policies
+  USING (account_id = opengeni_private.current_account_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id());
+CREATE POLICY organization_integration_policy_operation_account ON organization_integration_policy_operations
+  USING (account_id = opengeni_private.current_account_id())
+  WITH CHECK (account_id = opengeni_private.current_account_id());
+
+-- This is a live fence, not authentication. The application must verify canonical
+-- administrator provenance before selecting the subject, including on replay.
+CREATE FUNCTION opengeni_private.assert_organization_integration_policy_administrator(
+  p_account uuid, p_actor text
+) RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $body$
+DECLARE
+  previous_marker text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+  permissions_value jsonb; member_id uuid;
+BEGIN
+  IF p_account IS NULL OR p_actor IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_actor IS DISTINCT FROM opengeni_private.current_subject_id() THEN
+    RAISE EXCEPTION 'integration policy scope invalid' USING ERRCODE = '42501';
+  END IF;
+  IF p_actor LIKE 'api_key:%' THEN
+    SELECT permissions INTO permissions_value FROM api_keys
+      WHERE account_id = p_account AND 'api_key:' || id::text = p_actor
+        AND credential_kind = 'organization' AND workspace_id IS NULL AND revoked_at IS NULL
+        AND (expires_at IS NULL OR expires_at > clock_timestamp()) FOR SHARE;
+    IF NOT coalesce(permissions_value ? 'workspace:admin', false) THEN
+      RAISE EXCEPTION 'organization administrator required' USING ERRCODE = '42501';
+    END IF;
+  ELSE
+    PERFORM set_config('opengeni.organization_tenancy_lifecycle', 'organization_private_session_settings', true);
+    SELECT id INTO member_id FROM organization_memberships
+      WHERE account_id = p_account AND subject_id = p_actor AND status = 'active' AND role IN ('owner','admin') FOR SHARE;
+    PERFORM set_config('opengeni.organization_tenancy_lifecycle', coalesce(previous_marker, ''), true);
+    IF member_id IS NULL THEN RAISE EXCEPTION 'organization administrator required' USING ERRCODE = '42501'; END IF;
+  END IF;
+END $body$;
+REVOKE ALL ON FUNCTION opengeni_private.assert_organization_integration_policy_administrator(uuid,text) FROM PUBLIC;
+
+CREATE FUNCTION opengeni_private.update_organization_integration_policy(
+  p_account uuid, p_actor text, p_request jsonb
+) RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $body$
+DECLARE
+  prior organization_integration_policy_operations%ROWTYPE;
+  current_revision bigint; expected_revision bigint; operation_value uuid; result_value jsonb;
+  policy_lock bigint := hashtextextended('organization-integration-policy:' || p_account::text, 0);
+BEGIN
+  IF p_account IS NULL OR p_actor IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_actor IS DISTINCT FROM opengeni_private.current_subject_id() THEN
+    RAISE EXCEPTION 'integration policy scope invalid' USING ERRCODE = '42501';
+  END IF;
+  IF jsonb_typeof(p_request) IS DISTINCT FROM 'object'
+    OR p_request ->> 'mode' IS NULL OR p_request ->> 'mode' NOT IN ('unrestricted', 'restricted')
+    OR jsonb_typeof(p_request -> 'allowedIntegrationKeys') IS DISTINCT FROM 'array'
+    OR jsonb_typeof(p_request -> 'expectedRevision') IS DISTINCT FROM 'number'
+    OR coalesce(p_request ->> 'expectedRevision', '') !~ '^[0-9]+$'
+    OR jsonb_typeof(p_request -> 'operationId') IS DISTINCT FROM 'string'
+    OR p_request - ARRAY['mode','allowedIntegrationKeys','expectedRevision','operationId'] <> '{}'::jsonb THEN
+    RAISE EXCEPTION 'integration policy request invalid' USING ERRCODE = '22023';
+  END IF;
+  expected_revision := (p_request ->> 'expectedRevision')::bigint;
+  operation_value := (p_request ->> 'operationId')::uuid;
+  IF expected_revision NOT BETWEEN 0 AND 9007199254740990
+    OR jsonb_array_length(p_request -> 'allowedIntegrationKeys') > 10000
+    OR EXISTS (SELECT 1 FROM jsonb_array_elements(p_request -> 'allowedIntegrationKeys') k
+      WHERE jsonb_typeof(k) <> 'string' OR length(k #>> '{}') NOT BETWEEN 1 AND 200
+        OR k #>> '{}' !~ '^[a-z0-9][a-z0-9._:-]*$')
+    OR (SELECT count(*) <> count(DISTINCT k) FROM jsonb_array_elements(p_request -> 'allowedIntegrationKeys') k) THEN
+    RAISE EXCEPTION 'integration policy request invalid' USING ERRCODE = '22023';
+  END IF;
+  -- Never upgrade a shared acquisition fence: two upgrading acquisitions deadlock.
+  -- This also detects a shared fence retained by a released nested savepoint.
+  IF EXISTS (SELECT 1 FROM pg_locks WHERE locktype = 'advisory' AND pid = pg_backend_pid()
+    AND mode = 'ShareLock' AND granted AND objsubid = 1
+    AND classid = ((policy_lock >> 32) & 4294967295)::oid
+    AND objid = (policy_lock & 4294967295)::oid) THEN
+    RAISE EXCEPTION 'policy mutation cannot upgrade an acquisition fence' USING ERRCODE = '55000';
+  END IF;
+  -- Policy BEFORE membership: acquisition callbacks such as personal OAuth take
+  -- membership themselves. The inverse order cycles with their shared policy lock.
+  -- No workspace row is required or locked by this organization-only operation.
+  PERFORM pg_advisory_xact_lock(policy_lock);
+  PERFORM pg_advisory_xact_lock(hashtextextended('organization-membership:' || p_account::text, 0));
+  PERFORM opengeni_private.assert_organization_integration_policy_administrator(p_account, p_actor);
+  SELECT * INTO prior FROM organization_integration_policy_operations
+    WHERE account_id = p_account AND operation_id = operation_value;
+  IF FOUND THEN
+    IF prior.actor_subject_id <> p_actor OR prior.request <> p_request THEN
+      RAISE EXCEPTION 'integration policy operation reused' USING ERRCODE = '23505';
+    END IF;
+    RETURN prior.result;
+  END IF;
+  SELECT revision INTO current_revision FROM organization_integration_policies WHERE account_id = p_account;
+  IF coalesce(current_revision, 0) <> expected_revision THEN
+    RAISE EXCEPTION 'integration policy revision conflict' USING ERRCODE = '40001';
+  END IF;
+  result_value := jsonb_build_object('mode', p_request -> 'mode', 'allowedIntegrationKeys', p_request -> 'allowedIntegrationKeys', 'revision', expected_revision + 1);
+  INSERT INTO organization_integration_policies (account_id, mode, allowed_integration_keys, revision)
+    VALUES (p_account, p_request ->> 'mode', p_request -> 'allowedIntegrationKeys', expected_revision + 1)
+    ON CONFLICT (account_id) DO UPDATE SET mode = excluded.mode,
+      allowed_integration_keys = excluded.allowed_integration_keys, revision = excluded.revision;
+  INSERT INTO organization_integration_policy_operations (account_id, operation_id, actor_subject_id, request, result)
+    VALUES (p_account, operation_value, p_actor, p_request, result_value);
+  RETURN result_value;
+END $body$;
+REVOKE ALL ON FUNCTION opengeni_private.update_organization_integration_policy(uuid,text,jsonb) FROM PUBLIC;
+-- Explicit pg_temp LAST prevents temporary relation shadowing in the definer.
+DO $safe_path$
+BEGIN
+  EXECUTE format('ALTER FUNCTION opengeni_private.update_organization_integration_policy(uuid,text,jsonb) SET search_path = pg_catalog, %I, pg_temp', current_schema());
+  EXECUTE format('ALTER FUNCTION opengeni_private.assert_organization_integration_policy_administrator(uuid,text) SET search_path = pg_catalog, %I, pg_temp', current_schema());
+END $safe_path$;

package/drizzle/0471_usage_events_account_recent_index.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "usage_events_account_recent_idx"
+  ON "usage_events" ("account_id", "occurred_at" DESC, "recorded_at" DESC);

package/drizzle/0472_usage_events_workspace_recent_index.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "usage_events_workspace_recent_idx"
+  ON "usage_events" ("account_id", "workspace_id", "occurred_at" DESC, "recorded_at" DESC);

package/drizzle/0473_organization_usage_analytical_capability.sql

@@ -0,0 +1,237 @@
+-- deployment-mode: rolling
+-- Exact account-scoped reporting, retaining FORCE RLS and actual actor scope.
+-- Only this aggregate function may mint the short-lived owner capability. It
+-- never returns raw facts and does not change any write/tenant/session policy.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE opengeni_private.organization_usage_read_capabilities (
+  backend_pid integer NOT NULL,
+  transaction_id xid8 NOT NULL,
+  account_id uuid NOT NULL,
+  subject_id text,
+  initiating_human_subject_id text,
+  PRIMARY KEY (backend_pid, transaction_id)
+);
+REVOKE ALL ON TABLE opengeni_private.organization_usage_read_capabilities FROM PUBLIC;
+
+-- Strip hostile owner defaults, not merely the nominal application role.
+DO $table_acl$
+DECLARE role_name text;
+BEGIN
+  FOR role_name IN
+    SELECT DISTINCT role_row.rolname
+    FROM pg_catalog.pg_class relation
+    CROSS JOIN LATERAL pg_catalog.aclexplode(coalesce(relation.relacl,
+      pg_catalog.acldefault('r', relation.relowner))) privilege
+    JOIN pg_catalog.pg_roles role_row ON role_row.oid = privilege.grantee
+    WHERE relation.oid = 'opengeni_private.organization_usage_read_capabilities'::regclass
+      AND privilege.grantee <> relation.relowner
+  LOOP
+    EXECUTE format('REVOKE ALL ON TABLE opengeni_private.organization_usage_read_capabilities FROM %I', role_name);
+  END LOOP;
+END
+$table_acl$;
+
+DO $functions$
+DECLARE data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE FUNCTION %1$I.organization_usage_policy_capability_active(p_actor text)
+    RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $fn$
+      SELECT p_actor = pg_catalog.pg_get_userbyid((
+        SELECT relowner FROM pg_catalog.pg_class
+        WHERE oid = %2$L::pg_catalog.regclass
+      )) AND nullif(pg_catalog.current_setting('opengeni.workspace_id', true), '') IS NULL
+      AND EXISTS (
+        SELECT 1 FROM opengeni_private.organization_usage_read_capabilities capability
+        WHERE capability.backend_pid = pg_catalog.pg_backend_pid()
+          AND capability.transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability.account_id::text IS NOT DISTINCT FROM nullif(pg_catalog.current_setting('opengeni.account_id', true), '')
+          AND capability.subject_id IS NOT DISTINCT FROM nullif(pg_catalog.current_setting('opengeni.subject_id', true), '')
+          AND capability.initiating_human_subject_id IS NOT DISTINCT FROM nullif(pg_catalog.current_setting('opengeni.initiating_human_subject_id', true), '')
+      )
+    $fn$;
+    REVOKE ALL ON FUNCTION %1$I.organization_usage_policy_capability_active(text) FROM PUBLIC;
+    -- RLS plans check function ACLs before short circuiting. This reveals only
+    -- a same-backend boolean; callers cannot insert its capability row.
+    GRANT EXECUTE ON FUNCTION %1$I.organization_usage_policy_capability_active(text) TO PUBLIC;
+
+    CREATE FUNCTION opengeni_private.organization_usage_summary(
+      p_account_id uuid, p_since timestamptz, p_until timestamptz,
+      p_granularity text, p_after_workspace_id uuid, p_include_period boolean
+    ) RETURNS jsonb LANGUAGE plpgsql VOLATILE SECURITY DEFINER
+    SET search_path = pg_catalog, %1$I, opengeni_private, pg_temp
+    SET plan_cache_mode = force_custom_plan
+    AS $fn$
+    DECLARE
+      context_account_id uuid;
+      context_subject_id text;
+      context_human_id text;
+      page_ids uuid[];
+      next_cursor uuid;
+      response jsonb;
+    BEGIN
+      PERFORM opengeni_private.session_variable_set_attachments_protocol_v1_active();
+      BEGIN
+        context_account_id := nullif(current_setting('opengeni.account_id', true), '')::uuid;
+      EXCEPTION WHEN invalid_text_representation THEN
+        RAISE EXCEPTION 'Organization usage account context is malformed' USING ERRCODE = '42501';
+      END;
+      context_subject_id := nullif(current_setting('opengeni.subject_id', true), '');
+      context_human_id := nullif(current_setting('opengeni.initiating_human_subject_id', true), '');
+      IF context_account_id IS NULL OR context_account_id IS DISTINCT FROM p_account_id
+        OR nullif(current_setting('opengeni.workspace_id', true), '') IS NOT NULL
+      THEN
+        RAISE EXCEPTION 'Organization usage requires the exact account-only context' USING ERRCODE = '42501';
+      END IF;
+      IF p_since IS NULL OR p_until IS NULL OR NOT isfinite(p_since) OR NOT isfinite(p_until)
+        OR p_until < p_since OR p_until - p_since > interval '366 days'
+        OR p_granularity IS NULL OR p_granularity NOT IN ('hour', 'day')
+        OR (p_granularity = 'hour' AND p_until - p_since > interval '1 day')
+        OR p_include_period IS NULL
+      THEN
+        RAISE EXCEPTION 'Organization usage window or granularity is invalid' USING ERRCODE = '22023';
+      END IF;
+      -- Match listSharedWorkspacesForAccount: canonical membership pointers
+      -- exclude EVERY Personal workspace before lookahead/cursor selection.
+      -- Names, kind guesses and caller-owned Personal exceptions are forbidden.
+      -- Period totals remain actor-visible accounting across the account;
+      -- this shared-only inventory deliberately need not sum to those totals.
+      SELECT coalesce(array_agg(id ORDER BY id), '{}'::uuid[]) INTO page_ids
+      FROM (SELECT id FROM %1$I.workspaces
+        WHERE account_id = context_account_id
+          AND id IN (SELECT workspace_id FROM %1$I.list_organization_workspace_ids(context_account_id))
+          AND (p_after_workspace_id IS NULL OR id > p_after_workspace_id)
+        ORDER BY id LIMIT 51) page;
+      IF cardinality(page_ids) > 50 THEN
+        next_cursor := page_ids[50];
+        page_ids := page_ids[1:50];
+      END IF;
+
+      INSERT INTO opengeni_private.organization_usage_read_capabilities
+        (backend_pid, transaction_id, account_id, subject_id, initiating_human_subject_id)
+      VALUES (pg_backend_pid(), pg_current_xact_id(), context_account_id, context_subject_id, context_human_id);
+      BEGIN
+        WITH visible_sessions AS MATERIALIZED (
+          -- Sessions retain ordinary FORCE RLS. Private actor checks occur
+          -- once per session here, never once per fact in the aggregate scan.
+          SELECT id, account_id, workspace_id FROM %1$I.sessions session_row
+          WHERE account_id = context_account_id
+            AND (p_include_period OR workspace_id = ANY(page_ids))
+            AND (context_subject_id IS NULL OR visibility = 'workspace_shared'
+              OR %1$I.session_private_actor_visible(account_id, workspace_id,
+                owner_organization_membership_id, owner_subject_id))
+        ), visible AS MATERIALIZED (
+          SELECT usage_row.workspace_id, usage_row.event_type, usage_row.unit, usage_row.quantity,
+            CASE WHEN p_include_period THEN to_char(date_trunc(p_granularity, usage_row.occurred_at AT TIME ZONE 'UTC'),
+              CASE WHEN p_granularity = 'hour' THEN 'YYYY-MM-DD"T"HH24:00' ELSE 'YYYY-MM-DD' END) END AS bucket
+          FROM %1$I.usage_events usage_row
+          LEFT JOIN visible_sessions session_row
+            ON session_row.id = usage_row.session_id
+            AND session_row.account_id = usage_row.account_id
+            AND session_row.workspace_id = usage_row.workspace_id
+          WHERE usage_row.account_id = context_account_id
+            AND usage_row.occurred_at >= p_since AND usage_row.occurred_at < p_until
+            AND (p_include_period OR usage_row.workspace_id = ANY(page_ids))
+            AND (usage_row.session_id IS NULL OR session_row.id IS NOT NULL)
+        ), aggregates AS MATERIALIZED (
+          SELECT workspace_id, bucket, grouping(workspace_id) AS all_workspaces,
+            grouping(bucket) AS all_buckets,
+            jsonb_build_object('eventType', event_type, 'unit', unit,
+              'quantity', sum(quantity)::text, 'eventCount', count(*)::text) AS total
+          FROM visible GROUP BY GROUPING SETS
+            ((event_type, unit), (bucket, event_type, unit), (workspace_id, event_type, unit))
+        ), bucket_rows AS (
+          SELECT bucket, jsonb_agg(total ORDER BY total->>'eventType', total->>'unit') AS totals
+          FROM aggregates WHERE all_buckets = 0 AND p_include_period GROUP BY bucket
+        ), workspace_rows AS (
+          SELECT workspace_id, jsonb_agg(total ORDER BY total->>'eventType', total->>'unit') AS totals
+          FROM aggregates WHERE all_workspaces = 0 AND workspace_id = ANY(page_ids) GROUP BY workspace_id
+        )
+        SELECT jsonb_build_object(
+          'totals', CASE WHEN p_include_period THEN coalesce((SELECT jsonb_agg(total ORDER BY total->>'eventType', total->>'unit')
+            FROM aggregates WHERE all_workspaces = 1 AND all_buckets = 1), '[]'::jsonb) ELSE NULL END,
+          'buckets', CASE WHEN p_include_period THEN coalesce((SELECT jsonb_agg(jsonb_build_object('bucket', bucket, 'totals', totals) ORDER BY bucket)
+            FROM bucket_rows), '[]'::jsonb) ELSE NULL END,
+          'workspaces', coalesce((SELECT jsonb_agg(jsonb_build_object('workspaceId', w.id, 'name', w.name,
+            'totals', coalesce(r.totals, '[]'::jsonb)) ORDER BY w.id)
+            FROM %1$I.workspaces w LEFT JOIN workspace_rows r ON r.workspace_id = w.id
+            WHERE w.account_id = context_account_id AND w.id = ANY(page_ids)), '[]'::jsonb),
+          'nextWorkspaceCursor', next_cursor
+        ) INTO response;
+
+        DELETE FROM opengeni_private.organization_usage_read_capabilities
+          WHERE backend_pid = pg_backend_pid() AND transaction_id = pg_current_xact_id_if_assigned();
+        RETURN response;
+      EXCEPTION WHEN OTHERS THEN
+        DELETE FROM opengeni_private.organization_usage_read_capabilities
+          WHERE backend_pid = pg_backend_pid() AND transaction_id = pg_current_xact_id_if_assigned();
+        RAISE;
+      END;
+    END
+    $fn$;
+    REVOKE ALL ON FUNCTION opengeni_private.organization_usage_summary(uuid,timestamptz,timestamptz,text,uuid,boolean) FROM PUBLIC;
+  $ddl$, data_schema, format('%I.usage_events', data_schema));
+END
+$functions$;
+
+DO $policy$
+DECLARE data_schema text := current_schema(); installed record; expected_expression text;
+BEGIN
+  SELECT p.polpermissive, p.polcmd, pg_get_expr(p.polqual, p.polrelid) AS expression INTO installed
+  FROM pg_policy p WHERE p.polrelid = format('%I.usage_events', data_schema)::regclass
+    AND p.polname = 'session_visibility_isolation';
+  IF NOT FOUND OR installed.polpermissive OR installed.polcmd <> 'r'
+    OR installed.expression IS NULL
+  THEN
+    RAISE EXCEPTION 'Organization usage refuses unknown fact visibility policy' USING ERRCODE = '55000';
+  END IF;
+  -- Compare parsed policy trees, not substring heuristics. This temporary,
+  -- equally restrictive policy is dropped before the atomic migration ends.
+  -- A future visibility change must be reconciled explicitly rather than
+  -- silently replaced by a capability for a different authorization rule.
+  EXECUTE format('CREATE POLICY organization_usage_expected_visibility ON %1$I.usage_events AS RESTRICTIVE FOR SELECT USING (
+    CASE WHEN %1$I.insights_fact_read_policy_capability_active(current_user,
+      pg_catalog.pg_get_userbyid((SELECT relation.relowner FROM pg_catalog.pg_class relation WHERE relation.oid = %2$L::pg_catalog.regclass)),
+      ''usage_events'') THEN true ELSE %1$I.session_reference_visible(account_id, workspace_id, session_id) END)',
+    data_schema, format('%I.usage_events', data_schema));
+  SELECT pg_get_expr(p.polqual, p.polrelid) INTO expected_expression FROM pg_policy p
+    WHERE p.polrelid = format('%I.usage_events', data_schema)::regclass
+      AND p.polname = 'organization_usage_expected_visibility';
+  EXECUTE format('DROP POLICY organization_usage_expected_visibility ON %I.usage_events', data_schema);
+  IF installed.expression IS DISTINCT FROM expected_expression THEN
+    RAISE EXCEPTION 'Organization usage refuses changed fact visibility semantics' USING ERRCODE = '55000';
+  END IF;
+  -- The cheap owner-capability initPlan comes first; normal callers retain the
+  -- complete existing expression. Only SELECT changes; all writes stay intact.
+  EXECUTE format('ALTER POLICY session_visibility_isolation ON %I.usage_events USING (CASE WHEN (SELECT %I.organization_usage_policy_capability_active(current_user)) THEN true ELSE (%s) END)',
+    data_schema, data_schema, installed.expression);
+END
+$policy$;
+
+DO $function_acl$
+DECLARE role_name text; data_schema text := current_schema();
+BEGIN
+  FOR role_name IN
+    SELECT DISTINCT r.rolname FROM pg_proc p
+    CROSS JOIN LATERAL aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) privilege
+    JOIN pg_roles r ON r.oid = privilege.grantee
+    WHERE p.oid = 'opengeni_private.organization_usage_summary(uuid,timestamptz,timestamptz,text,uuid,boolean)'::regprocedure
+      AND privilege.grantee <> p.proowner
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.organization_usage_summary(uuid,timestamptz,timestamptz,text,uuid,boolean) FROM %I', role_name);
+  END LOOP;
+  FOR role_name IN
+    SELECT r.rolname FROM jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) configured(value)
+    JOIN pg_roles r ON r.rolname = configured.value
+    WHERE has_table_privilege(r.rolname, format('%I.usage_events', data_schema), 'SELECT')
+      AND has_table_privilege(r.rolname, format('%I.sessions', data_schema), 'SELECT')
+  LOOP
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', role_name);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.organization_usage_summary(uuid,timestamptz,timestamptz,text,uuid,boolean) TO %I', role_name);
+  END LOOP;
+END
+$function_acl$;

package/drizzle/0474_goal_report_requirements.sql

@@ -0,0 +1,156 @@
+-- deployment-mode: rolling
+-- Rolling-compatible storage fences. Existing non-report goals are unchanged.
+-- No caller boolean can waive a persisted requirement, including old binaries.
+-- Trust boundary: authenticated agent/API callers can supply receipt IDs, never
+-- receipt bodies. Trusted application code records proof after native query and
+-- decode. The runtime SQL role can INSERT these rows and is inside that trust
+-- boundary; these guards are retention/integrity checks, not an attestation
+-- against compromised application-role SQL or database administrators.
+CREATE FUNCTION session_goal_report_requirements_before_write()
+RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE requirements jsonb := coalesce(NEW.metadata -> 'reportRequirementsV1', '[]'::jsonb);
+DECLARE previous_requirements jsonb;
+DECLARE deliveries jsonb;
+DECLARE requirement jsonb;
+DECLARE delivery jsonb;
+DECLARE artifact record;
+BEGIN
+  IF jsonb_typeof(requirements) <> 'array' OR jsonb_array_length(requirements) > 16 THEN
+    RAISE EXCEPTION 'Invalid goal report requirements' USING ERRCODE = '23514';
+  END IF;
+  FOR requirement IN SELECT value FROM jsonb_array_elements(requirements) LOOP
+    IF jsonb_typeof(requirement) <> 'object'
+      OR (SELECT count(*) FROM jsonb_object_keys(requirement)) <> 2
+      OR jsonb_typeof(requirement -> 'id') IS DISTINCT FROM 'string'
+      OR (requirement ->> 'id') !~ '^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$'
+      OR jsonb_typeof(requirement -> 'title') IS DISTINCT FROM 'string'
+      OR octet_length(requirement ->> 'title') NOT BETWEEN 1 AND 512
+      OR btrim(requirement ->> 'title') = ''
+    THEN RAISE EXCEPTION 'Invalid goal report requirement' USING ERRCODE = '23514'; END IF;
+  END LOOP;
+  IF (SELECT count(DISTINCT value ->> 'id') FROM jsonb_array_elements(requirements)) <> jsonb_array_length(requirements) THEN
+    RAISE EXCEPTION 'Duplicate goal report requirement IDs' USING ERRCODE = '23514';
+  END IF;
+  IF TG_OP = 'UPDATE' AND NOT (OLD.status = 'completed' AND NEW.status = 'active') THEN
+    previous_requirements := coalesce(OLD.metadata -> 'reportRequirementsV1', '[]'::jsonb);
+    IF NOT requirements @> previous_requirements THEN
+      RAISE EXCEPTION 'Goal report requirements are append-only until completed-goal replacement' USING ERRCODE = '23514';
+    END IF;
+    IF OLD.status = 'completed' AND (requirements <> previous_requirements OR NEW.metadata -> 'reportDeliveriesV1' IS DISTINCT FROM OLD.metadata -> 'reportDeliveriesV1') THEN
+      RAISE EXCEPTION 'Completed report requirements and deliveries are immutable' USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  IF TG_OP = 'UPDATE' AND OLD.status = 'completed' AND NEW.status = 'active' THEN
+    -- Old rolling writers retain metadata on replacement. They must never
+    -- reuse a previous goal's verified delivery to complete the new goal.
+    NEW.metadata := jsonb_set(NEW.metadata, '{reportDeliveriesV1}', '[]'::jsonb);
+  END IF;
+  IF NEW.status = 'completed' AND (TG_OP = 'INSERT' OR OLD.status <> 'completed') AND jsonb_array_length(requirements) > 0 THEN
+    deliveries := coalesce(NEW.metadata -> 'reportDeliveriesV1', '[]'::jsonb);
+    IF jsonb_typeof(deliveries) <> 'array' OR jsonb_array_length(deliveries) <> jsonb_array_length(requirements)
+      OR (SELECT count(DISTINCT value ->> 'requirementId') FROM jsonb_array_elements(deliveries)) <> jsonb_array_length(requirements)
+    THEN RAISE EXCEPTION 'Missing report deliveries' USING ERRCODE = '23514'; END IF;
+    -- Same no-wait lock policy as the application: artifact writers already
+    -- lock the aggregate before checking their actor's session authority.
+    FOR delivery IN SELECT value FROM jsonb_array_elements(deliveries) ORDER BY value ->> 'artifactId' LOOP
+      IF NOT EXISTS (SELECT 1 FROM jsonb_array_elements(requirements) r WHERE r ->> 'id' = delivery ->> 'requirementId') THEN
+        RAISE EXCEPTION 'Unknown report requirement' USING ERRCODE = '23514';
+      END IF;
+      SELECT head_sequence, state_hash, authorization_revision INTO artifact FROM editable_artifacts
+        WHERE account_id = NEW.account_id AND workspace_id = NEW.workspace_id
+          AND id = delivery ->> 'artifactId' AND modality = 'document' AND lifecycle_state = 'active'
+        FOR SHARE NOWAIT;
+      IF NOT FOUND THEN RAISE EXCEPTION 'Report document unavailable' USING ERRCODE = '23514'; END IF;
+      IF NOT EXISTS (
+        SELECT 1 FROM session_command_receipts receipt
+        WHERE receipt.id::text = delivery ->> 'inspectionReceiptId'
+          AND receipt.account_id = NEW.account_id AND receipt.workspace_id = NEW.workspace_id
+          AND receipt.target_session_id = NEW.session_id
+          AND receipt.actor_type = 'agent_attempt' AND receipt.action = 'artifact.document.inspect'
+          AND receipt.result ->> 'version' = 'native-document-inspection.v1'
+          AND receipt.result ->> 'queryKind' = 'body'
+          AND receipt.result ->> 'artifactId' = delivery ->> 'artifactId'
+          AND receipt.result ->> 'headSequence' = artifact.head_sequence::text
+          AND receipt.result ->> 'stateHash' = artifact.state_hash
+          AND receipt.result ->> 'authorizationRevision' = artifact.authorization_revision::text
+      ) THEN RAISE EXCEPTION 'Missing or stale document inspection proof' USING ERRCODE = '23514'; END IF;
+    END LOOP;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER session_goal_report_requirements_before_write_trigger
+  BEFORE INSERT OR UPDATE OF metadata, status ON session_goals
+  FOR EACH ROW EXECUTE FUNCTION session_goal_report_requirements_before_write();
+
+-- Runs after the existing snapshot freeze trigger, without rewriting old turns.
+CREATE FUNCTION session_goal_freeze_report_requirements()
+RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE requirements jsonb;
+BEGIN
+  IF NEW.goal_snapshot ->> 'state' <> 'none' THEN
+    SELECT coalesce(metadata -> 'reportRequirementsV1', '[]'::jsonb) INTO requirements
+      FROM session_goals WHERE workspace_id = NEW.workspace_id AND session_id = NEW.session_id;
+    NEW.goal_snapshot := NEW.goal_snapshot || jsonb_build_object('reportRequirements', coalesce(requirements, '[]'::jsonb));
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER zz_session_goal_freeze_report_requirements_trigger
+  BEFORE INSERT ON session_turns
+  FOR EACH ROW EXECUTE FUNCTION session_goal_freeze_report_requirements();
+
+CREATE FUNCTION session_document_inspection_receipt_immutable()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF (OLD.action = 'artifact.document.inspect' OR NEW.action = 'artifact.document.inspect') AND NEW IS DISTINCT FROM OLD THEN
+    RAISE EXCEPTION 'Native document inspection receipts are immutable' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER session_document_inspection_receipt_immutable_trigger
+  BEFORE UPDATE ON session_command_receipts
+  FOR EACH ROW EXECUTE FUNCTION session_document_inspection_receipt_immutable();
+
+CREATE FUNCTION session_document_inspection_receipt_retained()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  -- Keep proof while its session exists. FK retention cascades remove the
+  -- session first and must remain able to delete its receipts. Checking parent
+  -- existence also prevents using an unrelated nested trigger to bypass this.
+  IF OLD.action = 'artifact.document.inspect' AND EXISTS (
+    SELECT 1 FROM sessions WHERE account_id = OLD.account_id
+      AND workspace_id = OLD.workspace_id AND id = OLD.target_session_id
+  ) THEN
+    RAISE EXCEPTION 'Native document inspection receipts are retained with their session' USING ERRCODE = '23514';
+  END IF;
+  RETURN OLD;
+END;
+$$;
+
+CREATE TRIGGER session_document_inspection_receipt_retained_trigger
+  BEFORE DELETE ON session_command_receipts
+  FOR EACH ROW EXECUTE FUNCTION session_document_inspection_receipt_retained();
+
+CREATE FUNCTION session_goal_report_requirements_before_delete()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  -- Parent session/workspace deletion remains cancellation, not completion.
+  -- Ordinary goal clearing must carry the exact trusted API cancellation stamp.
+  IF pg_trigger_depth() = 1 AND OLD.status <> 'completed'
+    AND jsonb_array_length(coalesce(OLD.metadata -> 'reportRequirementsV1', '[]'::jsonb)) > 0
+    AND current_setting('opengeni.goal_report_clear_id', true) IS DISTINCT FROM OLD.id::text
+  THEN
+    RAISE EXCEPTION 'Pending report requirements require explicit API cancellation' USING ERRCODE = '23514';
+  END IF;
+  RETURN OLD;
+END;
+$$;
+
+CREATE TRIGGER session_goal_report_requirements_before_delete_trigger
+  BEFORE DELETE ON session_goals
+  FOR EACH ROW EXECUTE FUNCTION session_goal_report_requirements_before_delete();

package/drizzle/0475_session_event_history_statistics.sql

@@ -0,0 +1,15 @@
+-- deployment-mode: rolling
+-- Session identity determines workspace and account. Independent column
+-- estimates otherwise multiply the same scope selectivity several times.
+-- No index, payload, pagination boundary, grant or planner setting changes.
+SET LOCAL lock_timeout = '5s';
+
+CREATE STATISTICS session_events_scope_statistics (dependencies, mcv)
+ON account_id, workspace_id, session_id FROM session_events;
+ALTER STATISTICS session_events_scope_statistics SET STATISTICS 1000;
+
+-- Populate existing installations immediately; autovacuum ANALYZE maintains
+-- this statistics object afterward. Only scope and cursor columns are sampled.
+-- The policy DDL is deliberately in 0476's separate transaction so its lock
+-- cannot be retained across this scan.
+ANALYZE session_events (account_id, workspace_id, session_id, sequence);

package/drizzle/0476_session_event_history_policy_planning.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: rolling
+-- Statistics were populated in 0475's separate transaction, so this policy
+-- DDL transaction does not retain its table lock across the ANALYZE scan.
+-- Keep the migration-owner capability exactly as introduced by 0353. In
+-- particular, ownership is resolved dynamically, not captured as a policy role.
+-- Express the owner-only branch as one conditional: treating its owner and
+-- capability terms as independent selectivity estimates can badly undercount
+-- ordinary scoped reads and favor scanning/sorting an entire session history.
+SET LOCAL lock_timeout = '5s';
+
+ALTER POLICY session_events_automatic_title_quarantine_v1 ON session_events
+USING (
+  CASE WHEN current_user = (
+    SELECT pg_catalog.pg_get_userbyid(relation.relowner)
+    FROM pg_catalog.pg_class relation
+    WHERE relation.oid = 'session_events'::regclass
+  ) THEN pg_catalog.current_setting(
+    'opengeni.automatic_session_title_quarantine_v1', true
+  ) = '1' ELSE false END
+)
+WITH CHECK (
+  CASE WHEN current_user = (
+    SELECT pg_catalog.pg_get_userbyid(relation.relowner)
+    FROM pg_catalog.pg_class relation
+    WHERE relation.oid = 'session_events'::regclass
+  ) THEN pg_catalog.current_setting(
+    'opengeni.automatic_session_title_quarantine_v1', true
+  ) = '1' ELSE false END
+);