@opengeni/db 5.0.1 → 6.0.0

package/drizzle/0483_preclaim_admission_block.sql

@@ -0,0 +1,85 @@
+-- deployment-mode: rolling
+-- Additive storage only. Old workers cannot honor a parked admission: complete
+-- the worker rollout before relying on this fence (see docs/run-lifecycle.md).
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '1min';
+ALTER TABLE sessions ADD COLUMN admission_block jsonb;
+ALTER TABLE sessions ADD CONSTRAINT sessions_admission_block_shape CHECK (
+  admission_block IS NULL OR (
+    jsonb_typeof(admission_block) = 'object'
+    AND admission_block ?& ARRAY['reason','sqlState','retryPolicy','blockedAt','attemptId','fence','previousStatus']
+    AND admission_block - ARRAY['reason','sqlState','retryPolicy','blockedAt','attemptId','fence','previousStatus'] = '{}'::jsonb
+    AND admission_block->>'previousStatus' IN ('queued','idle','running','recovering','waiting_capacity','requires_action')
+    AND admission_block->>'reason' IN ('database_claim_rejected','initiator_membership_required','personal_resource_grant_required')
+    AND admission_block->>'retryPolicy' = 'explicit_recheck'
+    AND (admission_block->'sqlState' = 'null'::jsonb OR admission_block->>'sqlState' ~ '^[0-9A-Z]{5}$')
+    AND jsonb_typeof(admission_block->'blockedAt') = 'string'
+    AND jsonb_typeof(admission_block->'attemptId') = 'string'
+    AND admission_block->>'attemptId' ~ '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
+    AND jsonb_typeof(admission_block->'fence') = 'object'
+    AND admission_block->'fence' ?& ARRAY['lastSequence','controlVersion']
+    AND (admission_block->'fence') - ARRAY['lastSequence','controlVersion'] = '{}'::jsonb
+    AND jsonb_typeof(admission_block#>'{fence,lastSequence}') = 'number'
+    AND jsonb_typeof(admission_block#>'{fence,controlVersion}') = 'number'
+    AND admission_block#>>'{fence,lastSequence}' ~ '^[0-9]+$'
+    AND admission_block#>>'{fence,controlVersion}' ~ '^[0-9]+$'
+  ) IS TRUE
+);
+
+-- Older application binaries do not read the new field. They may continue
+-- retrying until rolled out, but cannot admit an attempt through a durable block.
+CREATE FUNCTION guard_session_admission_block() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  IF EXISTS (SELECT 1 FROM sessions s WHERE s.id = NEW.session_id
+    AND s.workspace_id = NEW.workspace_id AND s.account_id = NEW.account_id
+    AND s.admission_block IS NOT NULL) THEN
+    RAISE EXCEPTION 'session admission requires an explicit recheck' USING ERRCODE = 'OG003';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+REVOKE ALL ON FUNCTION guard_session_admission_block() FROM PUBLIC;
+CREATE TRIGGER session_attempt_admission_block BEFORE INSERT ON session_turn_attempts
+FOR EACH ROW EXECUTE FUNCTION guard_session_admission_block();
+
+-- Give only these two reviewed guards stable typed causes. Never infer their
+-- meaning from arbitrary P0002/42501 errors or parse driver error messages.
+-- A temporary installer keeps quoted function source distinct from migration
+-- data preflights. This reads pg_proc only; no membership row is read or changed.
+CREATE FUNCTION pg_temp.install_typed_admission_causes() RETURNS void
+LANGUAGE plpgsql AS $typed_admission_causes$
+DECLARE
+  function_oid regprocedure := pg_catalog.to_regprocedure(pg_catalog.format(
+    '%I.admit_session_attempt_personal_resources()', current_schema()));
+  definition text;
+  membership_selection constant text := $selection$      SELECT membership.* INTO STRICT member_row
+      FROM organization_memberships membership
+      WHERE membership.account_id = NEW.account_id
+        AND membership.subject_id = initiating_subject
+        AND membership.status = 'active'
+        AND membership.revoked_at IS NULL
+      FOR SHARE;$selection$;
+  grant_rejection constant text := $rejection$RAISE EXCEPTION 'matching personal-resource grant required'
+            USING ERRCODE = '42501';$rejection$;
+BEGIN
+  IF function_oid IS NULL THEN
+    RAISE EXCEPTION '0483 requires personal-resource admission' USING ERRCODE = '55000';
+  END IF;
+  definition := pg_catalog.pg_get_functiondef(function_oid);
+  IF (length(definition) - length(replace(definition, membership_selection, ''))) / length(membership_selection) <> 1
+    OR (length(definition) - length(replace(definition, grant_rejection, ''))) / length(grant_rejection) <> 1 THEN
+    RAISE EXCEPTION '0483 personal-resource guard source drift' USING ERRCODE = '55000';
+  END IF;
+  definition := replace(definition, membership_selection,
+    '      BEGIN' || chr(10) || membership_selection || chr(10) ||
+    '      EXCEPTION WHEN no_data_found THEN' || chr(10) ||
+    '        RAISE EXCEPTION ''personal-resource initiating membership required'' USING ERRCODE = ''OG001'';' || chr(10) ||
+    '      END;');
+  definition := replace(definition, grant_rejection,
+    replace(grant_rejection, '''42501''', '''OG002'''));
+  EXECUTE definition;
+END
+$typed_admission_causes$;
+SELECT pg_temp.install_typed_admission_causes();
+DROP FUNCTION pg_temp.install_typed_admission_causes();

package/drizzle/0484_insights_usage_projection.sql

@@ -0,0 +1,211 @@
+-- deployment-mode: rolling
+-- The bundle consumes four columns. A PL/pgSQL SETOF usage_events function
+-- constructs/spills the entire row before its caller can project those columns.
+-- Keep the 0359 authorization/window/filter/capability protocol unchanged and
+-- expose a separate narrow result so existing full-row callers keep working.
+DO $insights_usage_projection$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format($ddl$
+    CREATE FUNCTION opengeni_private.visible_workspace_insights_usage_projection(
+      p_workspace_id uuid,
+      p_since timestamp with time zone,
+      p_until timestamp with time zone,
+      p_event_types text[]
+    ) RETURNS TABLE (
+      event_type text,
+      quantity bigint,
+      occurred_at timestamp with time zone,
+      source_resource_id text
+    )
+    LANGUAGE plpgsql
+    VOLATILE
+    SECURITY DEFINER
+    SET search_path = pg_catalog, %1$I, opengeni_private, pg_temp
+    AS $function$
+    DECLARE
+      context_account_id uuid;
+      context_workspace_id uuid;
+      context_subject_id text;
+      context_initiating_human_subject_id text;
+    BEGIN
+      PERFORM opengeni_private.session_variable_set_attachments_protocol_v1_active();
+      BEGIN
+        context_account_id := nullif(
+          pg_catalog.current_setting('opengeni.account_id', true), ''
+        )::uuid;
+        context_workspace_id := nullif(
+          pg_catalog.current_setting('opengeni.workspace_id', true), ''
+        )::uuid;
+      EXCEPTION WHEN invalid_text_representation THEN
+        RAISE EXCEPTION 'Insights RLS context is malformed'
+          USING ERRCODE = '42501';
+      END;
+      context_subject_id := nullif(
+        pg_catalog.current_setting('opengeni.subject_id', true), ''
+      );
+      context_initiating_human_subject_id := nullif(
+        pg_catalog.current_setting('opengeni.initiating_human_subject_id', true), ''
+      );
+      IF context_account_id IS NULL
+        OR context_workspace_id IS NULL
+        OR context_workspace_id IS DISTINCT FROM p_workspace_id
+      THEN
+        RAISE EXCEPTION 'Insights RLS context does not match the requested workspace'
+          USING ERRCODE = '42501';
+      END IF;
+      IF p_since IS NULL
+        OR p_until IS NULL
+        OR p_since IN (
+          '-infinity'::timestamp with time zone,
+          'infinity'::timestamp with time zone
+        )
+        OR p_until = '-infinity'::timestamp with time zone
+        OR p_until < p_since
+        OR (
+          p_until <> 'infinity'::timestamp with time zone
+          AND p_until - p_since > interval '370 days'
+        )
+        OR (
+          p_until = 'infinity'::timestamp with time zone
+          AND p_since < CURRENT_TIMESTAMP - interval '370 days'
+        )
+      THEN
+        RAISE EXCEPTION 'Insights fact window must be non-negative and at most 370 days'
+          USING ERRCODE = '22023';
+      END IF;
+      IF p_event_types IS NULL
+        OR pg_catalog.array_ndims(p_event_types) <> 1
+        OR pg_catalog.cardinality(p_event_types) < 1
+        OR pg_catalog.cardinality(p_event_types) > 16
+        OR EXISTS (
+          SELECT 1
+          FROM pg_catalog.unnest(p_event_types) event_type(value)
+          WHERE event_type.value IS NULL
+            OR pg_catalog.btrim(event_type.value) = ''
+            OR pg_catalog.octet_length(event_type.value) > 256
+        )
+        OR (
+          SELECT pg_catalog.count(DISTINCT event_type.value COLLATE "C")
+          FROM pg_catalog.unnest(p_event_types) event_type(value)
+        ) <> pg_catalog.cardinality(p_event_types)
+      THEN
+        RAISE EXCEPTION 'Insights usage event types must contain 1-16 unique bounded values'
+          USING ERRCODE = '22023';
+      END IF;
+      IF p_until = p_since THEN
+        RETURN;
+      END IF;
+
+      INSERT INTO opengeni_private.insights_fact_read_runtime_capabilities (
+        backend_pid,
+        transaction_id,
+        capability_kind,
+        account_id,
+        workspace_id,
+        subject_id,
+        initiating_human_subject_id
+      ) VALUES (
+        pg_catalog.pg_backend_pid(),
+        pg_catalog.pg_current_xact_id(),
+        'usage_events',
+        context_account_id,
+        context_workspace_id,
+        context_subject_id,
+        context_initiating_human_subject_id
+      );
+      BEGIN
+        RETURN QUERY
+        WITH visible_sessions AS MATERIALIZED (
+          SELECT
+            id, account_id, workspace_id, visibility,
+            owner_organization_membership_id, owner_subject_id
+          FROM %1$I.sessions
+          WHERE account_id = context_account_id
+            AND workspace_id = p_workspace_id
+        )
+        SELECT usage_row.event_type, usage_row.quantity,
+          usage_row.occurred_at, usage_row.source_resource_id
+        FROM %1$I.usage_events usage_row
+        LEFT JOIN visible_sessions session_row
+          ON session_row.account_id = usage_row.account_id
+          AND session_row.workspace_id = usage_row.workspace_id
+          AND session_row.id = usage_row.session_id
+        WHERE usage_row.account_id = context_account_id
+          AND usage_row.workspace_id = p_workspace_id
+          AND usage_row.event_type = ANY (p_event_types)
+          AND usage_row.occurred_at >= p_since
+          AND usage_row.occurred_at < p_until
+          AND (
+            usage_row.session_id IS NULL
+            OR (
+              session_row.id IS NOT NULL
+              AND (
+                context_subject_id IS NULL
+                OR session_row.visibility = 'workspace_shared'
+                OR %1$I.session_private_actor_visible(
+                  session_row.account_id,
+                  session_row.workspace_id,
+                  session_row.owner_organization_membership_id,
+                  session_row.owner_subject_id
+                )
+              )
+            )
+          );
+
+        DELETE FROM opengeni_private.insights_fact_read_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'usage_events';
+        RETURN;
+      EXCEPTION WHEN OTHERS THEN
+        DELETE FROM opengeni_private.insights_fact_read_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'usage_events';
+        RAISE;
+      END;
+    END
+    $function$;
+    REVOKE ALL ON FUNCTION opengeni_private.visible_workspace_insights_usage_projection(
+      uuid, timestamptz, timestamptz, text[]
+    ) FROM PUBLIC;
+  $ddl$, data_schema);
+END
+$insights_usage_projection$;
+
+DO $insights_usage_projection_acl$
+DECLARE
+  role_name text;
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  -- Strip owner-default grants before admitting only configured application
+  -- roles that already have the existing full-row analytical authority.
+  FOR role_name IN
+    SELECT DISTINCT r.rolname FROM pg_catalog.pg_proc p
+    CROSS JOIN LATERAL pg_catalog.aclexplode(
+      coalesce(p.proacl, pg_catalog.acldefault('f', p.proowner))
+    ) privilege
+    JOIN pg_catalog.pg_roles r ON r.oid = privilege.grantee
+    WHERE p.oid = 'opengeni_private.visible_workspace_insights_usage_projection(uuid,timestamptz,timestamptz,text[])'::regprocedure
+      AND privilege.grantee <> p.proowner
+  LOOP
+    EXECUTE pg_catalog.format('REVOKE ALL ON FUNCTION opengeni_private.visible_workspace_insights_usage_projection(uuid,timestamptz,timestamptz,text[]) FROM %I', role_name);
+  END LOOP;
+  FOR role_name IN
+    SELECT r.rolname
+    FROM pg_catalog.jsonb_array_elements_text(
+      pg_catalog.current_setting('opengeni.migration_application_roles')::jsonb
+    ) configured(value)
+    JOIN pg_catalog.pg_roles r ON r.rolname = configured.value
+    WHERE pg_catalog.has_function_privilege(r.rolname,
+      'opengeni_private.visible_workspace_insights_usage_events(uuid,timestamptz,timestamptz,text[])', 'EXECUTE')
+      AND pg_catalog.has_table_privilege(r.rolname, pg_catalog.format('%I.usage_events', data_schema), 'SELECT')
+      AND pg_catalog.has_table_privilege(r.rolname, pg_catalog.format('%I.sessions', data_schema), 'SELECT')
+  LOOP
+    EXECUTE pg_catalog.format('GRANT USAGE ON SCHEMA opengeni_private TO %I', role_name);
+    EXECUTE pg_catalog.format('GRANT EXECUTE ON FUNCTION opengeni_private.visible_workspace_insights_usage_projection(uuid,timestamptz,timestamptz,text[]) TO %I', role_name);
+  END LOOP;
+END
+$insights_usage_projection_acl$;

package/drizzle/0485_inherited_mcp_approval_policies.sql

@@ -0,0 +1,6 @@
+-- deployment-mode: rolling
+-- Session-local approval settings do not copy or grant capability definitions.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+ALTER TABLE sessions ADD COLUMN mcp_approval_policies jsonb NOT NULL DEFAULT '{}'::jsonb
+  CHECK (jsonb_typeof(mcp_approval_policies) = 'object');

package/drizzle/0486_reasoning_configuration_message_forks.sql

@@ -0,0 +1,35 @@
+-- deployment-mode: rolling
+-- Configuration controls occupy fractional positions but are not compaction.
+-- Rewrite only the message-boundary overload's rejection predicate, retaining
+-- ordered JSON copying and all authority/provenance checks installed previously.
+DO $migration$
+DECLARE
+  candidate oid;
+  definition text;
+  updated text;
+BEGIN
+  SELECT oid INTO STRICT candidate FROM pg_proc
+  WHERE proname = 'fork_session_content'
+    AND pronamespace = current_schema()::regnamespace
+    AND pronargs = 11;
+  definition := pg_get_functiondef(candidate);
+  updated := replace(definition,
+    'history.position <> trunc(history.position)',
+    $predicate$(history.position <> trunc(history.position) AND (
+          history.item ->> 'type' = 'unknown'
+          AND history.item #> '{opengeniReasoningConfiguration,version}' = '1'::jsonb
+          AND history.item #>> '{opengeniReasoningConfiguration,baselineEffort}'
+            IN ('low', 'medium', 'high', 'xhigh', 'max')
+          AND history.item #>> '{opengeniReasoningConfiguration,effort}'
+            IN ('low', 'medium', 'high', 'xhigh', 'max')
+          AND jsonb_typeof(history.item #> '{opengeniReasoningConfiguration,turnId}') = 'string'
+          AND history.item #>> '{providerData,type}' = 'configuration_update'
+          AND history.item #>> '{providerData,reasoning,effort}' =
+            history.item #>> '{opengeniReasoningConfiguration,effort}'
+        ) IS NOT TRUE)$predicate$);
+  IF updated = definition THEN
+    RAISE EXCEPTION 'reasoning configuration fork predicate rewrite did not match';
+  END IF;
+  EXECUTE updated;
+END
+$migration$;

package/drizzle/0487_skill_catalog_message_forks.sql

@@ -0,0 +1,26 @@
+-- deployment-mode: rolling
+-- Durable catalog updates precede accepted input at fractional positions.
+-- Permit only their marked developer messages; keep compaction and authority
+-- checks, ordered JSON copying, and reasoning-control validation unchanged.
+DO $migration$
+DECLARE candidate oid; definition text; updated text;
+BEGIN
+  SELECT oid INTO STRICT candidate FROM pg_proc
+    WHERE proname = 'fork_session_content'
+      AND pronamespace = current_schema()::regnamespace AND pronargs = 11;
+  definition := pg_get_functiondef(candidate);
+  updated := replace(definition,
+    'history.position <> trunc(history.position) AND (',
+    $predicate$history.position <> trunc(history.position) AND NOT ((
+          history.item ->> 'type' = 'message'
+          AND history.item ->> 'role' = 'developer'
+          AND jsonb_typeof(history.item -> 'content') = 'string'
+          AND starts_with(history.item ->> 'content', E'<opengeni_skill_catalog>\n')
+          AND right(history.item ->> 'content', length(E'\n</opengeni_skill_catalog>')) = E'\n</opengeni_skill_catalog>'
+        ) IS TRUE) AND ($predicate$);
+  IF updated = definition THEN
+    RAISE EXCEPTION 'skill catalog fork predicate rewrite did not match';
+  END IF;
+  EXECUTE updated;
+END
+$migration$;

package/drizzle/0488_permanent_skill_removal.sql

@@ -0,0 +1,207 @@
+-- deployment-mode: maintenance
+-- Drain old API/control/turn workers: old review UIs do not describe deletion.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '1min';
+DO $drain$
+DECLARE roles jsonb := nullif(current_setting('opengeni.migration_application_roles',true),'')::jsonb;
+BEGIN
+  IF roles IS NULL OR jsonb_typeof(roles)<>'array' OR jsonb_array_length(roles) NOT BETWEEN 1 AND 16
+    OR EXISTS(SELECT 1 FROM jsonb_array_elements(roles) r WHERE jsonb_typeof(r)<>'string' OR length(btrim(r#>>'{}')) NOT BETWEEN 1 AND 63)
+  THEN RAISE EXCEPTION 'Skill removal requires explicit application database roles' USING ERRCODE='55000'; END IF;
+  IF EXISTS(SELECT 1 FROM pg_stat_activity a JOIN jsonb_array_elements_text(roles) r ON a.usename=r.value
+    WHERE a.datname=current_database() AND a.pid<>pg_backend_pid())
+  THEN RAISE EXCEPTION 'Skill removal requires drained application sessions' USING ERRCODE='55000'; END IF;
+END $drain$;
+
+ALTER TABLE preference_registry_revisions ADD COLUMN IF NOT EXISTS skill_removal_operation_id uuid;
+-- Keep content-free operation receipts: forgetting a create/save operation would
+-- allow its delayed retry to recreate the deleted Skill. Referential cleanup
+-- also reaches personal-Skill receipts written through another workspace.
+ALTER TABLE skill_write_receipts DROP CONSTRAINT skill_write_receipts_activation_event_id_fkey;
+ALTER TABLE skill_write_receipts ADD CONSTRAINT skill_write_receipts_activation_event_id_fkey
+  FOREIGN KEY (activation_event_id) REFERENCES preference_registry_events(id) ON DELETE SET NULL;
+-- No content is copied to a tombstone. Existing foreign keys remain restrictive
+-- for surviving cross-scope references; removal deletes only its scoped audit
+-- rows that hold live references. Content-free removal receipts remain replayable.
+
+-- The anchored function DDL below contains DML text. Keep the owner-visible
+-- window explicit for the migration guard; no table data is changed here.
+ALTER TABLE capability_facet_installations NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_events NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_preferences NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_revisions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE skill_write_receipts NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE company_brain_preference_proposal_receipts NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE capability_component_owners NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE skill_source_bindings NO FORCE ROW LEVEL SECURITY;
+DO $patch$
+DECLARE definition text; anchor text; replacement text; pair jsonb;
+BEGIN
+  definition := pg_get_functiondef('opengeni_private.guard_workspace_owned_skill_head_delete()'::regprocedure);
+  anchor := $a$IF TG_OP <> 'DELETE' OR pg_trigger_depth() <= 1 OR OLD.scope <> 'workspace' THEN$a$;
+  replacement := $r$IF TG_OP='DELETE'
+    AND current_user=pg_get_userbyid((SELECT relowner FROM pg_class WHERE oid=TG_RELID))
+    AND current_setting('opengeni.skill_remove_head',true)=OLD.id::text
+    AND nullif(current_setting('opengeni.account_id',true),'')::uuid=OLD.account_id
+    AND (OLD.scope='user' OR (OLD.scope='workspace' AND OLD.scope_workspace_id=nullif(current_setting('opengeni.workspace_id',true),'')::uuid))
+  THEN RETURN OLD; END IF;
+  IF TG_OP <> 'DELETE' OR pg_trigger_depth() <= 1 OR OLD.scope <> 'workspace' THEN$r$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill delete guard anchor mismatch'; END IF;
+  EXECUTE replace(definition,anchor,replacement);
+
+  definition := pg_get_functiondef('opengeni_private.guard_workspace_owned_skill_history_delete()'::regprocedure);
+  anchor := $a$IF TG_OP = 'DELETE' AND pg_trigger_depth() > 1 THEN RETURN OLD; END IF;$a$;
+  replacement := $r$IF TG_TABLE_NAME='skill_write_receipts' AND TG_OP='UPDATE' AND pg_trigger_depth()>1 THEN
+    IF OLD.activation_event_id IS NOT NULL AND NEW.activation_event_id IS NULL
+      AND (to_jsonb(NEW)-'activation_event_id')=(to_jsonb(OLD)-'activation_event_id')
+    THEN RETURN NEW; END IF;
+  END IF;
+  IF TG_OP='DELETE'
+    AND current_user=pg_get_userbyid((SELECT relowner FROM pg_class WHERE oid=TG_RELID))
+    AND nullif(current_setting('opengeni.skill_remove_head',true),'') IS NOT NULL
+    AND nullif(current_setting('opengeni.account_id',true),'')::uuid=OLD.account_id THEN
+    IF TG_TABLE_NAME='company_brain_preference_proposal_receipts' THEN
+      IF OLD.workspace_id=nullif(current_setting('opengeni.workspace_id',true),'')::uuid
+        AND OLD.preference_id::text=current_setting('opengeni.skill_remove_head',true) THEN RETURN OLD; END IF;
+    END IF;
+  END IF;
+  IF TG_OP = 'DELETE' AND pg_trigger_depth() > 1 THEN RETURN OLD; END IF;$r$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill audit guard anchor mismatch'; END IF;
+  EXECUTE replace(definition,anchor,replacement);
+
+  definition := pg_get_functiondef('skill_guard_legacy_activation()'::regprocedure);
+  anchor := 'RETURN NEW;';
+  replacement := $r$IF NEW.active_revision_id IS NOT NULL AND EXISTS(
+    SELECT 1 FROM preference_registry_revisions WHERE id=NEW.active_revision_id AND skill_removal_operation_id IS NOT NULL)
+  THEN RAISE EXCEPTION 'A removal proposal cannot be activated as Skill content' USING ERRCODE='42501'; END IF;
+  RETURN NEW;$r$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill activation guard anchor mismatch'; END IF;
+  EXECUTE replace(definition,anchor,replacement);
+
+  definition := pg_get_functiondef('skill_apply_lifecycle(uuid,uuid,jsonb,jsonb)'::regprocedure);
+  -- Exact anchored edits preserve the existing accepted Learning/actor resolver,
+  -- live attempt locks, operation replay, human proof and head/scope CAS.
+  FOR pair IN SELECT value FROM jsonb_array_elements(jsonb_build_array(
+    jsonb_build_array($a$'save','install','approve','reject','restore','confirm_response'$a$,
+      $r$'save','install','approve','reject','restore','confirm_response','remove'$r$),
+    jsonb_build_array($a$AND h.questions->0->>'label'='Save this Skill?'$a$,
+      $r$AND h.questions->0->>'label'=CASE WHEN skill_review ? 'removalOperationId' THEN 'Permanently delete this Skill?' ELSE 'Save this Skill?' END$r$),
+    jsonb_build_array($a$AND h.questions->0->>'helpText'='Review the complete files before saving. Saving activates this revision immediately.'$a$,
+      $r$AND h.questions->0->>'helpText'=CASE WHEN skill_review ? 'removalOperationId' THEN 'This cannot be undone. All stored Skill revisions will be deleted; conversations remain unchanged.' ELSE 'Review the complete files before saving. Saving activates this revision immediately.' END$r$),
+    jsonb_build_array($a$AND h.questions->0->>'prompt'='Save this exact Skill revision for this workspace?'$a$,
+      $r$AND h.questions->0->>'prompt'=CASE WHEN skill_review ? 'removalOperationId' THEN 'Permanently delete this Skill and all its stored revisions?' ELSE 'Save this exact Skill revision for this workspace?' END$r$),
+    jsonb_build_array($a$AND ((h.questions->0->'options'->0) - 'description')='{"id":"save","label":"Save"}'::jsonb$a$,
+      $r$AND ((h.questions->0->'options'->0) - 'description')=CASE WHEN skill_review ? 'removalOperationId' THEN '{"id":"save","label":"Permanently delete"}'::jsonb ELSE '{"id":"save","label":"Save"}'::jsonb END$r$),
+    jsonb_build_array($a$AND ((h.questions->0->'options'->1) - 'description')='{"id":"skip","label":"Don''t save"}'::jsonb$a$,
+      $r$AND ((h.questions->0->'options'->1) - 'description')=CASE WHEN skill_review ? 'removalOperationId' THEN '{"id":"skip","label":"Keep Skill"}'::jsonb ELSE '{"id":"skip","label":"Don''t save"}'::jsonb END$r$)
+  )) LOOP
+    anchor:=pair->>0; replacement:=pair->>1;
+    IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill removal lifecycle anchor mismatch: %',anchor; END IF;
+    definition:=replace(definition,anchor,replacement);
+  END LOOP;
+  anchor := $a$  SELECT * INTO head FROM preference_registry_preferences h WHERE h.id=skill_id AND h.account_id=p_account_id FOR UPDATE;$a$;
+  replacement := $r$  -- Distribution removals acquire facet/owner rows before the Skill head.
+  -- NOWAIT also prevents a publication-lock/facet-lock cycle with installation.
+  -- Contention aborts atomically; the caller can retry the same operation.
+  IF operation='remove' OR p_request ? 'removalOperationId' THEN
+    PERFORM fi.id FROM capability_facet_installations fi JOIN skill_source_bindings b
+      ON b.skill_facet_id=fi.facet_id AND b.workspace_id=fi.workspace_id
+      WHERE b.preference_id=skill_id AND b.account_id=p_account_id AND b.workspace_id=p_workspace_id
+      ORDER BY fi.id FOR UPDATE OF fi NOWAIT;
+    PERFORM o.id FROM capability_component_owners o JOIN capability_facet_installations fi ON fi.id=o.facet_installation_id
+      JOIN skill_source_bindings b ON b.skill_facet_id=fi.facet_id AND b.workspace_id=fi.workspace_id
+      WHERE b.preference_id=skill_id AND b.account_id=p_account_id AND b.workspace_id=p_workspace_id
+      ORDER BY o.id FOR UPDATE OF o NOWAIT;
+  END IF;
+  SELECT * INTO head FROM preference_registry_preferences h WHERE h.id=skill_id AND h.account_id=p_account_id FOR UPDATE;$r$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill removal lock anchor mismatch'; END IF;
+  definition:=replace(definition,anchor,replacement);
+  anchor := $a$  IF outcome IS NULL THEN
+    IF operation IN ('approve','restore','reject') THEN$a$;
+  replacement := $r$  -- Marked proposals are never ordinary approvals/restores. The reviewer must
+  -- explicitly supply the immutable removal operation id displayed by the UI.
+  SELECT * INTO rev FROM preference_registry_revisions r
+    WHERE r.account_id=p_account_id AND r.preference_id=skill_id
+      AND r.id=(p_request->>'revisionId')::uuid;
+  IF rev.skill_removal_operation_id IS NOT NULL AND operation<>'remove' THEN
+    IF operation NOT IN ('approve','reject')
+      OR rev.skill_removal_operation_id IS DISTINCT FROM (p_request->>'removalOperationId')::uuid THEN
+      RAISE EXCEPTION 'Removal requires explicit exact deletion approval' USING ERRCODE='42501'; END IF;
+    SELECT * INTO confirmation_source FROM skill_write_receipts r
+      WHERE r.account_id=p_account_id AND r.workspace_id=p_workspace_id
+        AND r.operation_id=rev.skill_removal_operation_id;
+    IF NOT FOUND OR confirmation_source.receipt->>'outcome'<>'pending'
+      OR confirmation_source.receipt#>>'{skillReview,revisionId}' IS DISTINCT FROM rev.id::text
+      OR (confirmation_source.receipt#>>'{skillReview,expectedRevisionId}')::uuid IS DISTINCT FROM head.active_revision_id
+      OR (confirmation_source.receipt#>>'{skillReview,expectedScopeVersion}')::integer IS DISTINCT FROM head.scope_version
+      OR EXISTS(SELECT 1 FROM preference_registry_revisions r WHERE r.preference_id=skill_id AND r.revision>rev.revision)
+      OR EXISTS(SELECT 1 FROM preference_registry_events e WHERE e.preference_id=skill_id AND e.new_revision_id=rev.id AND e.type='rejected')
+    THEN RAISE EXCEPTION 'Skill removal proposal changed or settled' USING ERRCODE='40001'; END IF;
+  ELSIF p_request ? 'removalOperationId' THEN
+    RAISE EXCEPTION 'Removal approval does not match a removal proposal' USING ERRCODE='42501';
+  END IF;
+  IF operation='remove' OR rev.skill_removal_operation_id IS NOT NULL THEN
+    IF head.scope NOT IN ('workspace','user') THEN
+      RAISE EXCEPTION 'Permanent removal does not manage organization Skills' USING ERRCODE='42501'; END IF;
+    IF operation='remove' THEN
+      SELECT * INTO rev FROM preference_registry_revisions r WHERE r.preference_id=skill_id AND r.account_id=p_account_id
+        ORDER BY r.revision DESC LIMIT 1;
+      IF NOT FOUND THEN RAISE EXCEPTION 'Skill revision unavailable' USING ERRCODE='40001'; END IF;
+    END IF;
+    revision_id:=rev.id;
+    IF operation='remove' AND mode<>'automatic' THEN
+      -- A distinct immutable proposal binds the complete revision inventory.
+      INSERT INTO preference_registry_revisions(account_id,preference_id,title,description,content,content_hash,
+        conflict_strategy,provenance_source,provenance_source_id,trust,created_by_subject_id,
+        corrects_revision_id,skill_files,skill_activation_mode,skill_removal_operation_id)
+      VALUES(p_account_id,skill_id,rev.title,rev.description,rev.content,rev.content_hash,
+        'override','agent',p_actor->>'attemptId','untrusted_proposal',actor_subject,
+        head.active_revision_id,rev.skill_files,rev.skill_activation_mode,operation_id) RETURNING id INTO revision_id;
+      outcome:='pending';
+    ELSIF operation='reject' THEN
+      SELECT coalesce(max(e.version),0)+1 INTO next_event FROM preference_registry_events e WHERE e.preference_id=skill_id;
+      INSERT INTO preference_registry_events(account_id,preference_id,type,version,new_revision_id,actor_subject_id,reason)
+        VALUES(p_account_id,skill_id,'rejected',next_event,revision_id,actor_subject,p_request->>'reason');
+      outcome:='preserved';
+    ELSE
+      -- Shared/composite distribution cannot be silently dismantled. Direct
+      -- installations are scoped to this one facet; other facets remain intact.
+      IF EXISTS(SELECT 1 FROM skill_source_bindings b JOIN capability_facet_installations fi
+        ON fi.facet_id=b.skill_facet_id AND fi.workspace_id=b.workspace_id
+        JOIN capability_component_owners o ON o.facet_installation_id=fi.id
+        WHERE b.preference_id=skill_id AND (o.owner_kind<>'direct' OR NOT o.removable)) THEN
+        RAISE EXCEPTION 'Skill has another distribution owner; release it before permanent removal' USING ERRCODE='42501'; END IF;
+      DELETE FROM capability_facet_installations fi USING skill_source_bindings b
+        WHERE b.preference_id=skill_id AND b.account_id=p_account_id AND b.workspace_id=p_workspace_id
+          AND fi.facet_id=b.skill_facet_id AND fi.account_id=p_account_id AND fi.workspace_id=p_workspace_id;
+      PERFORM set_config('opengeni.skill_remove_head',skill_id::text,true);
+      DELETE FROM company_brain_preference_proposal_receipts r
+        WHERE r.account_id=p_account_id AND r.workspace_id=p_workspace_id AND r.preference_id=skill_id;
+      DELETE FROM preference_registry_preferences WHERE id=skill_id AND account_id=p_account_id;
+      PERFORM set_config('opengeni.skill_remove_head','',true);
+      outcome:='applied';
+    END IF;
+    result:=jsonb_build_object('operationId',operation_id,'skillId',skill_id,'revisionId',revision_id,
+      'outcome',outcome,'removed',outcome='applied','removedScope',head.scope,'replayed',false);
+    IF outcome='pending' THEN result:=result||jsonb_build_object('pendingReason','approval','skillReview',
+      jsonb_build_object('sourceOperationId',operation_id,'removalOperationId',operation_id,'skillId',skill_id,
+        'revisionId',revision_id,'expectedRevisionId',head.active_revision_id,'expectedScopeVersion',head.scope_version)); END IF;
+    IF operation='reject' THEN result:=result||jsonb_build_object('decision','rejected'); END IF;
+    INSERT INTO skill_write_receipts(account_id,workspace_id,operation_id,fingerprint,actor,receipt)
+      VALUES(p_account_id,p_workspace_id,operation_id,fingerprint,p_actor,result);
+    RETURN result;
+  END IF;
+
+  IF outcome IS NULL THEN
+    IF operation IN ('approve','restore','reject') THEN$r$;
+  IF (length(definition)-length(replace(definition,anchor,'')))/length(anchor)<>1 THEN RAISE EXCEPTION 'Skill removal branch anchor mismatch'; END IF;
+  EXECUTE replace(definition,anchor,replacement);
+END $patch$;
+ALTER TABLE capability_facet_installations FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_events FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_preferences FORCE ROW LEVEL SECURITY;
+ALTER TABLE preference_registry_revisions FORCE ROW LEVEL SECURITY;
+ALTER TABLE skill_write_receipts FORCE ROW LEVEL SECURITY;
+ALTER TABLE company_brain_preference_proposal_receipts FORCE ROW LEVEL SECURITY;
+ALTER TABLE capability_component_owners FORCE ROW LEVEL SECURITY;
+ALTER TABLE skill_source_bindings FORCE ROW LEVEL SECURITY;

package/drizzle/0489_modal_command_byte_offsets.sql

@@ -0,0 +1,17 @@
+-- deployment-mode: maintenance
+-- Old readers cannot interpret router byte offsets. Drain old worker owners
+-- before activating new starts. Existing legacy locators remain unchanged and
+-- are reconciled by the explicit legacy reader; never reinterpret their IDs.
+ALTER TABLE sandbox_retained_processes
+  DROP CONSTRAINT sandbox_retained_processes_provider_command_chk;
+ALTER TABLE sandbox_retained_processes
+  ADD CONSTRAINT sandbox_retained_processes_provider_command_chk CHECK (
+    provider_command IS NULL OR ((
+      provider_backend = 'modal'
+      AND jsonb_typeof(provider_command) = 'object'
+      AND provider_command->>'kind' IN ('modal-control-v1', 'modal-router-v1')
+      AND provider_command->>'sandboxId' = provider_instance_id
+      AND length(provider_command->>'taskId') > 0
+      AND length(provider_command->>'execId') > 0
+    ) IS TRUE)
+  );

package/drizzle/0490_periodic_capture_attempt_cadence.sql

@@ -0,0 +1,6 @@
+-- deployment-mode: rolling
+-- Retain the cadence clock independently of an in-flight capture claim or a
+-- successful archive. Failed provider attempts must not re-pause the workspace
+-- on every heartbeat. Nullable expansion is compatible with old readers.
+ALTER TABLE sandbox_leases
+  ADD COLUMN archive_capture_last_attempt_at timestamptz;