@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/db/migrations/051_workflow_resume.d.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.WF5 FR-4 — workflow_instances resume columns.
+ *
+ * `resume_count`: the recorded redrive fact (the AWS Step Functions
+ * `redriveCount` shape — a first-class recorded field, never inferred
+ * from the trail).
+ *
+ * `hops_baseline`: the LIVELOCK RAIL (arch return R1). max_hops bounds
+ * each DRIVE, not the instance lifetime: the projection guard compares
+ * hops accrued since the LATEST instantiate-OR-resume, so a human
+ * resume sanctions exactly one more bounded window instead of
+ * re-tripping instantly on the first post-resume projection. WF-1's
+ * guard comment left this exact seam open ("WF-5 FR-4's resume later
+ * amends the baseline").
+ *
+ * Additive, NOT NULL DEFAULT 0: existing instances keep the v1
+ * baseline (0) and zero resumes — no backfill, byte-identical behavior
+ * until the first resume.
+ */
+export declare const workflowResumeSchema: Migration;
+//# sourceMappingURL=051_workflow_resume.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/051_workflow_resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"051_workflow_resume.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/051_workflow_resume.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAMlC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/051_workflow_resume.js

@@ -0,0 +1,27 @@
+/**
+ * OPR.0.4.6.WF5 FR-4 — workflow_instances resume columns.
+ *
+ * `resume_count`: the recorded redrive fact (the AWS Step Functions
+ * `redriveCount` shape — a first-class recorded field, never inferred
+ * from the trail).
+ *
+ * `hops_baseline`: the LIVELOCK RAIL (arch return R1). max_hops bounds
+ * each DRIVE, not the instance lifetime: the projection guard compares
+ * hops accrued since the LATEST instantiate-OR-resume, so a human
+ * resume sanctions exactly one more bounded window instead of
+ * re-tripping instantly on the first post-resume projection. WF-1's
+ * guard comment left this exact seam open ("WF-5 FR-4's resume later
+ * amends the baseline").
+ *
+ * Additive, NOT NULL DEFAULT 0: existing instances keep the v1
+ * baseline (0) and zero resumes — no backfill, byte-identical behavior
+ * until the first resume.
+ */
+export const workflowResumeSchema = {
+    name: "051_workflow_resume.sql",
+    sql: `
+    ALTER TABLE workflow_instances ADD COLUMN resume_count INTEGER NOT NULL DEFAULT 0;
+    ALTER TABLE workflow_instances ADD COLUMN hops_baseline INTEGER NOT NULL DEFAULT 0;
+  `,
+};
+//# sourceMappingURL=051_workflow_resume.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/051_workflow_resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"051_workflow_resume.js","sourceRoot":"","sources":["../../../src/db/migrations/051_workflow_resume.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAc;IAC7C,IAAI,EAAE,yBAAyB;IAC/B,GAAG,EAAE;;;GAGJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/052_workflow_instance_bound_rig.d.ts

@@ -0,0 +1,26 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.FAC1 — workflow_instances.bound_rig column.
+ *
+ * The binding layer's A1 substrate: a workflow instance is pointed at a
+ * rig at INSTANTIATION (`--rig` / route `targetRig`, defaulting to the
+ * spec's `target.rig`), and the binding persists on the instance so
+ * every owner-resolution site (projection, gate compile, entry, resume,
+ * exception routing) resolves roles against THAT rig's inventory.
+ *
+ * Persists the rig NAME, not the id (ARCH Q4): the name is the durable
+ * operator-space coordinate — consistent with the seat-name doctrine; a
+ * torn-down-and-recreated rig keeps the binding. Name→id is resolved
+ * FRESH at each resolution site (an exists-check-class read); a
+ * vanished rig fails loud there, never silently.
+ *
+ * NULLABLE, no default: NULL = unbound = byte-identical pre-FAC-1
+ * behavior for every pre-existing row and every instantiate that names
+ * no rig. No backfill.
+ *
+ * NUMBERING (binding, arch supersession 2026-07-07): FAC-1 fixed-claims
+ * 052; FS-1 renumbers its in-flight 051/052-adjacent migrations to 053+
+ * at its own rebase regardless of merge order.
+ */
+export declare const workflowInstanceBoundRigSchema: Migration;
+//# sourceMappingURL=052_workflow_instance_bound_rig.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/052_workflow_instance_bound_rig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"052_workflow_instance_bound_rig.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/052_workflow_instance_bound_rig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAK5C,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/052_workflow_instance_bound_rig.js

@@ -0,0 +1,30 @@
+/**
+ * OPR.0.4.6.FAC1 — workflow_instances.bound_rig column.
+ *
+ * The binding layer's A1 substrate: a workflow instance is pointed at a
+ * rig at INSTANTIATION (`--rig` / route `targetRig`, defaulting to the
+ * spec's `target.rig`), and the binding persists on the instance so
+ * every owner-resolution site (projection, gate compile, entry, resume,
+ * exception routing) resolves roles against THAT rig's inventory.
+ *
+ * Persists the rig NAME, not the id (ARCH Q4): the name is the durable
+ * operator-space coordinate — consistent with the seat-name doctrine; a
+ * torn-down-and-recreated rig keeps the binding. Name→id is resolved
+ * FRESH at each resolution site (an exists-check-class read); a
+ * vanished rig fails loud there, never silently.
+ *
+ * NULLABLE, no default: NULL = unbound = byte-identical pre-FAC-1
+ * behavior for every pre-existing row and every instantiate that names
+ * no rig. No backfill.
+ *
+ * NUMBERING (binding, arch supersession 2026-07-07): FAC-1 fixed-claims
+ * 052; FS-1 renumbers its in-flight 051/052-adjacent migrations to 053+
+ * at its own rebase regardless of merge order.
+ */
+export const workflowInstanceBoundRigSchema = {
+    name: "052_workflow_instance_bound_rig.sql",
+    sql: `
+    ALTER TABLE workflow_instances ADD COLUMN bound_rig TEXT;
+  `,
+};
+//# sourceMappingURL=052_workflow_instance_bound_rig.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/052_workflow_instance_bound_rig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"052_workflow_instance_bound_rig.js","sourceRoot":"","sources":["../../../src/db/migrations/052_workflow_instance_bound_rig.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,qCAAqC;IAC3C,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/053_sessions_node_id_index.d.ts

@@ -0,0 +1,48 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W1.1) — sessions per-node recency index.
+ *
+ * ROOT CAUSE (arch grounding ARCH-DESIGN-GROUNDING-fs1-2026-07-06, F1;
+ * re-verified firsthand at 384e60f1): the `sessions` table
+ * (002_bindings_sessions.ts) was created with ZERO indexes on `node_id` — its
+ * only index is the `id` PRIMARY-KEY autoindex. The "latest session per node"
+ * subquery `(SELECT s2.id FROM sessions s2 WHERE s2.node_id = ? ORDER BY … LIMIT 1)`
+ * is therefore a FULL SCAN of `sessions`, and it appears PER NODE at THREE sites
+ * on the hot `/api/ps` path — multiplied by the rig-level N+1 (getEntries loops
+ * rigs), one poll scanned `sessions` many times over (the 0.6-0.9s wedge at the
+ * host shape). The three sites, and their ORDER BY (why the index is 3-column):
+ *   - ps-projection.ts:157      ORDER BY created_at DESC, id DESC   ← the load-bearing shape
+ *   - node-inventory.ts:442     ORDER BY id DESC
+ *   - ps-projection.ts:256      ORDER BY id DESC
+ *
+ * INDEX SHAPE = (node_id, created_at DESC, id DESC) — arch RULING (B), decided
+ * by FIXTURE-MEASURED evidence, NOT preference. Measured before/after on the real
+ * incident fixture (24 rigs / 175 nodes / 445 sessions) — evidence:
+ *   missions/release-0.4.6/slices/01-fs1-daemon-read-path-hardening/proof/
+ *   perf-hardening-evidence/W1.1-sessions-index-measure-2026-07-06-dev44-driver2.md
+ *   - id-DESC sites (:442, :256): full-scan → covering seek, ~63x (0.677s→0.011s / 52.5k evals).
+ *   - created_at site (:157): under a 2-col (node_id, id DESC) index it SEARCHes
+ *     node_id but keeps a TEMP B-TREE sort (~18.6x); under THIS 3-col index it is
+ *     `SEARCH … USING COVERING INDEX` with NO sort (~95x, 0.856s→0.009s) — the
+ *     measured ~5x that decided the shape.
+ *   - Bound proven at 10x scale (4450 sessions): full-scan 8.4s (grows with data)
+ *     vs seek 0.024s (~flat) = ~350x. CREATE INDEX = 0.013s, safe on populated data.
+ * The 3-column index leads with `node_id` (the equality seek), so the two id-DESC
+ * sites still get the node_id seek (full-scan eliminated); their residual is a
+ * per-node sort over ~2-3 rows (445 sessions / 175 nodes) — arch-accepted as noise.
+ * ONE index by ruling: this migration WIDENS to the 3-column shape and never grows
+ * a sibling (a second index = write amplification + space for no measured need).
+ *
+ * CREATE INDEX IF NOT EXISTS is idempotent + safe on a live/populated table
+ * (SQLite builds it in one pass; no schema/data change).
+ *
+ * Sibling audit (arch D1.1): the snapshots(rig_id, created_at) subqueries in the
+ * rigs projection are a separate index-audit item in W1, not this migration.
+ *
+ * Number 053: main shipped 051_workflow_resume and FAC-1 reserves
+ * 052_workflow_instance_bound_rig, so FS-1's index migration renumbered
+ * 051→053 (orch deconflict 2026-07-06; re-verify the free slot against the
+ * final merged tree at rebase/proof time). The index NAME + shape are unchanged.
+ */
+export declare const sessionsNodeIdIndexSchema: Migration;
+//# sourceMappingURL=053_sessions_node_id_index.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/053_sessions_node_id_index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"053_sessions_node_id_index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/053_sessions_node_id_index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAMvC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/053_sessions_node_id_index.js

@@ -0,0 +1,53 @@
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W1.1) — sessions per-node recency index.
+ *
+ * ROOT CAUSE (arch grounding ARCH-DESIGN-GROUNDING-fs1-2026-07-06, F1;
+ * re-verified firsthand at 384e60f1): the `sessions` table
+ * (002_bindings_sessions.ts) was created with ZERO indexes on `node_id` — its
+ * only index is the `id` PRIMARY-KEY autoindex. The "latest session per node"
+ * subquery `(SELECT s2.id FROM sessions s2 WHERE s2.node_id = ? ORDER BY … LIMIT 1)`
+ * is therefore a FULL SCAN of `sessions`, and it appears PER NODE at THREE sites
+ * on the hot `/api/ps` path — multiplied by the rig-level N+1 (getEntries loops
+ * rigs), one poll scanned `sessions` many times over (the 0.6-0.9s wedge at the
+ * host shape). The three sites, and their ORDER BY (why the index is 3-column):
+ *   - ps-projection.ts:157      ORDER BY created_at DESC, id DESC   ← the load-bearing shape
+ *   - node-inventory.ts:442     ORDER BY id DESC
+ *   - ps-projection.ts:256      ORDER BY id DESC
+ *
+ * INDEX SHAPE = (node_id, created_at DESC, id DESC) — arch RULING (B), decided
+ * by FIXTURE-MEASURED evidence, NOT preference. Measured before/after on the real
+ * incident fixture (24 rigs / 175 nodes / 445 sessions) — evidence:
+ *   missions/release-0.4.6/slices/01-fs1-daemon-read-path-hardening/proof/
+ *   perf-hardening-evidence/W1.1-sessions-index-measure-2026-07-06-dev44-driver2.md
+ *   - id-DESC sites (:442, :256): full-scan → covering seek, ~63x (0.677s→0.011s / 52.5k evals).
+ *   - created_at site (:157): under a 2-col (node_id, id DESC) index it SEARCHes
+ *     node_id but keeps a TEMP B-TREE sort (~18.6x); under THIS 3-col index it is
+ *     `SEARCH … USING COVERING INDEX` with NO sort (~95x, 0.856s→0.009s) — the
+ *     measured ~5x that decided the shape.
+ *   - Bound proven at 10x scale (4450 sessions): full-scan 8.4s (grows with data)
+ *     vs seek 0.024s (~flat) = ~350x. CREATE INDEX = 0.013s, safe on populated data.
+ * The 3-column index leads with `node_id` (the equality seek), so the two id-DESC
+ * sites still get the node_id seek (full-scan eliminated); their residual is a
+ * per-node sort over ~2-3 rows (445 sessions / 175 nodes) — arch-accepted as noise.
+ * ONE index by ruling: this migration WIDENS to the 3-column shape and never grows
+ * a sibling (a second index = write amplification + space for no measured need).
+ *
+ * CREATE INDEX IF NOT EXISTS is idempotent + safe on a live/populated table
+ * (SQLite builds it in one pass; no schema/data change).
+ *
+ * Sibling audit (arch D1.1): the snapshots(rig_id, created_at) subqueries in the
+ * rigs projection are a separate index-audit item in W1, not this migration.
+ *
+ * Number 053: main shipped 051_workflow_resume and FAC-1 reserves
+ * 052_workflow_instance_bound_rig, so FS-1's index migration renumbered
+ * 051→053 (orch deconflict 2026-07-06; re-verify the free slot against the
+ * final merged tree at rebase/proof time). The index NAME + shape are unchanged.
+ */
+export const sessionsNodeIdIndexSchema = {
+    name: "053_sessions_node_id_index.sql",
+    sql: `
+    CREATE INDEX IF NOT EXISTS idx_sessions_node_created_id
+      ON sessions(node_id, created_at DESC, id DESC);
+  `,
+};
+//# sourceMappingURL=053_sessions_node_id_index.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/053_sessions_node_id_index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"053_sessions_node_id_index.js","sourceRoot":"","sources":["../../../src/db/migrations/053_sessions_node_id_index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;;GAGJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/054_queue_transitions_archive.d.ts

@@ -0,0 +1,34 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W2) — queue_transitions ARCHIVE
+ * sibling table (arch D3: ARCHIVE-never-plain-delete for the audit surface).
+ *
+ * `queue_transitions` is an AUDIT surface with product meaning (chain of record;
+ * `rig queue resolve` records decision text here) — INSERT-ONLY today, no prune
+ * path exists, so it grows unbounded (13691 rows on the incident fixture) and
+ * bloats backups + any transitions-reading surface. Arch D3 ruling: NEVER
+ * plain-delete; MOVE terminal-and-aged transitions into this sibling table, in
+ * the SAME transaction, so the audit trail is preserved (queryable in place),
+ * not lost.
+ *
+ * Schema MIRRORS `queue_transitions` (025) column-for-column so a move is a
+ * single `INSERT INTO queue_transitions_archive (...) SELECT ... FROM
+ * queue_transitions WHERE ...` + `DELETE`, both inside one txn. `transition_id`
+ * is a plain PRIMARY KEY (NOT AUTOINCREMENT) so archived rows KEEP their original
+ * id — audit references stay resolvable across the move. `archived_at` records
+ * when the row was archived (provenance; the source `ts` is preserved untouched).
+ *
+ * THE ACTIVE-FRONTIER INVARIANT (enforced by the W2 runner, not this migration):
+ * only transitions of TERMINAL qitems whose LAST transition is older than the
+ * retention window (default 30d) are ever moved; a non-terminal qitem's full
+ * transition history is never touched, at any age. The move runner + retention
+ * knobs land in the W2 maintenance-tick change; this migration is the sibling
+ * table + its read index only (additive; no data change to `queue_transitions`).
+ *
+ * Number 054: renumbered 052→054 with the FS-1 index (053) after the
+ * 051_workflow_resume ship + FAC-1's 052 reservation (orch deconflict
+ * 2026-07-06; re-verify against the final merged tree at rebase/proof time).
+ * The archive table + index names are unchanged.
+ */
+export declare const queueTransitionsArchiveSchema: Migration;
+//# sourceMappingURL=054_queue_transitions_archive.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/054_queue_transitions_archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"054_queue_transitions_archive.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/054_queue_transitions_archive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAgB3C,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/054_queue_transitions_archive.js

@@ -0,0 +1,49 @@
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W2) — queue_transitions ARCHIVE
+ * sibling table (arch D3: ARCHIVE-never-plain-delete for the audit surface).
+ *
+ * `queue_transitions` is an AUDIT surface with product meaning (chain of record;
+ * `rig queue resolve` records decision text here) — INSERT-ONLY today, no prune
+ * path exists, so it grows unbounded (13691 rows on the incident fixture) and
+ * bloats backups + any transitions-reading surface. Arch D3 ruling: NEVER
+ * plain-delete; MOVE terminal-and-aged transitions into this sibling table, in
+ * the SAME transaction, so the audit trail is preserved (queryable in place),
+ * not lost.
+ *
+ * Schema MIRRORS `queue_transitions` (025) column-for-column so a move is a
+ * single `INSERT INTO queue_transitions_archive (...) SELECT ... FROM
+ * queue_transitions WHERE ...` + `DELETE`, both inside one txn. `transition_id`
+ * is a plain PRIMARY KEY (NOT AUTOINCREMENT) so archived rows KEEP their original
+ * id — audit references stay resolvable across the move. `archived_at` records
+ * when the row was archived (provenance; the source `ts` is preserved untouched).
+ *
+ * THE ACTIVE-FRONTIER INVARIANT (enforced by the W2 runner, not this migration):
+ * only transitions of TERMINAL qitems whose LAST transition is older than the
+ * retention window (default 30d) are ever moved; a non-terminal qitem's full
+ * transition history is never touched, at any age. The move runner + retention
+ * knobs land in the W2 maintenance-tick change; this migration is the sibling
+ * table + its read index only (additive; no data change to `queue_transitions`).
+ *
+ * Number 054: renumbered 052→054 with the FS-1 index (053) after the
+ * 051_workflow_resume ship + FAC-1's 052 reservation (orch deconflict
+ * 2026-07-06; re-verify against the final merged tree at rebase/proof time).
+ * The archive table + index names are unchanged.
+ */
+export const queueTransitionsArchiveSchema = {
+    name: "054_queue_transitions_archive.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS queue_transitions_archive (
+      transition_id INTEGER PRIMARY KEY,
+      qitem_id TEXT NOT NULL,
+      ts TEXT NOT NULL,
+      state TEXT NOT NULL,
+      transition_note TEXT,
+      actor_session TEXT NOT NULL,
+      closure_reason TEXT,
+      closure_target TEXT,
+      archived_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_queue_transitions_archive_qitem ON queue_transitions_archive(qitem_id, ts);
+  `,
+};
+//# sourceMappingURL=054_queue_transitions_archive.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/054_queue_transitions_archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"054_queue_transitions_archive.js","sourceRoot":"","sources":["../../../src/db/migrations/054_queue_transitions_archive.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAc;IACtD,IAAI,EAAE,mCAAmC;IACzC,GAAG,EAAE;;;;;;;;;;;;;GAaJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/055_node_permission_policy.d.ts

@@ -0,0 +1,13 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.8.3 Seam B — nodes.permission_policy column.
+ *
+ * Adds `permission_policy TEXT` to the nodes table. Holds the per-seat
+ * permission_policy REF (`builtin:<name>` or a spec-relative custom path)
+ * when a seat declares one, written by createMemberNode → addNode.
+ * NULL when the seat attaches no policy (= the floor). Mirrors migration
+ * 022 (node codex_config_profile); the repository probes for the column
+ * so a seat attribute round-trips only on DBs that have the column.
+ */
+export declare const nodePermissionPolicySchema: Migration;
+//# sourceMappingURL=055_node_permission_policy.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/055_node_permission_policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"055_node_permission_policy.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/055_node_permission_policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAKxC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/055_node_permission_policy.js

@@ -0,0 +1,17 @@
+/**
+ * OPR.0.4.8.3 Seam B — nodes.permission_policy column.
+ *
+ * Adds `permission_policy TEXT` to the nodes table. Holds the per-seat
+ * permission_policy REF (`builtin:<name>` or a spec-relative custom path)
+ * when a seat declares one, written by createMemberNode → addNode.
+ * NULL when the seat attaches no policy (= the floor). Mirrors migration
+ * 022 (node codex_config_profile); the repository probes for the column
+ * so a seat attribute round-trips only on DBs that have the column.
+ */
+export const nodePermissionPolicySchema = {
+    name: "055_node_permission_policy.sql",
+    sql: `
+    ALTER TABLE nodes ADD COLUMN permission_policy TEXT;
+  `,
+};
+//# sourceMappingURL=055_node_permission_policy.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/055_node_permission_policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"055_node_permission_policy.js","sourceRoot":"","sources":["../../../src/db/migrations/055_node_permission_policy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAc;IACnD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/056_rig_permission_policy.d.ts

@@ -0,0 +1,13 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.8.3 Seam B — rigs.permission_policy column.
+ *
+ * Adds `permission_policy TEXT` to the rigs table. Holds the rig-level
+ * permission_policy REF (`builtin:<name>` or a spec-relative custom path)
+ * when a rig declares one, populated by RigRepository.setRigPermissionPolicy
+ * at instantiate time and read back via getRigPermissionPolicy (exporter /
+ * discovery). NULL for rigs without an attached policy (= the floor).
+ * Mirrors migration 038 (rigs.workspace_json).
+ */
+export declare const rigPermissionPolicySchema: Migration;
+//# sourceMappingURL=056_rig_permission_policy.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/056_rig_permission_policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"056_rig_permission_policy.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/056_rig_permission_policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAKvC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/056_rig_permission_policy.js

@@ -0,0 +1,17 @@
+/**
+ * OPR.0.4.8.3 Seam B — rigs.permission_policy column.
+ *
+ * Adds `permission_policy TEXT` to the rigs table. Holds the rig-level
+ * permission_policy REF (`builtin:<name>` or a spec-relative custom path)
+ * when a rig declares one, populated by RigRepository.setRigPermissionPolicy
+ * at instantiate time and read back via getRigPermissionPolicy (exporter /
+ * discovery). NULL for rigs without an attached policy (= the floor).
+ * Mirrors migration 038 (rigs.workspace_json).
+ */
+export const rigPermissionPolicySchema = {
+    name: "056_rig_permission_policy.sql",
+    sql: `
+    ALTER TABLE rigs ADD COLUMN permission_policy TEXT;
+  `,
+};
+//# sourceMappingURL=056_rig_permission_policy.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/056_rig_permission_policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"056_rig_permission_policy.js","sourceRoot":"","sources":["../../../src/db/migrations/056_rig_permission_policy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,+BAA+B;IACrC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/057_node_policy_provenance.d.ts

@@ -0,0 +1,19 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.8.3 Seam B (R2 — dev-guard restart-provenance ruling): additive restart-stable
+ * provenance columns for a node's RESOLVED permission-policy attachment. The raw ref
+ * (migration 055) alone is NOT restart-complete — a restore must be able to re-derive
+ * surface + launch posture without the original in-memory RigSpec:
+ *   - policy_origin           'builtin' | 'custom' (origin honesty, never reclassified)
+ *   - policy_resolved_target  custom: the absolute resolved policy path.
+ *                             builtin: the canonical shipped package-copy path ONCE the
+ *                             packaging leg rules it (PM lane c76c7153) — NULL until then;
+ *                             never a `builtin:<name>` echo of the raw ref.
+ *   - policy_declaring_dir    custom: the canonical declaring RigSpec directory.
+ *   - policy_launch_posture   'floor' | 'full_bypass' — the resolved posture at materialize;
+ *                             restore re-resolves and reconciles (a custom flag policy must
+ *                             restore to full_bypass — the ruling's crux).
+ * Additive only: no rework of 055/056. NULLs = no policy attached (honest absence).
+ */
+export declare const nodePolicyProvenanceSchema: Migration;
+//# sourceMappingURL=057_node_policy_provenance.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/057_node_policy_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"057_node_policy_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/057_node_policy_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAQxC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/057_node_policy_provenance.js

@@ -0,0 +1,26 @@
+/**
+ * OPR.0.4.8.3 Seam B (R2 — dev-guard restart-provenance ruling): additive restart-stable
+ * provenance columns for a node's RESOLVED permission-policy attachment. The raw ref
+ * (migration 055) alone is NOT restart-complete — a restore must be able to re-derive
+ * surface + launch posture without the original in-memory RigSpec:
+ *   - policy_origin           'builtin' | 'custom' (origin honesty, never reclassified)
+ *   - policy_resolved_target  custom: the absolute resolved policy path.
+ *                             builtin: the canonical shipped package-copy path ONCE the
+ *                             packaging leg rules it (PM lane c76c7153) — NULL until then;
+ *                             never a `builtin:<name>` echo of the raw ref.
+ *   - policy_declaring_dir    custom: the canonical declaring RigSpec directory.
+ *   - policy_launch_posture   'floor' | 'full_bypass' — the resolved posture at materialize;
+ *                             restore re-resolves and reconciles (a custom flag policy must
+ *                             restore to full_bypass — the ruling's crux).
+ * Additive only: no rework of 055/056. NULLs = no policy attached (honest absence).
+ */
+export const nodePolicyProvenanceSchema = {
+    name: "057_node_policy_provenance.sql",
+    sql: `
+    ALTER TABLE nodes ADD COLUMN policy_origin TEXT;
+    ALTER TABLE nodes ADD COLUMN policy_resolved_target TEXT;
+    ALTER TABLE nodes ADD COLUMN policy_declaring_dir TEXT;
+    ALTER TABLE nodes ADD COLUMN policy_launch_posture TEXT;
+  `,
+};
+//# sourceMappingURL=057_node_policy_provenance.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/057_node_policy_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"057_node_policy_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/057_node_policy_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAc;IACnD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/058_rig_policy_provenance.d.ts

@@ -0,0 +1,15 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.8.3 Seam B (Guard NOT-CLEAR at 9e94c274, finding 1): additive restart-stable
+ * provenance for the RIG-level resolved permission-policy attachment. The raw rig ref
+ * (migration 056) alone is not restart-complete for a RELATIVE custom policy: organic
+ * claim/self-attach seats have no node provenance, structured add-member runs under a
+ * DIFFERENT operation root, and restore/successor must never resolve a persisted relative
+ * ref against an unrelated cwd. Columns mirror the node-level 057 set:
+ *   rig_policy_origin / rig_policy_resolved_target / rig_policy_declaring_dir /
+ *   rig_policy_launch_posture
+ * declaring_dir = the ORIGINAL declaring RigSpec directory (the materialize rigRoot).
+ * Additive only; NULLs = no rig-level policy attached.
+ */
+export declare const rigPolicyProvenanceSchema: Migration;
+//# sourceMappingURL=058_rig_policy_provenance.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/058_rig_policy_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"058_rig_policy_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/058_rig_policy_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAQvC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/058_rig_policy_provenance.js

@@ -0,0 +1,22 @@
+/**
+ * OPR.0.4.8.3 Seam B (Guard NOT-CLEAR at 9e94c274, finding 1): additive restart-stable
+ * provenance for the RIG-level resolved permission-policy attachment. The raw rig ref
+ * (migration 056) alone is not restart-complete for a RELATIVE custom policy: organic
+ * claim/self-attach seats have no node provenance, structured add-member runs under a
+ * DIFFERENT operation root, and restore/successor must never resolve a persisted relative
+ * ref against an unrelated cwd. Columns mirror the node-level 057 set:
+ *   rig_policy_origin / rig_policy_resolved_target / rig_policy_declaring_dir /
+ *   rig_policy_launch_posture
+ * declaring_dir = the ORIGINAL declaring RigSpec directory (the materialize rigRoot).
+ * Additive only; NULLs = no rig-level policy attached.
+ */
+export const rigPolicyProvenanceSchema = {
+    name: "058_rig_policy_provenance.sql",
+    sql: `
+    ALTER TABLE rigs ADD COLUMN rig_policy_origin TEXT;
+    ALTER TABLE rigs ADD COLUMN rig_policy_resolved_target TEXT;
+    ALTER TABLE rigs ADD COLUMN rig_policy_declaring_dir TEXT;
+    ALTER TABLE rigs ADD COLUMN rig_policy_launch_posture TEXT;
+  `,
+};
+//# sourceMappingURL=058_rig_policy_provenance.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/058_rig_policy_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"058_rig_policy_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/058_rig_policy_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,+BAA+B;IACrC,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/059_self_host_identity.d.ts

@@ -0,0 +1,20 @@
+import type { Migration } from "../migrate.js";
+/**
+ * 51-09 increment 1 — the durable daemon SELF-HOST identity record.
+ *
+ * Arch ruling cb19867f (Q1): canonical self-host identity is NET-NEW — there is
+ * no authoritative self-record today, only a display-only `host.name`
+ * (settings), the positional `"local"` sentinel (fanout-contract), and the host
+ * registry's labels-others-assign-me. This table is the daemon's own
+ * authoritative, durable, stable-across-restart self-host id, reconciled AT BOOT
+ * beside the seat-identity substrate (slice-13 reconcile lineage).
+ *
+ * Singleton: exactly one row (`singleton = 1` CHECK). `host_id` is MINTED once on
+ * first boot and thereafter RECONCILED (never re-minted) — restart ⇒ same id.
+ * `minted_at` never moves; `reconciled_at` advances every boot. The id is never
+ * the `"local"`/`"kernel"`/`"host"` reserved set nor the `"localhost"` display
+ * default (asserted in the reconciler). Next free number after
+ * 058_rig_policy_provenance.ts.
+ */
+export declare const selfHostIdentitySchema: Migration;
+//# sourceMappingURL=059_self_host_identity.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/059_self_host_identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"059_self_host_identity.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/059_self_host_identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAUpC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/059_self_host_identity.js

@@ -0,0 +1,29 @@
+/**
+ * 51-09 increment 1 — the durable daemon SELF-HOST identity record.
+ *
+ * Arch ruling cb19867f (Q1): canonical self-host identity is NET-NEW — there is
+ * no authoritative self-record today, only a display-only `host.name`
+ * (settings), the positional `"local"` sentinel (fanout-contract), and the host
+ * registry's labels-others-assign-me. This table is the daemon's own
+ * authoritative, durable, stable-across-restart self-host id, reconciled AT BOOT
+ * beside the seat-identity substrate (slice-13 reconcile lineage).
+ *
+ * Singleton: exactly one row (`singleton = 1` CHECK). `host_id` is MINTED once on
+ * first boot and thereafter RECONCILED (never re-minted) — restart ⇒ same id.
+ * `minted_at` never moves; `reconciled_at` advances every boot. The id is never
+ * the `"local"`/`"kernel"`/`"host"` reserved set nor the `"localhost"` display
+ * default (asserted in the reconciler). Next free number after
+ * 058_rig_policy_provenance.ts.
+ */
+export const selfHostIdentitySchema = {
+    name: "059_self_host_identity.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS self_host_identity (
+      singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+      host_id TEXT NOT NULL,
+      minted_at TEXT NOT NULL,
+      reconciled_at TEXT NOT NULL
+    );
+  `,
+};
+//# sourceMappingURL=059_self_host_identity.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/059_self_host_identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"059_self_host_identity.js","sourceRoot":"","sources":["../../../src/db/migrations/059_self_host_identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAc;IAC/C,IAAI,EAAE,4BAA4B;IAClC,GAAG,EAAE;;;;;;;GAOJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/060_occupant_tenures.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const occupantTenuresSchema: Migration;
+//# sourceMappingURL=060_occupant_tenures.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/060_occupant_tenures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"060_occupant_tenures.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/060_occupant_tenures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAiB/C,eAAO,MAAM,qBAAqB,EAAE,SAenC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/060_occupant_tenures.js

@@ -0,0 +1,32 @@
+// GHOST-STAGE atom-B (P12 verdict 3548d8eb): the occupant-generation TENURE ledger.
+//
+// A `sessions` row is a REGISTRATION, not a tenure — treating a row as a generation mints PHANTOM
+// generations. This append-only ledger records ONE row per OCCUPANT GENERATION on a node, minted in
+// the registry at registerSession / registerClaimedSession (callers declare `kind`). `generation_uuid`
+// identifies ONE occupant tenure: it PERSISTS within a tenure (a same-native relaunch is a
+// continuation, not a new generation) but CHANGES for a new occupant — a handover/swap/repair to a
+// different native session mints a NEW generation_uuid (the provider's native session id is a separate
+// POINTER — the 51-09 split). Consumers compare recorded-vs-live generation_uuid to gate
+// stale-generation state (the ghost-stage defect): a CHANGED generation is the dead-tenure signal.
+// node_id is the identity that IS stable across handover/swap/repair — the cross-handover key.
+//
+// HONEST BOUNDARY: node_id does NOT survive a `rig` teardown-recreate of the node — out of scope for
+// this ledger (a recreated node is a genuinely new identity), and labelled here so no consumer assumes
+// cross-teardown continuity.
+export const occupantTenuresSchema = {
+    name: "060_occupant_tenures.sql",
+    sql: `
+    CREATE TABLE occupant_tenures (
+      id                        TEXT PRIMARY KEY,
+      node_id                   TEXT NOT NULL REFERENCES nodes(id) ON DELETE CASCADE,
+      generation_ordinal        INTEGER NOT NULL,
+      generation_uuid           TEXT NOT NULL UNIQUE,
+      kind                      TEXT NOT NULL,
+      native_session_id_at_boot TEXT,
+      boot_at                   TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(node_id, generation_ordinal)
+    );
+    CREATE INDEX idx_occupant_tenures_node ON occupant_tenures(node_id);
+  `,
+};
+//# sourceMappingURL=060_occupant_tenures.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/060_occupant_tenures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"060_occupant_tenures.js","sourceRoot":"","sources":["../../../src/db/migrations/060_occupant_tenures.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,uGAAuG;AACvG,2FAA2F;AAC3F,mGAAmG;AACnG,uGAAuG;AACvG,yFAAyF;AACzF,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,qGAAqG;AACrG,uGAAuG;AACvG,6BAA6B;AAC7B,MAAM,CAAC,MAAM,qBAAqB,GAAc;IAC9C,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE;;;;;;;;;;;;GAYJ;CACF,CAAC"}