@panaversity/ksor 0.0.2 → 0.0.4

package/dist/index.d.mts

@@ -19,8 +19,9 @@ declare const exitCodes: {
   readonly environment: 3;
 };
 type ExitCode = (typeof exitCodes)[keyof typeof exitCodes];
-/** The CLI vocabulary. Deliberately small; see the README. */
-declare const verbs: readonly ["init", "dev", "build", "serve"];
+/** The CLI vocabulary. Lifecycle verbs plus the corpus operations the bundled
+ * kernel provides (one binary — decision 12 publish revision). */
+declare const verbs: readonly ["init", "dev", "build", "serve", "ingest", "schema", "grant", "calibrate", "gc"];
 type Verb = (typeof verbs)[number];
 interface ResolvedCommand {
   /** The first non-flag token, or null when only flags (or nothing) appear. */

package/dist/index.mjs

@@ -1,37 +1,2 @@
-//#region src/index.ts
-/**
-* Public entry point of @panaversity/ksor.
-*
-* Nothing here is a released capability: 0.x builds expose only the CLI
-* contract, so that scripts and agents driving `ksor` can rely on stable,
-* documented exit semantics before the verbs are implemented.
-*/
-/**
-* Exit-code contract for the `ksor` CLI. 2 must never be read as a crash: it
-* is the honest "this verb is designed but not implemented in this build".
-*/
-const exitCodes = {
-	/** The command was refused: bad input or a guarded operation. */
-	refused: 1,
-	/** The verb exists in the design but is not implemented in this build. */
-	notImplemented: 2,
-	/** The environment cannot run ksor (missing runtime requirement). */
-	environment: 3
-};
-/** The CLI vocabulary. Deliberately small; see the README. */
-const verbs = [
-	"init",
-	"dev",
-	"build",
-	"serve"
-];
-/** Resolve the command word from CLI arguments (flags are skipped). */
-function resolveCommand(argv) {
-	const word = argv.find((arg) => !arg.startsWith("-")) ?? null;
-	return {
-		word,
-		verb: word !== null && verbs.includes(word) ? word : null
-	};
-}
-//#endregion
+import { n as resolveCommand, r as verbs, t as exitCodes } from "./src-CpDIVudJ.mjs";
 export { exitCodes, resolveCommand, verbs };

package/dist/src-CpDIVudJ.mjs

@@ -0,0 +1,43 @@
+//#region src/index.ts
+/**
+* Public entry point of @panaversity/ksor.
+*
+* Nothing here is a released capability: 0.x builds expose only the CLI
+* contract, so that scripts and agents driving `ksor` can rely on stable,
+* documented exit semantics before the verbs are implemented.
+*/
+/**
+* Exit-code contract for the `ksor` CLI. 2 must never be read as a crash: it
+* is the honest "this verb is designed but not implemented in this build".
+*/
+const exitCodes = {
+	/** The command was refused: bad input or a guarded operation. */
+	refused: 1,
+	/** The verb exists in the design but is not implemented in this build. */
+	notImplemented: 2,
+	/** The environment cannot run ksor (missing runtime requirement). */
+	environment: 3
+};
+/** The CLI vocabulary. Lifecycle verbs plus the corpus operations the bundled
+* kernel provides (one binary — decision 12 publish revision). */
+const verbs = [
+	"init",
+	"dev",
+	"build",
+	"serve",
+	"ingest",
+	"schema",
+	"grant",
+	"calibrate",
+	"gc"
+];
+/** Resolve the command word from CLI arguments (flags are skipped). */
+function resolveCommand(argv) {
+	const word = argv.find((arg) => !arg.startsWith("-")) ?? null;
+	return {
+		word,
+		verb: word !== null && verbs.includes(word) ? word : null
+	};
+}
+//#endregion
+export { resolveCommand as n, verbs as r, exitCodes as t };

package/docs/index.md

@@ -24,8 +24,10 @@ instead of their training memory. The corpus grows with each implemented verb.
   at `http://localhost:3000`; `pnpm build` writes a fully static export to
   `system/site/out/`. `KSOR_BASE_PATH=/repo pnpm build` targets sub-path
   hosting.
-- The remaining verbs (`dev`, `build`, `serve`) are designed, not
-  implemented: each prints an honest notice and exits `2`.
+- `ksor serve` runs the MCP server over a built record (with
+  `ingest`/`schema`/`calibrate`/`gc`) — the climbed rung, needing Postgres and
+  a provider key. Only `dev` and `build` remain designed, not implemented:
+  each prints an honest notice and exits `2`.
 - Exit codes are a contract: `1` refused (first stderr line is a stable
   slug such as `error: bad-name`, followed by a remedy), `2` designed but
   not implemented, `3` the environment cannot run ksor
@@ -40,8 +42,12 @@ Read the scaffold's own `AGENTS.md` first — it is the working contract.
 Knowledge lives in `knowledge/` and never inside the site; frontmatter uses
 a closed key set (`title` + `status` required); `pnpm check` explains any
 violation and how to fix it. Sidebar order is the governed `order:`
-frontmatter key — never `meta.json` or `sidebar_position`. The site shell
-at `system/site/` is replaceable behind a four-clause surface contract; a
+frontmatter key — never `meta.json` or `sidebar_position`. If the
+instance declares an `audiences:` model, documents may carry a
+`visibility:` key and per-audience builds (`KSOR_AUDIENCE=<tier> pnpm
+build`) stage only what that tier may see — publication, not authorship:
+anyone who can clone reads everything. The site shell
+at `system/site/` is replaceable behind a five-clause surface contract; a
 Docusaurus conformance shell lives in the ksor repository under
 `workbench/shells/docusaurus/` with its swap recipe.
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Knowledge System of Record — the authoritative, governed source of knowledge that humans and AI agents operate from. Name reserved; implementation in progress.",
   "keywords": [
     "abstention",
     "citations",
     "documentation",
-    "docusaurus",
+    "fumadocs",
     "governance",
     "knowledge-system-of-record",
     "mcp",
@@ -33,7 +33,8 @@
     "docs",
     "templates",
     "CHANGELOG.md",
-    "NOTICE"
+    "NOTICE",
+    "schema"
   ],
   "type": "module",
   "sideEffects": false,
@@ -49,19 +50,31 @@
     "access": "public",
     "provenance": true
   },
+  "dependencies": {
+    "@google/genai": "^2.17.1",
+    "@hono/node-server": "2.1.1",
+    "@modelcontextprotocol/server": "^2.0.0",
+    "@types/pg": "^8.21.0",
+    "hono": "4.13.2",
+    "jose": "^6.2.9",
+    "pg": "^8.23.0",
+    "zod": "^4.4.3"
+  },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "playwright": "^1.58.0",
     "publint": "0.3.23",
     "tsdown": "0.22.14",
     "typescript": "7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "@panaversity/ksor-content": "0.0.0",
+    "@panaversity/ksor-content-gateway": "0.0.0"
   },
   "engines": {
     "node": ">=24"
   },
   "scripts": {
-    "build": "tsdown",
+    "build": "tsdown && node copy-schema.mjs",
     "typecheck": "tsc -p tsconfig.json",
     "publint": "publint"
   }

package/schema/schema.sql

@@ -0,0 +1,316 @@
+-- sor-content schema v2 — the generational corpus store (specs/platform/generations.md §2 is the
+-- design this implements; specs/platform/spec.md §5 the roles; the legacy schema the quarry).
+-- ONE schema file; no migration runner (spec §9: compatibility is a RANGE, recorded in schema_meta).
+--
+-- Carried from legacy verbatim where the eval lock demands it: HNSW (m=16, ef_construction=64)
+-- cosine, 'english' generated tsvector, per-tenant one-embedding-model trigger, fail-closed tenant
+-- RLS keyed on GUC app.tenant_id. The two embedding columns (chunks, node_centroids) carry the
+-- dimension of the DECLARED embedding space (instance.md `embedding.dim`): `schema/schema.sql` in
+-- the repo is the shipped, eval-locked rendering (Gemini Embedding 001 at its MRL truncation);
+-- `sor_content.render_schema(dim)` / `sor-content-schema --instance <dir>` re-render it for another
+-- declared space. A different space is a NEW database.
+-- v2 decisions recorded here:
+--   • generation BIGINT on every corpus table; natural uniques are GENERATION-SCOPED.
+--   • status='published' filtering is an ARM PREDICATE on every serving path (resolving the legacy
+--     open decision): drafts embed like everything else, serving hides them; RLS stays a pure
+--     tenant wall.
+--   • hnsw.iterative_scan = relaxed_order + pinned ef_search are RUNTIME SET LOCALs applied by the
+--     query builder on every vector arm (the legacy documented-but-unapplied fix becomes code in 1b).
+--   • takedown_denylist has NO generation column BY DESIGN (denial beats every generation, §6).
+
+CREATE EXTENSION IF NOT EXISTS vector;
+
+-- ============================================================================ corpus pointer + runs
+CREATE TABLE corpora (
+    tenant_id           TEXT NOT NULL,
+    corpus_id           TEXT NOT NULL,               -- immutable, globally unique (spec §4)
+    active_generation   BIGINT NOT NULL,
+    rollback_generation BIGINT,
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (tenant_id, corpus_id)
+);
+
+CREATE TABLE ingestion_runs (
+    run_id                 BIGSERIAL PRIMARY KEY,
+    tenant_id              TEXT NOT NULL,
+    corpus_id              TEXT NOT NULL,
+    generation             BIGINT NOT NULL,
+    state                  TEXT NOT NULL CHECK (state IN ('building','ready','active','retired','abandoned','reaped')),
+    source_commit          TEXT NOT NULL,
+    instance_bundle_sha256 TEXT NOT NULL,
+    started_at             TIMESTAMPTZ NOT NULL DEFAULT now(),
+    heartbeat_at           TIMESTAMPTZ NOT NULL DEFAULT now(),
+    finished_at            TIMESTAMPTZ,
+    UNIQUE (tenant_id, corpus_id, generation)
+);
+
+-- ============================================================================ the tree
+CREATE TABLE content_nodes (
+    node_id    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id  TEXT NOT NULL,
+    generation BIGINT NOT NULL,
+    stable_id  TEXT NOT NULL,                        -- durable identity WITHIN the corpus (spec §7)
+    parent_id  UUID,
+    kind       TEXT NOT NULL,
+    slug       TEXT NOT NULL,
+    title      TEXT NOT NULL,
+    summary    TEXT,
+    keywords   TEXT[],
+    position   INT  NOT NULL DEFAULT 0,
+    permalink  TEXT,                                  -- CONFIRMED site route (/docs/…), sitemap-verified at publish; NULL = no proven page URL (a group, or an unlisted route) — never a guess
+    status     TEXT NOT NULL DEFAULT 'published' CHECK (status IN ('published','draft','archived')),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT nodes_stable_uniq  UNIQUE (tenant_id, generation, stable_id),
+    CONSTRAINT nodes_sibling_uniq UNIQUE (tenant_id, generation, parent_id, slug),
+    CONSTRAINT nodes_id_tenant_uniq UNIQUE (node_id, tenant_id),
+    CONSTRAINT nodes_no_self_parent CHECK (parent_id IS NULL OR parent_id <> node_id),
+    CONSTRAINT nodes_parent_fk FOREIGN KEY (parent_id, tenant_id)
+        REFERENCES content_nodes (node_id, tenant_id) ON DELETE RESTRICT
+);
+CREATE INDEX idx_nodes_gen      ON content_nodes (tenant_id, generation, kind);
+CREATE INDEX idx_nodes_parent   ON content_nodes (parent_id);
+CREATE INDEX idx_nodes_keywords ON content_nodes USING gin (keywords);
+CREATE UNIQUE INDEX nodes_root_slug_uniq ON content_nodes (tenant_id, generation, slug) WHERE parent_id IS NULL;
+
+CREATE TABLE slug_aliases (
+    tenant_id      TEXT NOT NULL,
+    generation     BIGINT NOT NULL,
+    alias_slug     TEXT NOT NULL,
+    canonical_slug TEXT NOT NULL,                    -- aliases FLATTEN at ingest (spec §7)
+    PRIMARY KEY (tenant_id, generation, alias_slug)
+);
+
+-- ============================================================================ files + passages
+CREATE TABLE sources (
+    tenant_id       TEXT NOT NULL,
+    generation      BIGINT NOT NULL,
+    source_id       TEXT NOT NULL,                   -- path-derived, unique within (tenant, generation)
+    node_id         UUID NOT NULL,
+    modality        TEXT NOT NULL DEFAULT 'prose',
+    title           TEXT NOT NULL,
+    origin_path     TEXT NOT NULL,
+    content_hash    TEXT NOT NULL,
+    embedding_model TEXT NOT NULL,
+    chunk_policy    TEXT NOT NULL,
+    source_commit   TEXT,
+    seeded_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (tenant_id, generation, source_id),
+    CONSTRAINT sources_node_fk FOREIGN KEY (node_id, tenant_id)
+        REFERENCES content_nodes (node_id, tenant_id) ON DELETE RESTRICT
+);
+CREATE INDEX idx_sources_node ON sources (node_id);
+
+CREATE TABLE chunks (
+    chunk_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id         TEXT NOT NULL,
+    generation        BIGINT NOT NULL,
+    source_id         TEXT NOT NULL,
+    ordinal           INT  NOT NULL,
+    content           TEXT NOT NULL,
+    chunk_hash        TEXT NOT NULL,                 -- sha256(content): the carry-forward key (§3.4)
+    heading_path      JSONB NOT NULL DEFAULT '[]',
+    heading_path_text TEXT,
+    anchor            TEXT,
+    labels            JSONB NOT NULL DEFAULT '{}',
+    embedding         VECTOR(1536),                  -- NULL while pending/failed; dim = the declared space
+    embedding_status  TEXT NOT NULL DEFAULT 'embedded'
+                      CHECK (embedding_status IN ('pending','embedded','failed')),
+    search_tsv        TSVECTOR GENERATED ALWAYS AS (to_tsvector('english', content)) STORED,
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
+    embedded_at       TIMESTAMPTZ,
+    embedding_model   TEXT,
+    embed_error       TEXT,
+    UNIQUE (tenant_id, generation, source_id, ordinal),
+    CONSTRAINT chunks_embedded_has_vector CHECK (embedding_status <> 'embedded' OR embedding IS NOT NULL),
+    CONSTRAINT chunks_source_fk FOREIGN KEY (tenant_id, generation, source_id)
+        REFERENCES sources (tenant_id, generation, source_id) ON DELETE CASCADE
+);
+CREATE INDEX idx_chunks_hnsw    ON chunks USING hnsw (embedding vector_cosine_ops) WITH (m = 16, ef_construction = 64);
+CREATE INDEX idx_chunks_gen     ON chunks (tenant_id, generation);
+CREATE INDEX idx_chunks_hpath   ON chunks (source_id, heading_path_text text_pattern_ops);
+CREATE INDEX idx_chunks_pending ON chunks (tenant_id, generation, source_id) WHERE embedding_status <> 'embedded';
+CREATE INDEX idx_chunks_tsv     ON chunks USING gin (search_tsv);
+
+-- Materialized at run finalization (generations.md §2): the routing arm reads rows, never
+-- aggregates at query time; generation-consistent by construction.
+CREATE TABLE node_centroids (
+    tenant_id  TEXT NOT NULL,
+    generation BIGINT NOT NULL,
+    node_id    UUID NOT NULL,
+    stable_id  TEXT NOT NULL,                        -- denylist binds here without a join
+    chunk_count INT NOT NULL,
+    embedding  VECTOR(1536) NOT NULL,
+    PRIMARY KEY (tenant_id, generation, node_id)
+);
+
+-- ============================================================================ takedown (NO generation)
+-- scope (decision 14): 'node' denies EXACTLY this stable_id (identity — the
+-- default, immune to reorganization, auditable as a frozen list); 'subtree'
+-- denies this node AND every descendant, resolved at SERVING time by a
+-- recursive parent_id walk (so descendants added by a FUTURE generation are
+-- covered — this table has no generation column BY DESIGN). NO generation
+-- column: denial beats every generation (§6).
+CREATE TABLE takedown_denylist (
+    tenant_id  TEXT NOT NULL,
+    corpus_id  TEXT NOT NULL,
+    stable_id  TEXT NOT NULL,
+    scope      TEXT NOT NULL DEFAULT 'node' CHECK (scope IN ('node','subtree')),
+    reason     TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (tenant_id, corpus_id, stable_id)
+);
+
+-- ============================================================================ the ledger
+CREATE TABLE retrieval_log (
+    id          BIGSERIAL,
+    tenant_id   TEXT NOT NULL,
+    corpus_id   TEXT,
+    generation  BIGINT,
+    actor       TEXT NOT NULL,                       -- NO default: unset errors loudly (carried)
+    action      TEXT NOT NULL CHECK (action IN
+                  ('content_served','similarity_searched','corpus_seeded','outline_served',
+                   'search_abstained','generation_activated','takedown_applied')),
+    source_id   TEXT,
+    -- spec §7 audit fields (explicit + queryable; free detail rides JSONB)
+    content_hash           TEXT,
+    chunk_hash             TEXT,
+    instance_bundle_sha256 TEXT,
+    embedding_model        TEXT,
+    chunk_policy_version   TEXT,
+    detail      JSONB NOT NULL DEFAULT '{}',
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (id, created_at)
+) PARTITION BY RANGE (created_at);
+CREATE TABLE retrieval_log_default PARTITION OF retrieval_log DEFAULT;
+CREATE INDEX idx_rlog_tenant ON retrieval_log (tenant_id, created_at);
+CREATE INDEX idx_rlog_action ON retrieval_log (action, created_at);
+
+-- ============================================================================ meta + triggers
+CREATE TABLE schema_meta (
+    schema_version  TEXT NOT NULL,                   -- spec §9: readers/writers support a RANGE
+    compatible_from TEXT NOT NULL,
+    applied_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+-- 2.1 adds takedown_denylist.scope (decision 14); additive with a default, so
+-- a 2.0 reader still reads a 2.1 database — compatible_from stays 2.0.
+INSERT INTO schema_meta (schema_version, compatible_from) VALUES ('2.1', '2.0');
+
+CREATE OR REPLACE FUNCTION touch_updated_at() RETURNS trigger AS $$
+BEGIN NEW.updated_at = now(); RETURN NEW; END; $$ LANGUAGE plpgsql;
+CREATE TRIGGER trg_nodes_touch   BEFORE UPDATE ON content_nodes FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+CREATE TRIGGER trg_sources_touch BEFORE UPDATE ON sources       FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+
+-- One embedding model per tenant (carried verbatim — a model switch is a DELIBERATE full re-embed).
+CREATE OR REPLACE FUNCTION sources_one_model() RETURNS trigger AS $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM sources WHERE tenant_id = NEW.tenant_id AND embedding_model <> NEW.embedding_model) THEN
+    RAISE EXCEPTION 'embedding-contract: tenant % is on model %, refusing % (a model switch is a deliberate full re-embed)',
+      NEW.tenant_id,
+      (SELECT embedding_model FROM sources WHERE tenant_id = NEW.tenant_id AND embedding_model <> NEW.embedding_model LIMIT 1),
+      NEW.embedding_model;
+  END IF;
+  RETURN NEW;
+END; $$ LANGUAGE plpgsql;
+CREATE TRIGGER trg_sources_one_model
+  BEFORE INSERT OR UPDATE OF embedding_model ON sources
+  FOR EACH ROW EXECUTE FUNCTION sources_one_model();
+
+-- ============================================================================ roles (spec §5 — per-DB grants,
+-- FORCE RLS, NO BYPASSRLS, no owner membership; the grant table IS ingest authorization)
+CREATE TABLE ingest_tenant_grants (
+    role_name  TEXT NOT NULL,
+    tenant_id  TEXT NOT NULL,
+    granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (role_name, tenant_id)
+);
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'sor_content_runtime') THEN CREATE ROLE sor_content_runtime NOLOGIN; END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'sor_content_ingest')  THEN CREATE ROLE sor_content_ingest NOLOGIN;  END IF;
+END $$;
+
+-- Explicit in-schema membership for the APPLYING role, so SET LOCAL ROLE works from day one
+-- (spec §5: NO out-of-band grants — the legacy schema's missing owner-membership grant broke
+-- every fresh project until hand-fixed). Deployment LOGIN roles receive the same membership
+-- when they are provisioned (1h).
+DO $$ BEGIN
+  EXECUTE format('GRANT sor_content_runtime, sor_content_ingest TO %I WITH SET TRUE', current_user);
+END $$;
+
+GRANT USAGE ON SCHEMA public TO sor_content_runtime, sor_content_ingest;
+-- runtime: read published corpora, write the ledger — NOTHING else.
+GRANT SELECT ON corpora, content_nodes, sources, chunks, slug_aliases, node_centroids, takedown_denylist, schema_meta TO sor_content_runtime;
+-- freshness on /health (2026-07-16): the runtime reads the active run's source_commit +
+-- finished_at/heartbeat_at to report sync-age; RLS tenant_read already covers ingestion_runs.
+GRANT SELECT ON ingestion_runs TO sor_content_runtime;
+GRANT INSERT ON retrieval_log TO sor_content_runtime;
+GRANT USAGE, SELECT ON SEQUENCE retrieval_log_id_seq TO sor_content_runtime;
+-- ingest: build generations + flip, for AUTHORIZED tenants only (policy-checked via the grant table).
+GRANT SELECT ON schema_meta, takedown_denylist, ingest_tenant_grants TO sor_content_ingest;
+GRANT SELECT, INSERT, UPDATE, DELETE ON corpora, ingestion_runs, content_nodes, sources, chunks, slug_aliases, node_centroids TO sor_content_ingest;
+GRANT INSERT ON retrieval_log TO sor_content_ingest;
+GRANT USAGE, SELECT ON SEQUENCE retrieval_log_id_seq, ingestion_runs_run_id_seq TO sor_content_ingest;
+
+-- FORCE: even a table owner obeys (spec §5 hardened over legacy ENABLE).
+ALTER TABLE corpora            ENABLE ROW LEVEL SECURITY; ALTER TABLE corpora            FORCE ROW LEVEL SECURITY;
+ALTER TABLE ingestion_runs     ENABLE ROW LEVEL SECURITY; ALTER TABLE ingestion_runs     FORCE ROW LEVEL SECURITY;
+ALTER TABLE content_nodes      ENABLE ROW LEVEL SECURITY; ALTER TABLE content_nodes      FORCE ROW LEVEL SECURITY;
+ALTER TABLE sources            ENABLE ROW LEVEL SECURITY; ALTER TABLE sources            FORCE ROW LEVEL SECURITY;
+ALTER TABLE chunks             ENABLE ROW LEVEL SECURITY; ALTER TABLE chunks             FORCE ROW LEVEL SECURITY;
+ALTER TABLE slug_aliases       ENABLE ROW LEVEL SECURITY; ALTER TABLE slug_aliases       FORCE ROW LEVEL SECURITY;
+ALTER TABLE node_centroids     ENABLE ROW LEVEL SECURITY; ALTER TABLE node_centroids     FORCE ROW LEVEL SECURITY;
+ALTER TABLE retrieval_log      ENABLE ROW LEVEL SECURITY; ALTER TABLE retrieval_log      FORCE ROW LEVEL SECURITY;
+ALTER TABLE takedown_denylist  ENABLE ROW LEVEL SECURITY; ALTER TABLE takedown_denylist  FORCE ROW LEVEL SECURITY;
+
+-- Tenant wall (GUC app.tenant_id; unset ⇒ zero rows, fail-closed). Reads:
+CREATE POLICY tenant_read ON corpora           FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON content_nodes     FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON sources           FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON chunks            FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON slug_aliases      FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON node_centroids    FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON takedown_denylist FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_read ON ingestion_runs    FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true));
+-- Ledger writes:
+CREATE POLICY tenant_write ON retrieval_log FOR INSERT
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+-- Ingest mutations: tenant GUC match AND the grant table authorizes THIS role for THIS tenant
+-- (a CLI flag is not authorization — spec §5).
+CREATE POLICY ingest_write ON content_nodes FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = content_nodes.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = content_nodes.tenant_id));
+CREATE POLICY ingest_write ON sources FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = sources.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = sources.tenant_id));
+CREATE POLICY ingest_write ON chunks FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = chunks.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = chunks.tenant_id));
+CREATE POLICY ingest_write ON slug_aliases FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = slug_aliases.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = slug_aliases.tenant_id));
+CREATE POLICY ingest_write ON node_centroids FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = node_centroids.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = node_centroids.tenant_id));
+CREATE POLICY ingest_write ON ingestion_runs FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = ingestion_runs.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = ingestion_runs.tenant_id));
+-- The FLIP (and only the flip-shaped mutation) on corpora:
+CREATE POLICY ingest_flip ON corpora FOR ALL TO sor_content_ingest
+  USING (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = corpora.tenant_id))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true)
+         AND EXISTS (SELECT 1 FROM ingest_tenant_grants g WHERE g.role_name = current_user AND g.tenant_id = corpora.tenant_id));

package/templates/scaffold/.agents/skills/add-sources/SKILL.md

@@ -2,7 +2,7 @@
 name: add-sources
 description: Turn source material — documents, pages, pasted text, notes — into governed knowledge in knowledge/. Use when the owner shares material to add, says "add this to the knowledge base", or asks how to get existing content in. Not for editing the site.
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
 ---
 
 # Add sources
@@ -24,6 +24,9 @@ The rules that make it _governed_ rather than merely stored:
   file names, systems, people, dates) whenever the owner can tell you.
   Precision matters: "Finance policy manual §4.2, 2025 edition" governs;
   "internal docs" does not.
+- When `instance.md` declares `audiences:`, ask the owner which audience the
+  new material belongs to and write it as `visibility:` — never guess that
+  restricted material is public.
 
 ## Fidelity rules
 

package/templates/scaffold/.agents/skills/format-checker/SKILL.md

@@ -2,7 +2,7 @@
 name: format-checker
 description: The record's format rules as a runnable check — frontmatter, filenames, links, structure. Use before handing off any change to knowledge/, when a check fails and you need to fix it, or when unsure whether a document is well-formed. Run with `pnpm check` (or node .agents/skills/format-checker/check.mjs).
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
 ---
 
 # Format checker
@@ -25,6 +25,13 @@ enforces what AGENTS.md states in prose:
   blocks are code, not links, and are ignored.
 - `instance.md` exists, is `format: 1`, and carries only the keys the format
   defines — an unknown key is named, never ignored.
+- The audience model, when there is one: `audiences:` is ordered least- to
+  most-restricted with `public` first, no duplicates, and never without
+  `default_visibility:`; a document's `visibility:` names one of the declared
+  audiences; and no link or `superseded_by:` points from a wider audience at a
+  narrower one — the leak no single build can catch, since the build that
+  publishes the pointer has already dropped its target. A record that declares
+  no `audiences:` is checked exactly as it was before the key existed.
 - `CLAUDE.md` stays a one-line pointer; `.agents/skills/` and
   `.claude/skills/` hold the same files byte for byte **in both directions**
   (a file only one tree carries is a rule nobody reviewed); the site contains