@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/migrations/taskSchemaMigrations.js

@@ -534,6 +534,7 @@ export function ensureWorkspaceSchema(db) {
             user_id TEXT NOT NULL,
             name TEXT NOT NULL,
             scopes_json TEXT NOT NULL,
+            tool_profile TEXT NOT NULL DEFAULT 'default',
             token_prefix TEXT NOT NULL,
             token_hash TEXT NOT NULL,
             status TEXT NOT NULL DEFAULT 'active',
@@ -654,6 +655,7 @@ export function ensureWorkspaceSchema(db) {
             { name: 'user_id', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN user_id TEXT NOT NULL DEFAULT ''` },
             { name: 'name', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN name TEXT NOT NULL DEFAULT ''` },
             { name: 'scopes_json', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN scopes_json TEXT NOT NULL DEFAULT '[]'` },
+            { name: 'tool_profile', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN tool_profile TEXT NOT NULL DEFAULT 'default'` },
             { name: 'token_prefix', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_prefix TEXT NOT NULL DEFAULT ''` },
             { name: 'token_hash', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_hash TEXT NOT NULL DEFAULT ''` },
             { name: 'status', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN status TEXT NOT NULL DEFAULT 'active'` },
@@ -1423,6 +1425,7 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
             base_lifecycle_revision ${revisionType} NOT NULL DEFAULT 0,
             payload_json TEXT NOT NULL,
             payload_fingerprint TEXT NOT NULL,
+            canonical_intent_json TEXT,
             status TEXT NOT NULL DEFAULT 'pending',
             attempt_count INTEGER NOT NULL DEFAULT 0,
             initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0,
@@ -1687,6 +1690,9 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
         CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_expiry
         ON workspace_sync_repair_snapshots(tenant_id, workspace_id, expires_at);
 
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_global_expiry
+        ON workspace_sync_repair_snapshots(tenant_id, expires_at, workspace_id, snapshot_id);
+
         CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_created
         ON workspace_sync_repair_snapshots(tenant_id, workspace_id, created_at);
 
@@ -1729,6 +1735,60 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
 }
 export function ensureWorkspaceSyncDurabilitySchema(db) {
     db.exec(buildWorkspaceSyncDurabilitySchemaSql(db.provider));
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_tombstone_provenance (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            logical_path TEXT NOT NULL,
+            source TEXT NOT NULL,
+            operation_id TEXT,
+            actor_id TEXT,
+            source_runtime TEXT,
+            source_updated_at TEXT NOT NULL,
+            repair_involved INTEGER NOT NULL DEFAULT 0,
+            recorded_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_tombstone_provenance_path
+        ON workspace_sync_content_tombstone_provenance(
+            tenant_id, workspace_id, kind, logical_path, recorded_at
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_tombstone_provenance_recorded
+        ON workspace_sync_content_tombstone_provenance(tenant_id, workspace_id, recorded_at);
+    `);
+    // workspace_sync_content_pull_obligations (T-1607) is normally created by
+    // ensureLocalSyncCoordinatorSchema, but that function only runs for
+    // runtimeMode === 'local' (see core/Taskforce.ts). Cloud/Postgres deployments
+    // otherwise depended solely on the static migrations/postgres/001_init.sql
+    // bootstrap, which only benefits brand-new databases — an existing cloud
+    // deployment provisioned before that table existed would never self-heal.
+    // ensureWorkspaceSyncDurabilitySchema runs unconditionally on every startup
+    // for both runtimes, so creating it here too (idempotently) closes that gap
+    // for already-provisioned cloud deployments as well.
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_pull_obligations (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            path TEXT NOT NULL,
+            source_watermark TEXT NOT NULL,
+            metadata_fingerprint TEXT NOT NULL,
+            expected_sha256 TEXT NOT NULL,
+            expected_size_bytes INTEGER NOT NULL,
+            manifest_updated_at TEXT NOT NULL,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            last_error TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            resolved_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, kind, path)
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_pull_obligations_open
+        ON workspace_sync_content_pull_obligations(
+            tenant_id, workspace_id, resolved_at, updated_at, kind, path
+        );
+    `);
     if (db.provider === 'sqlite' && hasTable(db, 'tasks')) {
         db.exec(`
             CREATE TRIGGER IF NOT EXISTS trg_tasks_v3_create_fence
@@ -1827,6 +1887,9 @@ export function ensureWorkspaceSyncDurabilitySchema(db) {
     if (!outboxColumns.some((column) => column.name === 'initial_not_found_attempt_count')) {
         db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0`);
     }
+    if (!outboxColumns.some((column) => column.name === 'canonical_intent_json')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN canonical_intent_json TEXT`);
+    }
     if (!outboxColumns.some((column) => column.name === 'owns_task_metadata')) {
         db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN owns_task_metadata INTEGER NOT NULL DEFAULT 0`);
     }
@@ -2072,6 +2135,7 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             upstream_disposition TEXT NOT NULL,
             last_committed_cursor_json TEXT,
             required_action TEXT NOT NULL,
+            coalescing_key TEXT,
             created_at TEXT NOT NULL,
             resolved_at TEXT,
             resolved_boundary_json TEXT
@@ -2129,6 +2193,8 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
             next_attempt_at TEXT NOT NULL,
+            terminal_at TEXT,
+            terminal_reason TEXT,
             resolved_at TEXT,
             PRIMARY KEY (tenant_id, workspace_id, task_id)
         );
@@ -2172,6 +2238,12 @@ export function ensureLocalSyncCoordinatorSchema(db) {
     if (!attachmentApplyColumns.has('revision_fingerprint')) {
         db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN revision_fingerprint TEXT`);
     }
+    if (!attachmentApplyColumns.has('terminal_at')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN terminal_at TEXT`);
+    }
+    if (!attachmentApplyColumns.has('terminal_reason')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN terminal_reason TEXT`);
+    }
     const coordinatorStateColumns = db.provider === 'postgres'
         ? new Set(db.prepare(`
             SELECT column_name AS name
@@ -2280,6 +2352,17 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             ADD COLUMN resolved_boundary_json TEXT
         `);
     }
+    if (!recoveryObligationColumns.has('coalescing_key')) {
+        db.exec(`
+            ALTER TABLE local_sync_recovery_obligations
+            ADD COLUMN coalescing_key TEXT
+        `);
+    }
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_local_sync_recovery_obligations_open_key
+        ON local_sync_recovery_obligations(coalescing_key)
+        WHERE coalescing_key IS NOT NULL AND resolved_at IS NULL
+    `);
 }
 export function ensureWorkspaceDocumentsSchema(db) {
     db.exec(`
@@ -2413,6 +2496,350 @@ export function ensureTaskforceAgentsSchema(db) {
             : `ALTER TABLE agent_conversations ADD COLUMN task_id TEXT`);
     }
 }
+export function ensureModelProviderConnectionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS model_provider_connections (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            owner_user_id TEXT NOT NULL,
+            provider_key TEXT NOT NULL,
+            authentication_type TEXT NOT NULL,
+            lifecycle_status TEXT NOT NULL DEFAULT 'pending',
+            display_metadata_json TEXT NOT NULL DEFAULT '{}',
+            credential_home_ref TEXT NOT NULL,
+            last_verified_at TEXT,
+            last_refreshed_at TEXT,
+            last_failure_at TEXT,
+            failure_code TEXT,
+            disconnected_at TEXT,
+            revoked_at TEXT,
+            revoked_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, credential_home_ref),
+            FOREIGN KEY (owner_user_id) REFERENCES users(id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connections_owner
+        ON model_provider_connections(tenant_id, owner_user_id, lifecycle_status, updated_at);
+
+        CREATE TABLE IF NOT EXISTS model_provider_connection_leases (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            connection_id TEXT NOT NULL,
+            lease_token TEXT NOT NULL,
+            operation TEXT NOT NULL,
+            acquired_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, connection_id),
+            FOREIGN KEY (connection_id) REFERENCES model_provider_connections(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connection_leases_expiry
+        ON model_provider_connection_leases(tenant_id, expires_at);
+
+        CREATE TABLE IF NOT EXISTS model_provider_connection_events (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            connection_id TEXT NOT NULL,
+            owner_user_id TEXT NOT NULL,
+            actor_user_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            outcome TEXT NOT NULL,
+            reason_code TEXT,
+            created_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_model_provider_connection_events_connection
+        ON model_provider_connection_events(tenant_id, connection_id, created_at);
+    `);
+}
+export function ensureTaskforceAgentConnectionBindingsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS taskforce_agent_connection_bindings (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            agent_id TEXT NOT NULL,
+            connection_id TEXT NOT NULL,
+            owner_user_id TEXT NOT NULL,
+            provider_key TEXT NOT NULL,
+            model_source TEXT NOT NULL,
+            created_by_user_id TEXT NOT NULL,
+            updated_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, agent_id),
+            FOREIGN KEY (agent_id) REFERENCES taskforce_agents(id) ON DELETE CASCADE,
+            FOREIGN KEY (connection_id) REFERENCES model_provider_connections(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_connection_bindings_owner
+        ON taskforce_agent_connection_bindings(
+            tenant_id, workspace_id, owner_user_id, updated_at
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_connection_bindings_connection
+        ON taskforce_agent_connection_bindings(tenant_id, connection_id);
+    `);
+}
+export function ensureGitHubReviewEvidenceInstallationBindingsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS github_review_evidence_installation_bindings (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            installation_id TEXT NOT NULL,
+            account_id TEXT NOT NULL,
+            account_login TEXT NOT NULL,
+            account_type TEXT NOT NULL,
+            repository_selection TEXT NOT NULL,
+            bound_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id),
+            UNIQUE (installation_id),
+            FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_github_review_evidence_installation
+        ON github_review_evidence_installation_bindings(tenant_id, installation_id);
+    `);
+}
+export function ensureExecutorPhaseAApprovalReceiptsSchema(db) {
+    const bytesType = db.provider === 'postgres' ? 'BYTEA' : 'BLOB';
+    if (hasTable(db, 'executor_phase_a_approval_receipts')) {
+        if (db.provider === 'postgres') {
+            db.exec(`
+                ALTER TABLE executor_phase_a_approval_receipts
+                    ADD COLUMN IF NOT EXISTS receipt_kind TEXT,
+                    ADD COLUMN IF NOT EXISTS original_capability_id TEXT,
+                    ADD COLUMN IF NOT EXISTS residual_inventory_sha256 TEXT;
+                UPDATE executor_phase_a_approval_receipts
+                SET receipt_kind = 'main'
+                WHERE receipt_kind IS NULL;
+                ALTER TABLE executor_phase_a_approval_receipts
+                    ALTER COLUMN receipt_kind SET NOT NULL;
+                DO $$
+                BEGIN
+                    IF NOT EXISTS (
+                        SELECT 1 FROM pg_constraint
+                        WHERE conrelid = 'executor_phase_a_approval_receipts'::regclass
+                          AND conname = 'executor_phase_a_approval_receipts_kind_check'
+                    ) THEN
+                        ALTER TABLE executor_phase_a_approval_receipts
+                            ADD CONSTRAINT executor_phase_a_approval_receipts_kind_check
+                            CHECK (receipt_kind IN ('main', 'cleanup-only'));
+                    END IF;
+                END $$;
+            `);
+            const legacyConstraints = db.prepare(`
+                SELECT constraint_name AS name
+                FROM information_schema.table_constraints
+                WHERE table_schema = current_schema()
+                  AND table_name = 'executor_phase_a_approval_receipts'
+                  AND constraint_type = 'UNIQUE'
+            `).all();
+            for (const constraint of legacyConstraints) {
+                const name = String(constraint.name || '');
+                if (!/^[A-Za-z0-9_]+$/.test(name))
+                    continue;
+                const columns = db.prepare(`
+                    SELECT column_name AS name
+                    FROM information_schema.key_column_usage
+                    WHERE table_schema = current_schema()
+                      AND table_name = 'executor_phase_a_approval_receipts'
+                      AND constraint_name = ?
+                    ORDER BY ordinal_position
+                `).all(name);
+                if (columns.map((column) => column.name).join(',') === 'tenant_id,workspace_id,task_id,run_id') {
+                    db.exec(`ALTER TABLE executor_phase_a_approval_receipts DROP CONSTRAINT "${name}"`);
+                }
+            }
+        }
+        else {
+            const columns = db.prepare(`PRAGMA table_info(executor_phase_a_approval_receipts)`).all();
+            if (!columns.some((column) => column.name === 'receipt_kind')) {
+                db.transaction(() => db.exec(`
+                    ALTER TABLE executor_phase_a_approval_receipts RENAME TO executor_phase_a_approval_receipts_v1;
+                    CREATE TABLE executor_phase_a_approval_receipts (
+                        receipt_id TEXT PRIMARY KEY,
+                        tenant_id TEXT NOT NULL DEFAULT 'default',
+                        workspace_id TEXT NOT NULL,
+                        task_id TEXT NOT NULL,
+                        task_reference TEXT NOT NULL,
+                        run_id TEXT NOT NULL,
+                        receipt_kind TEXT NOT NULL CHECK (receipt_kind IN ('main', 'cleanup-only')),
+                        original_capability_id TEXT,
+                        residual_inventory_sha256 TEXT,
+                        actor_user_id TEXT NOT NULL,
+                        preflight_sha256 TEXT NOT NULL,
+                        logical_envelope_sha256 TEXT NOT NULL,
+                        canonical_preflight_bytes BLOB NOT NULL,
+                        canonical_receipt_bytes BLOB NOT NULL,
+                        receipt_sha256 TEXT NOT NULL,
+                        key_id TEXT NOT NULL,
+                        approved_at TEXT NOT NULL,
+                        expires_at TEXT NOT NULL,
+                        created_at TEXT NOT NULL,
+                        UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_kind)
+                    );
+                    INSERT INTO executor_phase_a_approval_receipts (
+                        receipt_id, tenant_id, workspace_id, task_id, task_reference, run_id,
+                        receipt_kind, original_capability_id, residual_inventory_sha256,
+                        actor_user_id, preflight_sha256, logical_envelope_sha256,
+                        canonical_preflight_bytes, canonical_receipt_bytes, receipt_sha256,
+                        key_id, approved_at, expires_at, created_at
+                    )
+                    SELECT receipt_id, tenant_id, workspace_id, task_id, task_reference, run_id,
+                        'main', NULL, NULL, actor_user_id, preflight_sha256, logical_envelope_sha256,
+                        canonical_preflight_bytes, canonical_receipt_bytes, receipt_sha256,
+                        key_id, approved_at, expires_at, created_at
+                    FROM executor_phase_a_approval_receipts_v1;
+                    DROP TABLE executor_phase_a_approval_receipts_v1;
+                `))();
+            }
+        }
+    }
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS executor_phase_a_approval_receipts (
+            receipt_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            task_reference TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_kind TEXT NOT NULL CHECK (receipt_kind IN ('main', 'cleanup-only')),
+            original_capability_id TEXT,
+            residual_inventory_sha256 TEXT,
+            actor_user_id TEXT NOT NULL,
+            preflight_sha256 TEXT NOT NULL,
+            logical_envelope_sha256 TEXT NOT NULL,
+            canonical_preflight_bytes ${bytesType} NOT NULL,
+            canonical_receipt_bytes ${bytesType} NOT NULL,
+            receipt_sha256 TEXT NOT NULL,
+            key_id TEXT NOT NULL,
+            approved_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_kind)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_receipts_scope
+        ON executor_phase_a_approval_receipts(tenant_id, workspace_id, task_id, approved_at);
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_executor_phase_a_receipts_run_kind
+        ON executor_phase_a_approval_receipts(tenant_id, workspace_id, task_id, run_id, receipt_kind);
+    `);
+}
+export function ensureExecutorPhaseARunAuthorizationsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS executor_phase_a_run_capabilities (
+            capability_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_id TEXT NOT NULL,
+            receipt_sha256 TEXT NOT NULL,
+            capability_kind TEXT NOT NULL CHECK (capability_kind IN ('main', 'cleanup-only')),
+            original_capability_id TEXT,
+            residual_inventory_sha256 TEXT,
+            actor_user_id TEXT NOT NULL,
+            account_id TEXT NOT NULL,
+            region TEXT NOT NULL,
+            availability_zone TEXT NOT NULL,
+            read_principal_arn TEXT NOT NULL,
+            broker_key_fingerprint TEXT NOT NULL,
+            capability_sha256 TEXT NOT NULL,
+            preflight_sha256 TEXT NOT NULL,
+            logical_envelope_sha256 TEXT NOT NULL,
+            source_commit TEXT NOT NULL,
+            role_map_sha256 TEXT NOT NULL,
+            oidc_audience_sha256 TEXT NOT NULL,
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            mutation_deadline TEXT NOT NULL,
+            cleanup_deadline TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (status IN (
+                'active', 'awaiting-cleanup-approval', 'completed', 'cleanup-failed', 'expired'
+            )),
+            hard_stopped_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, workspace_id, task_id, run_id, receipt_id, broker_key_fingerprint),
+            UNIQUE (tenant_id, receipt_id),
+            UNIQUE (tenant_id, original_capability_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_run_capabilities_scope
+        ON executor_phase_a_run_capabilities(tenant_id, workspace_id, task_id, run_id, status);
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_sender_nonces (
+            nonce_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            capability_id TEXT NOT NULL,
+            request_sha256 TEXT NOT NULL,
+            phase TEXT NOT NULL CHECK (phase IN ('bootstrap', 'ami-build', 'provenance', 'runtime', 'cleanup')),
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            consumed_at TEXT,
+            status TEXT NOT NULL CHECK (status IN ('issued', 'consumed', 'revoked', 'expired')),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, capability_id, nonce_id),
+            FOREIGN KEY (capability_id) REFERENCES executor_phase_a_run_capabilities(capability_id) ON DELETE RESTRICT
+        );
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_workload_grants (
+            grant_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            capability_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            receipt_id TEXT NOT NULL,
+            phase TEXT NOT NULL CHECK (phase IN ('bootstrap', 'ami-build', 'provenance', 'runtime', 'cleanup')),
+            role_arn TEXT NOT NULL,
+            grant_sha256 TEXT NOT NULL,
+            token_id TEXT NOT NULL,
+            nonce_id TEXT NOT NULL,
+            sender_proof_sha256 TEXT NOT NULL,
+            broker_key_fingerprint TEXT NOT NULL,
+            source_identity TEXT NOT NULL,
+            session_tags_sha256 TEXT NOT NULL,
+            policy_sha256 TEXT NOT NULL,
+            issued_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            used_at TEXT,
+            status TEXT NOT NULL CHECK (status IN ('issued', 'used', 'revoked', 'rejected', 'expired')),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (tenant_id, token_id),
+            UNIQUE (tenant_id, capability_id, nonce_id),
+            UNIQUE (tenant_id, capability_id, sender_proof_sha256),
+            FOREIGN KEY (capability_id) REFERENCES executor_phase_a_run_capabilities(capability_id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_workload_grants_scope
+        ON executor_phase_a_workload_grants(tenant_id, capability_id, phase, status, issued_at);
+
+        CREATE TABLE IF NOT EXISTS executor_phase_a_issuer_redemptions (
+            request_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            grant_id TEXT NOT NULL,
+            grant_sha256 TEXT NOT NULL,
+            sender_proof_sha256 TEXT NOT NULL,
+            request_sha256 TEXT NOT NULL,
+            canonical_response_bytes ${db.provider === 'postgres' ? 'BYTEA' : 'BLOB'} NOT NULL,
+            response_sha256 TEXT NOT NULL,
+            redeemed_at TEXT NOT NULL,
+            UNIQUE (tenant_id, grant_id),
+            FOREIGN KEY (grant_id) REFERENCES executor_phase_a_workload_grants(grant_id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_executor_phase_a_issuer_redemptions_grant
+        ON executor_phase_a_issuer_redemptions(tenant_id, grant_id, redeemed_at);
+    `);
+}
 export function ensureAgentRolesSchema(db) {
     db.exec(`
         CREATE TABLE IF NOT EXISTS agent_roles (

package/dist/runtime/appGateDefinitions.d.ts

@@ -1,36 +1,60 @@
 export declare const APP_GATE_DEFINITIONS: {
     readonly 'annotated_attachments.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "Annotated Attachment workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Annotated Attachment GA";
     };
     readonly 'documents.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "Document Manager/editor workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Document Manager GA";
     };
     readonly 'workflow_manager.workspace_access': {
-        readonly enabled: false;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: false;
+        };
         readonly description: "Workflow Manager workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Workflow Manager GA";
     };
     readonly 'taskforce_agents.workspace_access': {
-        readonly enabled: false;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: false;
+        };
         readonly description: "Taskforce Agents workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Taskforce Agents workspace GA";
     };
     readonly 'ai_profiles.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "AI Profiles workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "AI Profiles workspace GA";
     };
     readonly 'planning.workspace_access': {
-        readonly enabled: false;
+        readonly enabledByEnvironment: {
+            readonly performance: false;
+            readonly staging: false;
+            readonly production: false;
+        };
         readonly description: "Planning workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Planning workspace GA";

package/dist/runtime/appGateDefinitions.js

@@ -1,36 +1,36 @@
 export const APP_GATE_DEFINITIONS = {
     'annotated_attachments.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'Annotated Attachment workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Annotated Attachment GA'
     },
     'documents.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'Document Manager/editor workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Document Manager GA'
     },
     'workflow_manager.workspace_access': {
-        enabled: false,
+        enabledByEnvironment: { performance: true, staging: true, production: false },
         description: 'Workflow Manager workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Workflow Manager GA'
     },
     'taskforce_agents.workspace_access': {
-        enabled: false,
+        enabledByEnvironment: { performance: true, staging: true, production: false },
         description: 'Taskforce Agents workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Taskforce Agents workspace GA'
     },
     'ai_profiles.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'AI Profiles workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'AI Profiles workspace GA'
     },
     'planning.workspace_access': {
-        enabled: false,
+        enabledByEnvironment: { performance: false, staging: false, production: false },
         description: 'Planning workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Planning workspace GA'

package/dist/runtime/appGates.d.ts

@@ -1,17 +1,18 @@
-export type RuntimeMode = 'local' | 'cloud';
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { APP_GATE_DEFINITIONS as APP_GATE_CONFIG } from './appGateDefinitions.js';
 export declare const ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY: "annotated_attachments.workspace_access";
 export declare const DOCUMENT_WORKSPACE_FEATURE_KEY: "documents.workspace_access";
 export declare const WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY: "workflow_manager.workspace_access";
 export declare const TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY: "taskforce_agents.workspace_access";
 export declare const AI_PROFILES_WORKSPACE_FEATURE_KEY: "ai_profiles.workspace_access";
 export declare const PLANNING_WORKSPACE_FEATURE_KEY: "planning.workspace_access";
-export type AppGateKey = typeof ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY | typeof DOCUMENT_WORKSPACE_FEATURE_KEY | typeof WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY | typeof TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY | typeof AI_PROFILES_WORKSPACE_FEATURE_KEY | typeof PLANNING_WORKSPACE_FEATURE_KEY;
+export type AppGateKey = keyof typeof APP_GATE_CONFIG;
 export interface AppGateDefinition {
-    key: AppGateKey;
-    enabled: boolean;
-    description: string;
-    owner: string;
-    removalMilestone: string;
+    readonly key: AppGateKey;
+    readonly enabledByEnvironment: Readonly<Record<TaskforceCloudEnvironment, boolean>>;
+    readonly description: string;
+    readonly owner: string;
+    readonly removalMilestone: string;
 }
 export interface ResolvedFeatureAccess {
     featureKey: string;
@@ -20,11 +21,10 @@ export interface ResolvedFeatureAccess {
     code: string;
 }
 export type ResolvedFeatureAccessMap = Record<string, ResolvedFeatureAccess>;
-export declare const APP_GATE_DEFINITIONS: Record<AppGateKey, AppGateDefinition>;
+export declare const APP_GATE_DEFINITIONS: Readonly<Record<AppGateKey, AppGateDefinition>>;
 export declare function listAppGateDefinitions(): AppGateDefinition[];
 export declare function getAppGateDefinition(featureKey: string): AppGateDefinition | null;
-export declare function resolveAppGateAccess(featureKey: string): ResolvedFeatureAccess;
-export declare function resolveFeatureAccess(input: {
-    featureKey: string;
-    runtimeMode: RuntimeMode;
-}): ResolvedFeatureAccess;
+export declare function resolveAppGateAccess(featureKey: string, environment: TaskforceCloudEnvironment): ResolvedFeatureAccess;
+export declare function resolveAppGateAccessMap(environment: TaskforceCloudEnvironment): ResolvedFeatureAccessMap;
+export declare function resolveClientAppGateAccessMap(accessMap: ResolvedFeatureAccessMap | null | undefined, cloudEnvironment: unknown): ResolvedFeatureAccessMap;
+export declare function isResolvedFeatureAccessMap(value: unknown): value is ResolvedFeatureAccessMap;