@team-semicolon/semicolony-cli 4.18.103 → 4.18.105

package/migrations/198_meeting_record_canonical.sql

@@ -0,0 +1,85 @@
+-- 198_meeting_record_canonical.sql
+--
+-- Make semo_ops.meetings the canonical meeting record.
+--
+-- The table was built in 2026-03 for a VITO STT + Notion pipeline and was
+-- abandoned with it: 7 rows, none after 2026-04. The record moved to GitHub
+-- Discussions, which the headless workstation cannot write — it holds no GitHub
+-- credential, so 0 discussions were published after 2026-08-06 while the skill
+-- correctly reported `not-published` and Slack thread delivery masked it. When
+-- the router timed out on 2026-08-12 that surface went too and the minutes
+-- survived only in the worker's in-memory job result.
+--
+-- This restores the table rather than adding a second one: `target_domain` is
+-- already an ontology FK and `attendees` is already jsonb, which is the shape
+-- the action-item linkage needs.
+--
+-- Design: docs/superpowers/specs/2026-08-12-meeting-record-db-design.md (semo-ops)
+--
+-- Safety: additive except for five dead VITO/Notion columns. `audio_data` is
+-- deliberately NOT dropped — see the constraint at the bottom.
+-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
+-- retargets the `semicolony.` qualifier to the active schema.
+
+ALTER TABLE semicolony.meetings
+  ADD COLUMN IF NOT EXISTS visibility text NOT NULL DEFAULT 'restricted',
+  ADD COLUMN IF NOT EXISTS record_body text,
+  ADD COLUMN IF NOT EXISTS record_source text;
+
+-- The default is the closed value on purpose. A meeting wrongly hidden from the
+-- team is recoverable; a client negotiation wrongly exposed to it is not.
+ALTER TABLE semicolony.meetings
+  DROP CONSTRAINT IF EXISTS meetings_visibility_check;
+ALTER TABLE semicolony.meetings
+  ADD CONSTRAINT meetings_visibility_check
+  CHECK (visibility IN ('team', 'restricted'));
+
+ALTER TABLE semicolony.meetings
+  DROP CONSTRAINT IF EXISTS meetings_record_source_check;
+ALTER TABLE semicolony.meetings
+  ADD CONSTRAINT meetings_record_source_check
+  CHECK (record_source IS NULL
+         OR record_source IN ('slack-worker', 'operator', 'backfill-discussion'));
+
+-- The linkage this change exists for. Nullable: the 1,760 existing action items
+-- predate the meetings table and must not be invented a source.
+ALTER TABLE semicolony.action_items
+  ADD COLUMN IF NOT EXISTS meeting_id uuid REFERENCES semicolony.meetings(meeting_id);
+
+-- Dead pipeline. VITO was replaced by the hive whisper backend, and Notion sync
+-- was retired with the same pipeline.
+ALTER TABLE semicolony.meetings
+  DROP COLUMN IF EXISTS vito_transcribe_id,
+  DROP COLUMN IF EXISTS notion_page_id,
+  DROP COLUMN IF EXISTS notion_url,
+  DROP COLUMN IF EXISTS notion_sync_status,
+  DROP COLUMN IF EXISTS notion_sync_error;
+
+-- audio_data is NOT dropped.
+--
+-- The design called for dropping it: recordings are restricted material and the
+-- worker deletes them once the transcript exists, so a column that stores them
+-- permanently contradicts the policy it serves. But the pre-flight audit found
+-- 2 of the 7 rows still holding bytes — 스페이스씨엘 회의 (2026-03-19, 7.6 MB) and
+-- 스타스팟 회의 (2026-03-28, 6.6 MB), 14 MB total. Neither has a Discussion, so
+-- these are the only copies in existence. Dropping the column would destroy
+-- restricted material that no one has decided to dispose of.
+--
+-- The policy contradiction is closed without destroying anything: NOT VALID
+-- enforces the rule on every future insert and update while tolerating the two
+-- existing rows. Disposal stays a separate, explicit decision. Validate this
+-- constraint and drop the column once those two recordings are dealt with.
+ALTER TABLE semicolony.meetings
+  DROP CONSTRAINT IF EXISTS meetings_audio_data_not_stored;
+ALTER TABLE semicolony.meetings
+  ADD CONSTRAINT meetings_audio_data_not_stored
+  CHECK (audio_data IS NULL) NOT VALID;
+
+-- Idempotency key for record_meeting. A teammate re-requesting a meeting is
+-- normal behaviour — on 2026-08-12 one did, and an already-successful 190-minute
+-- transcription ran a second time. It must not also create a second row.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_meetings_date_title
+  ON semicolony.meetings (meeting_date, lower(regexp_replace(title, '\s+', ' ', 'g')));
+
+CREATE INDEX IF NOT EXISTS idx_action_items_meeting
+  ON semicolony.action_items (meeting_id) WHERE meeting_id IS NOT NULL;

package/migrations/199_meeting_record_capability.sql

@@ -0,0 +1,164 @@
+-- 199_meeting_record_capability.sql
+--
+-- One narrowly-scoped write primitive for a meeting record, modelled on
+-- `178_feedback_capture_capability.sql`. `sc_app` receives EXECUTE only: it
+-- still has no general DML on meetings, action_items, or knowledge_base.
+--
+-- The function records the meeting, projects the body into the Knowledge Fabric,
+-- and creates the meeting's action items in one transaction. Action items belong
+-- here rather than behind a second endpoint because `semo action-items` needs a
+-- DATABASE_URL and answers `DB 연결 실패` on the workstation — the headless path
+-- has never created one, which is why 1,760 action items carry no meeting. Doing
+-- both here also makes them atomic: a record cannot land with its follow-ups
+-- silently missing.
+--
+-- Restriction reuses the existing mechanism rather than inventing one. The
+-- `knowledge_base_hide_restricted` policy hides a row from sc_app when
+-- `metadata -> 'classification' ->> 'sensitivity' = 'restricted'`, so a
+-- restricted meeting is projected with exactly that shape.
+
+CREATE OR REPLACE FUNCTION semicolony.record_meeting(
+  p_title text,
+  p_meeting_date date,
+  p_meeting_type text,
+  p_adhoc_subtype text,
+  p_visibility text,
+  p_target_domain text,
+  p_attendees jsonb,
+  p_record_body text,
+  p_transcript text,
+  p_action_items jsonb,
+  p_record_source text,
+  p_worker_id text,
+  p_device_id text
+)
+RETURNS TABLE(meeting_id uuid, kb_id bigint, action_item_ids uuid[], duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_meeting_id uuid;
+  v_kb_id bigint;
+  v_existing uuid;
+  v_norm text;
+  v_sensitivity text;
+  v_sub_key text;
+BEGIN
+  IF p_title IS NULL OR length(btrim(p_title)) < 3 THEN
+    RAISE EXCEPTION 'title must be at least 3 characters';
+  END IF;
+  IF p_meeting_date IS NULL THEN
+    RAISE EXCEPTION 'meeting_date is required';
+  END IF;
+  IF p_visibility IS NULL OR p_visibility NOT IN ('team', 'restricted') THEN
+    RAISE EXCEPTION 'visibility must be team or restricted, got %', p_visibility;
+  END IF;
+  IF p_record_source IS NULL
+     OR p_record_source NOT IN ('slack-worker', 'operator', 'backfill-discussion') THEN
+    RAISE EXCEPTION 'invalid record_source %', p_record_source;
+  END IF;
+  IF p_record_body IS NULL OR length(btrim(p_record_body)) = 0 THEN
+    RAISE EXCEPTION 'record_body is required';
+  END IF;
+
+  v_norm := lower(regexp_replace(btrim(p_title), '\s+', ' ', 'g'));
+  v_sensitivity := CASE WHEN p_visibility = 'restricted' THEN 'restricted' ELSE 'internal' END;
+
+  SELECT m.meeting_id INTO v_existing
+    FROM semicolony.meetings m
+   WHERE m.meeting_date = p_meeting_date
+     AND lower(regexp_replace(m.title, '\s+', ' ', 'g')) = v_norm;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE semicolony.meetings m
+       SET record_body = COALESCE(p_record_body, m.record_body),
+           mapped_transcript = COALESCE(p_transcript, m.mapped_transcript),
+           visibility = p_visibility,
+           record_source = p_record_source,
+           target_domain = COALESCE(p_target_domain, m.target_domain),
+           attendees = COALESCE(p_attendees, m.attendees),
+           updated_at = now()
+     WHERE m.meeting_id = v_existing;
+    v_meeting_id := v_existing;
+  ELSE
+    INSERT INTO semicolony.meetings (
+      meeting_id, title, meeting_type, adhoc_subtype, meeting_date, attendees,
+      visibility, record_body, mapped_transcript, record_source, target_domain,
+      transcription_status, speaker_map, created_at, updated_at
+    ) VALUES (
+      gen_random_uuid(), btrim(p_title), p_meeting_type, p_adhoc_subtype, p_meeting_date,
+      COALESCE(p_attendees, '[]'::jsonb), p_visibility, p_record_body,
+      p_transcript, p_record_source, p_target_domain,
+      'completed', '{}'::jsonb, now(), now()
+    ) RETURNING meetings.meeting_id INTO v_meeting_id;
+  END IF;
+
+  v_sub_key := to_char(p_meeting_date, 'YYYY-MM-DD') || '-' || left(v_norm, 60);
+
+  INSERT INTO semicolony.knowledge_base (
+    domain, key, sub_key, content, metadata, created_by, created_at, updated_at
+  ) VALUES (
+    COALESCE(p_target_domain, 'semicolon'),
+    'meeting',
+    v_sub_key,
+    p_record_body,
+    jsonb_build_object(
+      'classification', jsonb_build_object('sensitivity', v_sensitivity),
+      'meeting_id', v_meeting_id,
+      'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+      'record_source', p_record_source
+    ),
+    COALESCE(p_worker_id, 'meeting-worker'),
+    now(), now()
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE
+    SET content = EXCLUDED.content,
+        metadata = semicolony.knowledge_base.metadata || EXCLUDED.metadata,
+        updated_at = now()
+  RETURNING semicolony.knowledge_base.kb_id INTO v_kb_id;
+
+  -- Re-recording the same meeting must not duplicate its follow-ups. Existing
+  -- machine-created items for this meeting are replaced; anything a human filed
+  -- separately carries no meeting_id and is untouched.
+  IF p_action_items IS NOT NULL AND jsonb_typeof(p_action_items) = 'array'
+     AND jsonb_array_length(p_action_items) > 0 THEN
+    DELETE FROM semicolony.action_items a WHERE a.meeting_id = v_meeting_id;
+
+    INSERT INTO semicolony.action_items (
+      owner_domain, target_domain, description, assignee, deadline,
+      priority, status, source, meeting_id, created_at, updated_at
+    )
+    SELECT
+      NULLIF(btrim(item->>'owner'), ''),
+      NULLIF(btrim(item->>'target'), ''),
+      btrim(item->>'description'),
+      NULLIF(btrim(item->>'assignee'), ''),
+      NULLIF(btrim(item->>'deadline'), '')::date,
+      COALESCE(NULLIF(btrim(item->>'priority'), ''), 'normal'),
+      'open',
+      'meeting',
+      v_meeting_id,
+      now(), now()
+    FROM jsonb_array_elements(p_action_items) AS item
+    WHERE COALESCE(btrim(item->>'description'), '') <> '';
+  END IF;
+
+  RETURN QUERY
+  SELECT v_meeting_id,
+         v_kb_id,
+         COALESCE(ARRAY(SELECT a.action_item_id
+                          FROM semicolony.action_items a
+                         WHERE a.meeting_id = v_meeting_id
+                         ORDER BY a.created_at), '{}'::uuid[]),
+         (v_existing IS NOT NULL);
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+) TO sc_app;

package/migrations/200_meeting_credential_scope.sql

@@ -0,0 +1,320 @@
+-- 200_meeting_credential_scope.sql
+--
+-- Allow `meetings:write` on worker gateway credentials and grant it to the one
+-- device that runs the meeting worker.
+--
+-- The workstation records a meeting through the gateway because it holds no
+-- DATABASE_URL by policy and no GitHub credential at all. Without this scope the
+-- capability added in 199 is unreachable from the only host that needs it.
+--
+-- Rollout follows `179_worker_feedback_credential_scope.sql`: extend the scope
+-- allowlist on both governed entry points, then backfill the specific binding.
+-- Unlike 179 the backfill is deliberately narrowed to a single device — only the
+-- workstation runs the meeting worker, and no other worker should gain the
+-- ability to write a meeting record.
+--
+-- The two function bodies below are the live definitions with `meetings:write`
+-- added to the scope allowlist and nothing else changed. They were generated
+-- from pg_get_functiondef rather than retyped so the ~10KB of unrelated
+-- validation logic cannot drift. Replacing a function preserves its existing
+-- privileges, so the ACLs are intentionally left untouched.
+--
+-- Observed while writing this, not fixed here: `workspace:assets-write` is held
+-- by two live credentials but is absent from both allowlists — 192 grants it
+-- through its own dedicated function instead. That makes
+-- `amend_worker_gateway_credential_scopes` unusable on any credential holding it
+-- without silently dropping the scope. Worth closing separately; widening
+-- credential authz beyond this change's need would be the wrong place for it.
+--
+-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
+-- retargets the `semicolony.` qualifier to the active schema.
+
+CREATE OR REPLACE FUNCTION semicolony.issue_worker_gateway_credential(p_team_tenant_id uuid, p_worker_id text, p_device_id text, p_token_hash text, p_token_prefix text, p_scopes text[], p_issued_by text, p_expires_days integer, p_workspace_grants jsonb)
+ RETURNS uuid
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'pg_catalog'
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_previous_credential_id uuid;
+  v_workspace_grants jsonb := coalesce(p_workspace_grants, '[]'::jsonb);
+  v_grant jsonb;
+  v_project_id text;
+  v_capability text;
+  v_environments text[];
+  v_grant_key text;
+  v_seen_grant_keys text[] := ARRAY[]::text[];
+  v_has_credential_grant boolean := false;
+  v_has_asset_grant boolean := false;
+BEGIN
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$' THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_hash IS NULL OR p_token_hash !~ '^[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'invalid worker credential token hash' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_prefix IS NULL
+     OR p_token_prefix !~ ('^wck_' || p_worker_id || '_[A-Za-z0-9_-]{6}$') THEN
+    RAISE EXCEPTION 'invalid worker credential token prefix' USING ERRCODE = '22023';
+  END IF;
+  IF p_issued_by IS NULL OR p_issued_by <> btrim(p_issued_by)
+     OR btrim(p_issued_by) = '' OR char_length(p_issued_by) > 128
+     OR p_issued_by ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid credential issuer' USING ERRCODE = '22023';
+  END IF;
+  IF p_expires_days IS NULL OR p_expires_days < 1 OR p_expires_days > 90 THEN
+    RAISE EXCEPTION 'worker credential expiry must be between 1 and 90 days' USING ERRCODE = '22023';
+  END IF;
+  IF p_scopes IS NULL OR cardinality(p_scopes) = 0
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_scopes) AS requested(scope)
+        WHERE requested.scope IS NULL
+           OR requested.scope <> ALL (ARRAY[
+             'kb:read',
+             'feedback:write',
+             'meetings:write',
+             'skills:read',
+             'skills:write',
+             'workspace:credentials-read',
+             'workspace:assets-read',
+             'worker:release:read',
+             'worker:release:report'
+           ]::text[])
+     )
+     OR cardinality(p_scopes) <> (
+       SELECT count(DISTINCT requested.scope)::integer FROM unnest(p_scopes) AS requested(scope)
+     )
+     OR ('skills:write' = ANY(p_scopes) AND NOT ('skills:read' = ANY(p_scopes))) THEN
+    RAISE EXCEPTION 'worker credential scopes are not permitted' USING ERRCODE = '22023';
+  END IF;
+  IF jsonb_typeof(v_workspace_grants) <> 'array' THEN
+    RAISE EXCEPTION 'workspace grants must be a JSON array' USING ERRCODE = '22023';
+  END IF;
+
+  FOR v_grant IN SELECT item.value FROM jsonb_array_elements(v_workspace_grants) AS item(value) LOOP
+    IF jsonb_typeof(v_grant) <> 'object'
+       OR EXISTS (
+         SELECT 1
+           FROM jsonb_object_keys(v_grant) AS object_key(key)
+          WHERE object_key.key NOT IN ('projectId', 'capability', 'environments')
+       ) THEN
+      RAISE EXCEPTION 'invalid workspace grant shape' USING ERRCODE = '22023';
+    END IF;
+    v_project_id := v_grant ->> 'projectId';
+    v_capability := v_grant ->> 'capability';
+    IF v_project_id IS NULL OR v_project_id !~ '^[a-z][a-z0-9-]{0,99}$'
+       OR v_capability NOT IN ('credentials-read', 'assets-read')
+       OR jsonb_typeof(v_grant -> 'environments') <> 'array' THEN
+      RAISE EXCEPTION 'invalid workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_environments := ARRAY(
+      SELECT jsonb_array_elements_text(v_grant -> 'environments')
+    );
+    IF cardinality(v_environments) <> (
+      SELECT count(DISTINCT environment.value)::integer
+        FROM unnest(v_environments) AS environment(value)
+    ) OR NOT (v_environments <@ ARRAY['dev', 'e2e']::text[])
+       OR (v_capability = 'credentials-read' AND cardinality(v_environments) = 0)
+       OR (v_capability = 'assets-read' AND cardinality(v_environments) <> 0) THEN
+      RAISE EXCEPTION 'invalid workspace grant environments' USING ERRCODE = '22023';
+    END IF;
+    v_grant_key := v_project_id || ':' || v_capability;
+    IF v_grant_key = ANY(v_seen_grant_keys) THEN
+      RAISE EXCEPTION 'duplicate workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_seen_grant_keys := array_append(v_seen_grant_keys, v_grant_key);
+    v_has_credential_grant := v_has_credential_grant OR v_capability = 'credentials-read';
+    v_has_asset_grant := v_has_asset_grant OR v_capability = 'assets-read';
+  END LOOP;
+  IF v_has_credential_grant <> ('workspace:credentials-read' = ANY(p_scopes))
+     OR v_has_asset_grant <> ('workspace:assets-read' = ANY(p_scopes)) THEN
+    RAISE EXCEPTION 'workspace scopes must exactly match workspace grants' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM t.id
+    FROM public.tenants AS t
+   WHERE t.id = p_team_tenant_id
+     AND t.slug = 'team-semicolon'
+     AND t.tenant_type = 'team'
+     AND coalesce(t.metadata ->> 'status', 'active') = 'active';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active team-semicolon tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  SELECT wd.gateway_credential_id
+    INTO v_previous_credential_id
+    FROM semicolony.worker_devices AS wd
+   WHERE wd.device_id = p_device_id
+     AND wd.worker_id = p_worker_id
+     AND wd.status = 'active'
+     AND wd.kb_access_mode = 'worker-gateway'
+     AND wd.last_doctor_status = 'pass'
+     AND wd.last_seen_at >= clock_timestamp() - interval '24 hours'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active worker device binding not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO semicolony.gateway_credentials (
+    tenant_id, tenant_slug, token_hash, token_prefix, scopes, issued_by, expires_at, metadata
+  ) VALUES (
+    p_team_tenant_id,
+    'team-semicolon',
+    p_token_hash,
+    p_token_prefix,
+    p_scopes,
+    p_issued_by,
+    clock_timestamp() + make_interval(days => p_expires_days),
+    jsonb_build_object(
+      'credential_kind', 'worker',
+      'worker_id', p_worker_id,
+      'device_id', p_device_id,
+      'tenant_anchor', 'team-semicolon',
+      'lineage_status', 'active'
+    )
+  )
+  RETURNING id INTO v_credential_id;
+
+  INSERT INTO semicolony.workspace_projection_grants (
+    gateway_credential_id, project_id, capability, environments
+  )
+  SELECT
+    v_credential_id,
+    item.value ->> 'projectId',
+    item.value ->> 'capability',
+    ARRAY(SELECT jsonb_array_elements_text(item.value -> 'environments'))
+  FROM jsonb_array_elements(v_workspace_grants) AS item(value);
+
+  IF v_previous_credential_id IS NOT NULL THEN
+    UPDATE semicolony.gateway_credentials
+       SET status = 'revoked',
+           revoked_at = clock_timestamp(),
+           revoked_reason = 'worker credential rotated'
+     WHERE id = v_previous_credential_id
+       AND status = 'active';
+  END IF;
+
+  UPDATE semicolony.worker_devices
+     SET gateway_credential_id = v_credential_id
+   WHERE device_id = p_device_id
+     AND worker_id = p_worker_id;
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION semicolony.amend_worker_gateway_credential_scopes(p_credential_id uuid, p_scopes text[], p_amended_by text, p_reason text)
+ RETURNS uuid
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'pg_catalog'
+AS $function$
+DECLARE
+  v_amendment_id uuid;
+  v_previous_scopes text[];
+  v_metadata jsonb;
+  v_has_credential_grant boolean;
+  v_has_asset_grant boolean;
+BEGIN
+  IF p_credential_id IS NULL THEN
+    RAISE EXCEPTION 'credential id is required' USING ERRCODE = '22023';
+  END IF;
+  IF NULLIF(btrim(coalesce(p_amended_by, '')), '') IS NULL
+     OR NULLIF(btrim(coalesce(p_reason, '')), '') IS NULL THEN
+    RAISE EXCEPTION 'amended_by and reason are required' USING ERRCODE = '22023';
+  END IF;
+
+  -- Same scope contract as issuance. Kept literal rather than shared so a
+  -- change to one is a visible, reviewed change to the other.
+  IF p_scopes IS NULL OR cardinality(p_scopes) = 0
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_scopes) AS requested(scope)
+        WHERE requested.scope IS NULL
+           OR requested.scope <> ALL (ARRAY[
+             'kb:read',
+             'feedback:write',
+             'meetings:write',
+             'skills:read',
+             'skills:write',
+             'workspace:credentials-read',
+             'workspace:assets-read',
+             'worker:release:read',
+             'worker:release:report'
+           ]::text[])
+     )
+     OR cardinality(p_scopes) <> (
+       SELECT count(DISTINCT requested.scope)::integer FROM unnest(p_scopes) AS requested(scope)
+     )
+     OR ('skills:write' = ANY(p_scopes) AND NOT ('skills:read' = ANY(p_scopes))) THEN
+    RAISE EXCEPTION 'worker credential scopes are not permitted' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT gc.scopes, gc.metadata
+    INTO v_previous_scopes, v_metadata
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.id = p_credential_id
+     AND gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND (gc.expires_at IS NULL OR gc.expires_at > clock_timestamp())
+     AND gc.metadata ->> 'credential_kind' = 'worker'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active worker credential not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  -- Workspace scopes stay bound to real grants, exactly as at issuance.
+  SELECT
+    bool_or(wpg.capability = 'credentials-read'),
+    bool_or(wpg.capability = 'assets-read')
+    INTO v_has_credential_grant, v_has_asset_grant
+    FROM semicolony.workspace_projection_grants AS wpg
+   WHERE wpg.gateway_credential_id = p_credential_id;
+
+  IF coalesce(v_has_credential_grant, false) <> ('workspace:credentials-read' = ANY(p_scopes))
+     OR coalesce(v_has_asset_grant, false) <> ('workspace:assets-read' = ANY(p_scopes)) THEN
+    RAISE EXCEPTION 'workspace scopes must exactly match workspace grants' USING ERRCODE = '22023';
+  END IF;
+
+  INSERT INTO semicolony.gateway_credential_scope_amendments (
+    credential_id, previous_scopes, next_scopes, reason, amended_by
+  ) VALUES (
+    p_credential_id, v_previous_scopes, p_scopes, btrim(p_reason), btrim(p_amended_by)
+  )
+  RETURNING amendment_id INTO v_amendment_id;
+
+  UPDATE semicolony.gateway_credentials
+     SET scopes = p_scopes
+   WHERE id = p_credential_id;
+
+  RETURN v_amendment_id;
+END
+$function$;
+
+-- Only the workstation runs the meeting worker. Narrow on purpose: matched by
+-- device id, active worker-kind credential, not already holding the scope.
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = array_append(gc.scopes, 'meetings:write')
+ WHERE gc.status = 'active'
+   AND gc.metadata ->> 'credential_kind' = 'worker'
+   AND gc.metadata ->> 'device_id' = 'semicolony-agent'
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND NOT ('meetings:write' = ANY(gc.scopes));
+
+-- Exactly one credential may hold it. A second would mean the device filter
+-- matched something unintended, and failing here is better than discovering it
+-- when an unexpected host writes a meeting record.
+DO $do$
+DECLARE v_count int;
+BEGIN
+  SELECT count(*) INTO v_count
+    FROM semicolony.gateway_credentials
+   WHERE status = 'active' AND 'meetings:write' = ANY(scopes);
+  IF v_count <> 1 THEN
+    RAISE EXCEPTION 'expected exactly 1 credential with meetings:write, found %', v_count;
+  END IF;
+END
+$do$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.103",
+  "version": "4.18.105",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {