@team-semicolon/semicolony-cli 4.18.104 → 4.18.106

package/migrations/205_action_item_credential_scope.sql

@@ -0,0 +1,318 @@
+-- 205_action_item_credential_scope.sql
+--
+-- Open the /action/* Gateway lane to the credentials that have to reach it.
+--
+-- Plan 2 tasks 1 and 2 built ActionService and the five /action routes. Every
+-- one of them gates on `action:read` or `action:write` and accepts either a
+-- `worker` credential (the human lane) or a `worker-agent-actor` credential
+-- (the agent lane, semi and colony). No credential in the fleet holds either
+-- scope, so the whole lane answers 403 today. This migration issues the two
+-- scopes and moves both scope contracts that would otherwise refuse them.
+--
+-- Measured live state before this migration (2026-08-13, from the production
+-- schema dump plus the operator's credential read). The two scopes below are
+-- what this file adds; nothing else may change:
+--
+--   metadata->>'device_id'  scopes (count)
+--   ----------------------  -------------------------------------------------
+--   reus-macmini            kb:read, feedback:write, skills:read, skills:write,
+--                           worker:release:read, worker:release:report,
+--                           workspace:assets-read, workspace:assets-write   (8)
+--   semicolony-agent        the same eight plus meetings:write               (9)
+--   roki-pc                 kb:read, skills:read, skills:write,
+--                           worker:release:read, worker:release:report       (5)
+--   jay-pc                  kb:read, skills:read, skills:write               (3)
+--
+--   worker-agent-actor semi and colony
+--                           kb:read, feedback:write, decision:write,
+--                           note:write                                       (4)
+--
+-- The worker amendment is therefore additive per credential and never a
+-- wholesale array write. reus-macmini is the only holder of
+-- `workspace:assets-write` and semicolony-agent the only holder of
+-- `meetings:write`; a replacement array sized to the plan's own list would
+-- drop one of those silently, and neither is recoverable from this file.
+--
+-- The two device-bound credentials that must NOT be reached: the
+-- `worker-agent-host` credential (release-only, two scopes, no device_id in
+-- its metadata) and any revoked or expired row. Both are excluded by
+-- predicate, and section 5 asserts it rather than assuming it.
+--
+-- Deploy order. The Gateway must ship before this migration is applied:
+-- `tenant-credentials.ts` gates the actor scope array order-exactly, and
+-- section 4 rewrites that array. The Gateway build that accompanies this
+-- migration accepts the 186 (3-scope), 194 (4-scope) and 205 (6-scope)
+-- contracts, so Gateway-then-migration is safe in either direction and
+-- migration-then-Gateway locks both actors out of every lane they own.
+--
+-- The migration runner owns BEGIN/COMMIT and retargets the `semicolony.`
+-- qualifier to the active schema.
+
+-- ---------------------------------------------------------------------------
+-- 1. Let the two governed worker-credential entry points express the new
+--    scopes.
+--
+--    `issue_worker_gateway_credential` (rotation) and
+--    `amend_worker_gateway_credential_scopes` (in-place amendment) each carry
+--    an identical literal scope allowlist and reject anything outside it.
+--    Backfilling section 2 without widening them would mean the next rotation
+--    of any of the four devices -- worker credentials expire within 90 days by
+--    construction -- either fails outright or silently drops the two scopes.
+--    200_meeting_credential_scope.sql widened both entry points for
+--    `meetings:write` for exactly this reason; skipping it here would repeat
+--    the `workspace:assets-write` drift that 200's header documents.
+--
+--    The widening rewrites only the allowlist inside the installed definition
+--    (the 187/194 pattern). Copying the ~10KB bodies would silently revert any
+--    correction they have received since the dump was taken.
+-- ---------------------------------------------------------------------------
+
+DO $worker_scope_allowlist$
+DECLARE
+  v_targets constant text[] := ARRAY[
+    'semicolony.issue_worker_gateway_credential(uuid,text,text,text,text,text[],text,integer,jsonb)',
+    'semicolony.amend_worker_gateway_credential_scopes(uuid,text[],text,text)'
+  ];
+  -- The last element of the allowlist plus its closing bracket. Anchoring on
+  -- the closing bracket is what makes this unambiguous: 'worker:release:report'
+  -- also appears in other functions, but only here immediately before `]`.
+  v_old constant text := E'             ''worker:release:report''\n           ]::text[])';
+  v_new constant text := E'             ''worker:release:report'',\n'
+                      || E'             ''action:read'',\n'
+                      || E'             ''action:write''\n'
+                      || E'           ]::text[])';
+  v_target text;
+  v_definition text;
+  v_old_occurrences integer;
+BEGIN
+  FOREACH v_target IN ARRAY v_targets LOOP
+    SELECT pg_get_functiondef(v_target::regprocedure::oid) INTO STRICT v_definition;
+
+    v_old_occurrences :=
+      (char_length(v_definition) - char_length(replace(v_definition, v_old, '')))
+      / char_length(v_old);
+
+    -- Already widened: re-running must be a no-op, not an exception.
+    IF v_old_occurrences = 0 AND position(v_new IN v_definition) > 0 THEN
+      CONTINUE;
+    END IF;
+    IF v_old_occurrences <> 1 THEN
+      RAISE EXCEPTION 'unexpected worker credential scope allowlist in %', v_target;
+    END IF;
+
+    EXECUTE replace(v_definition, v_old, v_new);
+  END LOOP;
+END;
+$worker_scope_allowlist$;
+
+-- ---------------------------------------------------------------------------
+-- 2. Grant the two scopes to the device-bound worker credentials.
+--
+--    Keyed on `metadata->>'device_id'` being present, so the actor and host
+--    credentials -- which carry `installation_id` instead -- cannot be reached
+--    from here. Each scope is appended only where it is absent, so a re-run
+--    changes nothing and no existing scope is rewritten.
+-- ---------------------------------------------------------------------------
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = gc.scopes
+       || CASE WHEN 'action:read' = ANY(gc.scopes)
+               THEN ARRAY[]::text[] ELSE ARRAY['action:read']::text[] END
+       || CASE WHEN 'action:write' = ANY(gc.scopes)
+               THEN ARRAY[]::text[] ELSE ARRAY['action:write']::text[] END
+ WHERE gc.status = 'active'
+   AND gc.revoked_at IS NULL
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker'
+   AND gc.metadata ->> 'device_id' IS NOT NULL
+   AND NOT (gc.scopes @> ARRAY['action:read', 'action:write']::text[]);
+
+-- ---------------------------------------------------------------------------
+-- 3. Widen the actor scope contract from four scopes to six.
+--
+--    The worker contract for action items was decided as human AND agent, so
+--    semi and colony must be able to read, create and close their own items.
+--    They cannot today: the actor scope array is compared by exact equality at
+--    three sites, and a credential carrying anything else is refused.
+--
+--    All three sites, measured against the live schema (2026-08-13):
+--      * issue_worker_agent_actor_credential -- the array written at issuance
+--      * record_worker_agent_decision        -- `gc.scopes = ARRAY[...]`
+--      * record_worker_agent_note            -- `gc.scopes = ARRAY[...]`
+--    Missing any one of them does not fail loudly; it silently refuses the
+--    credential the next time that lane is used. 194 moved the first two when
+--    it added `note:write` and installed the third.
+--
+--    Order. The array is order-exact, so the two scopes are APPENDED, in
+--    migration order (186 -> 194 -> 205) and read-before-write. Appending is
+--    the only change that cannot reinterpret an existing index, which is what
+--    lets the Gateway keep accepting the older contracts by length. The same
+--    order is mirrored in `tenant-credentials.ts`.
+-- ---------------------------------------------------------------------------
+
+DO $actor_scope_widen$
+DECLARE
+  v_targets constant text[] := ARRAY[
+    'semicolony.issue_worker_agent_actor_credential(uuid,text,text,text,text,integer)',
+    'semicolony.record_worker_agent_decision(uuid,uuid,text,text,text,text)',
+    'semicolony.record_worker_agent_note(uuid,text,text,text,text)'
+  ];
+  v_old constant text :=
+    'ARRAY[''kb:read'', ''feedback:write'', ''decision:write'', ''note:write'']::text[]';
+  v_new constant text :=
+    'ARRAY[''kb:read'', ''feedback:write'', ''decision:write'', ''note:write'', '
+    || '''action:read'', ''action:write'']::text[]';
+  v_target text;
+  v_definition text;
+  v_old_occurrences integer;
+BEGIN
+  FOREACH v_target IN ARRAY v_targets LOOP
+    SELECT pg_get_functiondef(v_target::regprocedure::oid) INTO STRICT v_definition;
+
+    v_old_occurrences :=
+      (char_length(v_definition) - char_length(replace(v_definition, v_old, '')))
+      / char_length(v_old);
+
+    IF v_old_occurrences = 0 AND position(v_new IN v_definition) > 0 THEN
+      CONTINUE;
+    END IF;
+    IF v_old_occurrences <> 1 THEN
+      RAISE EXCEPTION 'unexpected Worker-agent actor scope definition in %', v_target;
+    END IF;
+
+    EXECUTE replace(v_definition, v_old, v_new);
+  END LOOP;
+END;
+$actor_scope_widen$;
+
+-- ---------------------------------------------------------------------------
+-- 4. Move the two live actor credentials onto the widened contract.
+--
+--    Unlike section 2 this is a whole-array write, and it has to be: the three
+--    sites above compare by equality, so the stored array must be exactly the
+--    contract. It is safe here for the same reason -- the actor array is
+--    closed and fully determined -- and unsafe for the worker credentials in
+--    section 2, whose arrays differ per device. The join reproduces 194's
+--    binding predicate so nothing outside the two bound actors is reachable.
+-- ---------------------------------------------------------------------------
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = ARRAY[
+         'kb:read', 'feedback:write', 'decision:write', 'note:write',
+         'action:read', 'action:write'
+       ]::text[]
+  FROM semicolony.worker_agent_actor_bindings AS binding
+ WHERE binding.gateway_credential_id = gc.id
+   AND binding.installation_id = 'hermes-principals@hermes'
+   AND binding.profile_id = 'semo-ops-worker-agent'
+   AND binding.runtime_kind = 'hermes-cli'
+   AND binding.actor_id IN ('semi', 'colony')
+   AND binding.status = 'active'
+   AND gc.status = 'active'
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker-agent-actor'
+   AND gc.metadata ->> 'actor_id' = binding.actor_id
+   AND gc.metadata ->> 'installation_id' = binding.installation_id
+   AND gc.metadata ->> 'profile_id' = binding.profile_id
+   AND gc.metadata ->> 'runtime_kind' = binding.runtime_kind
+   AND gc.metadata ->> 'runtime_profile' = binding.runtime_profile
+   AND gc.scopes
+       IS DISTINCT FROM
+       ARRAY[
+         'kb:read', 'feedback:write', 'decision:write', 'note:write',
+         'action:read', 'action:write'
+       ]::text[];
+
+-- ---------------------------------------------------------------------------
+-- 5. Assert the reach, in both directions.
+--
+--    Under-reach (the device filter matched nothing) and over-reach (the
+--    release-only host credential picked up write authority) both fail loudly
+--    here rather than being discovered from a 403 or from an unexpected host
+--    writing an action item.
+-- ---------------------------------------------------------------------------
+
+DO $verify_action_scopes$
+DECLARE
+  v_worker_with integer;
+  v_worker_without integer;
+  v_actor_stale integer;
+  v_stray integer;
+  v_duplicated integer;
+BEGIN
+  SELECT
+      count(*) FILTER (
+        WHERE gc.scopes @> ARRAY['action:read', 'action:write']::text[]
+      ),
+      count(*) FILTER (
+        WHERE NOT (gc.scopes @> ARRAY['action:read', 'action:write']::text[])
+      )
+    INTO v_worker_with, v_worker_without
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+     AND gc.metadata ->> 'credential_kind' = 'worker'
+     AND gc.metadata ->> 'device_id' IS NOT NULL;
+
+  IF v_worker_without <> 0 THEN
+    RAISE EXCEPTION
+      'expected every active device-bound worker credential to hold the action scopes, % still do not',
+      v_worker_without;
+  END IF;
+  -- Four devices were measured. More is fine (a device onboarded since the
+  -- measurement is covered by the same predicate); fewer means the filter
+  -- matched something other than the fleet.
+  IF v_worker_with < 4 THEN
+    RAISE EXCEPTION
+      'expected at least the 4 measured device-bound worker credentials, found %',
+      v_worker_with;
+  END IF;
+
+  SELECT count(*)
+    INTO v_actor_stale
+    FROM semicolony.gateway_credentials AS gc
+    JOIN semicolony.worker_agent_actor_bindings AS binding
+      ON binding.gateway_credential_id = gc.id
+     AND binding.status = 'active'
+   WHERE gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+     AND gc.metadata ->> 'credential_kind' = 'worker-agent-actor'
+     AND gc.scopes IS DISTINCT FROM ARRAY[
+           'kb:read', 'feedback:write', 'decision:write', 'note:write',
+           'action:read', 'action:write'
+         ]::text[];
+  IF v_actor_stale <> 0 THEN
+    RAISE EXCEPTION
+      '% active actor credential(s) left on the old contract; section 3 has made them unusable',
+      v_actor_stale;
+  END IF;
+
+  SELECT count(*)
+    INTO v_stray
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.scopes && ARRAY['action:read', 'action:write']::text[]
+     AND gc.metadata ->> 'credential_kind' <> 'worker-agent-actor'
+     AND NOT (
+       gc.metadata ->> 'credential_kind' = 'worker'
+       AND gc.metadata ->> 'device_id' IS NOT NULL
+     );
+  IF v_stray <> 0 THEN
+    RAISE EXCEPTION 'action scopes reached % unintended credential(s)', v_stray;
+  END IF;
+
+  -- Scoped to what this file writes. A legacy duplicate elsewhere is not this
+  -- migration's to fail on, but a duplicate here means the append ran twice.
+  SELECT count(*)
+    INTO v_duplicated
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.scopes && ARRAY['action:read', 'action:write']::text[]
+     AND cardinality(gc.scopes) <> (
+           SELECT count(DISTINCT scope)::integer FROM unnest(gc.scopes) AS s(scope)
+         );
+  IF v_duplicated <> 0 THEN
+    RAISE EXCEPTION '% credential(s) carry a duplicated scope', v_duplicated;
+  END IF;
+END;
+$verify_action_scopes$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.104",
+  "version": "4.18.106",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {