@team-semicolon/semicolony-cli 4.18.105 → 4.18.106

package/migrations/201_meeting_audio_data_drop.sql

@@ -0,0 +1,61 @@
+-- 201_meeting_audio_data_drop.sql
+--
+-- Drop `semo_ops.meetings.audio_data` now that the two recordings it held have
+-- been preserved outside the database.
+--
+-- 198 deliberately did not drop this column. The design called for it —
+-- recordings are restricted material and the worker deletes them once the
+-- transcript exists, so a column storing them permanently contradicts the policy
+-- it serves — but the pre-flight audit found 2 of 7 rows still holding 14 MB,
+-- and neither meeting has a Discussion, so those were the only copies in
+-- existence. 198 closed the policy hole with a NOT VALID CHECK instead and left
+-- disposal as an explicit decision.
+--
+-- That decision has now been made and executed. Both recordings were exported,
+-- their digests computed from the database bytes, transferred to the service
+-- hive, and verified byte-identical after transfer:
+--
+--   스페이스씨엘 회의  2026-03-19  b7d51487-…  7,839,157 B
+--     sha256 01520aaf2fe0f4699fa3d164bbbe87794fa45c63e891698c85230ed80374c2c2
+--   스타스팟 회의      2026-03-28  a593c934-…  6,777,382 B
+--     sha256 a6c991378a965983b6f4319b11422afbe62014881114a911a342a356b4044ab6
+--
+--   semicolony-agent:~/meeting-salvage/db-audio-rescue-20260813/ (README.md
+--   records provenance and the intended final home)
+--
+-- That location is a holding area, not the designed home. Meeting audio belongs
+-- in the team asset system as a `restricted` asset
+-- (semo-ops docs/superpowers/specs/2026-08-06-semo-ops-assets-meeting-ingest-design.md),
+-- which is blocked until the gateway implements the restricted tier. Dropping
+-- the column does not depend on that work and should not wait for it: the bytes
+-- are safe, and leaving a permanent audio column in the schema keeps the
+-- contradiction alive.
+--
+-- Dropping the column also drops `meetings_audio_data_not_stored`, the CHECK
+-- that 198 added to guard it. That is correct — a column that does not exist
+-- cannot store audio.
+--
+-- Safety: refuse to run unless the rescue actually happened, expressed as the
+-- exact two rows and byte counts that were exported. If the table has changed
+-- since, this stops rather than destroying something unaccounted for.
+--
+-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
+-- retargets the `semicolony.` qualifier to the active schema.
+
+DO $$
+DECLARE
+  v_rows int;
+  v_bytes bigint;
+BEGIN
+  SELECT count(audio_data), coalesce(sum(length(audio_data)), 0)
+    INTO v_rows, v_bytes
+    FROM semicolony.meetings;
+
+  IF v_rows <> 2 OR v_bytes <> 14616539 THEN
+    RAISE EXCEPTION
+      'refusing to drop audio_data: expected the 2 rescued rows totalling 14616539 bytes, found % row(s) totalling % bytes',
+      v_rows, v_bytes;
+  END IF;
+END $$;
+
+ALTER TABLE semicolony.meetings DROP COLUMN IF EXISTS audio_data;

package/migrations/202_meeting_record_discussion_provenance.sql

@@ -0,0 +1,173 @@
+-- 202_meeting_record_discussion_provenance.sql
+--
+-- Let `record_meeting` persist where a record came from.
+--
+-- 198 kept `discussion_url` and `discussion_number` precisely so a migrated
+-- record could point back at the Discussion it was built from, but 199 had no
+-- way to set them. Phase 2 backfills 205 Meeting-Minutes Discussions and needs
+-- that link — without it a migrated record cannot be checked against its source.
+--
+-- Both parameters default to NULL, so every existing caller (the gateway route,
+-- the CLI, the skills) keeps working unchanged.
+--
+-- The 13-argument signature is dropped first. Adding defaulted parameters
+-- creates an overload rather than replacing, and two overloads would make every
+-- existing call ambiguous.
+--
+-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
+-- retargets the `semicolony.` qualifier to the active schema.
+
+DROP FUNCTION IF EXISTS semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+);
+
+CREATE OR REPLACE FUNCTION semicolony.record_meeting(
+  p_title text,
+  p_meeting_date date,
+  p_meeting_type text,
+  p_adhoc_subtype text,
+  p_visibility text,
+  p_target_domain text,
+  p_attendees jsonb,
+  p_record_body text,
+  p_transcript text,
+  p_action_items jsonb,
+  p_record_source text,
+  p_worker_id text,
+  p_device_id text,
+  p_discussion_url text DEFAULT NULL,
+  p_discussion_number integer DEFAULT NULL
+)
+RETURNS TABLE(meeting_id uuid, kb_id bigint, action_item_ids uuid[], duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_meeting_id uuid;
+  v_kb_id bigint;
+  v_existing uuid;
+  v_norm text;
+  v_sensitivity text;
+  v_sub_key text;
+BEGIN
+  IF p_title IS NULL OR length(btrim(p_title)) < 3 THEN
+    RAISE EXCEPTION 'title must be at least 3 characters';
+  END IF;
+  IF p_meeting_date IS NULL THEN
+    RAISE EXCEPTION 'meeting_date is required';
+  END IF;
+  IF p_visibility IS NULL OR p_visibility NOT IN ('team', 'restricted') THEN
+    RAISE EXCEPTION 'visibility must be team or restricted, got %', p_visibility;
+  END IF;
+  IF p_record_source IS NULL
+     OR p_record_source NOT IN ('slack-worker', 'operator', 'backfill-discussion') THEN
+    RAISE EXCEPTION 'invalid record_source %', p_record_source;
+  END IF;
+  IF p_record_body IS NULL OR length(btrim(p_record_body)) = 0 THEN
+    RAISE EXCEPTION 'record_body is required';
+  END IF;
+
+  v_norm := lower(regexp_replace(btrim(p_title), '\s+', ' ', 'g'));
+  v_sensitivity := CASE WHEN p_visibility = 'restricted' THEN 'restricted' ELSE 'internal' END;
+
+  SELECT m.meeting_id INTO v_existing
+    FROM semicolony.meetings m
+   WHERE m.meeting_date = p_meeting_date
+     AND lower(regexp_replace(m.title, '\s+', ' ', 'g')) = v_norm;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE semicolony.meetings m
+       SET record_body = COALESCE(p_record_body, m.record_body),
+           mapped_transcript = COALESCE(p_transcript, m.mapped_transcript),
+           visibility = p_visibility,
+           record_source = p_record_source,
+           target_domain = COALESCE(p_target_domain, m.target_domain),
+           attendees = COALESCE(p_attendees, m.attendees),
+           discussion_url = COALESCE(p_discussion_url, m.discussion_url),
+           discussion_number = COALESCE(p_discussion_number, m.discussion_number),
+           updated_at = now()
+     WHERE m.meeting_id = v_existing;
+    v_meeting_id := v_existing;
+  ELSE
+    INSERT INTO semicolony.meetings (
+      meeting_id, title, meeting_type, adhoc_subtype, meeting_date, attendees,
+      visibility, record_body, mapped_transcript, record_source, target_domain,
+      transcription_status, speaker_map, discussion_url, discussion_number,
+      created_at, updated_at
+    ) VALUES (
+      gen_random_uuid(), btrim(p_title), p_meeting_type, p_adhoc_subtype, p_meeting_date,
+      COALESCE(p_attendees, '[]'::jsonb), p_visibility, p_record_body,
+      p_transcript, p_record_source, p_target_domain,
+      'completed', '{}'::jsonb, p_discussion_url, p_discussion_number, now(), now()
+    ) RETURNING meetings.meeting_id INTO v_meeting_id;
+  END IF;
+
+  v_sub_key := to_char(p_meeting_date, 'YYYY-MM-DD') || '-' || left(v_norm, 60);
+
+  INSERT INTO semicolony.knowledge_base (
+    domain, key, sub_key, content, metadata, created_by, created_at, updated_at
+  ) VALUES (
+    COALESCE(p_target_domain, 'semicolon'),
+    'meeting',
+    v_sub_key,
+    p_record_body,
+    jsonb_build_object(
+      'classification', jsonb_build_object('sensitivity', v_sensitivity),
+      'meeting_id', v_meeting_id,
+      'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+      'record_source', p_record_source
+    ),
+    COALESCE(p_worker_id, 'meeting-worker'),
+    now(), now()
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE
+    SET content = EXCLUDED.content,
+        metadata = semicolony.knowledge_base.metadata || EXCLUDED.metadata,
+        updated_at = now()
+  RETURNING semicolony.knowledge_base.kb_id INTO v_kb_id;
+
+  -- Re-recording the same meeting must not duplicate its follow-ups. Existing
+  -- machine-created items for this meeting are replaced; anything a human filed
+  -- separately carries no meeting_id and is untouched.
+  IF p_action_items IS NOT NULL AND jsonb_typeof(p_action_items) = 'array'
+     AND jsonb_array_length(p_action_items) > 0 THEN
+    DELETE FROM semicolony.action_items a WHERE a.meeting_id = v_meeting_id;
+
+    INSERT INTO semicolony.action_items (
+      owner_domain, target_domain, description, assignee, deadline,
+      priority, status, source, meeting_id, created_at, updated_at
+    )
+    SELECT
+      NULLIF(btrim(item->>'owner'), ''),
+      NULLIF(btrim(item->>'target'), ''),
+      btrim(item->>'description'),
+      NULLIF(btrim(item->>'assignee'), ''),
+      NULLIF(btrim(item->>'deadline'), '')::date,
+      COALESCE(NULLIF(btrim(item->>'priority'), ''), 'normal'),
+      'open',
+      'meeting',
+      v_meeting_id,
+      now(), now()
+    FROM jsonb_array_elements(p_action_items) AS item
+    WHERE COALESCE(btrim(item->>'description'), '') <> '';
+  END IF;
+
+  RETURN QUERY
+  SELECT v_meeting_id,
+         v_kb_id,
+         COALESCE(ARRAY(SELECT a.action_item_id
+                          FROM semicolony.action_items a
+                         WHERE a.meeting_id = v_meeting_id
+                         ORDER BY a.created_at), '{}'::uuid[]),
+         (v_existing IS NOT NULL);
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text, text, integer
+) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text, text, integer
+) TO sc_app;

package/migrations/202_team_members_record_of_authority.sql

@@ -0,0 +1,103 @@
+-- 202_team_members_record_of_authority.sql
+--
+-- Before this migration the only test for "is this person a team member" was
+-- the string 'team' inside ontology.tags (14 of 41 person rows, measured
+-- 2026-08-12). People, agents, and worker devices lived in three tables with
+-- no foreign key between them: ontology (person 41 / agents 13), bot_status
+-- (41), and worker_devices.worker_id. reus/roki/jay matched an ontology domain
+-- by slug coincidence, not by constraint.
+--
+-- This migration is additive. No existing writer changes behavior. The
+-- action_items cutover is migration 199.
+
+CREATE TABLE IF NOT EXISTS semicolony.team_members (
+  member_id       uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  domain          varchar(100) NOT NULL UNIQUE REFERENCES semicolony.ontology(domain),
+  display_name    text NOT NULL,
+  handle          text,
+  role            text,
+  status          text NOT NULL DEFAULT 'active'
+                    CHECK (status IN ('active', 'inactive', 'left')),
+  joined_at       date,
+  left_at         date,
+  slack_user_id   text,
+  gitlab_username text,
+  github_login    text,
+  auth_user_id    uuid,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT team_members_left_requires_date
+    CHECK (status <> 'left' OR left_at IS NOT NULL)
+);
+
+COMMENT ON TABLE semicolony.team_members IS
+  'Record of authority for Semicolon team people. Referenced externally by domain.';
+
+-- Seed from the tag convention this table replaces, UNION the owner of every
+-- registered human worker device. The tag alone is not sufficient: measured
+-- 2026-08-12, jay owns jay-pc but carries tags={person}, so a tag-only seed
+-- would leave jay-pc.member_id NULL and every feedback capture from that
+-- device would fail resolving its origin member.
+-- display_name falls back to o.domain when description is NULL, empty, or
+-- has no ' — ' separator. Measured 2026-08-12: 15 eligible rows, 0 NULL/empty,
+-- 0 missing the separator, so split_part(...,1) alone works today -- but
+-- ontology.description is nullable and a snapshot is not a guarantee. A
+-- coordinated maintenance window (this migration runs inside one) is
+-- exactly where an unguarded NULL turning into a NOT NULL-violating INSERT
+-- would abort loudest.
+INSERT INTO semicolony.team_members (domain, display_name, role)
+SELECT o.domain,
+       coalesce(nullif(btrim(split_part(o.description, ' — ', 1)), ''), o.domain),
+       nullif(split_part(o.description, ' — ', 2), '')
+  FROM semicolony.ontology o
+ WHERE o.entity_type = 'person'
+   AND (
+     'team' = ANY(tags)
+     OR o.domain IN (
+       SELECT wd.worker_id
+         FROM semicolony.worker_devices wd
+        WHERE wd.installation_kind = 'human-device'
+     )
+   )
+ON CONFLICT (domain) DO NOTHING;
+
+-- Fail loudly rather than silently leaving a worker unbound.
+DO $$
+DECLARE
+  v_missing text;
+BEGIN
+  SELECT string_agg(DISTINCT wd.worker_id, ', ')
+    INTO v_missing
+    FROM semicolony.worker_devices wd
+   WHERE wd.installation_kind = 'human-device'
+     AND NOT EXISTS (
+       SELECT 1 FROM semicolony.team_members tm WHERE tm.domain = wd.worker_id
+     );
+  IF v_missing IS NOT NULL THEN
+    RAISE EXCEPTION
+      'human worker owners have no ontology person row: %. Add them to ontology before applying.',
+      v_missing USING ERRCODE = '22023';
+  END IF;
+END
+$$;
+
+ALTER TABLE semicolony.worker_devices
+  ADD COLUMN IF NOT EXISTS member_id uuid REFERENCES semicolony.team_members(member_id);
+
+-- Bind each human device to its person. worker_id is the human identity;
+-- device_id is the machine. agent-runtime installations keep member_id NULL.
+UPDATE semicolony.worker_devices wd
+   SET member_id = tm.member_id
+  FROM semicolony.team_members tm
+ WHERE tm.domain = wd.worker_id
+   AND wd.installation_kind = 'human-device'
+   AND wd.member_id IS DISTINCT FROM tm.member_id;
+
+ALTER TABLE semicolony.worker_devices
+  ADD CONSTRAINT worker_devices_device_member_uk
+  UNIQUE (device_id, member_id);
+
+-- Required target key for the action_items project FK in migration 199.
+ALTER TABLE semicolony.ontology
+  ADD CONSTRAINT ontology_domain_entity_uk
+  UNIQUE (domain, entity_type);