@team-semicolon/semicolony-cli 4.18.105 → 4.18.107

package/migrations/205_action_item_credential_scope.sql

@@ -0,0 +1,318 @@
+-- 205_action_item_credential_scope.sql
+--
+-- Open the /action/* Gateway lane to the credentials that have to reach it.
+--
+-- Plan 2 tasks 1 and 2 built ActionService and the five /action routes. Every
+-- one of them gates on `action:read` or `action:write` and accepts either a
+-- `worker` credential (the human lane) or a `worker-agent-actor` credential
+-- (the agent lane, semi and colony). No credential in the fleet holds either
+-- scope, so the whole lane answers 403 today. This migration issues the two
+-- scopes and moves both scope contracts that would otherwise refuse them.
+--
+-- Measured live state before this migration (2026-08-13, from the production
+-- schema dump plus the operator's credential read). The two scopes below are
+-- what this file adds; nothing else may change:
+--
+--   metadata->>'device_id'  scopes (count)
+--   ----------------------  -------------------------------------------------
+--   reus-macmini            kb:read, feedback:write, skills:read, skills:write,
+--                           worker:release:read, worker:release:report,
+--                           workspace:assets-read, workspace:assets-write   (8)
+--   semicolony-agent        the same eight plus meetings:write               (9)
+--   roki-pc                 kb:read, skills:read, skills:write,
+--                           worker:release:read, worker:release:report       (5)
+--   jay-pc                  kb:read, skills:read, skills:write               (3)
+--
+--   worker-agent-actor semi and colony
+--                           kb:read, feedback:write, decision:write,
+--                           note:write                                       (4)
+--
+-- The worker amendment is therefore additive per credential and never a
+-- wholesale array write. reus-macmini is the only holder of
+-- `workspace:assets-write` and semicolony-agent the only holder of
+-- `meetings:write`; a replacement array sized to the plan's own list would
+-- drop one of those silently, and neither is recoverable from this file.
+--
+-- The two device-bound credentials that must NOT be reached: the
+-- `worker-agent-host` credential (release-only, two scopes, no device_id in
+-- its metadata) and any revoked or expired row. Both are excluded by
+-- predicate, and section 5 asserts it rather than assuming it.
+--
+-- Deploy order. The Gateway must ship before this migration is applied:
+-- `tenant-credentials.ts` gates the actor scope array order-exactly, and
+-- section 4 rewrites that array. The Gateway build that accompanies this
+-- migration accepts the 186 (3-scope), 194 (4-scope) and 205 (6-scope)
+-- contracts, so Gateway-then-migration is safe in either direction and
+-- migration-then-Gateway locks both actors out of every lane they own.
+--
+-- The migration runner owns BEGIN/COMMIT and retargets the `semicolony.`
+-- qualifier to the active schema.
+
+-- ---------------------------------------------------------------------------
+-- 1. Let the two governed worker-credential entry points express the new
+--    scopes.
+--
+--    `issue_worker_gateway_credential` (rotation) and
+--    `amend_worker_gateway_credential_scopes` (in-place amendment) each carry
+--    an identical literal scope allowlist and reject anything outside it.
+--    Backfilling section 2 without widening them would mean the next rotation
+--    of any of the four devices -- worker credentials expire within 90 days by
+--    construction -- either fails outright or silently drops the two scopes.
+--    200_meeting_credential_scope.sql widened both entry points for
+--    `meetings:write` for exactly this reason; skipping it here would repeat
+--    the `workspace:assets-write` drift that 200's header documents.
+--
+--    The widening rewrites only the allowlist inside the installed definition
+--    (the 187/194 pattern). Copying the ~10KB bodies would silently revert any
+--    correction they have received since the dump was taken.
+-- ---------------------------------------------------------------------------
+
+DO $worker_scope_allowlist$
+DECLARE
+  v_targets constant text[] := ARRAY[
+    'semicolony.issue_worker_gateway_credential(uuid,text,text,text,text,text[],text,integer,jsonb)',
+    'semicolony.amend_worker_gateway_credential_scopes(uuid,text[],text,text)'
+  ];
+  -- The last element of the allowlist plus its closing bracket. Anchoring on
+  -- the closing bracket is what makes this unambiguous: 'worker:release:report'
+  -- also appears in other functions, but only here immediately before `]`.
+  v_old constant text := E'             ''worker:release:report''\n           ]::text[])';
+  v_new constant text := E'             ''worker:release:report'',\n'
+                      || E'             ''action:read'',\n'
+                      || E'             ''action:write''\n'
+                      || E'           ]::text[])';
+  v_target text;
+  v_definition text;
+  v_old_occurrences integer;
+BEGIN
+  FOREACH v_target IN ARRAY v_targets LOOP
+    SELECT pg_get_functiondef(v_target::regprocedure::oid) INTO STRICT v_definition;
+
+    v_old_occurrences :=
+      (char_length(v_definition) - char_length(replace(v_definition, v_old, '')))
+      / char_length(v_old);
+
+    -- Already widened: re-running must be a no-op, not an exception.
+    IF v_old_occurrences = 0 AND position(v_new IN v_definition) > 0 THEN
+      CONTINUE;
+    END IF;
+    IF v_old_occurrences <> 1 THEN
+      RAISE EXCEPTION 'unexpected worker credential scope allowlist in %', v_target;
+    END IF;
+
+    EXECUTE replace(v_definition, v_old, v_new);
+  END LOOP;
+END;
+$worker_scope_allowlist$;
+
+-- ---------------------------------------------------------------------------
+-- 2. Grant the two scopes to the device-bound worker credentials.
+--
+--    Keyed on `metadata->>'device_id'` being present, so the actor and host
+--    credentials -- which carry `installation_id` instead -- cannot be reached
+--    from here. Each scope is appended only where it is absent, so a re-run
+--    changes nothing and no existing scope is rewritten.
+-- ---------------------------------------------------------------------------
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = gc.scopes
+       || CASE WHEN 'action:read' = ANY(gc.scopes)
+               THEN ARRAY[]::text[] ELSE ARRAY['action:read']::text[] END
+       || CASE WHEN 'action:write' = ANY(gc.scopes)
+               THEN ARRAY[]::text[] ELSE ARRAY['action:write']::text[] END
+ WHERE gc.status = 'active'
+   AND gc.revoked_at IS NULL
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker'
+   AND gc.metadata ->> 'device_id' IS NOT NULL
+   AND NOT (gc.scopes @> ARRAY['action:read', 'action:write']::text[]);
+
+-- ---------------------------------------------------------------------------
+-- 3. Widen the actor scope contract from four scopes to six.
+--
+--    The worker contract for action items was decided as human AND agent, so
+--    semi and colony must be able to read, create and close their own items.
+--    They cannot today: the actor scope array is compared by exact equality at
+--    three sites, and a credential carrying anything else is refused.
+--
+--    All three sites, measured against the live schema (2026-08-13):
+--      * issue_worker_agent_actor_credential -- the array written at issuance
+--      * record_worker_agent_decision        -- `gc.scopes = ARRAY[...]`
+--      * record_worker_agent_note            -- `gc.scopes = ARRAY[...]`
+--    Missing any one of them does not fail loudly; it silently refuses the
+--    credential the next time that lane is used. 194 moved the first two when
+--    it added `note:write` and installed the third.
+--
+--    Order. The array is order-exact, so the two scopes are APPENDED, in
+--    migration order (186 -> 194 -> 205) and read-before-write. Appending is
+--    the only change that cannot reinterpret an existing index, which is what
+--    lets the Gateway keep accepting the older contracts by length. The same
+--    order is mirrored in `tenant-credentials.ts`.
+-- ---------------------------------------------------------------------------
+
+DO $actor_scope_widen$
+DECLARE
+  v_targets constant text[] := ARRAY[
+    'semicolony.issue_worker_agent_actor_credential(uuid,text,text,text,text,integer)',
+    'semicolony.record_worker_agent_decision(uuid,uuid,text,text,text,text)',
+    'semicolony.record_worker_agent_note(uuid,text,text,text,text)'
+  ];
+  v_old constant text :=
+    'ARRAY[''kb:read'', ''feedback:write'', ''decision:write'', ''note:write'']::text[]';
+  v_new constant text :=
+    'ARRAY[''kb:read'', ''feedback:write'', ''decision:write'', ''note:write'', '
+    || '''action:read'', ''action:write'']::text[]';
+  v_target text;
+  v_definition text;
+  v_old_occurrences integer;
+BEGIN
+  FOREACH v_target IN ARRAY v_targets LOOP
+    SELECT pg_get_functiondef(v_target::regprocedure::oid) INTO STRICT v_definition;
+
+    v_old_occurrences :=
+      (char_length(v_definition) - char_length(replace(v_definition, v_old, '')))
+      / char_length(v_old);
+
+    IF v_old_occurrences = 0 AND position(v_new IN v_definition) > 0 THEN
+      CONTINUE;
+    END IF;
+    IF v_old_occurrences <> 1 THEN
+      RAISE EXCEPTION 'unexpected Worker-agent actor scope definition in %', v_target;
+    END IF;
+
+    EXECUTE replace(v_definition, v_old, v_new);
+  END LOOP;
+END;
+$actor_scope_widen$;
+
+-- ---------------------------------------------------------------------------
+-- 4. Move the two live actor credentials onto the widened contract.
+--
+--    Unlike section 2 this is a whole-array write, and it has to be: the three
+--    sites above compare by equality, so the stored array must be exactly the
+--    contract. It is safe here for the same reason -- the actor array is
+--    closed and fully determined -- and unsafe for the worker credentials in
+--    section 2, whose arrays differ per device. The join reproduces 194's
+--    binding predicate so nothing outside the two bound actors is reachable.
+-- ---------------------------------------------------------------------------
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = ARRAY[
+         'kb:read', 'feedback:write', 'decision:write', 'note:write',
+         'action:read', 'action:write'
+       ]::text[]
+  FROM semicolony.worker_agent_actor_bindings AS binding
+ WHERE binding.gateway_credential_id = gc.id
+   AND binding.installation_id = 'hermes-principals@hermes'
+   AND binding.profile_id = 'semo-ops-worker-agent'
+   AND binding.runtime_kind = 'hermes-cli'
+   AND binding.actor_id IN ('semi', 'colony')
+   AND binding.status = 'active'
+   AND gc.status = 'active'
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker-agent-actor'
+   AND gc.metadata ->> 'actor_id' = binding.actor_id
+   AND gc.metadata ->> 'installation_id' = binding.installation_id
+   AND gc.metadata ->> 'profile_id' = binding.profile_id
+   AND gc.metadata ->> 'runtime_kind' = binding.runtime_kind
+   AND gc.metadata ->> 'runtime_profile' = binding.runtime_profile
+   AND gc.scopes
+       IS DISTINCT FROM
+       ARRAY[
+         'kb:read', 'feedback:write', 'decision:write', 'note:write',
+         'action:read', 'action:write'
+       ]::text[];
+
+-- ---------------------------------------------------------------------------
+-- 5. Assert the reach, in both directions.
+--
+--    Under-reach (the device filter matched nothing) and over-reach (the
+--    release-only host credential picked up write authority) both fail loudly
+--    here rather than being discovered from a 403 or from an unexpected host
+--    writing an action item.
+-- ---------------------------------------------------------------------------
+
+DO $verify_action_scopes$
+DECLARE
+  v_worker_with integer;
+  v_worker_without integer;
+  v_actor_stale integer;
+  v_stray integer;
+  v_duplicated integer;
+BEGIN
+  SELECT
+      count(*) FILTER (
+        WHERE gc.scopes @> ARRAY['action:read', 'action:write']::text[]
+      ),
+      count(*) FILTER (
+        WHERE NOT (gc.scopes @> ARRAY['action:read', 'action:write']::text[])
+      )
+    INTO v_worker_with, v_worker_without
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+     AND gc.metadata ->> 'credential_kind' = 'worker'
+     AND gc.metadata ->> 'device_id' IS NOT NULL;
+
+  IF v_worker_without <> 0 THEN
+    RAISE EXCEPTION
+      'expected every active device-bound worker credential to hold the action scopes, % still do not',
+      v_worker_without;
+  END IF;
+  -- Four devices were measured. More is fine (a device onboarded since the
+  -- measurement is covered by the same predicate); fewer means the filter
+  -- matched something other than the fleet.
+  IF v_worker_with < 4 THEN
+    RAISE EXCEPTION
+      'expected at least the 4 measured device-bound worker credentials, found %',
+      v_worker_with;
+  END IF;
+
+  SELECT count(*)
+    INTO v_actor_stale
+    FROM semicolony.gateway_credentials AS gc
+    JOIN semicolony.worker_agent_actor_bindings AS binding
+      ON binding.gateway_credential_id = gc.id
+     AND binding.status = 'active'
+   WHERE gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+     AND gc.metadata ->> 'credential_kind' = 'worker-agent-actor'
+     AND gc.scopes IS DISTINCT FROM ARRAY[
+           'kb:read', 'feedback:write', 'decision:write', 'note:write',
+           'action:read', 'action:write'
+         ]::text[];
+  IF v_actor_stale <> 0 THEN
+    RAISE EXCEPTION
+      '% active actor credential(s) left on the old contract; section 3 has made them unusable',
+      v_actor_stale;
+  END IF;
+
+  SELECT count(*)
+    INTO v_stray
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.scopes && ARRAY['action:read', 'action:write']::text[]
+     AND gc.metadata ->> 'credential_kind' <> 'worker-agent-actor'
+     AND NOT (
+       gc.metadata ->> 'credential_kind' = 'worker'
+       AND gc.metadata ->> 'device_id' IS NOT NULL
+     );
+  IF v_stray <> 0 THEN
+    RAISE EXCEPTION 'action scopes reached % unintended credential(s)', v_stray;
+  END IF;
+
+  -- Scoped to what this file writes. A legacy duplicate elsewhere is not this
+  -- migration's to fail on, but a duplicate here means the append ran twice.
+  SELECT count(*)
+    INTO v_duplicated
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.scopes && ARRAY['action:read', 'action:write']::text[]
+     AND cardinality(gc.scopes) <> (
+           SELECT count(DISTINCT scope)::integer FROM unnest(gc.scopes) AS s(scope)
+         );
+  IF v_duplicated <> 0 THEN
+    RAISE EXCEPTION '% credential(s) carry a duplicated scope', v_duplicated;
+  END IF;
+END;
+$verify_action_scopes$;

package/migrations/206_action_scope_narrow_dashboard.sql

@@ -0,0 +1,29 @@
+-- The semo-ops-dashboard credential gained action:read and action:write from
+-- 205's blanket scope amendment, but the dashboard never calls the Gateway's
+-- action routes -- it reads and writes semo_ops.action_items through direct
+-- queries in lib/core/action-items.ts. Measured 2026-08-14: zero occurrences
+-- of /action/list|create|update|get anywhere in packages/semicolony-dashboard.
+-- Take the unused scopes back.
+UPDATE semicolony.gateway_credentials
+   SET scopes = array_remove(array_remove(scopes, 'action:read'), 'action:write')
+ WHERE status = 'active'
+   AND metadata->>'device_id' = 'semo-ops-dashboard';
+
+DO $$
+DECLARE
+  remaining text[];
+BEGIN
+  SELECT scopes INTO remaining
+    FROM semicolony.gateway_credentials
+   WHERE status = 'active' AND metadata->>'device_id' = 'semo-ops-dashboard';
+
+  IF remaining IS NULL THEN
+    RAISE EXCEPTION 'semo-ops-dashboard credential not found or not active';
+  END IF;
+  IF 'workspace:assets-read' <> ALL(remaining) THEN
+    RAISE EXCEPTION 'workspace:assets-read was lost: %', remaining;
+  END IF;
+  IF 'action:read' = ANY(remaining) OR 'action:write' = ANY(remaining) THEN
+    RAISE EXCEPTION 'action scopes still present: %', remaining;
+  END IF;
+END $$;

package/migrations/207_action_grants_fleet_board.sql

@@ -0,0 +1,48 @@
+-- The dashboard's action-item surface moved off appdb.semicolony onto
+-- semo_ops (see KB semicolon decision
+-- semo-ops-dashboard-control-room-data-routing-2026-08-06, and the 42P01
+-- outage measured 2026-08-16). Its pool connects as sc_fleet_board, which
+-- held SELECT only. Writes still reach action_items exclusively through
+-- SECURITY DEFINER functions -- this grants EXECUTE on the three the
+-- dashboard calls (lib/core/action-items.ts: createActionItem,
+-- assignActionItem, operatorUpdateActionItem -- cancelActionItem delegates
+-- to operatorUpdateActionItem rather than calling its own function) and
+-- adds no direct DML. The other five surfaces that moved to the fleet pool
+-- in the same cutover (the /api/action-items roster query, /api/goals,
+-- /api/person/[domain], lib/plugins/service/kpi.ts, lib/tasks-db.ts) are
+-- read-only SELECTs against action_items/team_members/bot_commitments and
+-- call no function, so they need no grant here. No read path selects from
+-- action_item_events, so this migration does not grant SELECT on it either.
+GRANT EXECUTE ON FUNCTION semicolony.create_action_item(
+  p_description text, p_project_domain text, p_deadline date,
+  p_assignee_kind text, p_assignee_member text, p_assignee_agent text,
+  p_assignee_device text, p_priority text, p_source_kind text,
+  p_source_ref text, p_related_url text, p_external_contact text,
+  p_metadata jsonb, p_origin_surface text, p_origin_actor_kind text,
+  p_origin_member text, p_origin_agent text, p_origin_device text,
+  p_origin_harness text, p_origin_session_key text
+) TO sc_fleet_board;
+
+GRANT EXECUTE ON FUNCTION semicolony.assign_action_item(
+  p_action_item_id uuid, p_assignee_kind text, p_assignee_member text,
+  p_assignee_agent text, p_assignee_device text, p_actor_kind text,
+  p_actor_member text, p_actor_agent text
+) TO sc_fleet_board;
+
+GRANT EXECUTE ON FUNCTION semicolony.operator_update_action_item(
+  p_action_item_id uuid, p_status text, p_deadline date, p_note text,
+  p_metadata jsonb, p_actor_kind text, p_actor_member text,
+  p_actor_agent text
+) TO sc_fleet_board;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.table_privileges
+     WHERE grantee = 'sc_fleet_board' AND table_schema = 'semicolony'
+       AND table_name = 'action_items'
+       AND privilege_type IN ('INSERT','UPDATE','DELETE')
+  ) THEN
+    RAISE EXCEPTION 'sc_fleet_board must never hold direct DML on action_items';
+  END IF;
+END $$;

package/migrations/208_action_grants_fleet_board_guard_repair.sql

@@ -0,0 +1,45 @@
+-- 207_action_grants_fleet_board.sql shipped a safety-net guard that can never
+-- fire in the environment it targets:
+--
+--   WHERE grantee = 'sc_fleet_board' AND table_schema = 'semicolony' ...
+--
+-- `table_schema = 'semicolony'` is a string LITERAL compared against a column,
+-- not a schema-qualified identifier. `retargetSchemaSql`
+-- (packages/cli/src/commands/db.ts:35-44) rewrites `semicolony.` only when it
+-- qualifies an identifier (`semicolony.<name>`, matched by
+-- `(?<![\w./])semicolony\.`) -- a bare string literal with no trailing dot,
+-- like `'semicolony'` in a WHERE clause, is left untouched by design (see
+-- that function's own docstring, which names this exact pattern as excluded).
+-- This migration always runs with SEMICOLONY_DB_SCHEMA=semo_ops against
+-- team_knowledge_fabric, which has no `semicolony` schema at all -- so the
+-- guard's WHERE clause matched zero rows regardless of grant state, and the
+-- RAISE EXCEPTION was dead code. The invariant itself was never violated
+-- (verified separately, see task-3-report.md); only the safety net was inert.
+--
+-- Fix: drop the schema filter rather than try to make it retarget-aware.
+-- `current_schema()` was considered and rejected -- it happens to resolve to
+-- `semo_ops` for the role this migration currently runs as (that role's
+-- search_path defaults to `semo_ops, public, pg_catalog` in this database),
+-- but that is a property of the connecting role's search_path, not of
+-- SEMICOLONY_DB_SCHEMA, and would silently go back to matching nothing under
+-- a role without that search_path -- the same failure mode this migration
+-- exists to close. `action_items` is schema-unique in this database (checked
+-- against information_schema.tables across all schemas: exactly one row,
+-- semo_ops.action_items) so filtering on table_name alone is unambiguous
+-- today, and if a second action_items ever appears anywhere and picks up
+-- direct DML for sc_fleet_board, this guard should fire for that too -- a
+-- schema-agnostic check is the more conservative invariant, not a weaker one.
+--
+-- Record the trap for future authors: a bare string literal inside a WHERE
+-- clause is not an identifier and `retargetSchemaSql` will never rewrite it,
+-- by design, no matter how much it looks like a schema reference.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.table_privileges
+     WHERE grantee = 'sc_fleet_board' AND table_name = 'action_items'
+       AND privilege_type IN ('INSERT','UPDATE','DELETE')
+  ) THEN
+    RAISE EXCEPTION 'sc_fleet_board must never hold direct DML on action_items';
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.105",
+  "version": "4.18.107",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {