@team-semicolon/semicolony-cli 4.18.51 → 4.18.52

package/migrations/161_skill_governance.sql

@@ -0,0 +1,529 @@
+-- @schema-retarget: off
+-- SEMO Ops skill release, capability, proposal, and project audit contract.
+--
+-- This migration is additive and contains no production backfill. The migration
+-- runner supplies the transaction boundary; do not add BEGIN/COMMIT here.
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_capability_leases (
+  lease_id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  lease_family_id      UUID NOT NULL,
+  lease_version        INTEGER NOT NULL CHECK (lease_version > 0),
+  credential_id        UUID NOT NULL
+    REFERENCES semicolony.gateway_credentials (id),
+  principal_id         TEXT NOT NULL,
+  worker_id            TEXT NOT NULL,
+  device_id            TEXT NOT NULL,
+  task_id              TEXT NOT NULL,
+  profile              TEXT NOT NULL
+    CHECK (profile IN ('read', 'make', 'operate')),
+  operations           TEXT[] NOT NULL,
+  resources            TEXT[] NOT NULL,
+  channel_scope        TEXT,
+  project_scope        TEXT,
+  release_scope        UUID,
+  not_before           TIMESTAMPTZ NOT NULL,
+  expires_at           TIMESTAMPTZ NOT NULL,
+  approval_reference   TEXT,
+  issued_by_principal  TEXT NOT NULL,
+  created_at           TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (lease_family_id, lease_version),
+  CHECK (NULLIF(btrim(principal_id), '') IS NOT NULL),
+  CHECK (NULLIF(btrim(worker_id), '') IS NOT NULL),
+  CHECK (NULLIF(btrim(device_id), '') IS NOT NULL),
+  CHECK (NULLIF(btrim(task_id), '') IS NOT NULL),
+  CHECK (NULLIF(btrim(issued_by_principal), '') IS NOT NULL),
+  CHECK (cardinality(operations) > 0),
+  CHECK (NOT ('*' = ANY(operations))),
+  CHECK (array_position(operations, NULL) IS NULL),
+  CHECK (
+    (
+      profile = 'read'
+      AND operations <@ ARRAY[
+        'skills.health.read',
+        'skills.release.read'
+      ]::TEXT[]
+    )
+    OR
+    (
+      profile = 'make'
+      AND operations <@ ARRAY[
+        'skills.health.read',
+        'skills.release.read',
+        'skills.proposal.write',
+        'skills.projection.reconcile',
+        'skills.project.write',
+        'skills.release.stage'
+      ]::TEXT[]
+    )
+    OR
+    (
+      profile = 'operate'
+      AND operations <@ ARRAY[
+        'skills.health.read',
+        'skills.release.read',
+        'skills.proposal.write',
+        'skills.projection.reconcile',
+        'skills.project.write',
+        'skills.release.stage',
+        'skills.project.publish',
+        'skills.release.activate',
+        'skills.audience.manage'
+      ]::TEXT[]
+    )
+  ),
+  CHECK (cardinality(resources) > 0),
+  CHECK (NOT ('*' = ANY(resources))),
+  CHECK (array_position(resources, NULL) IS NULL),
+  CHECK (not_before < expires_at),
+  CHECK (expires_at <= not_before + INTERVAL '60 minutes'),
+  CHECK (
+    profile = 'read'
+    OR NULLIF(btrim(approval_reference), '') IS NOT NULL
+  )
+);
+
+COMMENT ON TABLE semicolony.skill_capability_leases IS
+  'Immutable task-scoped Knowledge Fabric skill capability lease versions. Worker credentials are coarse route gates only.';
+
+CREATE INDEX IF NOT EXISTS idx_skill_capability_leases_binding
+  ON semicolony.skill_capability_leases
+    (worker_id, device_id, task_id, principal_id, lease_family_id, lease_version DESC);
+
+CREATE INDEX IF NOT EXISTS idx_skill_capability_leases_validity
+  ON semicolony.skill_capability_leases (not_before, expires_at);
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_capability_lease_revocations (
+  revocation_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  lease_family_id        UUID NOT NULL,
+  revoked_through_version INTEGER NOT NULL CHECK (revoked_through_version > 0),
+  reason                 TEXT NOT NULL CHECK (NULLIF(btrim(reason), '') IS NOT NULL),
+  revoked_by_principal   TEXT NOT NULL
+    CHECK (NULLIF(btrim(revoked_by_principal), '') IS NOT NULL),
+  revoked_at             TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (lease_family_id, revoked_through_version),
+  FOREIGN KEY (lease_family_id, revoked_through_version)
+    REFERENCES semicolony.skill_capability_leases (lease_family_id, lease_version)
+);
+
+COMMENT ON TABLE semicolony.skill_capability_lease_revocations IS
+  'Append-only revocations for a lease family through an exact issued version.';
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_releases (
+  release_id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel                TEXT NOT NULL CHECK (NULLIF(btrim(channel), '') IS NOT NULL),
+  skill_name             TEXT NOT NULL
+    CHECK (skill_name ~ '^[a-z0-9]+(?:-[a-z0-9]+)*$'),
+  source_repository      TEXT NOT NULL
+    CHECK (NULLIF(btrim(source_repository), '') IS NOT NULL),
+  git_commit_sha         TEXT NOT NULL
+    CHECK (git_commit_sha ~ '^[0-9a-f]{40}$'),
+  git_tree_oid           TEXT NOT NULL
+    CHECK (git_tree_oid ~ '^[0-9a-f]{40}$'),
+  tree_sha256            TEXT NOT NULL
+    CHECK (tree_sha256 ~ '^[0-9a-f]{64}$'),
+  manifest_sha256        TEXT NOT NULL
+    CHECK (manifest_sha256 ~ '^[0-9a-f]{64}$'),
+  file_count             INTEGER NOT NULL CHECK (file_count > 0),
+  total_bytes            BIGINT NOT NULL CHECK (total_bytes >= 0),
+  audiences              TEXT[] NOT NULL DEFAULT ARRAY['worker']::TEXT[],
+  created_by_principal   TEXT NOT NULL
+    CHECK (NULLIF(btrim(created_by_principal), '') IS NOT NULL),
+  created_under_lease_id UUID NOT NULL
+    REFERENCES semicolony.skill_capability_leases (lease_id),
+  staged_at              TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (release_id, channel, skill_name),
+  UNIQUE (release_id, channel, skill_name, tree_sha256),
+  UNIQUE (source_repository, git_commit_sha, channel, skill_name),
+  UNIQUE (source_repository, git_commit_sha, channel, skill_name, tree_sha256),
+  CHECK (cardinality(audiences) > 0),
+  CHECK (array_position(audiences, NULL) IS NULL),
+  CHECK (audiences <@ ARRAY['worker', 'semi', 'colony']::TEXT[])
+);
+
+COMMENT ON TABLE semicolony.skill_releases IS
+  'Immutable complete common-skill release headers. Runtime authority is selected only by activation rows.';
+
+CREATE INDEX IF NOT EXISTS idx_skill_releases_channel_skill
+  ON semicolony.skill_releases (channel, skill_name, staged_at DESC);
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_release_files (
+  release_id             UUID NOT NULL
+    REFERENCES semicolony.skill_releases (release_id),
+  relative_path          TEXT NOT NULL,
+  file_mode              INTEGER NOT NULL CHECK (file_mode IN (420, 493)),
+  size                   BIGINT NOT NULL CHECK (size >= 0),
+  content_sha256         TEXT NOT NULL
+    CHECK (content_sha256 ~ '^[0-9a-f]{64}$'),
+  content                BYTEA NOT NULL,
+  PRIMARY KEY (release_id, relative_path),
+  CHECK (relative_path <> ''),
+  CHECK (relative_path !~ '^/'),
+  CHECK (relative_path !~ E'\\\\'),
+  CHECK (relative_path !~ '(^|/)\.{1,2}(/|$)'),
+  CHECK (relative_path !~ '//'),
+  CHECK (relative_path !~ '/$'),
+  CHECK (octet_length(content) = size)
+);
+
+COMMENT ON TABLE semicolony.skill_release_files IS
+  'Immutable bytes and provenance needed to reconstruct and verify a complete common-skill tree.';
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_release_activations (
+  activation_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel                TEXT NOT NULL CHECK (NULLIF(btrim(channel), '') IS NOT NULL),
+  skill_name             TEXT NOT NULL
+    CHECK (skill_name ~ '^[a-z0-9]+(?:-[a-z0-9]+)*$'),
+  release_id             UUID NOT NULL,
+  previous_release_id    UUID,
+  audiences              TEXT[] NOT NULL,
+  lease_id               UUID NOT NULL
+    REFERENCES semicolony.skill_capability_leases (lease_id),
+  approval_reference     TEXT NOT NULL,
+  idempotency_key        TEXT NOT NULL UNIQUE,
+  activated_by_principal TEXT NOT NULL
+    CHECK (NULLIF(btrim(activated_by_principal), '') IS NOT NULL),
+  activated_at           TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  FOREIGN KEY (release_id, channel, skill_name)
+    REFERENCES semicolony.skill_releases (release_id, channel, skill_name),
+  FOREIGN KEY (previous_release_id, channel, skill_name)
+    REFERENCES semicolony.skill_releases (release_id, channel, skill_name),
+  CHECK (NULLIF(btrim(approval_reference), '') IS NOT NULL),
+  CHECK (NULLIF(btrim(idempotency_key), '') IS NOT NULL),
+  CHECK (cardinality(audiences) > 0),
+  CHECK (array_position(audiences, NULL) IS NULL),
+  CHECK (audiences <@ ARRAY['worker', 'semi', 'colony']::TEXT[]),
+  CHECK (previous_release_id IS NULL OR previous_release_id <> release_id)
+);
+
+COMMENT ON TABLE semicolony.skill_release_activations IS
+  'Append-only activation ledger. Rollback appends a row that targets an earlier immutable release.';
+
+CREATE INDEX IF NOT EXISTS idx_skill_release_activations_current
+  ON semicolony.skill_release_activations
+    (channel, skill_name, activated_at DESC, activation_id DESC);
+
+CREATE OR REPLACE FUNCTION semicolony.validate_skill_release_activation()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  staged_lease_id UUID;
+  staged_audiences TEXT[];
+  staged_file_count INTEGER;
+  staged_total_bytes BIGINT;
+  actual_file_count BIGINT;
+  actual_total_bytes BIGINT;
+  has_skill_md BOOLEAN;
+  current_release_id UUID;
+BEGIN
+  PERFORM pg_advisory_xact_lock(
+    hashtextextended(NEW.channel || ':' || NEW.skill_name, 0)
+  );
+
+  SELECT
+    release.created_under_lease_id,
+    release.audiences,
+    release.file_count,
+    release.total_bytes
+  INTO
+    staged_lease_id,
+    staged_audiences,
+    staged_file_count,
+    staged_total_bytes
+  FROM semicolony.skill_releases AS release
+  WHERE release.release_id = NEW.release_id
+    AND release.channel = NEW.channel
+    AND release.skill_name = NEW.skill_name;
+
+  IF staged_lease_id IS NULL THEN
+    RAISE EXCEPTION 'activation_release_identity_mismatch'
+      USING ERRCODE = '23503';
+  END IF;
+
+  IF NEW.lease_id = staged_lease_id THEN
+    RAISE EXCEPTION 'activation_lease_must_differ_from_stage_lease'
+      USING ERRCODE = '23514';
+  END IF;
+
+  IF NEW.audiences IS DISTINCT FROM staged_audiences THEN
+    RAISE EXCEPTION 'activation_audiences_must_match_release'
+      USING ERRCODE = '23514';
+  END IF;
+
+  SELECT
+    COUNT(*),
+    COALESCE(SUM(file.size), 0),
+    COALESCE(BOOL_OR(file.relative_path = 'SKILL.md'), false)
+  INTO
+    actual_file_count,
+    actual_total_bytes,
+    has_skill_md
+  FROM semicolony.skill_release_files AS file
+  WHERE file.release_id = NEW.release_id;
+
+  IF actual_file_count <> staged_file_count
+    OR actual_total_bytes <> staged_total_bytes
+    OR NOT has_skill_md
+  THEN
+    RAISE EXCEPTION 'activation_release_tree_is_not_sealed'
+      USING ERRCODE = '23514';
+  END IF;
+
+  SELECT activation.release_id
+  INTO current_release_id
+  FROM semicolony.skill_release_activations AS activation
+  WHERE activation.channel = NEW.channel
+    AND activation.skill_name = NEW.skill_name
+  ORDER BY activation.activated_at DESC, activation.activation_id DESC
+  LIMIT 1;
+
+  IF NEW.previous_release_id IS DISTINCT FROM current_release_id THEN
+    RAISE EXCEPTION 'activation_previous_release_must_match_current'
+      USING ERRCODE = '23514';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS validate_skill_release_activation
+  ON semicolony.skill_release_activations;
+CREATE TRIGGER validate_skill_release_activation
+BEFORE INSERT ON semicolony.skill_release_activations
+FOR EACH ROW EXECUTE FUNCTION semicolony.validate_skill_release_activation();
+
+CREATE TABLE IF NOT EXISTS semicolony.skill_change_proposals (
+  proposal_id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  proposal_family_id     UUID NOT NULL,
+  proposal_version       INTEGER NOT NULL CHECK (proposal_version > 0),
+  previous_proposal_id   UUID
+    REFERENCES semicolony.skill_change_proposals (proposal_id),
+  event_type             TEXT NOT NULL
+    CHECK (event_type IN ('proposed', 'accepted', 'rejected')),
+  scope                  TEXT NOT NULL
+    CHECK (scope = 'semo-ops-common'),
+  base_channel           TEXT NOT NULL DEFAULT 'semo-ops-common'
+    CHECK (base_channel = 'semo-ops-common'),
+  skill_name             TEXT NOT NULL
+    CHECK (skill_name ~ '^[a-z0-9]+(?:-[a-z0-9]+)*$'),
+  base_release_id        UUID NOT NULL
+    REFERENCES semicolony.skill_releases (release_id),
+  base_tree_sha256       TEXT NOT NULL
+    CHECK (base_tree_sha256 ~ '^[0-9a-f]{64}$'),
+  observed_tree_sha256   TEXT NOT NULL
+    CHECK (observed_tree_sha256 ~ '^[0-9a-f]{64}$'),
+  bundle_sha256          TEXT NOT NULL
+    CHECK (bundle_sha256 ~ '^[0-9a-f]{64}$'),
+  bundle                 BYTEA NOT NULL CHECK (octet_length(bundle) > 0),
+  harness                TEXT NOT NULL
+    CHECK (harness IN ('codex', 'claude')),
+  observed_path          TEXT NOT NULL
+    CHECK (NULLIF(btrim(observed_path), '') IS NOT NULL),
+  worker_id              TEXT NOT NULL
+    CHECK (NULLIF(btrim(worker_id), '') IS NOT NULL),
+  device_id              TEXT NOT NULL
+    CHECK (NULLIF(btrim(device_id), '') IS NOT NULL),
+  task_id                TEXT NOT NULL
+    CHECK (NULLIF(btrim(task_id), '') IS NOT NULL),
+  principal_id           TEXT NOT NULL
+    CHECK (NULLIF(btrim(principal_id), '') IS NOT NULL),
+  lease_id               UUID NOT NULL
+    REFERENCES semicolony.skill_capability_leases (lease_id),
+  decision_reference     TEXT,
+  recorded_at            TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (proposal_family_id, proposal_version),
+  FOREIGN KEY (base_release_id, base_channel, skill_name, base_tree_sha256)
+    REFERENCES semicolony.skill_releases
+      (release_id, channel, skill_name, tree_sha256),
+  CHECK (
+    (proposal_version = 1 AND event_type = 'proposed' AND previous_proposal_id IS NULL)
+    OR
+    (proposal_version > 1 AND event_type IN ('accepted', 'rejected') AND previous_proposal_id IS NOT NULL)
+  ),
+  CHECK (
+    event_type = 'proposed'
+    OR NULLIF(btrim(decision_reference), '') IS NOT NULL
+  )
+);
+
+COMMENT ON TABLE semicolony.skill_change_proposals IS
+  'Immutable proposal event rows preserving managed projection drift before any authorized reconcile.';
+
+CREATE TABLE IF NOT EXISTS semicolony.project_skill_releases (
+  project_release_id     UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id             TEXT NOT NULL
+    CHECK (NULLIF(btrim(project_id), '') IS NOT NULL),
+  source_repository      TEXT NOT NULL
+    CHECK (NULLIF(btrim(source_repository), '') IS NOT NULL),
+  skill_name             TEXT NOT NULL
+    CHECK (skill_name ~ '^[a-z0-9]+(?:-[a-z0-9]+)*$'),
+  git_commit_sha         TEXT NOT NULL
+    CHECK (git_commit_sha ~ '^[0-9a-f]{40}$'),
+  source_tree_sha256     TEXT NOT NULL
+    CHECK (source_tree_sha256 ~ '^[0-9a-f]{64}$'),
+  agents_tree_sha256     TEXT NOT NULL
+    CHECK (agents_tree_sha256 ~ '^[0-9a-f]{64}$'),
+  claude_tree_sha256     TEXT NOT NULL
+    CHECK (claude_tree_sha256 ~ '^[0-9a-f]{64}$'),
+  generator_contract     TEXT NOT NULL
+    CHECK (NULLIF(btrim(generator_contract), '') IS NOT NULL),
+  approval_state         TEXT NOT NULL DEFAULT 'approved'
+    CHECK (approval_state = 'approved'),
+  approval_reference     TEXT NOT NULL,
+  lease_id               UUID NOT NULL
+    REFERENCES semicolony.skill_capability_leases (lease_id),
+  recorded_by_principal  TEXT NOT NULL
+    CHECK (NULLIF(btrim(recorded_by_principal), '') IS NOT NULL),
+  recorded_at            TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (project_id, skill_name, git_commit_sha, source_tree_sha256),
+  CHECK (NULLIF(btrim(approval_reference), '') IS NOT NULL),
+  CHECK (agents_tree_sha256 = source_tree_sha256),
+  CHECK (claude_tree_sha256 = source_tree_sha256)
+);
+
+COMMENT ON TABLE semicolony.project_skill_releases IS
+  'Immutable project skill release approval audit. Project Git is content SoT; no project skill body is stored here.';
+
+CREATE OR REPLACE VIEW semicolony.v_current_skill_capability_leases AS
+WITH latest AS (
+  SELECT DISTINCT ON (lease_family_id)
+    lease.*
+  FROM semicolony.skill_capability_leases AS lease
+  ORDER BY lease_family_id, lease_version DESC
+)
+SELECT
+  latest.*,
+  COALESCE(
+    revocation.revoked_through_version >= latest.lease_version,
+    false
+  ) AS is_revoked,
+  revocation.revoked_through_version,
+  revocation.revoked_at
+FROM latest
+LEFT JOIN LATERAL (
+  SELECT
+    MAX(revoked_through_version) AS revoked_through_version,
+    MAX(revoked_at) AS revoked_at
+  FROM semicolony.skill_capability_lease_revocations
+  WHERE lease_family_id = latest.lease_family_id
+) AS revocation ON true;
+
+CREATE OR REPLACE VIEW semicolony.v_current_skill_release_activations AS
+SELECT DISTINCT ON (channel, skill_name)
+  activation.*
+FROM semicolony.skill_release_activations AS activation
+ORDER BY channel, skill_name, activated_at DESC, activation_id DESC;
+
+CREATE OR REPLACE FUNCTION semicolony.reject_skill_governance_mutation()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'skill_governance_rows_are_append_only'
+    USING ERRCODE = '55000';
+  RETURN NULL;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS protect_skill_releases ON semicolony.skill_releases;
+CREATE TRIGGER protect_skill_releases
+BEFORE UPDATE OR DELETE ON semicolony.skill_releases
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_skill_release_files ON semicolony.skill_release_files;
+CREATE TRIGGER protect_skill_release_files
+BEFORE UPDATE OR DELETE ON semicolony.skill_release_files
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_skill_release_activations ON semicolony.skill_release_activations;
+CREATE TRIGGER protect_skill_release_activations
+BEFORE UPDATE OR DELETE ON semicolony.skill_release_activations
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_skill_capability_leases ON semicolony.skill_capability_leases;
+CREATE TRIGGER protect_skill_capability_leases
+BEFORE UPDATE OR DELETE ON semicolony.skill_capability_leases
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_skill_capability_lease_revocations
+  ON semicolony.skill_capability_lease_revocations;
+CREATE TRIGGER protect_skill_capability_lease_revocations
+BEFORE UPDATE OR DELETE ON semicolony.skill_capability_lease_revocations
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_skill_change_proposals ON semicolony.skill_change_proposals;
+CREATE TRIGGER protect_skill_change_proposals
+BEFORE UPDATE OR DELETE ON semicolony.skill_change_proposals
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+DROP TRIGGER IF EXISTS protect_project_skill_releases ON semicolony.project_skill_releases;
+CREATE TRIGGER protect_project_skill_releases
+BEFORE UPDATE OR DELETE ON semicolony.project_skill_releases
+FOR EACH ROW EXECUTE FUNCTION semicolony.reject_skill_governance_mutation();
+
+-- The central migration/owner role retains lease issuance and revocation
+-- authority. kb-gateway runs as sc_app and receives only the append operations
+-- its worker-only routes need.
+GRANT USAGE ON SCHEMA semicolony TO sc_app;
+
+REVOKE ALL ON TABLE
+  semicolony.skill_capability_leases,
+  semicolony.skill_capability_lease_revocations
+FROM PUBLIC, sc_app;
+
+REVOKE ALL ON TABLE
+  semicolony.skill_releases,
+  semicolony.skill_release_files,
+  semicolony.skill_release_activations,
+  semicolony.skill_change_proposals,
+  semicolony.project_skill_releases,
+  semicolony.v_current_skill_capability_leases,
+  semicolony.v_current_skill_release_activations
+FROM PUBLIC, sc_app;
+
+GRANT SELECT, INSERT ON TABLE
+  semicolony.skill_releases,
+  semicolony.skill_release_files,
+  semicolony.skill_release_activations
+TO sc_app;
+
+GRANT INSERT ON TABLE
+  semicolony.skill_change_proposals,
+  semicolony.project_skill_releases
+TO sc_app;
+
+GRANT SELECT (proposal_id, recorded_at) ON TABLE
+  semicolony.skill_change_proposals
+TO sc_app;
+
+GRANT SELECT (project_release_id, recorded_at) ON TABLE
+  semicolony.project_skill_releases
+TO sc_app;
+
+GRANT SELECT ON TABLE
+  semicolony.v_current_skill_capability_leases,
+  semicolony.v_current_skill_release_activations
+TO sc_app;
+
+-- Existing kb-gateway authentication and KB routes must also remain viable
+-- after the service is moved from the schema-owner account to sc_app.
+GRANT SELECT (
+  id,
+  tenant_id,
+  tenant_slug,
+  token_hash,
+  scopes,
+  status,
+  expires_at,
+  metadata
+) ON TABLE semicolony.gateway_credentials TO sc_app;
+GRANT UPDATE (last_used_at) ON TABLE
+  semicolony.gateway_credentials
+TO sc_app;
+GRANT SELECT, INSERT ON TABLE semicolony.ontology TO sc_app;
+GRANT SELECT ON TABLE semicolony.kb_type_schema TO sc_app;
+
+REVOKE ALL ON FUNCTION semicolony.validate_skill_release_activation()
+FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.reject_skill_governance_mutation()
+FROM PUBLIC, sc_app;

package/migrations/161_workspace_projection_grants.sql

@@ -0,0 +1,39 @@
+-- 161_workspace_projection_grants.sql
+-- Explicit project/capability grants for SEMO Ops worker gateway credentials.
+--
+-- Safety:
+--   - Additive only.
+--   - References the hashed gateway credential record; no plaintext token or
+--     projected value is stored here.
+--   - The migration runner supplies BEGIN/COMMIT.
+
+CREATE TABLE IF NOT EXISTS semicolony.workspace_projection_grants (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  gateway_credential_id UUID NOT NULL
+    REFERENCES semicolony.gateway_credentials(id) ON DELETE CASCADE,
+  project_id TEXT NOT NULL
+    CHECK (project_id ~ '^[a-z][a-z0-9-]{0,99}$'),
+  capability TEXT NOT NULL
+    CHECK (capability IN ('credentials-read', 'assets-read')),
+  environments TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  status TEXT NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'revoked')),
+  expires_at TIMESTAMPTZ,
+  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (gateway_credential_id, project_id, capability),
+  CHECK (environments <@ ARRAY['dev', 'e2e']::TEXT[]),
+  CHECK (
+    (capability = 'credentials-read' AND cardinality(environments) > 0)
+    OR
+    (capability = 'assets-read' AND cardinality(environments) = 0)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_workspace_projection_grants_lookup
+  ON semicolony.workspace_projection_grants
+    (gateway_credential_id, project_id, capability)
+  WHERE status = 'active';
+
+COMMENT ON TABLE semicolony.workspace_projection_grants IS
+  'Explicit project/capability grants for wck_ worker identities. Contains no projected values.';

package/migrations/162_sc_app_kb_history_trigger_hardening.sql

@@ -0,0 +1,96 @@
+-- @schema-retarget: off
+-- Preserve KB history writes under the least-privileged Gateway role without
+-- granting that role direct access to forge audit rows. The existing trigger
+-- function remains owner-controlled and executes with a pinned search_path.
+
+DO $$
+BEGIN
+  IF to_regrole('sc_app') IS NULL THEN
+    RAISE EXCEPTION 'required role sc_app does not exist';
+  END IF;
+
+  IF to_regclass('semicolony.knowledge_base') IS NULL THEN
+    RAISE EXCEPTION 'required table semicolony.knowledge_base does not exist';
+  END IF;
+
+  IF to_regclass('semicolony.knowledge_base_history') IS NULL THEN
+    RAISE EXCEPTION 'required table semicolony.knowledge_base_history does not exist';
+  END IF;
+
+  IF to_regprocedure('semicolony.kb_history_trigger_fn()') IS NULL THEN
+    RAISE EXCEPTION 'required function semicolony.kb_history_trigger_fn() does not exist';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+      FROM pg_proc p
+     WHERE p.oid = to_regprocedure('semicolony.kb_history_trigger_fn()')
+       AND p.proowner = (SELECT oid FROM pg_roles WHERE rolname = current_user)
+  ) THEN
+    RAISE EXCEPTION 'kb_history_trigger_fn must be owned by the migration role';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+      FROM pg_trigger tg
+     WHERE tg.tgrelid = to_regclass('semicolony.knowledge_base')
+       AND tg.tgfoid = to_regprocedure('semicolony.kb_history_trigger_fn()')
+       AND tg.tgname = 'kb_history_trigger'
+       AND NOT tg.tgisinternal
+       AND tg.tgenabled IN ('O', 'A')
+       AND tg.tgtype & 1 = 1
+       AND tg.tgtype & 2 = 0
+       AND tg.tgtype & 4 = 4
+       AND tg.tgtype & 8 = 8
+       AND tg.tgtype & 16 = 16
+  ) THEN
+    RAISE EXCEPTION 'expected enabled AFTER ROW KB history trigger is missing or drifted';
+  END IF;
+END $$;
+
+CREATE OR REPLACE FUNCTION semicolony.kb_history_trigger_fn()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, semicolony
+AS $$
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    INSERT INTO semicolony.knowledge_base_history(
+      kb_id,
+      operation,
+      changed_by,
+      kb_snapshot
+    )
+    VALUES (NEW.kb_id, 'insert', NEW.created_by, to_jsonb(NEW));
+    RETURN NEW;
+  ELSIF TG_OP = 'UPDATE' THEN
+    INSERT INTO semicolony.knowledge_base_history(
+      kb_id,
+      operation,
+      changed_by,
+      kb_snapshot
+    )
+    VALUES (
+      OLD.kb_id,
+      'update',
+      COALESCE(NEW.created_by, OLD.created_by),
+      to_jsonb(OLD)
+    );
+    RETURN NEW;
+  ELSIF TG_OP = 'DELETE' THEN
+    INSERT INTO semicolony.knowledge_base_history(
+      kb_id,
+      operation,
+      changed_by,
+      kb_snapshot
+    )
+    VALUES (OLD.kb_id, 'delete', OLD.created_by, to_jsonb(OLD));
+    RETURN OLD;
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+REVOKE ALL ON TABLE semicolony.knowledge_base_history FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.kb_history_trigger_fn() FROM PUBLIC, sc_app;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.51",
+  "version": "4.18.52",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {
@@ -12,6 +12,7 @@
     "build": "tsc --noEmit && node scripts/bundle.mjs && rm -rf dist/templates && cp -r src/templates dist/templates && xattr -cr dist/ 2>/dev/null || true",
     "build:tsc": "tsc --noEmit",
     "bundle": "node scripts/bundle.mjs",
+    "release:worker": "npm run build && node scripts/build-worker-release.mjs",
     "start": "node dist/bundle.js",
     "dev": "ts-node src/index.ts",
     "lint": "eslint src/",
@@ -41,7 +42,8 @@
     "cron-parser": "^4.9.0",
     "inquirer": "^8.2.6",
     "ora": "^5.4.1",
-    "smol-toml": "^1.6.1"
+    "smol-toml": "^1.6.1",
+    "yaml": "2.9.0"
   },
   "optionalDependencies": {
     "@team-semicolon/semicolony-common": "*",