@team-semicolon/semicolony-cli 4.18.59 → 4.18.60

package/migrations/167_worker_credential_operator_boundary.sql

@@ -0,0 +1,427 @@
+-- 167_worker_credential_operator_boundary.sql
+--
+-- Worker credential issuance is an owner-controlled operation. The CLI runs
+-- through the non-owner sc_app role, so direct DML against worker_devices and
+-- gateway_credentials deliberately fails. Keep the narrow operation here
+-- rather than widening table grants or exposing credential hashes.
+--
+-- The migration runner supplies BEGIN/COMMIT. All object references are
+-- schema-qualified and the SECURITY DEFINER search path is fixed.
+
+CREATE OR REPLACE FUNCTION semicolony.issue_worker_gateway_credential(
+  p_team_tenant_id uuid,
+  p_worker_id text,
+  p_device_id text,
+  p_token_hash text,
+  p_token_prefix text,
+  p_scopes text[],
+  p_issued_by text,
+  p_expires_days integer,
+  p_workspace_grants jsonb
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_previous_credential_id uuid;
+  v_workspace_grants jsonb := coalesce(p_workspace_grants, '[]'::jsonb);
+  v_grant jsonb;
+  v_project_id text;
+  v_capability text;
+  v_environments text[];
+  v_grant_key text;
+  v_seen_grant_keys text[] := ARRAY[]::text[];
+  v_has_credential_grant boolean := false;
+  v_has_asset_grant boolean := false;
+BEGIN
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$' THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_hash IS NULL OR p_token_hash !~ '^[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'invalid worker credential token hash' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_prefix IS NULL
+     OR p_token_prefix !~ ('^wck_' || p_worker_id || '_[A-Za-z0-9_-]{6}$') THEN
+    RAISE EXCEPTION 'invalid worker credential token prefix' USING ERRCODE = '22023';
+  END IF;
+  IF p_issued_by IS NULL OR p_issued_by <> btrim(p_issued_by)
+     OR btrim(p_issued_by) = '' OR char_length(p_issued_by) > 128
+     OR p_issued_by ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid credential issuer' USING ERRCODE = '22023';
+  END IF;
+  IF p_expires_days IS NULL OR p_expires_days < 1 OR p_expires_days > 90 THEN
+    RAISE EXCEPTION 'worker credential expiry must be between 1 and 90 days' USING ERRCODE = '22023';
+  END IF;
+  IF p_scopes IS NULL OR cardinality(p_scopes) = 0
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_scopes) AS requested(scope)
+        WHERE requested.scope IS NULL
+           OR requested.scope <> ALL (ARRAY[
+             'kb:read',
+             'skills:read',
+             'skills:write',
+             'workspace:credentials-read',
+             'workspace:assets-read'
+           ]::text[])
+     )
+     OR cardinality(p_scopes) <> (
+       SELECT count(DISTINCT requested.scope)::integer FROM unnest(p_scopes) AS requested(scope)
+     )
+     OR ('skills:write' = ANY(p_scopes) AND NOT ('skills:read' = ANY(p_scopes))) THEN
+    RAISE EXCEPTION 'worker credential scopes are not permitted' USING ERRCODE = '22023';
+  END IF;
+  IF jsonb_typeof(v_workspace_grants) <> 'array' THEN
+    RAISE EXCEPTION 'workspace grants must be a JSON array' USING ERRCODE = '22023';
+  END IF;
+
+  FOR v_grant IN SELECT item.value FROM jsonb_array_elements(v_workspace_grants) AS item(value) LOOP
+    IF jsonb_typeof(v_grant) <> 'object'
+       OR EXISTS (
+         SELECT 1
+           FROM jsonb_object_keys(v_grant) AS object_key(key)
+          WHERE object_key.key NOT IN ('projectId', 'capability', 'environments')
+       ) THEN
+      RAISE EXCEPTION 'invalid workspace grant shape' USING ERRCODE = '22023';
+    END IF;
+    v_project_id := v_grant ->> 'projectId';
+    v_capability := v_grant ->> 'capability';
+    IF v_project_id IS NULL OR v_project_id !~ '^[a-z][a-z0-9-]{0,99}$'
+       OR v_capability NOT IN ('credentials-read', 'assets-read')
+       OR jsonb_typeof(v_grant -> 'environments') <> 'array' THEN
+      RAISE EXCEPTION 'invalid workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_environments := ARRAY(
+      SELECT jsonb_array_elements_text(v_grant -> 'environments')
+    );
+    IF cardinality(v_environments) <> (
+      SELECT count(DISTINCT environment.value)::integer
+        FROM unnest(v_environments) AS environment(value)
+    ) OR NOT (v_environments <@ ARRAY['dev', 'e2e']::text[])
+       OR (v_capability = 'credentials-read' AND cardinality(v_environments) = 0)
+       OR (v_capability = 'assets-read' AND cardinality(v_environments) <> 0) THEN
+      RAISE EXCEPTION 'invalid workspace grant environments' USING ERRCODE = '22023';
+    END IF;
+    v_grant_key := v_project_id || ':' || v_capability;
+    IF v_grant_key = ANY(v_seen_grant_keys) THEN
+      RAISE EXCEPTION 'duplicate workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_seen_grant_keys := array_append(v_seen_grant_keys, v_grant_key);
+    v_has_credential_grant := v_has_credential_grant OR v_capability = 'credentials-read';
+    v_has_asset_grant := v_has_asset_grant OR v_capability = 'assets-read';
+  END LOOP;
+  IF v_has_credential_grant <> ('workspace:credentials-read' = ANY(p_scopes))
+     OR v_has_asset_grant <> ('workspace:assets-read' = ANY(p_scopes)) THEN
+    RAISE EXCEPTION 'workspace scopes must exactly match workspace grants' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM t.id
+    FROM public.tenants AS t
+   WHERE t.id = p_team_tenant_id
+     AND t.slug = 'team-semicolon'
+     AND t.tenant_type = 'team'
+     AND coalesce(t.metadata ->> 'status', 'active') = 'active';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active team-semicolon tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  SELECT wd.gateway_credential_id
+    INTO v_previous_credential_id
+    FROM semicolony.worker_devices AS wd
+   WHERE wd.device_id = p_device_id
+     AND wd.worker_id = p_worker_id
+     AND wd.status = 'active'
+     AND wd.kb_access_mode = 'worker-gateway'
+     AND wd.last_doctor_status = 'pass'
+     AND wd.last_seen_at >= clock_timestamp() - interval '24 hours'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active worker device binding not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO semicolony.gateway_credentials (
+    tenant_id, tenant_slug, token_hash, token_prefix, scopes, issued_by, expires_at, metadata
+  ) VALUES (
+    p_team_tenant_id,
+    'team-semicolon',
+    p_token_hash,
+    p_token_prefix,
+    p_scopes,
+    p_issued_by,
+    clock_timestamp() + make_interval(days => p_expires_days),
+    jsonb_build_object(
+      'credential_kind', 'worker',
+      'worker_id', p_worker_id,
+      'device_id', p_device_id,
+      'tenant_anchor', 'team-semicolon',
+      'lineage_status', 'active'
+    )
+  )
+  RETURNING id INTO v_credential_id;
+
+  INSERT INTO semicolony.workspace_projection_grants (
+    gateway_credential_id, project_id, capability, environments
+  )
+  SELECT
+    v_credential_id,
+    item.value ->> 'projectId',
+    item.value ->> 'capability',
+    ARRAY(SELECT jsonb_array_elements_text(item.value -> 'environments'))
+  FROM jsonb_array_elements(v_workspace_grants) AS item(value);
+
+  IF v_previous_credential_id IS NOT NULL THEN
+    UPDATE semicolony.gateway_credentials
+       SET status = 'revoked',
+           revoked_at = clock_timestamp(),
+           revoked_reason = 'worker credential rotated'
+     WHERE id = v_previous_credential_id
+       AND status = 'active';
+  END IF;
+
+  UPDATE semicolony.worker_devices
+     SET gateway_credential_id = v_credential_id
+   WHERE device_id = p_device_id
+     AND worker_id = p_worker_id;
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION semicolony.list_worker_credential_metadata(p_worker_id text)
+RETURNS TABLE (
+  id uuid,
+  token_prefix text,
+  scopes text[],
+  status text,
+  issued_at timestamptz,
+  expires_at timestamptz,
+  last_used_at timestamptz
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+  SELECT gc.id,
+         gc.token_prefix,
+         gc.scopes,
+         gc.status,
+         gc.issued_at,
+         gc.expires_at,
+         gc.last_used_at
+    FROM semicolony.gateway_credentials AS gc
+   WHERE p_worker_id ~ '^[a-z][a-z0-9-]{0,63}$'
+     AND gc.tenant_slug = 'team-semicolon'
+     AND gc.metadata ->> 'credential_kind' = 'worker'
+     AND gc.metadata ->> 'worker_id' = p_worker_id
+   ORDER BY gc.issued_at DESC;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.issue_worker_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.list_worker_credential_metadata(text)
+  FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.issue_worker_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) TO sc_app;
+GRANT EXECUTE ON FUNCTION semicolony.list_worker_credential_metadata(text) TO sc_app;
+
+-- Leases remain immutable audit rows, but the user-facing CLI cannot be
+-- expected to connect as the schema owner. These narrow routines preserve the
+-- owner boundary while re-validating every authority field at execution time.
+CREATE OR REPLACE FUNCTION semicolony.issue_skill_capability_lease(
+  p_credential_id uuid,
+  p_worker_id text,
+  p_device_id text,
+  p_task_id text,
+  p_profile text,
+  p_operations text[],
+  p_resources text[],
+  p_expires_minutes integer,
+  p_approval_reference text
+)
+RETURNS TABLE (
+  lease_id uuid,
+  lease_family_id uuid,
+  lease_version integer,
+  not_before timestamptz,
+  expires_at timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_issued_at timestamptz;
+  v_lease_id uuid;
+  v_lease_family_id uuid;
+  v_lease_version integer;
+  v_expires_at timestamptz;
+BEGIN
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$'
+     OR p_task_id IS NULL OR p_task_id = '' OR p_task_id <> btrim(p_task_id)
+     OR char_length(p_task_id) > 160 OR p_task_id ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid skill lease identity' USING ERRCODE = '22023';
+  END IF;
+  IF p_profile IS NULL OR p_profile NOT IN ('read', 'make', 'operate')
+     OR p_operations IS NULL OR cardinality(p_operations) = 0 OR cardinality(p_operations) > 32
+     OR p_resources IS NULL OR cardinality(p_resources) = 0 OR cardinality(p_resources) > 32
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_operations) AS operation(value)
+        WHERE operation.value IS NULL OR operation.value = '*' OR operation.value <> btrim(operation.value)
+           OR char_length(operation.value) > 512 OR operation.value ~ '[[:cntrl:]]'
+     )
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_resources) AS resource(value)
+        WHERE resource.value IS NULL OR resource.value = '*' OR resource.value <> btrim(resource.value)
+           OR char_length(resource.value) > 512 OR resource.value ~ '[[:cntrl:]]'
+     )
+     OR cardinality(p_operations) <> (
+       SELECT count(DISTINCT operation.value)::integer FROM unnest(p_operations) AS operation(value)
+     )
+     OR cardinality(p_resources) <> (
+       SELECT count(DISTINCT resource.value)::integer FROM unnest(p_resources) AS resource(value)
+     )
+     OR p_expires_minutes IS NULL OR p_expires_minutes < 1 OR p_expires_minutes > 60 THEN
+    RAISE EXCEPTION 'invalid skill lease request' USING ERRCODE = '22023';
+  END IF;
+  IF (p_profile = 'read' AND NOT (p_operations <@ ARRAY[
+        'skills.health.read', 'skills.release.read'
+      ]::text[]))
+     OR (p_profile = 'make' AND NOT (p_operations <@ ARRAY[
+        'skills.health.read', 'skills.release.read', 'skills.proposal.write',
+        'skills.projection.reconcile', 'skills.project.write', 'skills.release.stage'
+      ]::text[]))
+     OR (p_profile = 'operate' AND NOT (p_operations <@ ARRAY[
+        'skills.health.read', 'skills.release.read', 'skills.proposal.write',
+        'skills.projection.reconcile', 'skills.project.write', 'skills.release.stage',
+        'skills.project.publish', 'skills.release.activate', 'skills.audience.manage',
+        'skills.release.retire'
+      ]::text[])) THEN
+    RAISE EXCEPTION 'operation_not_allowed_by_profile' USING ERRCODE = '22023';
+  END IF;
+  IF (p_approval_reference IS NOT NULL
+        AND (p_approval_reference = ''
+             OR p_approval_reference <> btrim(p_approval_reference)
+             OR char_length(p_approval_reference) > 160
+             OR p_approval_reference ~ '[[:cntrl:]]'))
+     OR (p_profile <> 'read' AND p_approval_reference IS NULL) THEN
+    RAISE EXCEPTION 'mutation_approval_required' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT clock_timestamp()
+    INTO v_issued_at
+    FROM semicolony.gateway_credentials AS credential
+    JOIN semicolony.worker_devices AS device
+      ON device.gateway_credential_id = credential.id
+     AND device.device_id = p_device_id
+     AND device.worker_id = p_worker_id
+     AND device.status = 'active'
+     AND device.kb_access_mode = 'worker-gateway'
+   WHERE credential.id = p_credential_id
+     AND credential.tenant_slug = 'team-semicolon'
+     AND credential.status = 'active'
+     AND credential.scopes @> ARRAY['skills:read']::text[]
+     AND (p_profile = 'read' OR credential.scopes @> ARRAY['skills:write']::text[])
+     AND credential.metadata ->> 'credential_kind' = 'worker'
+     AND credential.metadata ->> 'worker_id' = p_worker_id
+     AND credential.metadata ->> 'device_id' = p_device_id
+     AND (credential.expires_at IS NULL OR credential.expires_at > clock_timestamp())
+     AND device.last_doctor_status = 'pass'
+     AND device.last_seen_at >= clock_timestamp() - interval '24 hours'
+   FOR SHARE OF credential, device;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active_worker_device_binding_not_found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO semicolony.skill_capability_leases AS lease (
+    lease_family_id, lease_version, credential_id, principal_id, worker_id,
+    device_id, task_id, profile, operations, resources, not_before,
+    expires_at, approval_reference, issued_by_principal
+  ) VALUES (
+    gen_random_uuid(),
+    1,
+    p_credential_id,
+    'worker:' || p_worker_id,
+    p_worker_id,
+    p_device_id,
+    p_task_id,
+    p_profile,
+    p_operations,
+    p_resources,
+    v_issued_at,
+    v_issued_at + make_interval(mins => p_expires_minutes),
+    NULLIF(p_approval_reference, ''),
+    'db-session:' || session_user::text
+  )
+  RETURNING
+    lease.lease_id,
+    lease.lease_family_id,
+    lease.lease_version,
+    lease.not_before,
+    lease.expires_at
+  INTO v_lease_id, v_lease_family_id, v_lease_version, v_issued_at, v_expires_at;
+
+  RETURN QUERY SELECT v_lease_id, v_lease_family_id, v_lease_version, v_issued_at, v_expires_at;
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION semicolony.revoke_skill_capability_lease(
+  p_lease_id uuid,
+  p_reason text
+)
+RETURNS TABLE (
+  revocation_id uuid,
+  lease_family_id uuid,
+  revoked_through_version integer,
+  revoked_at timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+BEGIN
+  IF p_reason IS NULL OR p_reason = '' OR p_reason <> btrim(p_reason)
+     OR char_length(p_reason) > 160 OR p_reason ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid_revocation_reason' USING ERRCODE = '22023';
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO semicolony.skill_capability_lease_revocations AS revocation (
+    lease_family_id, revoked_through_version, reason, revoked_by_principal
+  )
+  SELECT
+    lease.lease_family_id,
+    lease.lease_version,
+    p_reason,
+    'db-session:' || session_user::text
+  FROM semicolony.skill_capability_leases AS lease
+  WHERE lease.lease_id = p_lease_id
+  RETURNING
+    revocation.revocation_id,
+    revocation.lease_family_id,
+    revocation.revoked_through_version,
+    revocation.revoked_at;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.issue_skill_capability_lease(
+  uuid, text, text, text, text, text[], text[], integer, text
+) FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semicolony.revoke_skill_capability_lease(uuid, text)
+  FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.issue_skill_capability_lease(
+  uuid, text, text, text, text, text[], text[], integer, text
+) TO sc_app;
+GRANT EXECUTE ON FUNCTION semicolony.revoke_skill_capability_lease(uuid, text) TO sc_app;
+
+-- The view intentionally omits gateway_credential_id and token material. It is
+-- the read-only status surface used by `semo worker status`.
+GRANT SELECT ON TABLE semicolony.v_worker_environment_status TO sc_app;

package/migrations/169_worker_profile_releases.sql

@@ -0,0 +1,227 @@
+-- 169_worker_profile_releases.sql
+-- Immutable SEMO Ops worker profile releases and per-device rollout state.
+--
+-- Existing workspace_profiles.version and worker_devices.installed_profile_version
+-- remain bootstrap compatibility data. They are not release-completion evidence.
+
+CREATE TABLE IF NOT EXISTS semicolony.worker_profile_releases (
+  release_id       UUID PRIMARY KEY,
+  profile_id       TEXT NOT NULL REFERENCES semicolony.workspace_profiles(profile_id),
+  version          TEXT NOT NULL,
+  status           TEXT NOT NULL DEFAULT 'staged'
+    CHECK (status IN ('staged', 'active', 'superseded', 'withdrawn')),
+  manifest         JSONB NOT NULL,
+  manifest_sha256  TEXT NOT NULL
+    CHECK (manifest_sha256 ~ '^[A-Fa-f0-9]{64}$'),
+  source_commit    TEXT NOT NULL,
+  created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  activated_at     TIMESTAMPTZ,
+  activated_by     TEXT,
+  UNIQUE (profile_id, version),
+  CHECK (
+    status <> 'active'
+    OR (activated_at IS NOT NULL AND NULLIF(BTRIM(activated_by), '') IS NOT NULL)
+  )
+);
+
+COMMENT ON TABLE semicolony.worker_profile_releases IS
+  'Immutable desired-state releases for SEMO Ops workspace profiles.';
+COMMENT ON COLUMN semicolony.worker_profile_releases.manifest_sha256 IS
+  'SHA-256 digest of the immutable release manifest.';
+
+CREATE INDEX IF NOT EXISTS idx_worker_profile_releases_profile_status_created
+  ON semicolony.worker_profile_releases (profile_id, status, created_at DESC);
+
+CREATE OR REPLACE FUNCTION semicolony.enforce_worker_profile_release_immutable()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'worker profile releases are immutable and cannot be deleted';
+  END IF;
+
+  IF NEW.release_id IS DISTINCT FROM OLD.release_id
+     OR NEW.profile_id IS DISTINCT FROM OLD.profile_id
+     OR NEW.version IS DISTINCT FROM OLD.version
+     OR NEW.manifest IS DISTINCT FROM OLD.manifest
+     OR NEW.manifest_sha256 IS DISTINCT FROM OLD.manifest_sha256
+     OR NEW.source_commit IS DISTINCT FROM OLD.source_commit
+     OR NEW.created_at IS DISTINCT FROM OLD.created_at THEN
+    RAISE EXCEPTION 'worker profile release provenance is immutable';
+  END IF;
+
+  IF NEW.status IS DISTINCT FROM OLD.status THEN
+    IF NOT (
+      (OLD.status = 'staged' AND NEW.status IN ('active', 'withdrawn'))
+      OR (OLD.status = 'active' AND NEW.status IN ('superseded', 'withdrawn'))
+    ) THEN
+      RAISE EXCEPTION 'invalid worker profile release status transition: % to %', OLD.status, NEW.status;
+    END IF;
+
+    IF OLD.status = 'active'
+       AND NEW.status <> 'active'
+       AND EXISTS (
+         SELECT 1
+           FROM semicolony.workspace_profiles wp
+          WHERE wp.active_release_id = OLD.release_id
+       ) THEN
+      RAISE EXCEPTION 'cannot change status of a release selected by a workspace profile';
+    END IF;
+  END IF;
+
+  IF NEW.activated_at IS DISTINCT FROM OLD.activated_at
+     OR NEW.activated_by IS DISTINCT FROM OLD.activated_by THEN
+    IF NOT (OLD.status = 'staged' AND NEW.status = 'active') THEN
+      RAISE EXCEPTION 'worker profile release activation metadata is immutable after activation';
+    END IF;
+  END IF;
+
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_worker_profile_releases_immutable
+  ON semicolony.worker_profile_releases;
+CREATE TRIGGER trg_worker_profile_releases_immutable
+  BEFORE UPDATE OR DELETE ON semicolony.worker_profile_releases
+  FOR EACH ROW EXECUTE FUNCTION semicolony.enforce_worker_profile_release_immutable();
+
+ALTER TABLE semicolony.workspace_profiles
+  ADD COLUMN IF NOT EXISTS active_release_id UUID;
+
+ALTER TABLE semicolony.workspace_profiles
+  ADD CONSTRAINT workspace_profiles_active_release_id_fkey
+  FOREIGN KEY (active_release_id)
+  REFERENCES semicolony.worker_profile_releases(release_id)
+  ON DELETE SET NULL;
+
+CREATE OR REPLACE FUNCTION semicolony.assert_workspace_profile_active_release()
+RETURNS TRIGGER AS $$
+DECLARE
+  selected_profile_id TEXT;
+  selected_status TEXT;
+BEGIN
+  IF NEW.active_release_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  SELECT r.profile_id, r.status
+    INTO selected_profile_id, selected_status
+    FROM semicolony.worker_profile_releases r
+   WHERE r.release_id = NEW.active_release_id;
+
+  IF NOT FOUND
+     OR selected_profile_id IS DISTINCT FROM NEW.profile_id
+     OR selected_status <> 'active' THEN
+    RAISE EXCEPTION 'active_release_id must reference an active release for the same workspace profile';
+  END IF;
+
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_workspace_profiles_active_release
+  ON semicolony.workspace_profiles;
+CREATE TRIGGER trg_workspace_profiles_active_release
+  BEFORE INSERT OR UPDATE OF profile_id, active_release_id ON semicolony.workspace_profiles
+  FOR EACH ROW EXECUTE FUNCTION semicolony.assert_workspace_profile_active_release();
+
+ALTER TABLE semicolony.worker_devices
+  ADD COLUMN IF NOT EXISTS applied_release_id UUID,
+  ADD COLUMN IF NOT EXISTS applied_release_version TEXT,
+  ADD COLUMN IF NOT EXISTS applied_at TIMESTAMPTZ,
+  ADD CONSTRAINT worker_devices_applied_release_state_check CHECK (
+    (applied_release_id IS NULL AND applied_release_version IS NULL AND applied_at IS NULL)
+    OR (applied_release_id IS NOT NULL AND applied_release_version IS NOT NULL AND applied_at IS NOT NULL)
+  );
+
+ALTER TABLE semicolony.worker_devices
+  ADD CONSTRAINT worker_devices_applied_release_id_fkey
+  FOREIGN KEY (applied_release_id)
+  REFERENCES semicolony.worker_profile_releases(release_id)
+  ON DELETE SET NULL;
+
+CREATE OR REPLACE FUNCTION semicolony.assert_worker_device_applied_release()
+RETURNS TRIGGER AS $$
+DECLARE
+  selected_profile_id TEXT;
+  selected_version TEXT;
+BEGIN
+  IF NEW.applied_release_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  SELECT r.profile_id, r.version
+    INTO selected_profile_id, selected_version
+    FROM semicolony.worker_profile_releases r
+   WHERE r.release_id = NEW.applied_release_id;
+
+  IF NOT FOUND
+     OR selected_profile_id IS DISTINCT FROM NEW.installed_profile_id
+     OR selected_version IS DISTINCT FROM NEW.applied_release_version THEN
+    RAISE EXCEPTION 'applied release must match the worker device profile and release version';
+  END IF;
+
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_worker_devices_applied_release
+  ON semicolony.worker_devices;
+CREATE TRIGGER trg_worker_devices_applied_release
+  BEFORE INSERT OR UPDATE OF installed_profile_id, applied_release_id, applied_release_version, applied_at
+  ON semicolony.worker_devices
+  FOR EACH ROW EXECUTE FUNCTION semicolony.assert_worker_device_applied_release();
+
+CREATE OR REPLACE VIEW semicolony.v_worker_environment_status AS
+SELECT
+  wd.device_id,
+  wd.worker_id,
+  wd.display_name,
+  wd.hostname,
+  wd.os,
+  wd.workspace_root,
+  wd.installed_profile_id,
+  wd.installed_profile_version,
+  wd.tool_adapters_enabled,
+  wd.kb_access_mode,
+  wd.last_seen_at,
+  wd.last_doctor_status,
+  wd.last_doctor_summary,
+  wd.setup_progress,
+  wd.status,
+  wd.updated_at,
+  COALESCE(
+    jsonb_agg(
+      jsonb_build_object(
+        'local_hive_id', lh.local_hive_id,
+        'workload_type', lh.workload_type,
+        'status', lh.status,
+        'migration_target', lh.migration_target,
+        'expiry_at', lh.expiry_at,
+        'last_seen_at', lh.last_seen_at
+      )
+    ) FILTER (WHERE lh.local_hive_id IS NOT NULL),
+    '[]'::jsonb
+  ) AS local_hives,
+  wp.active_release_id,
+  active_release.version AS active_release_version,
+  wd.applied_release_id,
+  wd.applied_release_version,
+  wd.applied_at
+FROM semicolony.worker_devices wd
+LEFT JOIN semicolony.local_hives lh
+  ON lh.device_id = wd.device_id
+LEFT JOIN semicolony.workspace_profiles wp
+  ON wp.profile_id = wd.installed_profile_id
+LEFT JOIN semicolony.worker_profile_releases active_release
+  ON active_release.release_id = wp.active_release_id
+GROUP BY wd.device_id, wp.active_release_id, active_release.version;
+
+COMMENT ON COLUMN semicolony.workspace_profiles.active_release_id IS
+  'Desired immutable release. Null until an operator stages and activates the first release.';
+COMMENT ON COLUMN semicolony.worker_devices.applied_release_id IS
+  'Last release a device successfully applied; failed updates must not advance this value.';
+COMMENT ON COLUMN semicolony.worker_devices.applied_release_version IS
+  'Version recorded with the last successfully applied release.';
+COMMENT ON COLUMN semicolony.worker_devices.applied_at IS
+  'Time the device last successfully applied its recorded release.';