@team-semicolon/semicolony-cli 4.18.72 → 4.18.73

package/migrations/178_feedback_capture_capability.sql

@@ -0,0 +1,137 @@
+-- 178_feedback_capture_capability.sql
+--
+-- Give the Gateway one narrowly-scoped write primitive for SEMO Ops feedback.
+-- sc_app receives EXECUTE only: it still has no general DML on knowledge_base
+-- or action_items. The function fixes domain/key/source values, validates the
+-- remaining input, serializes same-slug writes, and creates the KB record and
+-- its open action-item handle in the caller's transaction.
+
+CREATE OR REPLACE FUNCTION semicolony.record_feedback(
+  p_slug text,
+  p_summary text,
+  p_content text,
+  p_metadata jsonb,
+  p_embedding text,
+  p_worker_id text,
+  p_device_id text
+)
+RETURNS TABLE(kb_id bigint, action_item_id uuid, duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_kb_id bigint;
+  v_action_item_id uuid;
+  v_duplicate boolean := false;
+  v_metadata jsonb;
+  v_priority text;
+BEGIN
+  IF p_slug IS NULL
+     OR char_length(p_slug) < 3
+     OR char_length(p_slug) > 60
+     OR p_slug !~ '^[[:alnum:]가-힣][[:alnum:]가-힣-]*$' THEN
+    RAISE EXCEPTION 'invalid feedback slug' USING ERRCODE = '22023';
+  END IF;
+  IF p_summary IS NULL OR char_length(btrim(p_summary)) < 8 OR char_length(p_summary) > 500 THEN
+    RAISE EXCEPTION 'invalid feedback summary' USING ERRCODE = '22023';
+  END IF;
+  IF p_content IS NULL OR char_length(p_content) < 30 OR char_length(p_content) > 30000 THEN
+    RAISE EXCEPTION 'invalid feedback content' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata IS NULL OR jsonb_typeof(p_metadata) <> 'object' THEN
+    RAISE EXCEPTION 'invalid feedback metadata' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata ->> 'category' NOT IN ('context-failure', 'env-drift', 'policy-gap', 'tooling') THEN
+    RAISE EXCEPTION 'invalid feedback category' USING ERRCODE = '22023';
+  END IF;
+  v_priority := coalesce(p_metadata ->> 'severity', 'normal');
+  IF v_priority NOT IN ('low', 'normal', 'high', 'urgent') THEN
+    RAISE EXCEPTION 'invalid feedback severity' USING ERRCODE = '22023';
+  END IF;
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$' THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+
+  -- The cast also validates dimensionality against the target vector column.
+  PERFORM p_embedding::public.vector;
+  PERFORM pg_advisory_xact_lock(hashtextextended('feedback:' || p_slug, 0));
+
+  v_metadata := p_metadata || jsonb_build_object(
+    'status', 'open',
+    'source', 'session-hook',
+    'worker_id', p_worker_id,
+    'device_id', p_device_id
+  );
+
+  INSERT INTO semicolony.knowledge_base AS kb (
+    domain, key, sub_key, content, created_by, embedding, metadata
+  ) VALUES (
+    'semicolon',
+    'feedback',
+    p_slug,
+    p_content,
+    'feedback-pipeline:' || p_worker_id,
+    p_embedding::public.vector,
+    v_metadata
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE SET
+    content = EXCLUDED.content,
+    embedding = EXCLUDED.embedding,
+    metadata = coalesce(kb.metadata, '{}'::jsonb) || EXCLUDED.metadata,
+    archived = false,
+    updated_at = clock_timestamp()
+  RETURNING kb.kb_id INTO v_kb_id;
+
+  SELECT ai.action_item_id
+    INTO v_action_item_id
+    FROM semicolony.action_items AS ai
+   WHERE ai.owner_domain = 'semicolon'
+     AND ai.source = 'feedback'
+     AND ai.status = 'open'
+     AND ai.metadata ->> 'feedback_slug' = p_slug
+   ORDER BY ai.created_at DESC
+   LIMIT 1
+   FOR UPDATE;
+
+  IF FOUND THEN
+    v_duplicate := true;
+  ELSE
+    INSERT INTO semicolony.action_items (
+      owner_domain,
+      target_domain,
+      description,
+      priority,
+      category,
+      source,
+      related_url,
+      metadata
+    ) VALUES (
+      'semicolon',
+      'semicolon',
+      '[SEMO Ops feedback] ' || btrim(p_summary),
+      v_priority,
+      'feedback',
+      'feedback',
+      'semo kb get semicolon feedback ' || p_slug,
+      jsonb_build_object(
+        'feedback_slug', p_slug,
+        'failed_rule', coalesce(p_metadata ->> 'failed_rule', 'general'),
+        'worker_id', p_worker_id,
+        'device_id', p_device_id
+      )
+    )
+    RETURNING action_items.action_item_id INTO v_action_item_id;
+  END IF;
+
+  RETURN QUERY SELECT v_kb_id, v_action_item_id, v_duplicate;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.record_feedback(
+  text, text, text, jsonb, text, text, text
+) FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.record_feedback(
+  text, text, text, jsonb, text, text, text
+) TO sc_app;

package/migrations/179_worker_feedback_credential_scope.sql

@@ -0,0 +1,209 @@
+-- 179_worker_feedback_credential_scope.sql
+--
+-- Allow the dedicated feedback:write capability in future worker credential
+-- rotations, then add it to currently device-bound active credentials. This
+-- does not add kb:write and does not change any table DML grant.
+
+CREATE OR REPLACE FUNCTION semicolony.issue_worker_gateway_credential(
+  p_team_tenant_id uuid,
+  p_worker_id text,
+  p_device_id text,
+  p_token_hash text,
+  p_token_prefix text,
+  p_scopes text[],
+  p_issued_by text,
+  p_expires_days integer,
+  p_workspace_grants jsonb
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_previous_credential_id uuid;
+  v_workspace_grants jsonb := coalesce(p_workspace_grants, '[]'::jsonb);
+  v_grant jsonb;
+  v_project_id text;
+  v_capability text;
+  v_environments text[];
+  v_grant_key text;
+  v_seen_grant_keys text[] := ARRAY[]::text[];
+  v_has_credential_grant boolean := false;
+  v_has_asset_grant boolean := false;
+BEGIN
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$' THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_hash IS NULL OR p_token_hash !~ '^[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'invalid worker credential token hash' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_prefix IS NULL
+     OR p_token_prefix !~ ('^wck_' || p_worker_id || '_[A-Za-z0-9_-]{6}$') THEN
+    RAISE EXCEPTION 'invalid worker credential token prefix' USING ERRCODE = '22023';
+  END IF;
+  IF p_issued_by IS NULL OR p_issued_by <> btrim(p_issued_by)
+     OR btrim(p_issued_by) = '' OR char_length(p_issued_by) > 128
+     OR p_issued_by ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid credential issuer' USING ERRCODE = '22023';
+  END IF;
+  IF p_expires_days IS NULL OR p_expires_days < 1 OR p_expires_days > 90 THEN
+    RAISE EXCEPTION 'worker credential expiry must be between 1 and 90 days' USING ERRCODE = '22023';
+  END IF;
+  IF p_scopes IS NULL OR cardinality(p_scopes) = 0
+     OR EXISTS (
+       SELECT 1
+         FROM unnest(p_scopes) AS requested(scope)
+        WHERE requested.scope IS NULL
+           OR requested.scope <> ALL (ARRAY[
+             'kb:read',
+             'feedback:write',
+             'skills:read',
+             'skills:write',
+             'workspace:credentials-read',
+             'workspace:assets-read',
+             'worker:release:read',
+             'worker:release:report'
+           ]::text[])
+     )
+     OR cardinality(p_scopes) <> (
+       SELECT count(DISTINCT requested.scope)::integer FROM unnest(p_scopes) AS requested(scope)
+     )
+     OR ('skills:write' = ANY(p_scopes) AND NOT ('skills:read' = ANY(p_scopes))) THEN
+    RAISE EXCEPTION 'worker credential scopes are not permitted' USING ERRCODE = '22023';
+  END IF;
+  IF jsonb_typeof(v_workspace_grants) <> 'array' THEN
+    RAISE EXCEPTION 'workspace grants must be a JSON array' USING ERRCODE = '22023';
+  END IF;
+
+  FOR v_grant IN SELECT item.value FROM jsonb_array_elements(v_workspace_grants) AS item(value) LOOP
+    IF jsonb_typeof(v_grant) <> 'object'
+       OR EXISTS (
+         SELECT 1
+           FROM jsonb_object_keys(v_grant) AS object_key(key)
+          WHERE object_key.key NOT IN ('projectId', 'capability', 'environments')
+       ) THEN
+      RAISE EXCEPTION 'invalid workspace grant shape' USING ERRCODE = '22023';
+    END IF;
+    v_project_id := v_grant ->> 'projectId';
+    v_capability := v_grant ->> 'capability';
+    IF v_project_id IS NULL OR v_project_id !~ '^[a-z][a-z0-9-]{0,99}$'
+       OR v_capability NOT IN ('credentials-read', 'assets-read')
+       OR jsonb_typeof(v_grant -> 'environments') <> 'array' THEN
+      RAISE EXCEPTION 'invalid workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_environments := ARRAY(
+      SELECT jsonb_array_elements_text(v_grant -> 'environments')
+    );
+    IF cardinality(v_environments) <> (
+      SELECT count(DISTINCT environment.value)::integer
+        FROM unnest(v_environments) AS environment(value)
+    ) OR NOT (v_environments <@ ARRAY['dev', 'e2e']::text[])
+       OR (v_capability = 'credentials-read' AND cardinality(v_environments) = 0)
+       OR (v_capability = 'assets-read' AND cardinality(v_environments) <> 0) THEN
+      RAISE EXCEPTION 'invalid workspace grant environments' USING ERRCODE = '22023';
+    END IF;
+    v_grant_key := v_project_id || ':' || v_capability;
+    IF v_grant_key = ANY(v_seen_grant_keys) THEN
+      RAISE EXCEPTION 'duplicate workspace grant' USING ERRCODE = '22023';
+    END IF;
+    v_seen_grant_keys := array_append(v_seen_grant_keys, v_grant_key);
+    v_has_credential_grant := v_has_credential_grant OR v_capability = 'credentials-read';
+    v_has_asset_grant := v_has_asset_grant OR v_capability = 'assets-read';
+  END LOOP;
+  IF v_has_credential_grant <> ('workspace:credentials-read' = ANY(p_scopes))
+     OR v_has_asset_grant <> ('workspace:assets-read' = ANY(p_scopes)) THEN
+    RAISE EXCEPTION 'workspace scopes must exactly match workspace grants' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM t.id
+    FROM public.tenants AS t
+   WHERE t.id = p_team_tenant_id
+     AND t.slug = 'team-semicolon'
+     AND t.tenant_type = 'team'
+     AND coalesce(t.metadata ->> 'status', 'active') = 'active';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active team-semicolon tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  SELECT wd.gateway_credential_id
+    INTO v_previous_credential_id
+    FROM semicolony.worker_devices AS wd
+   WHERE wd.device_id = p_device_id
+     AND wd.worker_id = p_worker_id
+     AND wd.status = 'active'
+     AND wd.kb_access_mode = 'worker-gateway'
+     AND wd.last_doctor_status = 'pass'
+     AND wd.last_seen_at >= clock_timestamp() - interval '24 hours'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active worker device binding not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO semicolony.gateway_credentials (
+    tenant_id, tenant_slug, token_hash, token_prefix, scopes, issued_by, expires_at, metadata
+  ) VALUES (
+    p_team_tenant_id,
+    'team-semicolon',
+    p_token_hash,
+    p_token_prefix,
+    p_scopes,
+    p_issued_by,
+    clock_timestamp() + make_interval(days => p_expires_days),
+    jsonb_build_object(
+      'credential_kind', 'worker',
+      'worker_id', p_worker_id,
+      'device_id', p_device_id,
+      'tenant_anchor', 'team-semicolon',
+      'lineage_status', 'active'
+    )
+  )
+  RETURNING id INTO v_credential_id;
+
+  INSERT INTO semicolony.workspace_projection_grants (
+    gateway_credential_id, project_id, capability, environments
+  )
+  SELECT
+    v_credential_id,
+    item.value ->> 'projectId',
+    item.value ->> 'capability',
+    ARRAY(SELECT jsonb_array_elements_text(item.value -> 'environments'))
+  FROM jsonb_array_elements(v_workspace_grants) AS item(value);
+
+  IF v_previous_credential_id IS NOT NULL THEN
+    UPDATE semicolony.gateway_credentials
+       SET status = 'revoked',
+           revoked_at = clock_timestamp(),
+           revoked_reason = 'worker credential rotated'
+     WHERE id = v_previous_credential_id
+       AND status = 'active';
+  END IF;
+
+  UPDATE semicolony.worker_devices
+     SET gateway_credential_id = v_credential_id
+   WHERE device_id = p_device_id
+     AND worker_id = p_worker_id;
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.issue_worker_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.issue_worker_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) TO sc_app;
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = array_append(gc.scopes, 'feedback:write')
+  FROM semicolony.worker_devices AS wd
+ WHERE wd.gateway_credential_id = gc.id
+   AND wd.status = 'active'
+   AND wd.kb_access_mode = 'worker-gateway'
+   AND gc.status = 'active'
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker'
+   AND NOT ('feedback:write' = ANY(gc.scopes));

package/migrations/180_worker_dashboard_owner_credentials.sql

@@ -0,0 +1,264 @@
+-- 180_worker_dashboard_owner_credentials.sql
+--
+-- SEMO Ops dashboard self-service worker registration and credential access.
+--
+-- Policy:
+--   - Approved admins manage every worker.
+--   - Approved members manage only devices bound to their Supabase auth user id.
+--   - New dashboard-issued worker keys remain viewable until credential sealing lands.
+--
+-- Existing credentials only contain a SHA-256 hash and cannot be recovered. They are
+-- intentionally left without a secret row and must be rotated from the dashboard.
+-- Safety: additive except for extending the fleet audit CHECK constraint.
+
+ALTER TABLE semo_ops.worker_devices
+  ADD COLUMN IF NOT EXISTS owner_auth_user_id UUID;
+
+COMMENT ON COLUMN semo_ops.worker_devices.owner_auth_user_id IS
+  'Supabase auth user that owns this device. NULL means admin-only legacy/unclaimed device.';
+
+CREATE INDEX IF NOT EXISTS idx_worker_devices_owner
+  ON semo_ops.worker_devices (owner_auth_user_id, status, device_id);
+
+CREATE TABLE IF NOT EXISTS semo_ops.worker_credential_secrets (
+  credential_id   UUID PRIMARY KEY
+    REFERENCES semo_ops.gateway_credentials(id) ON DELETE CASCADE,
+  device_id       TEXT NOT NULL
+    REFERENCES semo_ops.worker_devices(device_id) ON DELETE CASCADE,
+  plaintext_token TEXT NOT NULL CHECK (plaintext_token ~ '^wck_[a-z][a-z0-9-]{0,63}_[A-Za-z0-9_-]{32,64}$'),
+  created_by      TEXT NOT NULL,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  sealed_at       TIMESTAMPTZ
+);
+
+COMMENT ON TABLE semo_ops.worker_credential_secrets IS
+  'Temporary unsealed dashboard worker-key store. Replace plaintext_token with sealed material in the planned sealing migration.';
+COMMENT ON COLUMN semo_ops.worker_credential_secrets.plaintext_token IS
+  'Explicitly viewable to the authenticated owner/admin until credential sealing is implemented.';
+
+CREATE INDEX IF NOT EXISTS idx_worker_credential_secrets_device
+  ON semo_ops.worker_credential_secrets (device_id, created_at DESC);
+
+-- Extend the append-only audit vocabulary for the new dashboard operations.
+ALTER TABLE semo_ops.worker_fleet_audits
+  DROP CONSTRAINT IF EXISTS worker_fleet_audits_action_check;
+ALTER TABLE semo_ops.worker_fleet_audits
+  ADD CONSTRAINT worker_fleet_audits_action_check CHECK (
+    action IN (
+      'device.status', 'local_hive.status', 'local_hive.expiry', 'release.activate',
+      'worker.register', 'worker.owner', 'credential.issue'
+    )
+  );
+
+ALTER TABLE semo_ops.worker_fleet_audits
+  DROP CONSTRAINT IF EXISTS worker_fleet_audits_target_kind_check;
+ALTER TABLE semo_ops.worker_fleet_audits
+  ADD CONSTRAINT worker_fleet_audits_target_kind_check CHECK (
+    target_kind IN ('device', 'local_hive', 'profile', 'credential')
+  );
+
+CREATE OR REPLACE FUNCTION semo_ops.register_dashboard_worker(
+  p_actor_user_id UUID,
+  p_actor_is_admin BOOLEAN,
+  p_actor_email TEXT,
+  p_owner_auth_user_id UUID,
+  p_worker_id TEXT,
+  p_device_id TEXT,
+  p_display_name TEXT,
+  p_hostname TEXT,
+  p_os TEXT
+)
+RETURNS VOID
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+BEGIN
+  IF p_actor_user_id IS NULL OR p_owner_auth_user_id IS NULL
+     OR (NOT p_actor_is_admin AND p_actor_user_id <> p_owner_auth_user_id) THEN
+    RAISE EXCEPTION 'worker owner is outside the actor scope' USING ERRCODE = '42501';
+  END IF;
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL OR p_device_id !~ '^[a-z][a-z0-9-]{0,99}$' THEN
+    RAISE EXCEPTION 'invalid worker/device id' USING ERRCODE = '22023';
+  END IF;
+  IF p_actor_email IS NULL OR btrim(p_actor_email) = '' OR char_length(p_actor_email) > 320 THEN
+    RAISE EXCEPTION 'invalid actor email' USING ERRCODE = '22023';
+  END IF;
+
+  INSERT INTO semo_ops.worker_devices (
+    device_id, worker_id, display_name, hostname, os, owner_auth_user_id,
+    installed_profile_id, status, last_doctor_status, metadata
+  ) VALUES (
+    p_device_id, p_worker_id, nullif(btrim(p_display_name), ''),
+    nullif(btrim(p_hostname), ''), nullif(btrim(p_os), ''), p_owner_auth_user_id,
+    'semo-ops-worker', 'pending-setup', 'pending',
+    jsonb_build_object('registered_via', 'dashboard')
+  );
+
+  INSERT INTO semo_ops.worker_fleet_audits
+    (actor_email, action, target_kind, target_id, before, after)
+  VALUES (
+    p_actor_email, 'worker.register', 'device', p_device_id, '{}'::jsonb,
+    jsonb_build_object('worker_id', p_worker_id, 'owner_auth_user_id', p_owner_auth_user_id)
+  );
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION semo_ops.set_dashboard_worker_owner(
+  p_actor_is_admin BOOLEAN,
+  p_actor_email TEXT,
+  p_device_id TEXT,
+  p_owner_auth_user_id UUID
+)
+RETURNS VOID
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_previous_owner UUID;
+BEGIN
+  IF NOT p_actor_is_admin THEN
+    RAISE EXCEPTION 'admin role required' USING ERRCODE = '42501';
+  END IF;
+  SELECT owner_auth_user_id INTO v_previous_owner
+    FROM semo_ops.worker_devices
+   WHERE device_id = p_device_id
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'device not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  UPDATE semo_ops.worker_devices
+     SET owner_auth_user_id = p_owner_auth_user_id
+   WHERE device_id = p_device_id;
+
+  INSERT INTO semo_ops.worker_fleet_audits
+    (actor_email, action, target_kind, target_id, before, after)
+  VALUES (
+    p_actor_email, 'worker.owner', 'device', p_device_id,
+    jsonb_build_object('owner_auth_user_id', v_previous_owner),
+    jsonb_build_object('owner_auth_user_id', p_owner_auth_user_id)
+  );
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION semo_ops.issue_dashboard_worker_credential(
+  p_actor_user_id UUID,
+  p_actor_is_admin BOOLEAN,
+  p_actor_email TEXT,
+  p_device_id TEXT,
+  p_plaintext_token TEXT,
+  p_token_hash TEXT,
+  p_token_prefix TEXT,
+  p_expires_days INTEGER
+)
+RETURNS UUID
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_worker_id TEXT;
+  v_previous_credential_id UUID;
+  v_credential_id UUID;
+  v_tenant_id UUID;
+  v_scopes TEXT[] := ARRAY[
+    'kb:read', 'feedback:write', 'skills:read', 'worker:release:read', 'worker:release:report'
+  ]::TEXT[];
+BEGIN
+  IF p_token_hash IS NULL OR p_token_hash !~ '^[0-9a-f]{64}$'
+     OR p_plaintext_token IS NULL
+     OR p_plaintext_token !~ '^wck_[a-z][a-z0-9-]{0,63}_[A-Za-z0-9_-]{32,64}$'
+     OR p_expires_days IS NULL OR p_expires_days < 1 OR p_expires_days > 90 THEN
+    RAISE EXCEPTION 'invalid worker credential material' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT worker_id, gateway_credential_id
+    INTO v_worker_id, v_previous_credential_id
+    FROM semo_ops.worker_devices
+   WHERE device_id = p_device_id
+     AND status NOT IN ('revoked', 'retired')
+     AND (p_actor_is_admin OR owner_auth_user_id = p_actor_user_id)
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'manageable worker device not found' USING ERRCODE = '42501';
+  END IF;
+
+  IF p_token_prefix !~ ('^wck_' || v_worker_id || '_[A-Za-z0-9_-]{6}$')
+     OR p_plaintext_token !~ ('^wck_' || v_worker_id || '_[A-Za-z0-9_-]{32,64}$') THEN
+    RAISE EXCEPTION 'credential is not bound to the worker' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT id INTO v_tenant_id
+    FROM public.tenants
+   WHERE slug = 'team-semicolon'
+     AND tenant_type = 'team'
+     AND coalesce(metadata ->> 'status', 'active') = 'active';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active team-semicolon tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO semo_ops.gateway_credentials (
+    tenant_id, tenant_slug, token_hash, token_prefix, scopes, issued_by, expires_at, metadata
+  ) VALUES (
+    v_tenant_id, 'team-semicolon', p_token_hash, p_token_prefix, v_scopes,
+    p_actor_email, clock_timestamp() + make_interval(days => p_expires_days),
+    jsonb_build_object(
+      'credential_kind', 'worker', 'worker_id', v_worker_id,
+      'device_id', p_device_id, 'tenant_anchor', 'team-semicolon',
+      'lineage_status', 'active', 'issued_via', 'dashboard'
+    )
+  ) RETURNING id INTO v_credential_id;
+
+  INSERT INTO semo_ops.worker_credential_secrets
+    (credential_id, device_id, plaintext_token, created_by)
+  VALUES (v_credential_id, p_device_id, p_plaintext_token, p_actor_email);
+
+  IF v_previous_credential_id IS NOT NULL THEN
+    UPDATE semo_ops.gateway_credentials
+       SET status = 'revoked', revoked_at = clock_timestamp(),
+           revoked_reason = 'worker credential rotated from dashboard'
+     WHERE id = v_previous_credential_id AND status = 'active';
+  END IF;
+
+  UPDATE semo_ops.worker_devices
+     SET gateway_credential_id = v_credential_id,
+         status = CASE WHEN status = 'pending-auth' THEN 'pending-setup' ELSE status END
+   WHERE device_id = p_device_id;
+
+  INSERT INTO semo_ops.worker_fleet_audits
+    (actor_email, action, target_kind, target_id, before, after)
+  VALUES (
+    p_actor_email, 'credential.issue', 'credential', v_credential_id::TEXT,
+    jsonb_build_object('previous_credential_id', v_previous_credential_id),
+    jsonb_build_object('device_id', p_device_id, 'token_prefix', p_token_prefix)
+  );
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+REVOKE ALL ON TABLE semo_ops.worker_credential_secrets FROM PUBLIC, sc_app, sc_provider;
+GRANT SELECT ON TABLE semo_ops.worker_credential_secrets TO sc_fleet_board;
+
+REVOKE ALL ON FUNCTION semo_ops.register_dashboard_worker(
+  UUID, BOOLEAN, TEXT, UUID, TEXT, TEXT, TEXT, TEXT, TEXT
+) FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semo_ops.set_dashboard_worker_owner(
+  BOOLEAN, TEXT, TEXT, UUID
+) FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL ON FUNCTION semo_ops.issue_dashboard_worker_credential(
+  UUID, BOOLEAN, TEXT, TEXT, TEXT, TEXT, TEXT, INTEGER
+) FROM PUBLIC, sc_app, sc_provider;
+
+GRANT EXECUTE ON FUNCTION semo_ops.register_dashboard_worker(
+  UUID, BOOLEAN, TEXT, UUID, TEXT, TEXT, TEXT, TEXT, TEXT
+) TO sc_fleet_board;
+GRANT EXECUTE ON FUNCTION semo_ops.set_dashboard_worker_owner(
+  BOOLEAN, TEXT, TEXT, UUID
+) TO sc_fleet_board;
+GRANT EXECUTE ON FUNCTION semo_ops.issue_dashboard_worker_credential(
+  UUID, BOOLEAN, TEXT, TEXT, TEXT, TEXT, TEXT, INTEGER
+) TO sc_fleet_board;

package/migrations/181_db_authoritative_common_skills.sql

@@ -0,0 +1,57 @@
+-- @schema-retarget: off
+-- Make activated immutable DB releases the authoring authority for SEMO Ops
+-- common skills while preserving existing Git-pinned releases as readable
+-- legacy provenance. The migration runner owns the transaction boundary.
+
+ALTER TABLE semicolony.skill_releases
+  ADD COLUMN source_kind TEXT NOT NULL DEFAULT 'git-legacy',
+  ADD COLUMN base_release_id UUID,
+  ADD COLUMN authoring_task_id TEXT;
+
+ALTER TABLE semicolony.skill_releases
+  ALTER COLUMN source_repository DROP NOT NULL,
+  ALTER COLUMN git_commit_sha DROP NOT NULL,
+  ALTER COLUMN git_tree_oid DROP NOT NULL;
+
+ALTER TABLE semicolony.skill_releases
+  ADD CONSTRAINT skill_releases_source_kind_check
+    CHECK (source_kind IN ('db', 'git-legacy')),
+  ADD CONSTRAINT skill_releases_base_release_fk
+    FOREIGN KEY (base_release_id)
+    REFERENCES semicolony.skill_releases (release_id),
+  ADD CONSTRAINT skill_releases_not_own_base_check
+    CHECK (base_release_id IS NULL OR base_release_id <> release_id),
+  ADD CONSTRAINT skill_releases_provenance_check
+    CHECK (
+      (
+        source_kind = 'db'
+        AND source_repository IS NULL
+        AND git_commit_sha IS NULL
+        AND git_tree_oid IS NULL
+        AND NULLIF(btrim(authoring_task_id), '') IS NOT NULL
+      )
+      OR
+      (
+        source_kind = 'git-legacy'
+        AND NULLIF(btrim(source_repository), '') IS NOT NULL
+        AND git_commit_sha IS NOT NULL
+        AND git_tree_oid IS NOT NULL
+        AND base_release_id IS NULL
+        AND authoring_task_id IS NULL
+      )
+    );
+
+CREATE UNIQUE INDEX skill_releases_db_authoring_task_unique
+  ON semicolony.skill_releases (channel, skill_name, authoring_task_id)
+  WHERE source_kind = 'db';
+
+CREATE INDEX skill_releases_base_release_idx
+  ON semicolony.skill_releases (base_release_id)
+  WHERE base_release_id IS NOT NULL;
+
+COMMENT ON COLUMN semicolony.skill_releases.source_kind IS
+  'git-legacy for pre-DB authoring provenance; db for immutable release-to-release authoring.';
+COMMENT ON COLUMN semicolony.skill_releases.base_release_id IS
+  'Exact active DB release used as the edit base; NULL only for a DB-native create.';
+COMMENT ON COLUMN semicolony.skill_releases.authoring_task_id IS
+  'Task identity that produced a DB-native common-skill release.';