@team-semicolon/semicolony-cli 4.18.78 → 4.18.80

package/migrations/185_worker_agent_feedback_scope.sql

@@ -0,0 +1,309 @@
+-- 185_worker_agent_feedback_scope.sql
+--
+-- Promote the two fixed Hermes actor credentials from Phase 3 KB read to the
+-- exact Phase 4 capability pair. Existing active credentials are updated only
+-- through their normalized actor binding; the release-only host credential is
+-- not selected. The existing record_feedback capability remains the sole DB
+-- write primitive and now preserves validated runtime-native attribution.
+
+CREATE OR REPLACE FUNCTION semicolony.issue_worker_agent_actor_credential(
+  p_team_tenant_id uuid,
+  p_actor_id text,
+  p_token_hash text,
+  p_token_prefix text,
+  p_issued_by text,
+  p_expires_days integer
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_previous_credential_id uuid;
+  v_runtime_profile text;
+BEGIN
+  IF p_actor_id NOT IN ('semi', 'colony') THEN
+    RAISE EXCEPTION 'invalid Worker-agent actor' USING ERRCODE = '22023';
+  END IF;
+  v_runtime_profile := CASE p_actor_id WHEN 'semi' THEN 'semo-semi' ELSE 'semo-colony' END;
+  IF p_token_hash IS NULL OR p_token_hash !~ '^[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'invalid worker-agent actor credential token hash' USING ERRCODE = '22023';
+  END IF;
+  IF p_token_prefix IS NULL
+     OR p_token_prefix !~ ('^wck_' || p_actor_id || '_[A-Za-z0-9_-]{6}$') THEN
+    RAISE EXCEPTION 'invalid worker-agent actor credential token prefix' USING ERRCODE = '22023';
+  END IF;
+  IF p_issued_by IS NULL OR p_issued_by <> btrim(p_issued_by)
+     OR btrim(p_issued_by) = '' OR char_length(p_issued_by) > 128
+     OR p_issued_by ~ '[[:cntrl:]]' THEN
+    RAISE EXCEPTION 'invalid credential issuer' USING ERRCODE = '22023';
+  END IF;
+  IF p_expires_days IS NULL OR p_expires_days < 1 OR p_expires_days > 90 THEN
+    RAISE EXCEPTION 'worker-agent credential expiry must be between 1 and 90 days'
+      USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM t.id
+    FROM public.tenants AS t
+   WHERE t.id = p_team_tenant_id
+     AND t.slug = 'team-semicolon'
+     AND t.tenant_type = 'team'
+     AND coalesce(t.metadata ->> 'status', 'active') = 'active';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active team-semicolon tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  PERFORM wd.device_id
+    FROM semicolony.worker_devices AS wd
+   WHERE wd.device_id = 'hermes-principals@hermes'
+     AND wd.installation_kind = 'agent-runtime'
+     AND wd.installed_profile_id = 'semo-ops-worker-agent'
+     AND wd.kb_access_mode = 'worker-gateway'
+     AND wd.status = 'active'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active Worker-agent installation not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  SELECT binding.gateway_credential_id
+    INTO v_previous_credential_id
+    FROM semicolony.worker_agent_actor_bindings AS binding
+   WHERE binding.installation_id = 'hermes-principals@hermes'
+     AND binding.actor_id = p_actor_id
+   FOR UPDATE;
+
+  INSERT INTO semicolony.gateway_credentials (
+    tenant_id, tenant_slug, token_hash, token_prefix, scopes, issued_by, expires_at, metadata
+  ) VALUES (
+    p_team_tenant_id,
+    'team-semicolon',
+    p_token_hash,
+    p_token_prefix,
+    ARRAY['kb:read', 'feedback:write']::text[],
+    p_issued_by,
+    clock_timestamp() + make_interval(days => p_expires_days),
+    jsonb_build_object(
+      'credential_kind', 'worker-agent-actor',
+      'actor_id', p_actor_id,
+      'installation_id', 'hermes-principals@hermes',
+      'profile_id', 'semo-ops-worker-agent',
+      'runtime_kind', 'hermes-cli',
+      'runtime_profile', v_runtime_profile,
+      'tenant_anchor', 'team-semicolon',
+      'lineage_status', 'active'
+    )
+  )
+  RETURNING id INTO v_credential_id;
+
+  INSERT INTO semicolony.worker_agent_actor_bindings (
+    installation_id, actor_id, runtime_profile, profile_id, runtime_kind,
+    gateway_credential_id, status, issued_at, rotated_at, updated_at
+  ) VALUES (
+    'hermes-principals@hermes', p_actor_id, v_runtime_profile,
+    'semo-ops-worker-agent', 'hermes-cli', v_credential_id, 'active',
+    clock_timestamp(), CASE WHEN v_previous_credential_id IS NULL THEN NULL ELSE clock_timestamp() END,
+    clock_timestamp()
+  )
+  ON CONFLICT (installation_id, actor_id) DO UPDATE
+     SET runtime_profile = EXCLUDED.runtime_profile,
+         profile_id = EXCLUDED.profile_id,
+         runtime_kind = EXCLUDED.runtime_kind,
+         gateway_credential_id = EXCLUDED.gateway_credential_id,
+         status = 'active',
+         rotated_at = clock_timestamp(),
+         updated_at = clock_timestamp();
+
+  IF v_previous_credential_id IS NOT NULL AND v_previous_credential_id <> v_credential_id THEN
+    UPDATE semicolony.gateway_credentials
+       SET status = 'revoked',
+           revoked_at = clock_timestamp(),
+           revoked_reason = 'worker-agent actor credential rotated'
+     WHERE id = v_previous_credential_id
+       AND status = 'active';
+  END IF;
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.issue_worker_agent_actor_credential(
+  uuid, text, text, text, text, integer
+) FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.issue_worker_agent_actor_credential(
+  uuid, text, text, text, text, integer
+) TO sc_app;
+
+UPDATE semicolony.gateway_credentials AS gc
+   SET scopes = ARRAY['kb:read', 'feedback:write']::text[]
+  FROM semicolony.worker_agent_actor_bindings AS binding
+ WHERE binding.gateway_credential_id = gc.id
+   AND binding.installation_id = 'hermes-principals@hermes'
+   AND binding.profile_id = 'semo-ops-worker-agent'
+   AND binding.runtime_kind = 'hermes-cli'
+   AND binding.actor_id IN ('semi', 'colony')
+   AND binding.status = 'active'
+   AND gc.status = 'active'
+   AND coalesce(gc.expires_at, 'infinity'::timestamptz) > clock_timestamp()
+   AND gc.metadata ->> 'credential_kind' = 'worker-agent-actor'
+   AND gc.metadata ->> 'actor_id' = binding.actor_id
+   AND gc.metadata ->> 'installation_id' = binding.installation_id
+   AND gc.metadata ->> 'profile_id' = binding.profile_id
+   AND gc.metadata ->> 'runtime_kind' = binding.runtime_kind
+   AND gc.scopes IS DISTINCT FROM ARRAY['kb:read', 'feedback:write']::text[];
+
+CREATE OR REPLACE FUNCTION semicolony.record_feedback(
+  p_slug text,
+  p_summary text,
+  p_content text,
+  p_metadata jsonb,
+  p_embedding text,
+  p_worker_id text,
+  p_device_id text
+)
+RETURNS TABLE(kb_id bigint, action_item_id uuid, duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_kb_id bigint;
+  v_action_item_id uuid;
+  v_duplicate boolean := false;
+  v_metadata jsonb;
+  v_priority text;
+  v_source text;
+BEGIN
+  IF p_slug IS NULL
+     OR char_length(p_slug) < 3
+     OR char_length(p_slug) > 60
+     OR p_slug !~ '^[[:alnum:]가-힣][[:alnum:]가-힣-]*$' THEN
+    RAISE EXCEPTION 'invalid feedback slug' USING ERRCODE = '22023';
+  END IF;
+  IF p_summary IS NULL OR char_length(btrim(p_summary)) < 8 OR char_length(p_summary) > 500 THEN
+    RAISE EXCEPTION 'invalid feedback summary' USING ERRCODE = '22023';
+  END IF;
+  IF p_content IS NULL OR char_length(p_content) < 30 OR char_length(p_content) > 30000 THEN
+    RAISE EXCEPTION 'invalid feedback content' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata IS NULL OR jsonb_typeof(p_metadata) <> 'object' THEN
+    RAISE EXCEPTION 'invalid feedback metadata' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata ->> 'category' NOT IN ('context-failure', 'env-drift', 'policy-gap', 'tooling') THEN
+    RAISE EXCEPTION 'invalid feedback category' USING ERRCODE = '22023';
+  END IF;
+  v_priority := coalesce(p_metadata ->> 'severity', 'normal');
+  IF v_priority NOT IN ('low', 'normal', 'high', 'urgent') THEN
+    RAISE EXCEPTION 'invalid feedback severity' USING ERRCODE = '22023';
+  END IF;
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL
+     OR (p_device_id !~ '^[a-z][a-z0-9-]{0,99}$'
+         AND p_device_id <> 'hermes-principals@hermes') THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+
+  v_source := coalesce(p_metadata ->> 'source', 'session-hook');
+  IF v_source NOT IN ('session-hook', 'runtime-native-tool') THEN
+    RAISE EXCEPTION 'invalid feedback source' USING ERRCODE = '22023';
+  END IF;
+  IF v_source = 'runtime-native-tool' AND NOT (
+    p_worker_id IN ('semi', 'colony')
+    AND p_device_id = 'hermes-principals@hermes'
+    AND p_metadata ->> 'reported_by' = p_worker_id
+    AND p_metadata ->> 'installation_id' = 'hermes-principals@hermes'
+    AND p_metadata ->> 'runtime_kind' = 'hermes-cli'
+    AND p_metadata ->> 'profile_id' = 'semo-ops-worker-agent'
+    AND (
+      (p_worker_id = 'semi' AND p_metadata ->> 'runtime_profile' = 'semo-semi')
+      OR (p_worker_id = 'colony' AND p_metadata ->> 'runtime_profile' = 'semo-colony')
+    )
+  ) THEN
+    RAISE EXCEPTION 'invalid runtime-native feedback attribution' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM p_embedding::public.vector;
+  PERFORM pg_advisory_xact_lock(hashtextextended('feedback:' || p_slug, 0));
+
+  v_metadata := p_metadata || jsonb_build_object(
+    'status', 'open',
+    'source', v_source,
+    'worker_id', p_worker_id,
+    'device_id', p_device_id
+  );
+
+  INSERT INTO semicolony.knowledge_base AS kb (
+    domain, key, sub_key, content, created_by, embedding, metadata
+  ) VALUES (
+    'semicolon',
+    'feedback',
+    p_slug,
+    p_content,
+    'feedback-pipeline:' || p_worker_id,
+    p_embedding::public.vector,
+    v_metadata
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE SET
+    content = EXCLUDED.content,
+    embedding = EXCLUDED.embedding,
+    metadata = coalesce(kb.metadata, '{}'::jsonb) || EXCLUDED.metadata,
+    archived = false,
+    updated_at = clock_timestamp()
+  RETURNING kb.kb_id INTO v_kb_id;
+
+  SELECT ai.action_item_id
+    INTO v_action_item_id
+    FROM semicolony.action_items AS ai
+   WHERE ai.owner_domain = 'semicolon'
+     AND ai.source = 'feedback'
+     AND ai.status = 'open'
+     AND ai.metadata ->> 'feedback_slug' = p_slug
+   ORDER BY ai.created_at DESC
+   LIMIT 1
+   FOR UPDATE;
+
+  IF FOUND THEN
+    v_duplicate := true;
+  ELSE
+    INSERT INTO semicolony.action_items (
+      owner_domain,
+      target_domain,
+      description,
+      priority,
+      category,
+      source,
+      related_url,
+      metadata
+    ) VALUES (
+      'semicolon',
+      'semicolon',
+      '[SEMO Ops feedback] ' || btrim(p_summary),
+      v_priority,
+      'feedback',
+      'feedback',
+      'semo kb get semicolon feedback ' || p_slug,
+      jsonb_build_object(
+        'feedback_slug', p_slug,
+        'failed_rule', coalesce(p_metadata ->> 'failed_rule', 'general'),
+        'worker_id', p_worker_id,
+        'device_id', p_device_id,
+        'reported_by', p_metadata ->> 'reported_by',
+        'installation_id', p_metadata ->> 'installation_id',
+        'runtime_kind', p_metadata ->> 'runtime_kind',
+        'profile_id', p_metadata ->> 'profile_id'
+      )
+    )
+    RETURNING action_items.action_item_id INTO v_action_item_id;
+  END IF;
+
+  RETURN QUERY SELECT v_kb_id, v_action_item_id, v_duplicate;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.record_feedback(
+  text, text, text, jsonb, text, text, text
+) FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.record_feedback(
+  text, text, text, jsonb, text, text, text
+) TO sc_app;

package/migrations/README.md

@@ -23,6 +23,7 @@ SEMICOLONY CLI의 PostgreSQL 마이그레이션 파일들.
 | `179_worker_feedback_credential_scope.sql` | 워커 자격증명 `feedback:write` 허용 및 활성 디바이스 바인딩에 범위 백필                                  |
 | `183_worker_agent_gateway_credentials.sql` | Hermes Agent host release credential과 Semi/Colony actor KB-read credential의 서버 바인딩 및 회전        |
 | `184_worker_agent_workspace_profile.sql`   | Hermes Agent immutable release가 참조하는 `semo-ops-worker-agent` DB 정본 프로필 시드                    |
+| `185_worker_agent_feedback_scope.sql`      | Hermes Semi/Colony actor에 정확한 feedback 범위·귀속을 추가하고 기존 바인딩만 백필                       |
 
 ## 007: Flat Skill Naming
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.78",
+  "version": "4.18.80",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {