@wardby/cli 0.3.0 → 0.4.1

package/prisma/migrations/20261002000000_jira_coding_bridge/migration.sql

@@ -0,0 +1,28 @@
+-- Jira phase 3 (the Jira -> code bridge): per-link PR statuses, the originating
+-- issue on a coding run, and the pull requests opened for tracker issues.
+ALTER TABLE "AgentIssueProject" ADD COLUMN "onPullRequestOpened" TEXT;
+ALTER TABLE "AgentIssueProject" ADD COLUMN "onPullRequestMerged" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "issueProvider" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "issueKey" TEXT;
+
+-- No foreign keys by design: audit-style rows that survive agent/run deletion.
+CREATE TABLE "IssuePullRequest" (
+    "id" TEXT NOT NULL,
+    "issueProvider" TEXT NOT NULL,
+    "issueKey" TEXT NOT NULL,
+    "codeProvider" TEXT NOT NULL,
+    "repository" TEXT NOT NULL,
+    "number" INTEGER NOT NULL,
+    "url" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "openedByRunId" TEXT NOT NULL,
+    "state" TEXT NOT NULL DEFAULT 'open',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "IssuePullRequest_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "IssuePullRequest_codeProvider_repository_number_issueProvid_key" ON "IssuePullRequest"("codeProvider", "repository", "number", "issueProvider", "issueKey");
+
+CREATE INDEX "IssuePullRequest_issueProvider_issueKey_idx" ON "IssuePullRequest"("issueProvider", "issueKey");

package/prisma/migrations/20261002010000_jira_issue_creation/migration.sql

@@ -0,0 +1,25 @@
+-- Jira phase 4: issue creation allowlist + cap on the link, self-defect config on the agent, and dedupe fingerprints.
+ALTER TABLE "AgentIssueProject" ADD COLUMN "creatableIssueTypes" TEXT[] DEFAULT ARRAY[]::TEXT[];
+ALTER TABLE "AgentIssueProject" ADD COLUMN "maxNewIssuesPerRun" INTEGER;
+
+ALTER TABLE "Agent" ADD COLUMN "defectProjectKey" TEXT;
+ALTER TABLE "Agent" ADD COLUMN "defectIssueType" TEXT;
+
+CREATE TABLE "IssueFingerprint" (
+    "id" TEXT NOT NULL,
+    "issueProvider" TEXT NOT NULL,
+    "projectKey" TEXT NOT NULL,
+    "fingerprintHash" TEXT NOT NULL,
+    "issueKey" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "createdByRunId" TEXT,
+    "seenCount" INTEGER NOT NULL DEFAULT 1,
+    "firstSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "IssueFingerprint_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "IssueFingerprint_issueProvider_issueKey_key" ON "IssueFingerprint"("issueProvider", "issueKey");
+CREATE INDEX "IssueFingerprint_issueProvider_projectKey_fingerprintHash_idx" ON "IssueFingerprint"("issueProvider", "projectKey", "fingerprintHash");
+CREATE INDEX "IssueFingerprint_createdByRunId_idx" ON "IssueFingerprint"("createdByRunId");

package/prisma/migrations/20261003000000_issue_cost_attribution/migration.sql

@@ -0,0 +1,56 @@
+-- Issue cost attribution (Jira phase 4a): work items, per-run attribution,
+-- and per-run per-model usage by priced token kind.
+
+CREATE TABLE "WorkItem" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "title" TEXT,
+    "type" TEXT,
+    "url" TEXT,
+    "scopeKey" TEXT NOT NULL,
+    "parentKey" TEXT,
+    "parentKind" TEXT,
+    "refreshedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WorkItem_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "WorkItem_provider_key_key" ON "WorkItem"("provider", "key");
+CREATE INDEX "WorkItem_provider_parentKey_idx" ON "WorkItem"("provider", "parentKey");
+CREATE INDEX "WorkItem_provider_scopeKey_idx" ON "WorkItem"("provider", "scopeKey");
+
+CREATE TABLE "RunAttribution" (
+    "runId" TEXT NOT NULL,
+    "workItemId" TEXT NOT NULL,
+    "parentKeyAtRun" TEXT,
+    "source" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RunAttribution_pkey" PRIMARY KEY ("runId")
+);
+
+CREATE INDEX "RunAttribution_workItemId_idx" ON "RunAttribution"("workItemId");
+CREATE INDEX "RunAttribution_parentKeyAtRun_idx" ON "RunAttribution"("parentKeyAtRun");
+
+ALTER TABLE "RunAttribution" ADD CONSTRAINT "RunAttribution_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "RunAttribution" ADD CONSTRAINT "RunAttribution_workItemId_fkey"
+    FOREIGN KEY ("workItemId") REFERENCES "WorkItem"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+CREATE TABLE "RunModelUsage" (
+    "runId" TEXT NOT NULL,
+    "model" TEXT NOT NULL,
+    "freshInputTokens" INTEGER NOT NULL DEFAULT 0,
+    "cachedInputTokens" INTEGER NOT NULL DEFAULT 0,
+    "cacheWriteTokens" INTEGER NOT NULL DEFAULT 0,
+    "outputTokens" INTEGER NOT NULL DEFAULT 0,
+    "costUsd" DECIMAL(18,10) NOT NULL DEFAULT 0,
+
+    CONSTRAINT "RunModelUsage_pkey" PRIMARY KEY ("runId", "model")
+);
+
+ALTER TABLE "RunModelUsage" ADD CONSTRAINT "RunModelUsage_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261003010000_coding_run_service_status/migration.sql

@@ -0,0 +1,23 @@
+-- Live start-up state of each coding-run service, one row per run x service,
+-- written by the job launchers for display (wardby viewer, get_run).
+CREATE TYPE "CodingServiceState" AS ENUM ('pending', 'probing', 'ready', 'failed');
+
+CREATE TABLE "CodingRunServiceStatus" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "state" "CodingServiceState" NOT NULL DEFAULT 'pending',
+    "attempts" INTEGER,
+    "reason" TEXT,
+    "readyAt" TIMESTAMP(3),
+    "failedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "CodingRunServiceStatus_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "CodingRunServiceStatus_runId_name_key" ON "CodingRunServiceStatus"("runId", "name");
+
+ALTER TABLE "CodingRunServiceStatus" ADD CONSTRAINT "CodingRunServiceStatus_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261003020000_viewer_notify/migration.sql

@@ -0,0 +1,54 @@
+-- Live events for the admin viewer (docs/viewer-api.md): small pg_notify
+-- payloads on channel wardby_viewer. Runs as the writing role; pg_notify
+-- needs no grant. Payloads stay far below NOTIFY's 8000-byte limit.
+CREATE FUNCTION wardby_viewer_notify() RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE
+  payload jsonb;
+BEGIN
+  IF TG_TABLE_NAME = 'Run' THEN
+    IF TG_OP = 'UPDATE'
+       AND NEW."status" IS NOT DISTINCT FROM OLD."status"
+       AND NEW."turns" IS NOT DISTINCT FROM OLD."turns"
+       AND NEW."costUsd" IS NOT DISTINCT FROM OLD."costUsd"
+       AND NEW."tokensIn" IS NOT DISTINCT FROM OLD."tokensIn"
+       AND NEW."tokensOut" IS NOT DISTINCT FROM OLD."tokensOut"
+       AND NEW."finishedAt" IS NOT DISTINCT FROM OLD."finishedAt"
+       AND NEW."parentRunId" IS NOT DISTINCT FROM OLD."parentRunId" THEN
+      RETURN NULL; -- heartbeat-only and other invisible updates
+    END IF;
+    payload := jsonb_build_object(
+      'kind', 'run', 'runId', NEW."id", 'parentRunId', NEW."parentRunId", 'agentId', NEW."agentId",
+      'status', NEW."status", 'turns', NEW."turns", 'tokensIn', NEW."tokensIn", 'tokensOut', NEW."tokensOut",
+      'costUsd', NEW."costUsd"::float8,
+      'finishedAt', to_char(NEW."finishedAt" AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'));
+  ELSIF TG_TABLE_NAME = 'CodingRunServiceStatus' THEN
+    payload := jsonb_build_object(
+      'kind', 'service', 'runId', NEW."runId", 'name', NEW."name", 'state', NEW."state", 'attempts', NEW."attempts");
+  ELSIF TG_TABLE_NAME = 'IssuePullRequest' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."openedByRunId", 'source', 'pull_request');
+  ELSIF TG_TABLE_NAME = 'RunHostStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_status');
+  ELSIF TG_TABLE_NAME = 'RunIssueStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'issue_status');
+  ELSIF TG_TABLE_NAME = 'RunHostCheck' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_check');
+  ELSE
+    RETURN NULL;
+  END IF;
+  PERFORM pg_notify('wardby_viewer', payload::text);
+  RETURN NULL;
+END;
+$$;
+
+CREATE TRIGGER "Run_viewer_notify" AFTER INSERT OR UPDATE ON "Run"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();
+CREATE TRIGGER "CodingRunServiceStatus_viewer_notify" AFTER INSERT OR UPDATE ON "CodingRunServiceStatus"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();
+CREATE TRIGGER "IssuePullRequest_viewer_notify" AFTER INSERT OR UPDATE ON "IssuePullRequest"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();
+CREATE TRIGGER "RunHostStatus_viewer_notify" AFTER INSERT OR UPDATE ON "RunHostStatus"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();
+CREATE TRIGGER "RunIssueStatus_viewer_notify" AFTER INSERT OR UPDATE ON "RunIssueStatus"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();
+CREATE TRIGGER "RunHostCheck_viewer_notify" AFTER INSERT OR UPDATE ON "RunHostCheck"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();

package/prisma/migrations/20261003030000_viewer_notify_fixes/migration.sql

@@ -0,0 +1,47 @@
+-- Fixes for wardby_viewer_notify(): finishedAt formatting under a non-UTC
+-- session TimeZone (the column is timestamp without time zone, already UTC),
+-- and notification failures never fail the write. The triggers are unchanged.
+CREATE OR REPLACE FUNCTION wardby_viewer_notify() RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE
+  payload jsonb;
+BEGIN
+  IF TG_TABLE_NAME = 'Run' THEN
+    IF TG_OP = 'UPDATE'
+       AND NEW."status" IS NOT DISTINCT FROM OLD."status"
+       AND NEW."turns" IS NOT DISTINCT FROM OLD."turns"
+       AND NEW."costUsd" IS NOT DISTINCT FROM OLD."costUsd"
+       AND NEW."tokensIn" IS NOT DISTINCT FROM OLD."tokensIn"
+       AND NEW."tokensOut" IS NOT DISTINCT FROM OLD."tokensOut"
+       AND NEW."finishedAt" IS NOT DISTINCT FROM OLD."finishedAt"
+       AND NEW."parentRunId" IS NOT DISTINCT FROM OLD."parentRunId" THEN
+      RETURN NULL; -- heartbeat-only and other invisible updates
+    END IF;
+    payload := jsonb_build_object(
+      'kind', 'run', 'runId', NEW."id", 'parentRunId', NEW."parentRunId", 'agentId', NEW."agentId",
+      'status', NEW."status", 'turns', NEW."turns", 'tokensIn', NEW."tokensIn", 'tokensOut', NEW."tokensOut",
+      'costUsd', NEW."costUsd"::float8,
+      'finishedAt', to_char(NEW."finishedAt", 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'));
+  ELSIF TG_TABLE_NAME = 'CodingRunServiceStatus' THEN
+    payload := jsonb_build_object(
+      'kind', 'service', 'runId', NEW."runId", 'name', NEW."name", 'state', NEW."state", 'attempts', NEW."attempts");
+  ELSIF TG_TABLE_NAME = 'IssuePullRequest' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."openedByRunId", 'source', 'pull_request');
+  ELSIF TG_TABLE_NAME = 'RunHostStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_status');
+  ELSIF TG_TABLE_NAME = 'RunIssueStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'issue_status');
+  ELSIF TG_TABLE_NAME = 'RunHostCheck' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_check');
+  ELSE
+    RETURN NULL;
+  END IF;
+  -- A viewer event must never fail the write that caused it (e.g. a payload
+  -- over NOTIFY's 8000-byte limit).
+  BEGIN
+    PERFORM pg_notify('wardby_viewer', payload::text);
+  EXCEPTION WHEN OTHERS THEN
+    NULL;
+  END;
+  RETURN NULL;
+END;
+$$;

package/prisma/migrations/20261003040000_viewer_indexes/migration.sql

@@ -0,0 +1,12 @@
+-- Indexes for the admin viewer's queries (docs/viewer-api.md): the graph
+-- window (runs started since a time, or still pending/running), the
+-- ancestor/children walks, and the outcome lookup by run. Plain CREATE INDEX
+-- briefly blocks writes to each table while it builds; on a large existing
+-- deployment, apply this migration in a quiet period.
+CREATE INDEX "Run_startedAt_idx" ON "Run"("startedAt");
+
+CREATE INDEX "Run_status_idx" ON "Run"("status");
+
+CREATE INDEX "Run_parentRunId_idx" ON "Run"("parentRunId");
+
+CREATE INDEX "IssuePullRequest_openedByRunId_idx" ON "IssuePullRequest"("openedByRunId");

package/prisma/migrations/20261004000000_model_catalog/migration.sql

@@ -0,0 +1,26 @@
+-- Model catalog: admin overrides of the shipped catalog, and each run's
+-- catalog entry as recorded when it started. Additive only.
+CREATE TABLE "ModelCatalogEntry" (
+    "provider" TEXT NOT NULL,
+    "modelId" TEXT NOT NULL,
+    "enabled" BOOLEAN NOT NULL,
+    "encoding" TEXT NOT NULL,
+    "inputPerMTok" DOUBLE PRECISION NOT NULL,
+    "outputPerMTok" DOUBLE PRECISION NOT NULL,
+    "cachedInputPerMTok" DOUBLE PRECISION NOT NULL,
+    "cacheWritePerMTok" DOUBLE PRECISION NOT NULL,
+    "efforts" TEXT[],
+    "thinkingMode" TEXT NOT NULL,
+    "sourceUrl" TEXT NOT NULL,
+    "updatedBy" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "ModelCatalogEntry_pkey" PRIMARY KEY ("provider","modelId")
+);
+
+ALTER TABLE "Run" ADD COLUMN "pricingVersion" TEXT;
+ALTER TABLE "Run" ADD COLUMN "pricingSnapshot" JSONB;
+
+ALTER TABLE "CodingProxySession" ADD COLUMN "pricingVersion" TEXT;
+ALTER TABLE "CodingProxySession" ADD COLUMN "catalogEntry" JSONB;

package/prisma/schema.prisma

@@ -52,6 +52,11 @@ model Agent {
   datastores   AgentDatastore[]
   webhooks     Webhook[]
   repositories AgentRepository[]
+  issueProjects AgentIssueProject[]
+
+  /// Self-defects opt-in: the Jira project and issue type wardby files the agent's own failures into. Both or neither.
+  defectProjectKey String?
+  defectIssueType  String?
 
   // Phase 7: at most one budget group. Null = uncapped beyond its own budgetUsd.
   budgetGroupId String?
@@ -325,6 +330,12 @@ model Run {
   /// finalText — MCP's list_runs/get_run need it and it was previously
   /// dropped after the engine returned.
   turns            Int           @default(0)
+  /// The run's model catalog entry, recorded when it started (native: the
+  /// runner's load step; coding: dispatch). The run is billed at these rates
+  /// for its whole life, resumes included. Null on runs from before the
+  /// model catalog.
+  pricingVersion   String?
+  pricingSnapshot  Json?
   /// Detached executors are recovered by handle rather than inferred from trigger.
   executionManaged Boolean       @default(false)
   /// Phase 6: which durable executor backend holds this run, if any
@@ -335,6 +346,10 @@ model Run {
   codingRun        CodingRun?
   hostCheck        RunHostCheck?
   hostStatus       RunHostStatus?
+  issueStatus      RunIssueStatus?
+  attribution      RunAttribution?
+  modelUsage       RunModelUsage[]
+  serviceStatuses  CodingRunServiceStatus[]
 
   /// Un-phased: sub-agent dispatch (see AgentSubAgent). Null for a
   /// top-level run; set when this run was created by a parent run's
@@ -365,6 +380,11 @@ model Run {
   triggeredById           String?
 
   @@index([agentId, triggeredById])
+  /// The admin viewer's graph window (runs started since a time, or still
+  /// pending/running) and its ancestor/children walks (docs/viewer-api.md).
+  @@index([startedAt])
+  @@index([status])
+  @@index([parentRunId])
 }
 
 /// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
@@ -448,6 +468,9 @@ model CodingRun {
   /// .wardby/services.yaml: one snapshot per service (the catalog entry minus
   /// kind), fixed for the run's lifetime. Empty = none.
   services          Json                @default("[]")
+  /// The originating tracker issue ("jira" + key), set by the control plane from the run tree, never from model output.
+  issueProvider     String?
+  issueKey          String?
   createdAt         DateTime            @default(now())
   updatedAt         DateTime            @updatedAt
   proxySession      CodingProxySession?
@@ -509,6 +532,37 @@ model CodingService {
   @@unique([name, version])
 }
 
+enum CodingServiceState {
+  pending
+  probing
+  ready
+  failed
+}
+
+/// Live start-up state of one coding-run service (one row per run x
+/// service), written by the job launcher as it observes the service, for
+/// display only (the viewer). The run's CodingRun.services
+/// snapshot says what was started; this says how far each one got.
+/// `attempts` is the readiness probes made so far, known only where wardby
+/// runs the probe itself (Docker); `reason` is a fixed identifier
+/// (image_unavailable, start_failed, exited, probe_failed, timed_out),
+/// never probe output.
+model CodingRunServiceStatus {
+  id        String             @id @default(cuid())
+  runId     String
+  run       Run                @relation(fields: [runId], references: [id], onDelete: Cascade)
+  name      String
+  state     CodingServiceState @default(pending)
+  attempts  Int?
+  reason    String?
+  readyAt   DateTime?
+  failedAt  DateTime?
+  createdAt DateTime           @default(now())
+  updatedAt DateTime           @updatedAt
+
+  @@unique([runId, name])
+}
+
 enum CodingProxySessionStatus {
   active
   cancelled
@@ -547,6 +601,12 @@ model CodingProxySession {
   /// first provider failure the proxy relayed for this session; lets the
   /// executor say the model provider refused the run.
   upstreamFailure   String?
+  /// The run's catalog entry, copied from Run.pricingSnapshot when the session
+  /// is created; the proxy prices and shapes requests from it. Null on
+  /// sessions from before the model catalog (the proxy falls back to the
+  /// shipped catalog).
+  pricingVersion String?
+  catalogEntry   Json?
 
   @@index([deadlineAt])
 }
@@ -871,7 +931,7 @@ model AuthUser {
   displayName String?
   status      String                   @default("enabled")
   /// wardby roles (src/mcp/auth/resource-server.ts ROLE_PERMISSIONS: admin,
-  /// package-approver, service-manager), set with `wardby auth user grant`. Empty = member.
+  /// package-approver, service-manager, model-manager), set with `wardby auth user grant`. Empty = member.
   /// A privileged operation needs its scope on the token AND a role here
   /// that grants it; unknown values grant nothing.
   roles       String[]                 @default([])
@@ -999,7 +1059,7 @@ model AgentRepository {
   repository String
   /// "read" or "write".
   access     String
-  /// Subset of "pull_request", "mention".
+  /// Subset of "pull_request", "mention", "push".
   triggers   String[] @default([])
   /// Only with the "pull_request" trigger (required there); names the agent's
   /// check. Unique per repository across all links (NULLs are distinct).
@@ -1115,3 +1175,199 @@ model HostIdentityLinkRequest {
   @@index([principalId])
   @@index([expiresAt])
 }
+
+/// Which issue-tracker projects (Jira today) a native agent may act on, and
+/// which issue events trigger it. Admin-approved in phase 1 (no way to verify
+/// an owner's Jira access). See
+/// docs/private/2026-09-30-jira-issue-tracker-design.md §3.
+model AgentIssueProject {
+  id                    String   @id @default(cuid())
+  agentId               String
+  agent                 Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  /// "jira" today; validated in code.
+  provider              String
+  /// Upper-case Jira project key.
+  projectKey            String
+  /// "read" or "write".
+  access                String
+  /// Subset of "created", "transitioned", "labeled", "assigned", "mention".
+  triggers              String[] @default([])
+  /// With "transitioned": the status names (case-insensitive) that trigger.
+  triggerStatuses       String[] @default([])
+  /// With "labeled": the labels whose addition triggers.
+  triggerLabels         String[] @default([])
+  /// Optional JQL the issue must also match for any trigger.
+  jqlFilter             String?
+  /// Jira accountIds whose @-mention or assignment may trigger (required for those triggers).
+  trustedAccountIds     String[] @default([])
+  /// Optional project role that the agent's comments are restricted to.
+  commentVisibilityRole String?
+  /// Target status names (case-insensitive) jira_transition may move issues to. Empty = no transitions.
+  allowedTransitions    String[] @default([])
+  /// Field ids jira_update_fields may change ("labels", "components", "priority", "customfield_NNNNN"). Empty = none.
+  writableFields        String[] @default([])
+  /// Issue link type names (case-insensitive) jira_link_issues may create. Empty = linking off.
+  allowedLinkTypes      String[] @default([])
+  /// Status to move the issue to when a pull request for it opens (a control-plane move, not gated by allowedTransitions). Null = none.
+  onPullRequestOpened   String?
+  /// Status to move the issue to when a pull request for it merges. Null = none.
+  onPullRequestMerged   String?
+  /// Issue type names (case-insensitive) jira_create_issue may create. Empty = creation off.
+  creatableIssueTypes   String[] @default([])
+  /// Cap on issues one run may create in this project. Null = no cap.
+  maxNewIssuesPerRun    Int?
+  authorizedById        String
+  authorizedAt          DateTime @default(now())
+  createdAt             DateTime @default(now())
+
+  @@unique([agentId, provider, projectKey])
+  @@index([provider, projectKey])
+}
+
+/// Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
+model IssueFingerprint {
+  id              String   @id @default(cuid())
+  issueProvider   String
+  projectKey      String
+  /// sha256 hex of the agent- or control-plane-supplied fingerprint (raw value never stored).
+  fingerprintHash String
+  issueKey        String
+  agentId         String
+  createdByRunId  String?
+  seenCount       Int      @default(1)
+  firstSeenAt     DateTime @default(now())
+  lastSeenAt      DateTime @default(now())
+
+  @@unique([issueProvider, issueKey])
+  @@index([issueProvider, projectKey, fingerprintHash])
+  @@index([createdByRunId])
+}
+
+/// A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+/// Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
+model IssuePullRequest {
+  id            String   @id @default(cuid())
+  /// "jira"
+  issueProvider String
+  issueKey      String
+  /// "github" today; "bitbucket" next.
+  codeProvider  String
+  repository    String
+  number        Int
+  url           String
+  /// The issue-linked agent whose run tree opened it (the parent native agent).
+  agentId       String
+  /// The coding run that opened it (continuePriorRun target for follow-ups).
+  openedByRunId String
+  /// "open" | "merged" | "closed"
+  state         String   @default("open")
+  createdAt     DateTime @default(now())
+  updatedAt     DateTime @updatedAt
+
+  @@unique([codeProvider, repository, number, issueProvider, issueKey])
+  @@index([issueProvider, issueKey])
+  /// The admin viewer's outcome lookup by run.
+  @@index([openedByRunId])
+}
+
+/// The status comment wardby posts on the Jira issue whose event started this
+/// run ("working on it"), edited with the outcome when the run ends.
+model RunIssueStatus {
+  runId          String    @id
+  run            Run       @relation(fields: [runId], references: [id], onDelete: Cascade)
+  provider       String
+  issueKey       String
+  /// Null until the "working on it" comment is posted.
+  commentId      String?
+  visibilityRole String?
+  createdAt      DateTime  @default(now())
+  completedAt    DateTime?
+
+  @@index([completedAt])
+}
+
+/// Latest known state of an issue/epic in an external tracker (Jira, later
+/// Linear). Shared by every run attributed to it; titles are refreshed by the
+/// next snapshot, so reports always show current names.
+model WorkItem {
+  id           String           @id @default(cuid())
+  /// "jira" | "linear" | ...
+  provider     String
+  /// PAY-241, ENG-123
+  key          String
+  title        String?
+  type         String?
+  url          String?
+  /// Jira project / Linear team.
+  scopeKey     String
+  /// The current parent (epic or parent issue), refreshed on each snapshot.
+  parentKey    String?
+  /// "epic" | "parent" | ...
+  parentKind   String?
+  /// Last successful snapshot; null = key-only (never snapshotted).
+  refreshedAt  DateTime?
+  createdAt    DateTime         @default(now())
+  updatedAt    DateTime         @updatedAt
+  attributions RunAttribution[]
+
+  @@unique([provider, key])
+  @@index([provider, parentKey])
+  @@index([provider, scopeKey])
+}
+
+/// Which work item a run's cost belongs to, with its parent frozen as of
+/// dispatch. Written in dispatchRun's persist transaction; child runs copy
+/// their parent's row (source "inherited"). Control-plane data only.
+model RunAttribution {
+  runId          String   @id
+  run            Run      @relation(fields: [runId], references: [id], onDelete: Cascade)
+  workItemId     String
+  workItem       WorkItem @relation(fields: [workItemId], references: [id])
+  parentKeyAtRun String?
+  /// issue_event | linked_pr | explicit | inherited
+  source         String
+  createdAt      DateTime @default(now())
+
+  @@index([workItemId])
+  @@index([parentKeyAtRun])
+}
+
+/// Per-run, per-model usage by priced token kind. Sum of costUsd over a
+/// run's rows equals Run.costUsd (to Run.costUsd's 6 decimal places).
+model RunModelUsage {
+  runId             String
+  run               Run     @relation(fields: [runId], references: [id], onDelete: Cascade)
+  model             String
+  /// Input tokens NOT served from cache (LlmUsage.inputTokens - cachedInputTokens).
+  freshInputTokens  Int     @default(0)
+  cachedInputTokens Int     @default(0)
+  cacheWriteTokens  Int     @default(0)
+  outputTokens      Int     @default(0)
+  costUsd           Decimal @default(0) @db.Decimal(18, 10)
+
+  @@id([runId, model])
+}
+
+/// A deployment's override of the shipped model catalog
+/// (src/providers/llm/catalog-shipped.ts), written by set_model /
+/// disable_model (models:admin). A row fully replaces the shipped entry with
+/// the same key; enabled=false removes the model; a row with no shipped match
+/// adds one. Rates are the provider's exact published numbers (sourceUrl).
+model ModelCatalogEntry {
+  provider           String
+  modelId            String
+  enabled            Boolean
+  encoding           String
+  inputPerMTok       Float
+  outputPerMTok      Float
+  cachedInputPerMTok Float
+  cacheWritePerMTok  Float
+  efforts            String[]
+  thinkingMode       String
+  sourceUrl          String
+  updatedBy          String
+  createdAt          DateTime @default(now())
+  updatedAt          DateTime @updatedAt
+
+  @@id([provider, modelId])
+}

package/dist/mcp/tools/models.d.ts

@@ -1,8 +0,0 @@
-/**
- * Read-only lookup for which model IDs the deployment actually has an LLM
- * provider registered for — without it, the only way to learn a valid
- * model name was to trigger a run and read the "Known models" list off a
- * failed run's error message.
- */
-import type { WardbyMcpServer } from "../server.js";
-export declare function registerModelTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/models.js

@@ -1,15 +0,0 @@
-import { textResult } from "./text-result.js";
-export function registerModelTools(mcp) {
-    mcp.registerTool({
-        name: "list_models",
-        scope: "agents:read",
-        inputSchema: { type: "object", properties: {} },
-        handler: async (_args, ctx) => {
-            // Production always wires ctx.providers.llm as a RoutingLlmProvider
-            // (see buildMcpProviders in mcp/index.ts) — listModels() is specific
-            // to that composite router, not part of the single-provider LlmProvider seam.
-            const llm = ctx.providers.llm;
-            return textResult({ models: llm.listModels() });
-        },
-    });
-}

package/dist/providers/llm/pricing-anthropic.d.ts

@@ -1,14 +0,0 @@
-/**
- * Anthropic direct-API pricing table. Every entry is a fully literal,
- * hardcoded ModelPricing — every field, including cache read/write, is the
- * provider's own published rate for that exact model, never derived from
- * another field via a ratio (see CLAUDE.md "LLM pricing tables — STRICT": a
- * multiplier that happens to be correct today silently goes stale the
- * moment one model's real cache pricing diverges from the pattern).
- */
-import { type ModelPricing, type UsageTokens } from "./pricing-core.js";
-import type { LlmEffort } from "./types.js";
-export declare function anthropicSupportedEfforts(model: string): readonly LlmEffort[];
-export declare function getAnthropicPricing(model: string): ModelPricing;
-export declare function anthropicSupportedModels(): string[];
-export declare function anthropicPriceUsd(model: string, usage: UsageTokens): number;