@wardby/cli 0.5.3 → 0.7.0

package/help/status-comments.md

@@ -0,0 +1,31 @@
+---
+id: status-comments
+title: Run status comments
+summary: Read GitHub and Jira run outcomes, package registry blocked statuses, and Slack notifications.
+audience: operator
+tags: [status, comments, github, jira, slack, blocked, packages, mentions]
+appliesTo: >=0.2.1
+---
+
+# Run status comments
+
+Mentioning the GitHub App starts a run and posts a working status comment.
+The comment is updated when the run finishes, with pull request links, an
+answer, or a failure. This includes a run that a deploy moved to a new
+control-plane process. Jira requests also report their outcome in a status
+comment.
+
+When coding sub-runs record package refusals and no pull request or pushed
+changes result, the comment shows ⛔ **Blocked by the package registry: no
+changes were made.** It lists refused packages, registry codes, and fixes.
+Slack notifications use the same blocked wording. Lists are limited to ten
+distinct entries with a count of remaining refusals; use `get_run` for all.
+When changes were pushed despite refusals, the pull request link stays and
+there is a ⚠️ dependency install warning. Without refusals, the usual ✅
+success or ❌ failure wording remains.
+
+An approver can update the coding agent's package allowlist or policy with
+`update_agent` (requires `packages:approve` or `agents:admin`), then mention
+`@wardby` again. See [Package refusal errors](errors/package-refusals.md) for
+code-specific fixes and [Approve packages for coding agents](coding-packages.md)
+for policy details. Malware checks cannot be bypassed.

package/help/stop-run.md

@@ -0,0 +1,58 @@
+---
+id: stop-run
+title: Stop or cancel a run
+summary: Use stop_run to stop a pending, queued, or running run and its in-flight sub-agent runs; it ends as cancelled.
+audience: operator
+tags: [runs, stop run, cancel run, stop_run, cancelled, schedules, coding-agents, native-agents, sandbox]
+appliesTo: ">=0.7.0"
+---
+
+# Stop or cancel a run
+
+Call the MCP tool `stop_run` with the run's id to stop a run that has not
+finished. Add an optional `reason`; it is recorded on the run.
+
+```text
+stop_run {"runId": "<run id>", "reason": "unwanted scheduled run"}
+```
+
+Find the id with `list_runs` (filter with `"status": "pending"` or
+`"running"`). To stop a schedule from creating more runs, disable it with
+`disable_schedule` as well; `stop_run` stops one run, not the schedule.
+
+## What happens
+
+The run ends as `cancelled`, with `Stopped by <your id> with stop_run: <reason>`
+in its `stopRequestReason` (and, for a native run, in its `error`).
+
+| The run is                                 | `stop_run`                                                                                                                                                                                                     |
+| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Pending, or a coding run queued for a slot | Ends it now. It never starts.                                                                                                                                                                                  |
+| A running native run in the control plane  | Ends it now; the run stops at its next step (the model turn or tool call already under way finishes first).                                                                                                    |
+| A running native run in the sandbox        | Ends it now and ends its gateway session, so the worker's next call is refused and it exits. A worker still running after a short grace (5 seconds) is killed and removed; a warm pool worker is never reused. |
+| A running coding run                       | Ends it, cancels its model proxy session, and stops and removes its worker. It opens or updates no pull request afterwards.                                                                                    |
+| Already finished (any other status)        | Changes nothing and returns its status. Calling `stop_run` again is safe.                                                                                                                                      |
+
+Sub-agent runs the stopped run delegated, and that are still pending or running,
+are stopped too (their ids are in `stoppedChildRunIds`).
+
+Spend already recorded stays counted against the budget. A stopped run is not a
+failure: Slack notifications say it was cancelled, and no defect is filed.
+
+If the result still shows `pending` or `running`, the stop has been recorded
+but has not landed yet; check again with `get_run`.
+
+## Who can stop a run
+
+You need the `runs:trigger` scope and `execute` access to the run's agent, the
+same as `trigger_agent`. The agent's owner can stop any of its runs, including
+scheduled ones; anyone else can stop only runs they triggered. A run you cannot
+see returns `Run "<id>" not found.`, exactly like a missing one; a run you
+triggered but whose agent you can no longer execute returns a 403.
+
+## Related
+
+- [Operate managed agents](operating-agents.md)
+- [Run native agents in a sandbox](native-sandbox.md)
+- [Slack notifications](slack-notifications.md)
+- [Run lost](errors/run-lost.md), for runs a deploy interrupted

package/help/troubleshooting/budgets.md

@@ -41,3 +41,31 @@ with `already_dispatched` and a message naming how many delegations were
 made and how many are waiting for budget.
 
 For a shared-group refusal, read [Budget group exhausted](../errors/budget-group-exhausted.md).
+
+To see exactly which limit stopped a run and with what numbers, read
+`budgetEvents` in `get_run`; see the help article `errors/budget-exhausted`.
+A lead and the sub-agents it starts in the same budget group hold the lead's
+budget once (or its live sub-agent runs' unspent holds, if the lead's overrun
+let them be topped up past it), and `get_budget_group` reports `heldRuns` for
+each period.
+
+A coding run's per-request holds price the cached part of the input at the
+cache-read rate after the first reply of a conversation; see the help article
+`errors/budget-exhausted`.
+
+## Allowing a small overrun
+
+If coding runs stop just short of finishing, set `allowedOverrunPercent` (0 to
+100, default 0) on the coding agent so a run may spend that percent beyond
+`budgetUsd`. Set it on a lead agent that delegates to raise its run tree's
+ceiling for coding sub-agents; native runs' own model calls are not affected.
+
+The overrun is not reserved. A run reserves its base budget, and is topped up
+toward its limit while it works, only from room its budget group and run tree
+have at that moment. Budget group and run-tree caps stay hard: in a full group
+the run stops at what it was granted, and its budget sentence says so ("Only
+$0.40 of its 10% allowed overrun was available because the "team" group had no
+more left of its daily cap."). `get_run` shows `budgetBaseUsd`, the limit in `budgetLimitUsd`, and what
+has been granted so far in `budgetReservedUsd`. A run still stopped for budget
+keeps its work as a draft pull request you can continue. See
+`errors/budget-exhausted`.

package/help/troubleshooting/coding-workers.md

@@ -3,7 +3,7 @@ id: troubleshooting/coding-workers
 title: Troubleshoot coding workers
 summary: Investigate coding-worker setup, isolation preflight, and safe failure handling.
 audience: operator
-tags: [coding-agents, docker, kubernetes, isolation, services]
+tags: [coding-agents, quota, coding_queue_timeout, docker, kubernetes, isolation, services, debug-trace, debugTraceMinutes, debugTraceMaxMb, maxOutputTokens, output-tokens, claude-code, codex, memory, CODING_MEMORY_MB, CODING_CPUS, out-of-memory]
 appliesTo: >=0.2.1
 ---
 
@@ -23,6 +23,27 @@ Review the deployment guide for your target before assigning a coding profile.
 
 For the specific isolation refusal, read [Coding-worker isolation unavailable](../errors/docker-isolation-unsupported.md).
 
+## Cluster preflight at start-up (Kubernetes)
+
+With `JOB_LAUNCHER=kubernetes`, a long-running server process (`wardby
+serve`, `wardby mcp` over either transport, or `wardby scheduler`) starts
+the cluster preflight as soon as it starts, instead of waiting for the
+first coding run. Check the process's start-up log for the result: an info
+line when the preflight passes, or a warning naming the failure code (the
+same `kubernetes_isolation_unsupported:<check>` codes `wardby coding
+preflight` reports) when it does not.
+
+A failed start-up preflight is logged and retried on the next coding run,
+not left failing until a restart: fix the underlying configuration and the
+next run checks the cluster again on its own. If a run was already
+starting at the moment the start-up preflight failed, that one run still
+fails with the logged error — it was waiting on that same check — but the
+run after it retries. This differs from a preflight failure a coding run
+triggers itself (no start-up check ran, or the cluster is still broken when
+the next run checks it): that failure does stick, failing every subsequent
+run in that process until it is restarted. Run `wardby coding preflight` at
+any time for a one-off check against the same cluster.
+
 ## Runs that stop at the turn limit
 
 A Claude Code run whose failure category is `turn_limit` reached its agent's
@@ -33,14 +54,85 @@ raise `codingProfile.maxTurns` (up to 1000) with `update_agent` for the first,
 or narrow the task for the second. Codex runs have no turn limit. See
 [Coding run reached its turn limit](../errors/coding-turn-limit.md).
 
+## Claude Code replies that exceed the output token maximum
+
+A Claude Code run caps each model reply at 32000 output tokens by default,
+thinking included. When a reply needs more, Claude Code ends with an error
+that the response exceeded the output token maximum and the run fails as a
+stream failure. Raise `codingProfile.maxOutputTokens` (1024 to 128000; `null`
+restores the default) with `update_agent`, for example
+`{ "id": "<agent id>", "codingProfile": { "maxOutputTokens": 64000 } }`. The
+coding proxy reserves `maxOutputTokens` × the model's output price against the
+run's budget for every model request, so a higher value needs a larger
+`budgetUsd`; a request whose reservation does not fit ends the run as
+`budget_exhausted` (see the help article `errors/budget-exhausted`), so a small
+budget runs out sooner. Codex agents refuse the
+setting. The default and the setting need a Claude Code worker image from
+Wardby 0.7.0 or later: an older pinned image still caps replies at 4096 tokens
+and rejects a run whose agent sets `maxOutputTokens`.
+
+## Runs refused because the provider is out of credit
+
+A diagnostic of `job_coding_stream_quota_exceeded` means the model provider
+behind the coding proxy refused the run because its account is out of credit or
+over a spend limit, not that the run's own budget ran out. Every run on that
+account fails the same way until the limit is raised; see the help article
+`errors/coding-stream-quota-exceeded`.
+
+## Runs that die while running checks (out of memory)
+
+A run that fails with `coding_failure_executor` while it runs a linter, a type
+check or a test suite has often run out of memory. Each coding pod gets
+`CODING_MEMORY_MB` (2048 MiB by default) and `CODING_CPUS` (1 by default). In a
+Codex run the agent and its commands share that pod. In a Claude Code run the
+commands run in a tool-runner container limited to at most 512 MiB and 0.25 CPU.
+
+1. Turn on a debug trace (below) and run it again. A Node.js crash shows as
+   `Aborted` with exit code 134 in a command's output.
+2. Raise `CODING_MEMORY_MB` and `CODING_CPUS` on the control plane. On GKE, deploy
+   with `CODING_MEMORY_MB=6144 CODING_CPUS=2 deploy/gke/up.sh` (see the GKE deploy
+   guide). This applies to every coding run.
+3. For a Claude Code agent with heavy checks, run it on Codex instead, since raising
+   the pod's memory doesn't raise the tool runner's limit.
+
+## Debug trace
+
+When a run's fixed error code or a slow run doesn't say enough, an admin can
+trace the agent's runs for a while:
+`update_agent { "id": "<agent id>", "codingProfile": { "debugTraceMinutes": 30 } }`.
+Each run dispatched in that window writes its whole agent stream, redacted, to
+its worker container's log under a `debugTrace` key. That covers Codex events,
+or, for Claude Code (Wardby 0.7.0 or later), every Agent SDK message:
+each command the agent ran with its output, the final usage and duration, plus
+stream failures in full. For Claude Code, the time between a command's
+`tool_use` and its `tool_result` line is how long that command took. A run's
+trace stops at 2 MiB by default; set `codingProfile.debugTraceMaxMb` (1 to 64,
+admin only) for more. The trace can hold prompts and repository content, so
+keep it on briefly. See
+[the debug trace section](../../docs/coding-worker-isolation.md#debug-trace)
+for where the log lives and what is redacted.
+
 ## Runs that wait for cluster capacity
 
-On Kubernetes with `KUBERNETES_RESOURCE_QUOTA` set, a run whose pod would not
-fit the namespace quota stays `pending` with `codingQueuedAt` set, like a run
-over `CODING_MAX_CONCURRENT`, and starts once other runs finish. A run still
-waiting after `CODING_QUEUE_TIMEOUT_SEC` fails with `coding_queue_timeout`:
-raise the quota, lower the run pods' size, or lower `CODING_MAX_CONCURRENT` so
-fewer runs compete.
+On Kubernetes, a run whose pod would not fit the namespace quota waits instead
+of failing. With `KUBERNETES_RESOURCE_QUOTA` set, it is held before it starts;
+without it, or if the quota fills up meanwhile, the cluster refuses the pod and
+the run returns to the queue. Either way it stays `pending` with
+`codingQueuedAt` set, like a run over `CODING_MAX_CONCURRENT`, and is retried
+(a refused run no sooner than about a minute later). A refused run shows
+`running` briefly, then `pending` again.
+
+A run still waiting after `CODING_QUEUE_TIMEOUT_SEC` fails with
+`coding_queue_timeout`. That can mean either the concurrency limit or the
+namespace quota. To tell which, look for the control-plane log line
+`coding run waiting for capacity: the cluster refused its pod` (quota), and run
+`kubectl describe resourcequota -n <namespace>` to compare used against hard
+limits. If the quota is full, raise it, lower the run pods' size, or lower
+`CODING_MAX_CONCURRENT` so fewer runs compete; size the quota for
+`CODING_MAX_CONCURRENT` times the run pod's requests. If the log line
+`kubernetes_resource_quota_unconfigured` appears, set `KUBERNETES_RESOURCE_QUOTA`
+to the named quota and grant the launcher `get` on it. See
+[the queue section](../../docs/coding-worker-isolation.md#control-plane-configuration).
 
 A lead agent with `parallelDelegations` starts several coding runs together;
 expect some of them to queue when the lead fans out wider than the free slots.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wardby/cli",
-  "version": "0.5.3",
+  "version": "0.7.0",
   "description": "Self-hosted control plane for budget-guarded AI agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/wardby/wardby#readme",
@@ -58,16 +58,20 @@
     "build:help": "tsx src/help/build.ts",
     "sync:reviewer-prompt": "tsx src/quickstart/sync-reviewer-prompt.ts",
     "build:viewer-schemas": "tsx src/viewer/build-schemas.ts",
-    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json && npm run build:help",
+    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json && node scripts/copy-build-modules.mjs && npm run build:help",
     "prepare": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate",
     "prepack": "npm run build",
-    "cli": "tsx --conditions=wardby-source src/cli.ts",
+    "cli": "tsx --conditions=wardby-source src/wardby-bin.ts",
     "codex:rerecord": "tsx --conditions=wardby-source src/tools/codex-rerecord.ts",
     "capture:autopilot": "tsx --conditions=wardby-source src/tools/capture-autopilot-dry-run.ts",
     "test": "npm run build:vendor && vitest run",
     "test:package": "node scripts/npm-package-acceptance.mjs",
     "test:contract": "vitest run --config vitest.contract.config.ts",
+    "test:release": "npm run build:vendor && vitest run --config vitest.release.config.ts",
     "test:kubernetes": "WARDBY_KUBERNETES_TEST=1 vitest run src/providers/jobs/kubernetes.integration.test.ts",
+    "test:native-docker": "WARDBY_NATIVE_DOCKER_TEST=1 vitest run src/native-worker/docker.acceptance.test.ts",
+    "test:native-kind": "WARDBY_NATIVE_KIND_TEST=1 vitest run src/native-worker/kubernetes.acceptance.test.ts",
+    "test:native-cluster": "WARDBY_NATIVE_CLUSTER_TEST=1 vitest run src/native-worker/kubernetes-cluster.acceptance.test.ts",
     "prisma:generate": "PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate",
     "prisma:migrate": "prisma migrate deploy",
     "dbos:migrate": "dbos schema \"$DATABASE_URL\"",
@@ -79,13 +83,14 @@
     "observability:smoke": "node scripts/grafana-smoke.mjs",
     "observability:down": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml -f deploy/observability/docker-compose.grafana.yml down",
     "worker:image:local": "node scripts/build-local-coding-worker.mjs",
+    "native-worker:image:local": "docker build -f src/native-worker/Dockerfile -t wardby-native-worker:local .",
     "test:phase5": "vitest run src/coding/observability.test.ts src/coding/profile.test.ts src/coding/protocol.test.ts src/providers/coding-proxy/proxy.test.ts src/providers/coding-proxy/secure-fetch.test.ts src/providers/coding-proxy/metering.test.ts src/providers/coding-proxy/runtime.test.ts src/providers/executor/container.test.ts src/providers/jobs/docker.test.ts src/providers/jobs/docker-isolation.test.ts src/providers/jobs/fake.test.ts src/providers/vcs/github.test.ts src/mcp/tools/trigger.test.ts src/core/webhooks.test.ts src/claude-coding-worker/driver.test.ts src/claude-coding-worker/sdk.test.ts src/claude-coding-worker/image-policy.test.ts src/claude-tool-runner/command.test.mjs src/claude-tool-runner/main.test.mjs src/claude-tool-runner/image-policy.test.ts",
     "test:phase5:database": "vitest run src/coding/schema.database.test.ts src/providers/coding-proxy/prisma-ledger.database.test.ts src/providers/executor/container.database.test.ts src/core/coding-concurrency.database.test.ts src/core/scheduler.test.ts src/mcp/integration.test.ts",
     "verify:phase5": "npm run typecheck && npm run test:phase5 && npm run build && npm run worker:image:policy",
     "test:docker-isolation": "node scripts/docker-isolation-acceptance.mjs",
     "test:docker-job": "node scripts/docker-job-acceptance.mjs",
     "test:docker-services": "node scripts/docker-services-acceptance.mjs",
-    "claude:images:local": "docker build -f src/claude-coding-worker/Dockerfile -t wardby-claude-coding-worker:phase5 . && docker build -f src/claude-tool-runner/Dockerfile -t wardby-claude-tool-runner:phase5 . && docker build -f src/claude-tool-runner/Dockerfile --target node-python -t wardby-claude-tool-runner:phase5-node-python .",
+    "claude:images:local": "docker build -f src/claude-coding-worker/Dockerfile -t wardby-claude-coding-worker:phase5 . && docker build -f src/claude-tool-runner/Dockerfile -t wardby-claude-tool-runner:phase5 . && docker build -f src/claude-tool-runner/Dockerfile --target node-python -t wardby-claude-tool-runner:phase5-node-python . && docker build -f src/claude-tool-runner/Dockerfile.custom-example -t wardby-claude-tool-runner-custom:phase5 .",
     "test:claude-compatibility": "docker build -f src/claude-coding-worker/Dockerfile.compatibility -t wardby-claude-compat:phase5 . && docker run --rm wardby-claude-compat:phase5",
     "test:claude-docker": "node scripts/claude-docker-acceptance.mjs",
     "test:production-boundary": "node scripts/production-boundary-policy.mjs",
@@ -95,15 +100,22 @@
   "dependencies": {
     "@anthropic-ai/bedrock-sdk": "^0.33.4",
     "@anthropic-ai/sdk": "^0.124.0",
+    "@aws-crypto/sha256-js": "4.0.0",
+    "@aws-sdk/client-s3": "3.1140.0",
+    "@aws-sdk/lib-storage": "3.1140.0",
+    "@aws-sdk/rds-signer": "3.1140.0",
+    "@aws-sdk/s3-request-presigner": "3.1140.0",
     "@dbos-inc/dbos-sdk": "4.27.6",
+    "@google-cloud/storage": "8.2.0",
     "@kubernetes/client-node": "^2.0.0",
-    "@modelcontextprotocol/client": "^2.3.1",
-    "@modelcontextprotocol/node": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/client": "^2.4.0",
+    "@modelcontextprotocol/node": "^2.1.2",
+    "@modelcontextprotocol/server": "^2.4.0",
     "@prisma/adapter-pg": "7.10.0",
     "@prisma/client": "7.10.0",
     "@prometheus-io/client": "^0.16.1",
     "@renovatebot/pep440": "^5.0.1",
+    "@smithy/signature-v4": "5.7.4",
     "croner": "^10.0.1",
     "dotenv-flow": "^4.1.0",
     "fast-xml-parser": "^5.11.1",
@@ -117,15 +129,15 @@
     "pino": "^9.14.0",
     "quickjs-emscripten": "^0.32.0",
     "semver": "^7.8.5",
+    "smol-toml": "1.9.0",
     "tar-stream": "^3.2.1",
-    "undici": "^8.7.0",
+    "undici": "^8.12.3",
     "yaml": "^2.9.1",
-    "zod": "^3.25.76",
-    "zod-to-json-schema": "^3.25.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@openai/codex-sdk": "0.159.2",
+    "@openai/codex-sdk": "0.160.1",
     "@types/node": "^24.0.0",
     "@types/papaparse": "^5.5.2",
     "@types/pg": "8.23.1",
@@ -141,10 +153,12 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.69.0",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12",
+    "zod-to-json-schema": "^3.25.2"
   },
   "overrides": {
     "deepmerge-ts": "8.0.2",
-    "mysql2": "3.24.4"
+    "mysql2": "3.24.4",
+    "uuid": "11.1.1"
   }
 }

package/prisma/migrations/20261009000003_native_execution_mode/migration.sql

@@ -0,0 +1,12 @@
+-- Additive: per-agent native execution mode (control-plane or sandbox) and the
+-- per-run snapshot the executor routes on. Existing agents default to
+-- control-plane; existing runs keep a null snapshot (legacy = control plane).
+
+-- CreateEnum
+CREATE TYPE "NativeExecutionMode" AS ENUM ('control-plane', 'sandbox');
+
+-- AlterTable
+ALTER TABLE "Agent" ADD COLUMN "nativeExecutionMode" "NativeExecutionMode" NOT NULL DEFAULT 'control-plane';
+
+-- AlterTable
+ALTER TABLE "Run" ADD COLUMN "nativeExecutionMode" "NativeExecutionMode";

package/prisma/migrations/20261009000004_native_gateway_ledger/migration.sql

@@ -0,0 +1,65 @@
+-- Additive: the native sandbox gateway's session and call ledger. A session
+-- authenticates a sandbox worker by capability hash and pins what its run
+-- loaded; calls reserve and settle model spend and keep replayable results.
+
+-- CreateEnum
+CREATE TYPE "NativeGatewaySessionStatus" AS ENUM ('active', 'finished', 'cancelled');
+
+-- CreateEnum
+CREATE TYPE "NativeGatewayCallStatus" AS ENUM ('reserved', 'completed', 'released', 'uncertain', 'pending', 'waiting_budget');
+
+-- CreateTable
+CREATE TABLE "NativeGatewaySession" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "capabilityHash" TEXT NOT NULL,
+    "status" "NativeGatewaySessionStatus" NOT NULL DEFAULT 'active',
+    "deadlineAt" TIMESTAMP(3) NOT NULL,
+    "budgetUsd" DECIMAL(18,10) NOT NULL,
+    "snapshot" JSONB NOT NULL,
+    "budgetExhaustedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "NativeGatewaySession_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "NativeGatewayCall" (
+    "id" TEXT NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "callId" TEXT NOT NULL,
+    "method" TEXT NOT NULL,
+    "status" "NativeGatewayCallStatus" NOT NULL,
+    "reservationUsd" DECIMAL(18,10),
+    "actualCostUsd" DECIMAL(18,10),
+    "inputTokens" INTEGER,
+    "outputTokens" INTEGER,
+    "cachedInputTokens" INTEGER,
+    "cacheWriteTokens" INTEGER,
+    "result" JSONB,
+    "childRunId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "completedAt" TIMESTAMP(3),
+
+    CONSTRAINT "NativeGatewayCall_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NativeGatewaySession_runId_key" ON "NativeGatewaySession"("runId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NativeGatewaySession_capabilityHash_key" ON "NativeGatewaySession"("capabilityHash");
+
+-- CreateIndex
+CREATE INDEX "NativeGatewayCall_sessionId_status_idx" ON "NativeGatewayCall"("sessionId", "status");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NativeGatewayCall_sessionId_callId_key" ON "NativeGatewayCall"("sessionId", "callId");
+
+-- AddForeignKey
+ALTER TABLE "NativeGatewaySession" ADD CONSTRAINT "NativeGatewaySession_runId_fkey" FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "NativeGatewayCall" ADD CONSTRAINT "NativeGatewayCall_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "NativeGatewaySession"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261009000005_native_gateway_call_child_agent/migration.sql

@@ -0,0 +1,5 @@
+-- Additive: a delegation's sub-agent on its gateway call row, so a delegation
+-- waiting for budget holds its place in the per-run delegation limit.
+
+-- AlterTable
+ALTER TABLE "NativeGatewayCall" ADD COLUMN "childAgentId" TEXT;

package/prisma/migrations/20261009000006_run_deferred_start_stop/migration.sql

@@ -0,0 +1,14 @@
+-- Additive: runs dispatched (or asked to stop) by a process that holds no
+-- executor -- the native sandbox gateway -- are started (or stopped) by the
+-- scheduler leader through the server's executor.
+
+-- AlterTable
+ALTER TABLE "Run" ADD COLUMN "startDeferredAt" TIMESTAMP(3),
+ADD COLUMN "stopRequestedAt" TIMESTAMP(3),
+ADD COLUMN "stopRequestReason" TEXT;
+
+-- CreateIndex
+CREATE INDEX "Run_startDeferredAt_idx" ON "Run"("startDeferredAt");
+
+-- CreateIndex
+CREATE INDEX "Run_stopRequestedAt_idx" ON "Run"("stopRequestedAt");

package/prisma/migrations/20261009000007_native_gateway_network_ready/migration.sql

@@ -0,0 +1,5 @@
+-- Additive: when a native sandbox worker's network isolation was proven. The
+-- gateway serves a session only once this is set.
+
+-- AlterTable
+ALTER TABLE "NativeGatewaySession" ADD COLUMN "networkReadyAt" TIMESTAMP(3);

package/prisma/migrations/20261010000001_workflow_notifications/migration.sql

@@ -0,0 +1,99 @@
+-- Workflow notifications (Slack): channel links, the event outbox, per-channel
+-- deliveries, and thread parents. Additive only.
+
+CREATE TABLE "NotificationChannel" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "channelId" TEXT NOT NULL,
+    "channelName" TEXT,
+    "issueProvider" TEXT,
+    "projectKey" TEXT,
+    "agentId" TEXT,
+    "events" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "includeCost" BOOLEAN NOT NULL DEFAULT false,
+    "lastError" TEXT,
+    "lastErrorAt" TIMESTAMP(3),
+    "authorizedById" TEXT NOT NULL,
+    "authorizedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "NotificationChannel_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "NotificationChannel_one_subject" CHECK (
+        ("agentId" IS NOT NULL AND "issueProvider" IS NULL AND "projectKey" IS NULL)
+        OR ("agentId" IS NULL AND "issueProvider" IS NOT NULL AND "projectKey" IS NOT NULL)
+    )
+);
+
+-- Name truncated the way Prisma does for PostgreSQL's 63-byte identifier limit,
+-- so `migrate diff` sees it as the @@unique([provider, channelId, issueProvider, projectKey]).
+-- The one-subject CHECK above has no schema.prisma equivalent; migrate diff ignores it.
+CREATE UNIQUE INDEX "NotificationChannel_provider_channelId_issueProvider_projec_key"
+    ON "NotificationChannel"("provider", "channelId", "issueProvider", "projectKey");
+CREATE UNIQUE INDEX "NotificationChannel_provider_channelId_agentId_key"
+    ON "NotificationChannel"("provider", "channelId", "agentId");
+CREATE INDEX "NotificationChannel_issueProvider_projectKey_idx"
+    ON "NotificationChannel"("issueProvider", "projectKey");
+CREATE INDEX "NotificationChannel_agentId_idx" ON "NotificationChannel"("agentId");
+
+ALTER TABLE "NotificationChannel" ADD CONSTRAINT "NotificationChannel_agentId_fkey"
+    FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE TABLE "WorkflowEvent" (
+    "id" TEXT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "dedupeKey" TEXT NOT NULL,
+    "runId" TEXT,
+    "agentId" TEXT,
+    "workItemProvider" TEXT,
+    "workItemKey" TEXT,
+    "codeProvider" TEXT,
+    "repository" TEXT,
+    "prNumber" INTEGER,
+    "payload" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "WorkflowEvent_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "WorkflowEvent_dedupeKey_key" ON "WorkflowEvent"("dedupeKey");
+CREATE INDEX "WorkflowEvent_createdAt_idx" ON "WorkflowEvent"("createdAt");
+
+CREATE TABLE "NotificationDelivery" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "channelId" TEXT NOT NULL,
+    "threadKey" TEXT NOT NULL,
+    "includeCost" BOOLEAN NOT NULL DEFAULT false,
+    "state" TEXT NOT NULL DEFAULT 'pending',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "nextAttemptAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastError" TEXT,
+    "messageTs" TEXT,
+    "deliveredAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "NotificationDelivery_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "NotificationDelivery_eventId_provider_channelId_key"
+    ON "NotificationDelivery"("eventId", "provider", "channelId");
+CREATE INDEX "NotificationDelivery_state_nextAttemptAt_idx"
+    ON "NotificationDelivery"("state", "nextAttemptAt");
+CREATE INDEX "NotificationDelivery_provider_channelId_threadKey_createdAt_idx"
+    ON "NotificationDelivery"("provider", "channelId", "threadKey", "createdAt");
+
+ALTER TABLE "NotificationDelivery" ADD CONSTRAINT "NotificationDelivery_eventId_fkey"
+    FOREIGN KEY ("eventId") REFERENCES "WorkflowEvent"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE TABLE "NotificationThread" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "channelId" TEXT NOT NULL,
+    "threadKey" TEXT NOT NULL,
+    "parentTs" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "NotificationThread_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "NotificationThread_provider_channelId_threadKey_key"
+    ON "NotificationThread"("provider", "channelId", "threadKey");

package/prisma/migrations/20261011000001_native_gateway_session_status_index/migration.sql

@@ -0,0 +1,2 @@
+-- NATIVE_SANDBOX_MAX_CONCURRENT counts the active native gateway sessions on every sandbox start.
+CREATE INDEX "NativeGatewaySession_status_idx" ON "NativeGatewaySession"("status");

package/prisma/migrations/20261012000001_native_warm_worker/migration.sql

@@ -0,0 +1,32 @@
+-- Additive: the native sandbox warm pool. One row per pool worker, inserted
+-- before the worker exists; a run claims an idle row with a conditional update.
+
+-- CreateEnum
+CREATE TYPE "NativeWarmWorkerStatus" AS ENUM ('warming', 'idle', 'claimed', 'retiring');
+
+-- CreateTable
+CREATE TABLE "NativeWarmWorker" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "status" "NativeWarmWorkerStatus" NOT NULL DEFAULT 'warming',
+    "specHash" TEXT NOT NULL,
+    "runId" TEXT,
+    "readyAt" TIMESTAMP(3),
+    "claimedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "NativeWarmWorker_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NativeWarmWorker_name_key" ON "NativeWarmWorker"("name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NativeWarmWorker_runId_key" ON "NativeWarmWorker"("runId");
+
+-- CreateIndex
+CREATE INDEX "NativeWarmWorker_status_specHash_idx" ON "NativeWarmWorker"("status", "specHash");
+
+-- AddForeignKey
+ALTER TABLE "NativeWarmWorker" ADD CONSTRAINT "NativeWarmWorker_runId_fkey" FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20261013000001_coding_run_merge_order/migration.sql

@@ -0,0 +1,2 @@
+-- Additive: the merge step a delegating agent assigned to this coding run.
+ALTER TABLE "CodingRun" ADD COLUMN "mergeOrder" INTEGER;

package/prisma/migrations/20261013000001_secret_broker/migration.sql

@@ -0,0 +1,17 @@
+ALTER TABLE "Secret" ADD COLUMN "broker" JSONB;
+
+CREATE TABLE "SecretBrokerChange" (
+    "id" TEXT NOT NULL,
+    "secretId" TEXT NOT NULL,
+    "ownerId" TEXT NOT NULL,
+    "secretName" TEXT NOT NULL,
+    "actorId" TEXT NOT NULL,
+    "before" JSONB,
+    "after" JSONB,
+    "via" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "SecretBrokerChange_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "SecretBrokerChange_secretId_createdAt_idx" ON "SecretBrokerChange"("secretId", "createdAt");
+CREATE INDEX "SecretBrokerChange_ownerId_createdAt_idx" ON "SecretBrokerChange"("ownerId", "createdAt");

package/prisma/migrations/20261013000002_deferred_review_request/migration.sql

@@ -0,0 +1,4 @@
+-- Additive: a deferred review can wait for the delegating lead run, not just CI.
+ALTER TABLE "DeferredReview" ADD COLUMN "reason" TEXT NOT NULL DEFAULT 'ci',
+ADD COLUMN "leadRunId" TEXT;
+CREATE INDEX "DeferredReview_leadRunId_idx" ON "DeferredReview"("leadRunId");