@wardby/cli 0.5.3 → 0.7.0

package/prisma/schema.prisma

@@ -25,6 +25,8 @@ model Agent {
   systemPrompt  String
   model         String
   budgetUsd     Decimal             @db.Decimal(10, 4)
+  /// Percent above budgetUsd a run may spend: each coding run's limit, or (on a lead agent) its run tree's ceiling for coding sub-agents; native model calls are unaffected; group caps still apply.
+  allowedOverrunPercent Int @default(0)
   createdAt     DateTime            @default(now())
   updatedAt     DateTime            @updatedAt
   runs          Run[]
@@ -39,25 +41,26 @@ model Agent {
   lastScheduledAt DateTime?
 
   // Phase 3: tools + multi-turn loop.
-  tools    AgentTool[]
-  maxTurns Int         @default(10)
+  tools                AgentTool[]
+  maxTurns             Int         @default(10)
   /// Sub-agent delegations one run may make (delegate_to_*), each to a different sub-agent. 1 = route to exactly one.
-  maxDelegationsPerRun Int @default(1)
+  maxDelegationsPerRun Int         @default(1)
   /// Native leads: the delegate_to_* calls of one model turn run at the same time. False = one after another.
-  parallelDelegations Boolean @default(false)
+  parallelDelegations  Boolean     @default(false)
 
   // Phase 4: ownership. Null = owner-less, a transition state only: access
   // then comes from ResourceGrant rows alone (the migration gives everyone
   // execute), and `wardby grants adopt-public` assigns an owner. See
   // ResourceGrant.
-  ownerId      String?
-  owner        Principal?        @relation(fields: [ownerId], references: [id])
-  secrets      AgentSecret[]
-  datastores   AgentDatastore[]
-  webhooks     Webhook[]
-  repositories AgentRepository[]
-  deferredReviews DeferredReview[]
-  issueProjects AgentIssueProject[]
+  ownerId              String?
+  owner                Principal?            @relation(fields: [ownerId], references: [id])
+  secrets              AgentSecret[]
+  datastores           AgentDatastore[]
+  webhooks             Webhook[]
+  repositories         AgentRepository[]
+  deferredReviews      DeferredReview[]
+  issueProjects        AgentIssueProject[]
+  notificationChannels NotificationChannel[]
 
   /// Self-defects opt-in: the Jira project and issue type wardby files the agent's own failures into. Both or neither.
   defectProjectKey String?
@@ -78,6 +81,12 @@ model Agent {
   /// Null = the provider's default.
   effort String?
 
+  /// Native agents only: where their runs execute. control-plane (default) =
+  /// in this server process (in-process or DBOS); sandbox = an isolated,
+  /// single-use worker container/pod. Each Run snapshots this at creation
+  /// (Run.nativeExecutionMode), so a change reaches only later runs.
+  nativeExecutionMode NativeExecutionMode @default(control_plane)
+
   /// Un-phased: sub-agent composition edges (see AgentSubAgent below). An
   /// agent can be a parent (has children it can delegate to) and/or a
   /// child (is delegated to by others) independently.
@@ -134,6 +143,12 @@ enum AgentKind {
   coding
 }
 
+/// Where a native agent's runs execute (Agent.nativeExecutionMode).
+enum NativeExecutionMode {
+  control_plane @map("control-plane")
+  sandbox
+}
+
 enum RunStatus {
   pending
   running
@@ -312,51 +327,72 @@ enum RunTrigger {
 }
 
 model Run {
-  id               String        @id @default(cuid())
-  agent            Agent         @relation(fields: [agentId], references: [id])
-  agentId          String
-  status           RunStatus     @default(pending)
-  trigger          RunTrigger    @default(manual)
-  tokensIn         Int           @default(0)
-  tokensOut        Int           @default(0)
-  costUsd          Decimal       @default(0) @db.Decimal(10, 6)
-  error            String?
-  startedAt        DateTime      @default(now())
-  finishedAt       DateTime?
+  id                   String                   @id @default(cuid())
+  agent                Agent                    @relation(fields: [agentId], references: [id])
+  agentId              String
+  status               RunStatus                @default(pending)
+  trigger              RunTrigger               @default(manual)
+  tokensIn             Int                      @default(0)
+  tokensOut            Int                      @default(0)
+  costUsd              Decimal                  @default(0) @db.Decimal(10, 6)
+  error                String?
+  startedAt            DateTime                 @default(now())
+  finishedAt           DateTime?
   /// Phase 2: beaten by the executor while running; a stale value past
   /// HEARTBEAT_TIMEOUT is how the reconciler finds an orphaned run.
-  heartbeatAt      DateTime?
+  heartbeatAt          DateTime?
   /// Phase 4: EngineResult.finalText, persisted so a Task (MCP) or later
   /// inspection can read a completed run's answer. Previously only ever
   /// streamed live via onText and dropped — no durable place to read it
   /// from until this field existed.
-  finalText        String?
+  finalText            String?
   /// Phase 4: EngineResult.turns, persisted for the same reason as
   /// finalText — MCP's list_runs/get_run need it and it was previously
   /// dropped after the engine returned.
-  turns            Int           @default(0)
+  turns                Int                      @default(0)
   /// The run's model catalog entry, recorded when it started (native: the
   /// runner's load step; coding: dispatch). The run is billed at these rates
   /// for its whole life, resumes included. Null on runs from before the
   /// model catalog.
-  pricingVersion   String?
-  pricingSnapshot  Json?
+  pricingVersion       String?
+  pricingSnapshot      Json?
   /// Detached executors are recovered by handle rather than inferred from trigger.
-  executionManaged Boolean       @default(false)
+  executionManaged     Boolean                  @default(false)
   /// Phase 6: which durable executor backend holds this run, if any
   /// ("dbos" = a DBOS workflow whose id equals this run's id). Null for
   /// in-process runs. The reconciler consults the backend before declaring a
   /// stale run lost, and can adopt one orphaned by a dead instance.
-  executionBackend String?
-  codingRun        CodingRun?
-  hostCheck        RunHostCheck?
-  hostStatus       RunHostStatus?
-  issueStatus      RunIssueStatus?
-  attribution      RunAttribution?
-  modelUsage       RunModelUsage[]
-  serviceStatuses  CodingRunServiceStatus[]
+  executionBackend     String?
+  /// The DBOS workflow that currently holds this run, when it is not the run id: set when
+  /// recover() forks the run's workflow under a new application version. Null = the run id.
+  executionWorkflowId  String?
+  /// The agent's nativeExecutionMode when this run was created, fixed for the
+  /// run's life and what the executor routes on. Null for coding runs and for
+  /// native runs from before the field existed, which run in the control plane.
+  nativeExecutionMode  NativeExecutionMode?
+  codingRun            CodingRun?
+  transcript           RunTranscript?
+  hostCheck            RunHostCheck?
+  hostStatus           RunHostStatus?
+  issueStatus          RunIssueStatus?
+  attribution          RunAttribution?
+  modelUsage           RunModelUsage[]
+  serviceStatuses      CodingRunServiceStatus[]
+  budgetEvents         RunBudgetEvent[]
   /// A manual review of a local branch: this run is the review run dispatched for it.
-  localPullRequest LocalPullRequest?
+  localPullRequest     LocalPullRequest?
+  /// A sandbox-mode native run's gateway session (native sandbox phase 3).
+  nativeGatewaySession NativeGatewaySession?
+  /// The warm pool worker this sandbox-mode run claimed (native sandbox phase 6).
+  nativeWarmWorker     NativeWarmWorker?
+  /// Set when a process that may not start runs itself (the native sandbox
+  /// gateway, which holds no executor) dispatched this run: the scheduler
+  /// leader starts it through the server's executor and clears this.
+  startDeferredAt      DateTime?
+  /// Likewise a stop that process asked for: the scheduler leader stops the
+  /// run through the server's executor and clears this.
+  stopRequestedAt      DateTime?
+  stopRequestReason    String?
 
   /// Un-phased: sub-agent dispatch (see AgentSubAgent). Null for a
   /// top-level run; set when this run was created by a parent run's
@@ -367,6 +403,9 @@ model Run {
   parentRunId             String?
   parentRun               Run?     @relation("RunTree", fields: [parentRunId], references: [id])
   childRuns               Run[]    @relation("RunTree")
+  /// The parent's delegation call (the model's tool-call id) that created this child, so a
+  /// re-executed delegate step finds the same child instead of starting another.
+  parentCallId            String?
   /// Ephemeral, per-dispatch grant: exactly the parent-memory keys this
   /// one child run was handed permission to read via parent_memory_get.
   /// Never a standing allowlist — re-granted on every dispatch call.
@@ -392,39 +431,62 @@ model Run {
   @@index([startedAt])
   @@index([status])
   @@index([parentRunId])
+  @@index([startDeferredAt])
+  @@index([stopRequestedAt])
+  @@unique([parentRunId, parentCallId])
 }
 
 /// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
 /// launcher handles never live on the reusable profile.
 model CodingAgentProfile {
-  agentId                  String  @id
-  agent                    Agent   @relation(fields: [agentId], references: [id], onDelete: Cascade)
-  provider                 String  @default("codex")
+  agentId                  String            @id
+  agent                    Agent             @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  provider                 String            @default("codex")
   repository               String
-  baseRef                  String  @default("main")
+  baseRef                  String            @default("main")
   defaultTask              String?
-  allowWebhookTaskOverride Boolean @default(false)
-  timeoutSec               Int     @default(1800)
+  allowWebhookTaskOverride Boolean           @default(false)
+  timeoutSec               Int               @default(1800)
   /// Claude Code runs only: the most agent turns a run may take. Null = the worker default (200).
   maxTurns                 Int?
+  /// Claude Code runs only: the most output tokens per model reply (1024-128000). Null = the worker default (32000).
+  maxOutputTokens          Int?
   /// Unused; dropped after rollout (see the package-registry plan, Task 14).
-  allowedEgress            Json    @default("[]")
+  allowedEgress            Json              @default("[]")
   protectedPaths           Json
-  collectExclude           Json    @default("[]")
-  toolchain                String  @default("node")
+  collectExclude           Json              @default("[]")
+  toolchain                String            @default("node")
   toolchainVersion         String?
   workerImageRef           String?
   /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
   workspaceDiskMb          Int?
-  packageAllowlist         Json    @default("{}")
-  packagePolicy            Json    @default("{}")
+  packageAllowlist         Json              @default("{}")
+  packagePolicy            Json              @default("{}")
   /// Admin-requested debug trace: while now < debugTraceUntil, every coding
   /// run of this agent is dispatched with CodingRun.debugTrace set. Null = off.
   debugTraceUntil          DateTime?
+  /// Admin-set cap on one traced run's trace output, in MiB; null = the worker default (2).
+  debugTraceMaxMb          Int?
   /// Coding-run services (docs/coding-services.md): the catalog names
   /// (CodingService.name) this agent's runs may start, any version the catalog
   /// has. Empty = none. Owner-set through update_agent.
-  services                 Json      @default("[]")
+  services                 Json              @default("[]")
+  /// Load the repository's agent skills into coding runs (Codex: .agents/skills, .codex/skills;
+  /// Claude Code: .claude/skills). Repo instructions (AGENTS.md / CLAUDE.md) load regardless.
+  repoSkills               Boolean           @default(true)
+  /// Claude Code runs only: keep Claude Code's bare mode (CLAUDE_CODE_SIMPLE=1); wardby injects
+  /// repo instructions and the skill list into the system prompt. False = Claude Code's native loading.
+  claudeBareMode           Boolean           @default(true)
+  /// Restore node_modules from a cached snapshot (written only by trusted wardby code before the
+  /// agent starts) instead of a full install. Owner-set; off by default.
+  dependencyCache          Boolean           @default(false)
+  /// Keep each Claude Code run's session transcript so it can be resumed in a local CLI
+  /// (docs/coding-agent-setup.md#resume-a-run-locally). Owner-set; off by default.
+  sessionResume            Boolean           @default(false)
+  /// Owner-set package audit mode (docs/coding-packages.md#package-audit-mode); active while now < packageAuditUntil.
+  packageAuditMode         PackageAuditMode?
+  /// End of the audit window; null = off.
+  packageAuditUntil        DateTime?
 
   /// How `repository` was authorized for this agent (see AgentRepository.authorizedVia):
   /// "host_permission", "admin", or "grandfathered". Null = never authorized; runs are refused.
@@ -437,58 +499,103 @@ model CodingAgentProfile {
 /// Phase 5: immutable dispatch inputs plus opaque execution/result state for
 /// one coding run. Policy is copied from the profile before work starts.
 model CodingRun {
-  runId             String              @id
-  run               Run                 @relation(fields: [runId], references: [id], onDelete: Cascade)
-  task              String
-  repository        String
-  baseRef           String
-  headRef           String
-  provider          String
-  model             String
-  timeoutSec        Int
+  runId                 String              @id
+  run                   Run                 @relation(fields: [runId], references: [id], onDelete: Cascade)
+  task                  String
+  /// The run's own request (the trigger's task or the agent's default task), without the agent's standing instructions. Null on older runs.
+  request               String?             @db.Text
+  repository            String
+  baseRef               String
+  headRef               String
+  provider              String
+  model                 String
+  timeoutSec            Int
   /// Unused; dropped after rollout (see the package-registry plan, Task 14).
-  allowedEgress     Json                @default("[]")
-  protectedPaths    Json
-  collectExclude    Json                @default("[]")
-  jobBackend        String?
-  jobHandle         String?
-  result            Json?
-  resultSchema      Int                 @default(1)
+  allowedEgress         Json                @default("[]")
+  protectedPaths        Json
+  collectExclude        Json                @default("[]")
+  jobBackend            String?
+  jobHandle             String?
+  result                Json?
+  resultSchema          Int                 @default(1)
   /// Sanitized terminal classification and an opaque log correlation reference.
   /// Neither field may contain task, repository, environment, or credential data.
-  failureCategory   String?
-  diagnosticId      String?
-  workerImage       String?
+  failureCategory       String?
+  diagnosticId          String?
+  workerImage           String?
   /// Claude Code's tool-runner image, resolved from the agent's toolchain at dispatch; null for Codex runs.
-  toolImage         String?
-  budgetReservedUsd Decimal             @db.Decimal(10, 6)
+  toolImage             String?
+  /// What the run may spend now: its base, plus every overrun top-up granted so
+  /// far (on runs with budgetLimitUsd). Budget groups and run trees hold it.
+  budgetReservedUsd     Decimal             @db.Decimal(10, 6)
+  /// The budget before the agent's allowed overrun. Null on older runs.
+  budgetBaseUsd         Decimal?            @db.Decimal(10, 6)
+  /// The most the run may spend: its base budget raised by the agent's allowed
+  /// overrun, never reserved up front; top-ups raise budgetReservedUsd toward it
+  /// only from room its group and run tree have left. Null = no top-ups (older
+  /// runs, or no allowed overrun): budgetReservedUsd is the limit.
+  budgetLimitUsd        Decimal?            @db.Decimal(10, 6)
+  /// What set budgetReservedUsd below the agent's own budget at dispatch:
+  /// run-tree, day, week or month. Null = the agent's own budget.
+  budgetLimitedBy       String?
   /// Phase 12 concurrency queue: set when start() found every coding slot
   /// taken (CODING_MAX_CONCURRENT), cleared when the run claims a slot. A
   /// pending run with queuedAt set is waiting, not orphaned.
-  queuedAt          DateTime?
+  queuedAt              DateTime?
   /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
-  workspaceDiskMb   Int?
-  packageAllowlist  Json                @default("{}")
-  packagePolicy     Json                @default("{}")
+  workspaceDiskMb       Int?
+  packageAllowlist      Json                @default("{}")
+  packagePolicy         Json                @default("{}")
   /// Fixed at dispatch from the profile's debugTraceUntil: the worker writes a
   /// full stream trace to its own pod log (never to the database).
-  debugTrace        Boolean             @default(false)
+  debugTrace            Boolean             @default(false)
+  /// Fixed at dispatch from the profile's debugTraceMaxMb, only on a traced run. Null = the worker default.
+  debugTraceMaxMb       Int?
   /// Fixed at dispatch from the profile's maxTurns: the Claude Code worker's turn limit. Null = the worker default.
-  maxTurns          Int?
+  maxTurns              Int?
+  /// Fixed at dispatch from the profile's maxOutputTokens: Claude Code's output tokens per reply. Null = the worker default.
+  maxOutputTokens       Int?
+  /// Fixed at dispatch from the profile's repoSkills.
+  repoSkills            Boolean             @default(true)
+  /// Fixed at dispatch from the profile's claudeBareMode.
+  claudeBareMode        Boolean             @default(true)
   /// Coding-run services resolved at dispatch from the base branch's
   /// .wardby/services.yaml: one snapshot per service (the catalog entry minus
   /// kind), fixed for the run's lifetime. Empty = none.
-  services          Json                @default("[]")
+  services              Json                @default("[]")
   /// The originating tracker issue ("jira" + key), set by the control plane from the run tree, never from model output.
-  issueProvider     String?
-  issueKey          String?
+  issueProvider         String?
+  issueKey              String?
   /// The branch a run pushed to a local repository (no pull request exists); null otherwise.
-  resultBranch      String?
+  resultBranch          String?
   /// The commit the run started from (the base ref's tip when the workspace was prepared).
-  baseSha           String?
-  createdAt         DateTime            @default(now())
-  updatedAt         DateTime            @updatedAt
-  proxySession      CodingProxySession?
+  baseSha               String?
+  /// Step in the request's merge order set by the delegating agent (1 = first); null = no order.
+  mergeOrder            Int?
+  /// When Wardby marked this run's pull request ready for review (at most once;
+  /// a person moving it back to draft is final). Only set on a root coding run.
+  markedReadyAt         DateTime?
+  /// Root coding run only: SHA-256 (hex) of the pull request description Wardby last wrote,
+  /// normalized (CRLF→LF, Related pull requests section removed, blank lines collapsed, trimmed).
+  /// Null = never recorded (pull requests opened before this column, or a lost first write).
+  prDescriptionSha256   String?
+  /// Root coding run only: the coding run whose final message is that description's agent-written part.
+  prDescriptionRunId    String?
+  /// This run's description update: written | replaced | refreshed:<reason> | unchanged |
+  /// edited_by_hand | skipped:<reason>. Null = not attempted.
+  prDescriptionOutcome  String?
+  /// Fixed at dispatch from the profile's dependencyCache.
+  dependencyCache       Boolean             @default(false)
+  /// Fixed at dispatch from the profile's sessionResume.
+  sessionResume         Boolean             @default(false)
+  /// What the run's dependency cache did, written by the control plane when it collects the run:
+  /// { result, key?, sizeBytes?, restoreMs?, installMs?, reason? }. Null = not used or not reported.
+  dependencyCacheResult Json?
+  /// Fixed at dispatch: the profile's packageAuditMode when its window was open, else null.
+  packageAuditMode      PackageAuditMode?
+  createdAt             DateTime            @default(now())
+  updatedAt             DateTime            @updatedAt
+  proxySession          CodingProxySession?
 
   /// Revision-in-place for continuing an existing coding pull request.
   /// Points directly at the ROOT CodingRun that actually owns the branch/PR
@@ -504,11 +611,35 @@ model CodingRun {
   registryFetches          RegistryFetch[]
   registryApprovedVersions RegistryApprovedVersion[]
   registryPlanRefusals     RegistryPlanRefusal[]
+  registryAuditRecords     RegistryAuditRecord[]
+  dependencySnapshots      DependencySnapshot[]
 
   @@index([jobBackend, jobHandle])
   @@index([failureCategory])
   @@index([queuedAt])
   @@index([rootCodingRunId])
+  @@index([mergeOrder])
+}
+
+/// A coding run's session transcript for local resume: metadata only. The redacted content lives in
+/// the blob store under blobKey; the unredacted transcript is never stored.
+model RunTranscript {
+  runId     String   @id
+  run       Run      @relation(fields: [runId], references: [id], onDelete: Cascade)
+  /// "claude-code" (Codex later).
+  provider  String
+  /// stored | too_large | not_captured | failed
+  status    String
+  /// Fixed code for a status other than stored (e.g. missing, no_blob_store, secrets_unavailable); never content.
+  reason    String?
+  sessionId String?
+  blobKey   String?
+  sizeBytes Int?
+  sha256    String?
+  createdAt DateTime @default(now())
+  expiresAt DateTime
+
+  @@index([expiresAt])
 }
 
 /// Coding-run services (docs/coding-services.md): the catalog a repository's
@@ -590,44 +721,185 @@ enum CodingProxyRequestStatus {
   uncertain
 }
 
+enum RunBudgetEventKind {
+  refused
+  /// A coding run's overrun top-up found no room in its budget group or run tree.
+  overrun_unavailable
+}
+
+/// One budget decision about a run: a refusal by the coding proxy or at
+/// dispatch, or an overrun top-up with no room, with the numbers behind it.
+/// `limit` names what refused it: run, run-tree, day, week or month. `details`
+/// holds amounts, the model and the turn; never secrets or message text.
+model RunBudgetEvent {
+  id      String             @id @default(cuid())
+  runId   String
+  run     Run                @relation(fields: [runId], references: [id], onDelete: Cascade)
+  kind    RunBudgetEventKind
+  limit   String
+  at      DateTime           @default(now())
+  details Json
+
+  @@index([runId, at])
+}
+
+enum NativeGatewaySessionStatus {
+  active
+  finished
+  cancelled
+}
+
+enum NativeWarmWorkerStatus {
+  warming
+  idle
+  claimed
+  retiring
+}
+
+enum NativeGatewayCallStatus {
+  reserved
+  completed
+  released
+  uncertain
+  pending
+  waiting_budget
+}
+
+/// The trusted gateway's record of one sandbox-mode native run (native
+/// sandbox phase 3): the worker authenticates with a capability whose hash is
+/// stored here (the raw token is never persisted), and any control-plane
+/// replica can serve it from this row. `snapshot` is what the run loaded --
+/// the worker's input plus trusted-only capabilities and links -- and never
+/// holds a secret value.
+model NativeGatewaySession {
+  id                String                     @id @default(cuid())
+  runId             String                     @unique
+  run               Run                        @relation(fields: [runId], references: [id], onDelete: Cascade)
+  capabilityHash    String                     @unique
+  status            NativeGatewaySessionStatus @default(active)
+  deadlineAt        DateTime
+  budgetUsd         Decimal                    @db.Decimal(18, 10)
+  snapshot          Json
+  /// Set the first time the gateway refuses a model call for budget.
+  budgetExhaustedAt DateTime?
+  /// When the worker's network isolation was proven (a Kubernetes run's in-pod
+  /// probe; a Docker run's network exists before its container). The gateway
+  /// serves nothing before this is set.
+  networkReadyAt    DateTime?
+  /// What the run's review tools have read (ReviewReadsState), saved between gateway requests
+  /// for repo_publish_review's unread_files check. Null until the run reads a pull request.
+  reviewReads       Json?
+  createdAt         DateTime                   @default(now())
+  updatedAt         DateTime                   @updatedAt
+  calls             NativeGatewayCall[]
+
+  /// NATIVE_SANDBOX_MAX_CONCURRENT counts the active sessions on every start.
+  @@index([status])
+}
+
+/// One worker of the native sandbox warm pool (native sandbox phase 6): an
+/// isolated worker started before any run exists, holding no run data or
+/// capability. A run claims an idle one with a compare-and-swap on this row
+/// (`runId` is set at the claim), its input is delivered only after, and the
+/// worker is destroyed after that one run. The row is inserted before the
+/// worker is created, so a worker with no row is an orphan.
+model NativeWarmWorker {
+  /// The worker's random token; its container or pod name carries it.
+  id        String                 @id
+  name      String                 @unique
+  status    NativeWarmWorkerStatus @default(warming)
+  /// What the worker was built from (image, limits, isolation settings): a
+  /// claim only takes a worker of the current spec.
+  specHash  String
+  runId     String?                @unique
+  run       Run?                   @relation(fields: [runId], references: [id], onDelete: SetNull)
+  /// When its isolation was proven and it became claimable.
+  readyAt   DateTime?
+  claimedAt DateTime?
+  createdAt DateTime               @default(now())
+  updatedAt DateTime               @updatedAt
+
+  @@index([status, specHash])
+}
+
+/// One worker call through the gateway, keyed by its callId: model calls are
+/// reserved before the provider is called and settled after; side-effecting
+/// built-in and bridge calls keep their result so a retried callId replays it;
+/// a delegation records the child run it started.
+model NativeGatewayCall {
+  id                String                  @id @default(cuid())
+  sessionId         String
+  session           NativeGatewaySession    @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+  callId            String
+  method            String
+  status            NativeGatewayCallStatus
+  reservationUsd    Decimal?                @db.Decimal(18, 10)
+  actualCostUsd     Decimal?                @db.Decimal(18, 10)
+  /// actualCostUsd is an estimate for an interrupted call, not provider usage.
+  costEstimated     Boolean                 @default(false)
+  inputTokens       Int?
+  outputTokens      Int?
+  cachedInputTokens Int?
+  cacheWriteTokens  Int?
+  /// A replayable result. Never a secret value.
+  result            Json?
+  childRunId        String?
+  /// A delegation's sub-agent, recorded at admission (it holds a place while waiting for budget).
+  childAgentId      String?
+  createdAt         DateTime                @default(now())
+  updatedAt         DateTime                @updatedAt
+  completedAt       DateTime?
+
+  @@unique([sessionId, callId])
+  @@index([sessionId, status])
+}
+
 /// Trusted-boundary state for one coding run. Only a capability digest and an
 /// upstream credential reference are persisted; neither secret value enters the DB.
 model CodingProxySession {
-  id             String                   @id @default(cuid())
-  runId          String                   @unique
-  run            CodingRun                @relation(fields: [runId], references: [runId], onDelete: Cascade)
-  capabilityHash String                   @unique
-  credentialRef  String
-  protocol       String                   @default("openai-responses")
-  allowedModels  Json
-  deadlineAt     DateTime
-  budgetUsd      Decimal                  @db.Decimal(18, 10)
-  status         CodingProxySessionStatus @default(active)
-  createdAt      DateTime                 @default(now())
-  updatedAt      DateTime                 @updatedAt
-  requests       CodingProxyRequest[]
+  id                        String                   @id @default(cuid())
+  runId                     String                   @unique
+  run                       CodingRun                @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  capabilityHash            String                   @unique
+  credentialRef             String
+  protocol                  String                   @default("openai-responses")
+  allowedModels             Json
+  deadlineAt                DateTime
+  budgetUsd                 Decimal                  @db.Decimal(18, 10)
+  status                    CodingProxySessionStatus @default(active)
+  createdAt                 DateTime                 @default(now())
+  updatedAt                 DateTime                 @updatedAt
+  requests                  CodingProxyRequest[]
   /// Hash of the derived registry-only token (see deriveRegistryToken); the
   /// token itself is never persisted.
-  registryTokenHash String?               @unique
+  registryTokenHash         String?                  @unique
   /// Set the first time the proxy refuses a request of this session for
   /// budget; lets the executor report the run as out of budget.
-  budgetExhaustedAt DateTime?
+  budgetExhaustedAt         DateTime?
+  /// The numbers behind the first budget refusal of this session (budget, spent, holds, refused hold, model, turn); the control plane copies them into RunBudgetEvent. Never secrets.
+  budgetRefusal             Json?
   /// The upstream error code (a fixed identifier, never a message) of the
   /// first provider failure the proxy relayed for this session; lets the
   /// executor say the model provider refused the run.
-  upstreamFailure   String?
+  upstreamFailure           String?
   /// The run's catalog entry, copied from Run.pricingSnapshot when the session
   /// is created; the proxy prices and shapes requests from it. Null on
   /// sessions from before the model catalog (the proxy falls back to the
   /// shipped catalog).
-  pricingVersion String?
-  catalogEntry   Json?
+  pricingVersion            String?
+  catalogEntry              Json?
+  /// Dependency cache: every lockfile hash this session's plans approved (with
+  /// no refusals) while unsealed, at most 8. Only these may be restored or uploaded.
+  dependencyCacheLockHashes String[]                 @default([])
+  /// Set when the run's dependency step is over; after it the cache refuses this session.
+  dependencyCacheSealedAt   DateTime?
 
   @@index([deadlineAt])
 }
 
-/// Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
-/// crash or truncated provider stream can never create new spendable budget.
+/// Monotonic per-upstream-call ledger. An uncertain request without an
+/// estimate stays held in full; one the proxy estimated (costEstimated) counts
+/// at that estimate.
 model CodingProxyRequest {
   id                 String                   @id @default(cuid())
   sessionId          String
@@ -638,6 +910,17 @@ model CodingProxyRequest {
   status             CodingProxyRequestStatus @default(reserved)
   reservationUsd     Decimal                  @db.Decimal(18, 10)
   actualCostUsd      Decimal?                 @db.Decimal(18, 10)
+  /// actualCostUsd is the proxy's estimate for an interrupted (uncertain)
+  /// reply, not provider-reported usage.
+  costEstimated      Boolean                  @default(false)
+  /// UTF-8 bytes of the forwarded request body; the next request's hold compares against it.
+  requestBytes       Int?
+  /// The worst-case hold (whole body as uncached input); a reply costing more cancels the session.
+  ceilingUsd         Decimal?                 @db.Decimal(18, 10)
+  /// "cached" (priced from the conversation's previous reply) or "full" (= ceilingUsd).
+  reservationBasis   String?
+  /// sha256 of what identifies the conversation (first message, or OpenAI prompt_cache_key).
+  conversationKey    String?
   pricingVersion     String
   pricingSnapshot    Json
   inputTokens        Int?
@@ -652,6 +935,33 @@ model CodingProxyRequest {
 
   @@unique([sessionId, requestKey])
   @@index([sessionId, status])
+  @@index([sessionId, conversationKey])
+}
+
+/// Package audit mode (docs/coding-packages.md#package-audit-mode).
+enum PackageAuditMode {
+  audit
+  full
+}
+
+/// One package version a run's registry served only because of package audit mode (or, in full mode,
+/// served despite blocking advisories). Insert-only for the proxy.
+model RegistryAuditRecord {
+  runId      String
+  ecosystem  String
+  name       String
+  version    String
+  /// "top-level" | "transitive" | "unknown" | "allowed" (allowed = on the allowlist graph, recorded only for advisories)
+  relation   String
+  /// The top-level audited package that pulled it in (transitive only).
+  via        String?
+  sizeBytes  Int?
+  /// Full mode: [{ id, severity, summary }] served past; [] otherwise.
+  advisories Json      @default("[]")
+  createdAt  DateTime  @default(now())
+  run        CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+
+  @@id([runId, ecosystem, name, version])
 }
 
 enum RegistryFetchOutcome {
@@ -663,11 +973,15 @@ enum RegistryFetchOutcome {
 /// once at dispatch (see CodingRun.packageAllowlist) and used to gate every
 /// proxy fetch for the run's lifetime.
 model RegistryAllowance {
-  runId     String
-  ecosystem String
-  name      String
-  createdAt DateTime  @default(now())
-  run       CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  runId      String
+  ecosystem  String
+  name       String
+  /// Set only in an audit-mode run: the top-level audited package whose metadata or file declared this
+  /// name (its own name for a top-level audited package; empty when a lockfile plan could not tell). Null = a
+  /// normal allowance.
+  auditedVia String?
+  createdAt  DateTime  @default(now())
+  run        CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
 
   @@id([runId, ecosystem, name])
 }
@@ -713,13 +1027,20 @@ model RegistryVersionFact {
 /// /registry/<ecosystem>/-/plan) verified and approved: a download of it is
 /// served directly, integrity-checked against this value.
 model RegistryApprovedVersion {
-  runId     String
-  ecosystem String
-  name      String
-  version   String
-  integrity String
-  createdAt DateTime  @default(now())
-  run       CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  runId              String
+  ecosystem          String
+  name               String
+  version            String
+  integrity          String
+  /// Blocking advisories this run's packagePolicy.acceptedAdvisories waived
+  /// for this version: empty unless the plan kept it only by that waiver. A
+  /// download of it records them on its served RegistryFetch row.
+  acceptedAdvisories String[]  @default([])
+  /// Audit-mode plans only: { relation, via?, advisories? } for an approval outside the allowlist, or
+  /// one kept past advisories in full mode. Null = a normal approval.
+  audit              Json?
+  createdAt          DateTime  @default(now())
+  run                CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
 
   @@id([runId, ecosystem, name, version])
 }
@@ -729,10 +1050,10 @@ model RegistryApprovedVersion {
 /// published, no integrity, hosted elsewhere): a download of it is answered
 /// from here with the same code and reason, without a graph walk.
 model RegistryPlanRefusal {
-  runId     String
-  ecosystem String
-  name      String
-  version   String
+  runId       String
+  ecosystem   String
+  name        String
+  version     String
   code        String
   reason      String
   /// Set for a too-new refusal: the answer re-checks the version's age
@@ -744,6 +1065,39 @@ model RegistryPlanRefusal {
   @@id([runId, ecosystem, name, version])
 }
 
+/// A cached node_modules snapshot for one npm project of a repository, keyed
+/// server-side by the coding proxy. The archive lives in the blob store under
+/// blobKey; only trusted wardby code writes it, before a run's agent starts.
+/// Outlives the run that created it (createdByRunId is cleared when that run is
+/// deleted); evicted least-recently-used.
+model DependencySnapshot {
+  id                 String     @id @default(cuid())
+  ecosystem          String
+  repository         String
+  /// The project's folder relative to the repository root; "." = the root.
+  projectPath        String     @default(".")
+  lockHash           String
+  workerImage        String
+  policyHash         String
+  blobKey            String     @unique
+  sha256             String
+  sizeBytes          BigInt
+  /// The format/version and bounds trusted worker code verified before upload.
+  /// Null on snapshots made before validation metadata was introduced.
+  archiveScanVersion Int?
+  archiveEntries     Int?
+  unpackedBytes      BigInt?
+  createdAt          DateTime   @default(now())
+  lastUsedAt         DateTime   @default(now())
+  createdByRunId     String?
+  createdByRun       CodingRun? @relation(fields: [createdByRunId], references: [runId], onDelete: SetNull)
+
+  @@unique([ecosystem, repository, projectPath, lockHash, workerImage, policyHash])
+  @@index([ecosystem, repository, projectPath, workerImage, policyHash, createdAt])
+  @@index([lastUsedAt])
+  @@index([createdByRunId, projectPath])
+}
+
 /// Phase 2: single-row-per-scope lease so exactly one scheduler process
 /// ticks at a time. `holder` is a process instance id (crypto.randomUUID()).
 model SchedulerLease {
@@ -849,6 +1203,8 @@ model Secret {
   name       String
   ciphertext String
   keyId      String
+  /// Brokered-secret config (core/secret-broker-config.ts). Null = readable by attached tools.
+  broker     Json?
   ownerId    String?
   owner      Principal?    @relation(fields: [ownerId], references: [id])
   createdAt  DateTime      @default(now())
@@ -858,6 +1214,24 @@ model Secret {
   @@unique([ownerId, name])
 }
 
+/// Audit trail of every change to a secret's broker config. No FK to Secret,
+/// so the history survives deleting the secret. Never holds a value.
+model SecretBrokerChange {
+  id         String   @id @default(cuid())
+  secretId   String
+  ownerId    String
+  secretName String
+  actorId    String
+  before     Json?
+  after      Json?
+  /// "mcp" or "browser"
+  via        String
+  createdAt  DateTime @default(now())
+
+  @@index([secretId, createdAt])
+  @@index([ownerId, createdAt])
+}
+
 /// Phase 4: attaches a secret to an agent, addressed at sandbox point-of-use
 /// by `boundName` (secrets.get(boundName)). `boundName` defaults to the
 /// secret's canonical name; it differs only when the agent binds the secret
@@ -1065,29 +1439,34 @@ model AuthRateLimit {
 /// and which host events trigger it. See
 /// docs/private/2026-09-25-code-review-host-design.md §4.1.
 model AgentRepository {
-  id         String   @id @default(cuid())
-  agentId    String
-  agent      Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  id                   String   @id @default(cuid())
+  agentId              String
+  agent                Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
   /// "github" today; validated in code so adding a host needs no enum migration.
-  provider   String
+  provider             String
   /// Canonical lower-case owner/name for the provider.
-  repository String
+  repository           String
   /// "read" or "write".
-  access     String
+  access               String
   /// Subset of "pull_request", "mention", "push", "review_fix".
-  triggers   String[] @default([])
+  triggers             String[] @default([])
   /// Only with the "pull_request" trigger (required there); names the agent's
   /// check. Unique per repository across all links (NULLs are distinct).
-  checkName  String?
+  checkName            String?
   /// Only with the "review_fix" trigger: how many automatic fix rounds a
   /// pull request gets before wardby stops. Null = the default (2).
-  reviewFixMaxRounds Int?
+  reviewFixMaxRounds   Int?
   /// Only with the "pull_request" trigger: holds this agent's review on a
   /// pushed head until that head's own CI finishes (see DeferredReview),
   /// instead of racing it. Default off: existing links review immediately,
   /// exactly as today.
-  waitForCi  Boolean  @default(false)
-  createdAt  DateTime @default(now())
+  waitForCi            Boolean  @default(false)
+  /// Only on a write (builder) link: Wardby marks the draft pull requests this
+  /// agent opened in the repository ready for review, once, after every Wardby
+  /// review check passed, CI is green and the merge order check (if any) is
+  /// success. Default off.
+  markReadyWhenPassing Boolean  @default(false)
+  createdAt            DateTime @default(now())
 
   /// How this link was authorized: "host_permission" (the agent owner's
   /// verified host identity had enough access), "admin" (a wardby admin
@@ -1122,38 +1501,46 @@ model DeferredReview {
   /// against the same check even if the link's checkName changes later.
   checkName  String
   createdAt  DateTime @default(now())
+  /// Why the review waits: "ci" (until CI finishes) or "request" (until the
+  /// delegating lead run finishes, then CI if the link waits for it).
+  reason     String   @default("ci")
+  /// The run-tree root a "request" row waits for.
+  leadRunId  String?
 
   @@unique([provider, repository, prNumber, headSha, agentId])
   @@index([provider, repository, headSha])
   @@index([createdAt])
+  @@index([leadRunId])
 }
 
 /// The host check a run owns, so the review tool can complete it and the
 /// run finalizer can close it if the run ends without publishing.
 model RunHostCheck {
-  runId       String    @id
-  run         Run       @relation(fields: [runId], references: [id], onDelete: Cascade)
-  provider    String
-  repository  String
-  checkId     String
-  headSha     String
+  runId              String    @id
+  run                Run       @relation(fields: [runId], references: [id], onDelete: Cascade)
+  provider           String
+  repository         String
+  checkId            String
+  headSha            String
   /// The pull request the run was dispatched for. The review tool only
   /// completes or creates a check for this PR. Null on rows written before it
   /// existed: such a run publishes without a check.
-  prNumber    Int?
-  completedAt DateTime?
+  prNumber           Int?
+  completedAt        DateTime?
   /// The verdict the run published on its own check ("APPROVE",
   /// "CHANGES_REQUESTED", "COMMENT"); null until then, or when the check was
   /// closed without one (superseded, or by the finalizer).
-  verdict     String?
+  verdict            String?
   /// The published review's summary and body (capped), kept for an automatic
   /// fix round started when the run finishes.
-  reviewBody  String?
+  reviewBody         String?
   /// The run published COMMENT while CI on its head was still running or had
   /// not reported yet. CI finishing on that head later re-runs the review.
-  ciPendingAtReview Boolean?
+  ciPendingAtReview  Boolean?
   /// When CI finishing on this head re-ran the review: at most once per head.
-  ciRereviewAt      DateTime?
+  ciRereviewAt       DateTime?
+  /// When a no-change review-fix round re-reviewed this CHANGES_REQUESTED review: at most once.
+  noChangeRereviewAt DateTime?
 }
 
 /// De-duplicates host webhook redeliveries; pruned after 7 days.
@@ -1303,12 +1690,14 @@ model IssueFingerprint {
   @@index([createdByRunId])
 }
 
-/// A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+/// A pull request wardby opened for an issue (a Jira issue, a GitHub issue): one shape for every issue
+/// provider. Provider-neutral on both sides.
 /// Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
 model IssuePullRequest {
   id            String   @id @default(cuid())
-  /// "jira"
+  /// "jira" or "github" (an issue on a repository).
   issueProvider String
+  /// A Jira key ("PROJ-7"), or a GitHub issue's "<owner>/<repo>#<number>" (githubIssueKey).
   issueKey      String
   /// "github" today; "bitbucket" next.
   codeProvider  String
@@ -1458,6 +1847,9 @@ model LocalReview {
   pullRequest   LocalPullRequest @relation(fields: [pullRequestId], references: [id], onDelete: Cascade)
   agentId       String
   headSha       String
+  /// headSha when this review read every file of it (null otherwise): the head a later
+  /// re-review may compare from and still APPROVE (repo_pr_read's lastCoveredSha).
+  coveredSha    String?
   /// APPROVE | CHANGES_REQUESTED | COMMENT
   verdict       String
   summary       String
@@ -1468,3 +1860,96 @@ model LocalReview {
 
   @@index([pullRequestId, createdAt])
 }
+
+/// A Slack (chat) channel that receives workflow notifications for a Jira
+/// project or for one agent. Exactly one subject: (issueProvider, projectKey)
+/// or agentId (enforced in code and by a CHECK constraint). Admin-approved.
+/// See docs/slack-notifications.md.
+model NotificationChannel {
+  id             String    @id @default(cuid())
+  /// "slack" today; validated in code.
+  provider       String
+  /// Slack channel id (C…/G…), upper-case.
+  channelId      String
+  /// Last known channel name, display only.
+  channelName    String?
+  issueProvider  String?
+  projectKey     String?
+  agentId        String?
+  agent          Agent?    @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  /// Subset of the workflow event kinds; empty = all.
+  events         String[]  @default([])
+  /// Append the run's spend line to messages.
+  includeCost    Boolean   @default(false)
+  /// Set by the dispatcher on a permanent channel error; cleared by re-linking.
+  lastError      String?
+  lastErrorAt    DateTime?
+  authorizedById String
+  authorizedAt   DateTime  @default(now())
+  createdAt      DateTime  @default(now())
+
+  @@unique([provider, channelId, issueProvider, projectKey])
+  @@unique([provider, channelId, agentId])
+  @@index([issueProvider, projectKey])
+  @@index([agentId])
+}
+
+/// One workflow fact (a card picked up, a PR opened, ...). Written only when
+/// at least one channel matches. No FKs to Run/Agent: audit-style rows.
+model WorkflowEvent {
+  id               String                 @id @default(cuid())
+  kind             String
+  /// Idempotency key: repeated recordings of the same fact are no-ops.
+  dedupeKey        String                 @unique
+  runId            String?
+  agentId          String?
+  workItemProvider String?
+  workItemKey      String?
+  codeProvider     String?
+  repository       String?
+  prNumber         Int?
+  /// Template inputs only: never secrets, code, review bodies or run output.
+  payload          Json
+  createdAt        DateTime               @default(now())
+  deliveries       NotificationDelivery[]
+
+  @@index([createdAt])
+}
+
+/// One event's delivery to one channel (the outbox row the dispatcher works).
+model NotificationDelivery {
+  id            String        @id @default(cuid())
+  eventId       String
+  event         WorkflowEvent @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  provider      String
+  channelId     String
+  threadKey     String
+  includeCost   Boolean       @default(false)
+  /// "pending" | "delivered" | "failed"
+  state         String        @default("pending")
+  attempts      Int           @default(0)
+  nextAttemptAt DateTime      @default(now())
+  lastError     String?
+  messageTs     String?
+  deliveredAt   DateTime?
+  createdAt     DateTime      @default(now())
+
+  @@unique([eventId, provider, channelId])
+  @@index([state, nextAttemptAt])
+  @@index([provider, channelId, threadKey, createdAt])
+}
+
+/// The parent message of a work item's (or PR's) thread in one channel.
+model NotificationThread {
+  id        String   @id @default(cuid())
+  provider  String
+  channelId String
+  threadKey String
+  parentTs  String
+  /// Current status line shown on the parent message.
+  status    String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@unique([provider, channelId, threadKey])
+}