@wardby/cli 0.6.0 → 0.8.0

package/prisma/schema.prisma

@@ -20,16 +20,18 @@ datasource db {
 }
 
 model Agent {
-  id            String              @id @default(cuid())
-  name          String              @unique
-  systemPrompt  String
-  model         String
-  budgetUsd     Decimal             @db.Decimal(10, 4)
-  createdAt     DateTime            @default(now())
-  updatedAt     DateTime            @updatedAt
-  runs          Run[]
-  kind          AgentKind           @default(native)
-  codingProfile CodingAgentProfile?
+  id                    String              @id @default(cuid())
+  name                  String              @unique
+  systemPrompt          String
+  model                 String
+  budgetUsd             Decimal             @db.Decimal(10, 4)
+  /// Percent above budgetUsd a run may spend: each coding run's limit, or (on a lead agent) its run tree's ceiling for coding sub-agents; native model calls are unaffected; group caps still apply.
+  allowedOverrunPercent Int                 @default(0)
+  createdAt             DateTime            @default(now())
+  updatedAt             DateTime            @updatedAt
+  runs                  Run[]
+  kind                  AgentKind           @default(native)
+  codingProfile         CodingAgentProfile?
 
   // Phase 2: scheduling. `schedule` is a cron expression; null = manual-only.
   schedule        String?
@@ -58,6 +60,7 @@ model Agent {
   repositories         AgentRepository[]
   deferredReviews      DeferredReview[]
   issueProjects        AgentIssueProject[]
+  mcpServers           AgentMcpServer[]
   notificationChannels NotificationChannel[]
 
   /// Self-defects opt-in: the Jira project and issue type wardby files the agent's own failures into. Both or neither.
@@ -184,6 +187,10 @@ model Tool {
   jsonSchema  Json
   /// Tool body source; run inside the sandbox with the validated params.
   code        String
+  /// The tool's own time limit per call (ms). Null = the default (10 s). A
+  /// run uses the lower of this and WARDBY_TOOL_MAX_TIMEOUT_MS, and pins the
+  /// value its load step read, like the code.
+  timeoutMs   Int?
   createdAt   DateTime    @default(now())
   updatedAt   DateTime    @updatedAt
   agents      AgentTool[]
@@ -193,6 +200,8 @@ model Tool {
   ownerId String?
   owner   Principal? @relation(fields: [ownerId], references: [id])
 
+  hostProviderOperations HostProviderOperation[]
+
   @@unique([ownerId, name])
 }
 
@@ -361,17 +370,22 @@ model Run {
   /// in-process runs. The reconciler consults the backend before declaring a
   /// stale run lost, and can adopt one orphaned by a dead instance.
   executionBackend     String?
+  /// The DBOS workflow that currently holds this run, when it is not the run id: set when
+  /// recover() forks the run's workflow under a new application version. Null = the run id.
+  executionWorkflowId  String?
   /// The agent's nativeExecutionMode when this run was created, fixed for the
   /// run's life and what the executor routes on. Null for coding runs and for
   /// native runs from before the field existed, which run in the control plane.
   nativeExecutionMode  NativeExecutionMode?
   codingRun            CodingRun?
+  transcript           RunTranscript?
   hostCheck            RunHostCheck?
   hostStatus           RunHostStatus?
   issueStatus          RunIssueStatus?
   attribution          RunAttribution?
   modelUsage           RunModelUsage[]
   serviceStatuses      CodingRunServiceStatus[]
+  budgetEvents         RunBudgetEvent[]
   /// A manual review of a local branch: this run is the review run dispatched for it.
   localPullRequest     LocalPullRequest?
   /// A sandbox-mode native run's gateway session (native sandbox phase 3).
@@ -396,6 +410,9 @@ model Run {
   parentRunId             String?
   parentRun               Run?     @relation("RunTree", fields: [parentRunId], references: [id])
   childRuns               Run[]    @relation("RunTree")
+  /// The parent's delegation call (the model's tool-call id) that created this child, so a
+  /// re-executed delegate step finds the same child instead of starting another.
+  parentCallId            String?
   /// Ephemeral, per-dispatch grant: exactly the parent-memory keys this
   /// one child run was handed permission to read via parent_memory_get.
   /// Never a standing allowlist — re-granted on every dispatch call.
@@ -415,6 +432,7 @@ model Run {
   /// text, no FK.
   triggeredById           String?
 
+  @@unique([parentRunId, parentCallId])
   @@index([agentId, triggeredById])
   /// The admin viewer's graph window (runs started since a time, or still
   /// pending/running) and its ancestor/children walks (docs/viewer-api.md).
@@ -428,40 +446,54 @@ model Run {
 /// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
 /// launcher handles never live on the reusable profile.
 model CodingAgentProfile {
-  agentId                  String    @id
-  agent                    Agent     @relation(fields: [agentId], references: [id], onDelete: Cascade)
-  provider                 String    @default("codex")
+  agentId                  String            @id
+  agent                    Agent             @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  provider                 String            @default("codex")
   repository               String
-  baseRef                  String    @default("main")
+  baseRef                  String            @default("main")
   defaultTask              String?
-  allowWebhookTaskOverride Boolean   @default(false)
-  timeoutSec               Int       @default(1800)
+  allowWebhookTaskOverride Boolean           @default(false)
+  timeoutSec               Int               @default(1800)
   /// Claude Code runs only: the most agent turns a run may take. Null = the worker default (200).
   maxTurns                 Int?
+  /// Claude Code runs only: the most output tokens per model reply (1024-128000). Null = the worker default (32000).
+  maxOutputTokens          Int?
   /// Unused; dropped after rollout (see the package-registry plan, Task 14).
-  allowedEgress            Json      @default("[]")
+  allowedEgress            Json              @default("[]")
   protectedPaths           Json
-  collectExclude           Json      @default("[]")
-  toolchain                String    @default("node")
+  collectExclude           Json              @default("[]")
+  toolchain                String            @default("node")
   toolchainVersion         String?
   workerImageRef           String?
   /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
   workspaceDiskMb          Int?
-  packageAllowlist         Json      @default("{}")
-  packagePolicy            Json      @default("{}")
+  packageAllowlist         Json              @default("{}")
+  packagePolicy            Json              @default("{}")
   /// Admin-requested debug trace: while now < debugTraceUntil, every coding
   /// run of this agent is dispatched with CodingRun.debugTrace set. Null = off.
   debugTraceUntil          DateTime?
+  /// Admin-set cap on one traced run's trace output, in MiB; null = the worker default (2).
+  debugTraceMaxMb          Int?
   /// Coding-run services (docs/coding-services.md): the catalog names
   /// (CodingService.name) this agent's runs may start, any version the catalog
   /// has. Empty = none. Owner-set through update_agent.
-  services                 Json      @default("[]")
+  services                 Json              @default("[]")
   /// Load the repository's agent skills into coding runs (Codex: .agents/skills, .codex/skills;
   /// Claude Code: .claude/skills). Repo instructions (AGENTS.md / CLAUDE.md) load regardless.
-  repoSkills               Boolean   @default(true)
+  repoSkills               Boolean           @default(true)
   /// Claude Code runs only: keep Claude Code's bare mode (CLAUDE_CODE_SIMPLE=1); wardby injects
   /// repo instructions and the skill list into the system prompt. False = Claude Code's native loading.
-  claudeBareMode           Boolean   @default(true)
+  claudeBareMode           Boolean           @default(true)
+  /// Restore node_modules from a cached snapshot (written only by trusted wardby code before the
+  /// agent starts) instead of a full install. Owner-set; off by default.
+  dependencyCache          Boolean           @default(false)
+  /// Keep each Claude Code run's session transcript so it can be resumed in a local CLI
+  /// (docs/coding-agent-setup.md#resume-a-run-locally). Owner-set; off by default.
+  sessionResume            Boolean           @default(false)
+  /// Owner-set package audit mode (docs/coding-packages.md#package-audit-mode); active while now < packageAuditUntil.
+  packageAuditMode         PackageAuditMode?
+  /// End of the audit window; null = off.
+  packageAuditUntil        DateTime?
 
   /// How `repository` was authorized for this agent (see AgentRepository.authorizedVia):
   /// "host_permission", "admin", or "grandfathered". Null = never authorized; runs are refused.
@@ -474,64 +506,106 @@ model CodingAgentProfile {
 /// Phase 5: immutable dispatch inputs plus opaque execution/result state for
 /// one coding run. Policy is copied from the profile before work starts.
 model CodingRun {
-  runId             String              @id
-  run               Run                 @relation(fields: [runId], references: [id], onDelete: Cascade)
-  task              String
-  repository        String
-  baseRef           String
-  headRef           String
-  provider          String
-  model             String
-  timeoutSec        Int
+  runId                 String              @id
+  run                   Run                 @relation(fields: [runId], references: [id], onDelete: Cascade)
+  task                  String
+  /// The run's own request (the trigger's task or the agent's default task), without the agent's standing instructions. Null on older runs.
+  request               String?             @db.Text
+  repository            String
+  baseRef               String
+  headRef               String
+  provider              String
+  model                 String
+  timeoutSec            Int
   /// Unused; dropped after rollout (see the package-registry plan, Task 14).
-  allowedEgress     Json                @default("[]")
-  protectedPaths    Json
-  collectExclude    Json                @default("[]")
-  jobBackend        String?
-  jobHandle         String?
-  result            Json?
-  resultSchema      Int                 @default(1)
+  allowedEgress         Json                @default("[]")
+  protectedPaths        Json
+  collectExclude        Json                @default("[]")
+  jobBackend            String?
+  jobHandle             String?
+  result                Json?
+  resultSchema          Int                 @default(1)
   /// Sanitized terminal classification and an opaque log correlation reference.
   /// Neither field may contain task, repository, environment, or credential data.
-  failureCategory   String?
-  diagnosticId      String?
-  workerImage       String?
+  failureCategory       String?
+  diagnosticId          String?
+  workerImage           String?
   /// Claude Code's tool-runner image, resolved from the agent's toolchain at dispatch; null for Codex runs.
-  toolImage         String?
-  budgetReservedUsd Decimal             @db.Decimal(10, 6)
+  toolImage             String?
+  /// What the run may spend now: its base, plus every overrun top-up granted so
+  /// far (on runs with budgetLimitUsd). Budget groups and run trees hold it.
+  budgetReservedUsd     Decimal             @db.Decimal(10, 6)
+  /// The budget before the agent's allowed overrun. Null on older runs.
+  budgetBaseUsd         Decimal?            @db.Decimal(10, 6)
+  /// The most the run may spend: its base budget raised by the agent's allowed
+  /// overrun, never reserved up front; top-ups raise budgetReservedUsd toward it
+  /// only from room its group and run tree have left. Null = no top-ups (older
+  /// runs, or no allowed overrun): budgetReservedUsd is the limit.
+  budgetLimitUsd        Decimal?            @db.Decimal(10, 6)
+  /// What set budgetReservedUsd below the agent's own budget at dispatch:
+  /// run-tree, day, week or month. Null = the agent's own budget.
+  budgetLimitedBy       String?
   /// Phase 12 concurrency queue: set when start() found every coding slot
   /// taken (CODING_MAX_CONCURRENT), cleared when the run claims a slot. A
   /// pending run with queuedAt set is waiting, not orphaned.
-  queuedAt          DateTime?
+  queuedAt              DateTime?
   /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
-  workspaceDiskMb   Int?
-  packageAllowlist  Json                @default("{}")
-  packagePolicy     Json                @default("{}")
+  workspaceDiskMb       Int?
+  packageAllowlist      Json                @default("{}")
+  packagePolicy         Json                @default("{}")
   /// Fixed at dispatch from the profile's debugTraceUntil: the worker writes a
   /// full stream trace to its own pod log (never to the database).
-  debugTrace        Boolean             @default(false)
+  debugTrace            Boolean             @default(false)
+  /// Fixed at dispatch from the profile's debugTraceMaxMb, only on a traced run. Null = the worker default.
+  debugTraceMaxMb       Int?
   /// Fixed at dispatch from the profile's maxTurns: the Claude Code worker's turn limit. Null = the worker default.
-  maxTurns          Int?
+  maxTurns              Int?
+  /// Fixed at dispatch from the profile's maxOutputTokens: Claude Code's output tokens per reply. Null = the worker default.
+  maxOutputTokens       Int?
   /// Fixed at dispatch from the profile's repoSkills.
-  repoSkills        Boolean             @default(true)
+  repoSkills            Boolean             @default(true)
   /// Fixed at dispatch from the profile's claudeBareMode.
-  claudeBareMode    Boolean             @default(true)
+  claudeBareMode        Boolean             @default(true)
   /// Coding-run services resolved at dispatch from the base branch's
   /// .wardby/services.yaml: one snapshot per service (the catalog entry minus
   /// kind), fixed for the run's lifetime. Empty = none.
-  services          Json                @default("[]")
+  services              Json                @default("[]")
   /// The originating tracker issue ("jira" + key), set by the control plane from the run tree, never from model output.
-  issueProvider     String?
-  issueKey          String?
+  issueProvider         String?
+  issueKey              String?
   /// The branch a run pushed to a local repository (no pull request exists); null otherwise.
-  resultBranch      String?
+  resultBranch          String?
   /// The commit the run started from (the base ref's tip when the workspace was prepared).
-  baseSha           String?
+  baseSha               String?
   /// Step in the request's merge order set by the delegating agent (1 = first); null = no order.
-  mergeOrder        Int?
-  createdAt         DateTime            @default(now())
-  updatedAt         DateTime            @updatedAt
-  proxySession      CodingProxySession?
+  mergeOrder            Int?
+  /// Fixed at dispatch: this run's repository came from an AgentRepository link, not the
+  /// profile, so that link must still exist whenever the run uses the repository.
+  viaRepositoryLink     Boolean             @default(false)
+  /// When Wardby marked this run's pull request ready for review (at most once;
+  /// a person moving it back to draft is final). Only set on a root coding run.
+  markedReadyAt         DateTime?
+  /// Root coding run only: SHA-256 (hex) of the pull request description Wardby last wrote,
+  /// normalized (CRLF→LF, Related pull requests section removed, blank lines collapsed, trimmed).
+  /// Null = never recorded (pull requests opened before this column, or a lost first write).
+  prDescriptionSha256   String?
+  /// Root coding run only: the coding run whose final message is that description's agent-written part.
+  prDescriptionRunId    String?
+  /// This run's description update: written | replaced | refreshed:<reason> | unchanged |
+  /// edited_by_hand | skipped:<reason>. Null = not attempted.
+  prDescriptionOutcome  String?
+  /// Fixed at dispatch from the profile's dependencyCache.
+  dependencyCache       Boolean             @default(false)
+  /// Fixed at dispatch from the profile's sessionResume.
+  sessionResume         Boolean             @default(false)
+  /// What the run's dependency cache did, written by the control plane when it collects the run:
+  /// { result, key?, sizeBytes?, restoreMs?, installMs?, reason? }. Null = not used or not reported.
+  dependencyCacheResult Json?
+  /// Fixed at dispatch: the profile's packageAuditMode when its window was open, else null.
+  packageAuditMode      PackageAuditMode?
+  createdAt             DateTime            @default(now())
+  updatedAt             DateTime            @updatedAt
+  proxySession          CodingProxySession?
 
   /// Revision-in-place for continuing an existing coding pull request.
   /// Points directly at the ROOT CodingRun that actually owns the branch/PR
@@ -547,6 +621,8 @@ model CodingRun {
   registryFetches          RegistryFetch[]
   registryApprovedVersions RegistryApprovedVersion[]
   registryPlanRefusals     RegistryPlanRefusal[]
+  registryAuditRecords     RegistryAuditRecord[]
+  dependencySnapshots      DependencySnapshot[]
 
   @@index([jobBackend, jobHandle])
   @@index([failureCategory])
@@ -555,6 +631,27 @@ model CodingRun {
   @@index([mergeOrder])
 }
 
+/// A coding run's session transcript for local resume: metadata only. The redacted content lives in
+/// the blob store under blobKey; the unredacted transcript is never stored.
+model RunTranscript {
+  runId     String   @id
+  run       Run      @relation(fields: [runId], references: [id], onDelete: Cascade)
+  /// "claude-code" (Codex later).
+  provider  String
+  /// stored | too_large | not_captured | failed
+  status    String
+  /// Fixed code for a status other than stored (e.g. missing, no_blob_store, secrets_unavailable); never content.
+  reason    String?
+  sessionId String?
+  blobKey   String?
+  sizeBytes Int?
+  sha256    String?
+  createdAt DateTime @default(now())
+  expiresAt DateTime
+
+  @@index([expiresAt])
+}
+
 /// Coding-run services (docs/coding-services.md): the catalog a repository's
 /// .wardby/services.yaml names entries from. Admin-managed over MCP
 /// (list/get_service: agents:read; create/update/delete_service:
@@ -634,6 +731,28 @@ enum CodingProxyRequestStatus {
   uncertain
 }
 
+enum RunBudgetEventKind {
+  refused
+  /// A coding run's overrun top-up found no room in its budget group or run tree.
+  overrun_unavailable
+}
+
+/// One budget decision about a run: a refusal by the coding proxy or at
+/// dispatch, or an overrun top-up with no room, with the numbers behind it.
+/// `limit` names what refused it: run, run-tree, day, week or month. `details`
+/// holds amounts, the model and the turn; never secrets or message text.
+model RunBudgetEvent {
+  id      String             @id @default(cuid())
+  runId   String
+  run     Run                @relation(fields: [runId], references: [id], onDelete: Cascade)
+  kind    RunBudgetEventKind
+  limit   String
+  at      DateTime           @default(now())
+  details Json
+
+  @@index([runId, at])
+}
+
 enum NativeGatewaySessionStatus {
   active
   finished
@@ -677,6 +796,9 @@ model NativeGatewaySession {
   /// probe; a Docker run's network exists before its container). The gateway
   /// serves nothing before this is set.
   networkReadyAt    DateTime?
+  /// What the run's review tools have read (ReviewReadsState), saved between gateway requests
+  /// for repo_publish_review's unread_files check. Null until the run reads a pull request.
+  reviewReads       Json?
   createdAt         DateTime                   @default(now())
   updatedAt         DateTime                   @updatedAt
   calls             NativeGatewayCall[]
@@ -723,6 +845,8 @@ model NativeGatewayCall {
   status            NativeGatewayCallStatus
   reservationUsd    Decimal?                @db.Decimal(18, 10)
   actualCostUsd     Decimal?                @db.Decimal(18, 10)
+  /// actualCostUsd is an estimate for an interrupted call, not provider usage.
+  costEstimated     Boolean                 @default(false)
   inputTokens       Int?
   outputTokens      Int?
   cachedInputTokens Int?
@@ -732,6 +856,8 @@ model NativeGatewayCall {
   childRunId        String?
   /// A delegation's sub-agent, recorded at admission (it holds a place while waiting for budget).
   childAgentId      String?
+  /// A coding delegation's repository, recorded with childAgentId. Null = the child's default.
+  childRepository   String?
   createdAt         DateTime                @default(now())
   updatedAt         DateTime                @updatedAt
   completedAt       DateTime?
@@ -743,41 +869,55 @@ model NativeGatewayCall {
 /// Trusted-boundary state for one coding run. Only a capability digest and an
 /// upstream credential reference are persisted; neither secret value enters the DB.
 model CodingProxySession {
-  id                String                   @id @default(cuid())
-  runId             String                   @unique
-  run               CodingRun                @relation(fields: [runId], references: [runId], onDelete: Cascade)
-  capabilityHash    String                   @unique
-  credentialRef     String
-  protocol          String                   @default("openai-responses")
-  allowedModels     Json
-  deadlineAt        DateTime
-  budgetUsd         Decimal                  @db.Decimal(18, 10)
-  status            CodingProxySessionStatus @default(active)
-  createdAt         DateTime                 @default(now())
-  updatedAt         DateTime                 @updatedAt
-  requests          CodingProxyRequest[]
+  id                        String                   @id @default(cuid())
+  runId                     String                   @unique
+  run                       CodingRun                @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  capabilityHash            String                   @unique
+  credentialRef             String
+  protocol                  String                   @default("openai-responses")
+  allowedModels             Json
+  deadlineAt                DateTime
+  budgetUsd                 Decimal                  @db.Decimal(18, 10)
+  status                    CodingProxySessionStatus @default(active)
+  createdAt                 DateTime                 @default(now())
+  updatedAt                 DateTime                 @updatedAt
+  requests                  CodingProxyRequest[]
   /// Hash of the derived registry-only token (see deriveRegistryToken); the
   /// token itself is never persisted.
-  registryTokenHash String?                  @unique
+  registryTokenHash         String?                  @unique
   /// Set the first time the proxy refuses a request of this session for
   /// budget; lets the executor report the run as out of budget.
-  budgetExhaustedAt DateTime?
+  budgetExhaustedAt         DateTime?
+  /// The numbers behind the first budget refusal of this session (budget, spent, holds, refused hold, model, turn); the control plane copies them into RunBudgetEvent. Never secrets.
+  budgetRefusal             Json?
   /// The upstream error code (a fixed identifier, never a message) of the
   /// first provider failure the proxy relayed for this session; lets the
   /// executor say the model provider refused the run.
-  upstreamFailure   String?
+  upstreamFailure           String?
   /// The run's catalog entry, copied from Run.pricingSnapshot when the session
   /// is created; the proxy prices and shapes requests from it. Null on
   /// sessions from before the model catalog (the proxy falls back to the
   /// shipped catalog).
-  pricingVersion    String?
-  catalogEntry      Json?
+  pricingVersion            String?
+  catalogEntry              Json?
+  /// Dependency cache: every lockfile hash this session's plans approved (with
+  /// no refusals) while unsealed, at most 8. Only these may be restored or uploaded.
+  dependencyCacheLockHashes String[]                 @default([])
+  /// Set when the run's dependency step is over; after it the cache refuses this session.
+  dependencyCacheSealedAt   DateTime?
+  /// Phase 2 of remote MCP servers: the run's pinned MCP tools (no URLs or secrets), or null.
+  mcpTools                  Json?
+  /// SHA-256 (base64url) of the run's MCP token; null when the run has no MCP tools.
+  mcpTokenHash              String?                  @unique
+  /// MCP tools/call count for this run (capped by WARDBY_MCP_MAX_CALLS_PER_RUN).
+  mcpCallCount              Int                      @default(0)
 
   @@index([deadlineAt])
 }
 
-/// Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
-/// crash or truncated provider stream can never create new spendable budget.
+/// Monotonic per-upstream-call ledger. An uncertain request without an
+/// estimate stays held in full; one the proxy estimated (costEstimated) counts
+/// at that estimate.
 model CodingProxyRequest {
   id                 String                   @id @default(cuid())
   sessionId          String
@@ -788,6 +928,17 @@ model CodingProxyRequest {
   status             CodingProxyRequestStatus @default(reserved)
   reservationUsd     Decimal                  @db.Decimal(18, 10)
   actualCostUsd      Decimal?                 @db.Decimal(18, 10)
+  /// actualCostUsd is the proxy's estimate for an interrupted (uncertain)
+  /// reply, not provider-reported usage.
+  costEstimated      Boolean                  @default(false)
+  /// UTF-8 bytes of the forwarded request body; the next request's hold compares against it.
+  requestBytes       Int?
+  /// The worst-case hold (whole body as uncached input); a reply costing more cancels the session.
+  ceilingUsd         Decimal?                 @db.Decimal(18, 10)
+  /// "cached" (priced from the conversation's previous reply) or "full" (= ceilingUsd).
+  reservationBasis   String?
+  /// sha256 of what identifies the conversation (first message, or OpenAI prompt_cache_key).
+  conversationKey    String?
   pricingVersion     String
   pricingSnapshot    Json
   inputTokens        Int?
@@ -802,6 +953,33 @@ model CodingProxyRequest {
 
   @@unique([sessionId, requestKey])
   @@index([sessionId, status])
+  @@index([sessionId, conversationKey])
+}
+
+/// Package audit mode (docs/coding-packages.md#package-audit-mode).
+enum PackageAuditMode {
+  audit
+  full
+}
+
+/// One package version a run's registry served only because of package audit mode (or, in full mode,
+/// served despite blocking advisories). Insert-only for the proxy.
+model RegistryAuditRecord {
+  runId      String
+  ecosystem  String
+  name       String
+  version    String
+  /// "top-level" | "transitive" | "unknown" | "allowed" (allowed = on the allowlist graph, recorded only for advisories)
+  relation   String
+  /// The top-level audited package that pulled it in (transitive only).
+  via        String?
+  sizeBytes  Int?
+  /// Full mode: [{ id, severity, summary }] served past; [] otherwise.
+  advisories Json      @default("[]")
+  createdAt  DateTime  @default(now())
+  run        CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+
+  @@id([runId, ecosystem, name, version])
 }
 
 enum RegistryFetchOutcome {
@@ -813,11 +991,15 @@ enum RegistryFetchOutcome {
 /// once at dispatch (see CodingRun.packageAllowlist) and used to gate every
 /// proxy fetch for the run's lifetime.
 model RegistryAllowance {
-  runId     String
-  ecosystem String
-  name      String
-  createdAt DateTime  @default(now())
-  run       CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  runId      String
+  ecosystem  String
+  name       String
+  /// Set only in an audit-mode run: the top-level audited package whose metadata or file declared this
+  /// name (its own name for a top-level audited package; empty when a lockfile plan could not tell). Null = a
+  /// normal allowance.
+  auditedVia String?
+  createdAt  DateTime  @default(now())
+  run        CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
 
   @@id([runId, ecosystem, name])
 }
@@ -863,13 +1045,20 @@ model RegistryVersionFact {
 /// /registry/<ecosystem>/-/plan) verified and approved: a download of it is
 /// served directly, integrity-checked against this value.
 model RegistryApprovedVersion {
-  runId     String
-  ecosystem String
-  name      String
-  version   String
-  integrity String
-  createdAt DateTime  @default(now())
-  run       CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  runId              String
+  ecosystem          String
+  name               String
+  version            String
+  integrity          String
+  /// Blocking advisories this run's packagePolicy.acceptedAdvisories waived
+  /// for this version: empty unless the plan kept it only by that waiver. A
+  /// download of it records them on its served RegistryFetch row.
+  acceptedAdvisories String[]  @default([])
+  /// Audit-mode plans only: { relation, via?, advisories? } for an approval outside the allowlist, or
+  /// one kept past advisories in full mode. Null = a normal approval.
+  audit              Json?
+  createdAt          DateTime  @default(now())
+  run                CodingRun @relation(fields: [runId], references: [runId], onDelete: Cascade)
 
   @@id([runId, ecosystem, name, version])
 }
@@ -894,6 +1083,39 @@ model RegistryPlanRefusal {
   @@id([runId, ecosystem, name, version])
 }
 
+/// A cached node_modules snapshot for one npm project of a repository, keyed
+/// server-side by the coding proxy. The archive lives in the blob store under
+/// blobKey; only trusted wardby code writes it, before a run's agent starts.
+/// Outlives the run that created it (createdByRunId is cleared when that run is
+/// deleted); evicted least-recently-used.
+model DependencySnapshot {
+  id                 String     @id @default(cuid())
+  ecosystem          String
+  repository         String
+  /// The project's folder relative to the repository root; "." = the root.
+  projectPath        String     @default(".")
+  lockHash           String
+  workerImage        String
+  policyHash         String
+  blobKey            String     @unique
+  sha256             String
+  sizeBytes          BigInt
+  /// The format/version and bounds trusted worker code verified before upload.
+  /// Null on snapshots made before validation metadata was introduced.
+  archiveScanVersion Int?
+  archiveEntries     Int?
+  unpackedBytes      BigInt?
+  createdAt          DateTime   @default(now())
+  lastUsedAt         DateTime   @default(now())
+  createdByRunId     String?
+  createdByRun       CodingRun? @relation(fields: [createdByRunId], references: [runId], onDelete: SetNull)
+
+  @@unique([ecosystem, repository, projectPath, lockHash, workerImage, policyHash])
+  @@index([ecosystem, repository, projectPath, workerImage, policyHash, createdAt])
+  @@index([lastUsedAt])
+  @@index([createdByRunId, projectPath])
+}
+
 /// Phase 2: single-row-per-scope lease so exactly one scheduler process
 /// ticks at a time. `holder` is a process instance id (crypto.randomUUID()).
 model SchedulerLease {
@@ -917,6 +1139,7 @@ model Principal {
   webhooks     Webhook[]
   authUser     AuthUser?
   budgetGroups BudgetGroup[]
+  mcpServers   McpServer[]
 
   hostIdentities           HostIdentity[]
   hostIdentityLinkRequests HostIdentityLinkRequest[]
@@ -931,7 +1154,7 @@ model Principal {
 /// AgentRepository.provider, so a new type or level needs no enum migration.
 model ResourceGrant {
   id                 String     @id @default(cuid())
-  /// "agent" | "tool" | "budget_group" (later "secret" | "datastore").
+  /// "agent" | "tool" | "budget_group" | "mcp_server" (later "secret" | "datastore").
   resourceType       String
   resourceId         String
   /// "principal" | "everyone" (later "group").
@@ -989,6 +1212,9 @@ model Task {
   ttlAt          DateTime
   createdAt      DateTime   @default(now())
   updatedAt      DateTime   @updatedAt
+
+  /// The run-drivability and cancelled-task lookups: findFirst({ runId, status: "cancelled" }).
+  @@index([runId, status])
 }
 
 /// Phase 4: a secret value, encrypted at rest via the SecretCipher seam.
@@ -1007,6 +1233,10 @@ model Secret {
   updatedAt  DateTime      @updatedAt
   agents     AgentSecret[]
 
+  hostProviderWebhooks    HostProvider[]           @relation("HostProviderWebhookSecret")
+  hostProviderPermissions HostProvider[]           @relation("HostProviderPermissionSecret")
+  hostProviderCredentials HostProviderCredential[] @relation("HostProviderCredentialSecret")
+
   @@unique([ownerId, name])
 }
 
@@ -1116,7 +1346,7 @@ model AuthUser {
   displayName String?
   status      String                   @default("enabled")
   /// wardby roles (src/mcp/auth/resource-server.ts ROLE_PERMISSIONS: admin,
-  /// package-approver, service-manager, model-manager), set with `wardby auth user grant`. Empty = member.
+  /// package-approver, service-manager, model-manager, host-manager), set with `wardby auth user grant`. Empty = member.
   /// A privileged operation needs its scope on the token AND a role here
   /// that grants it; unknown values grant nothing.
   roles       String[]                 @default([])
@@ -1235,29 +1465,37 @@ model AuthRateLimit {
 /// and which host events trigger it. See
 /// docs/private/2026-09-25-code-review-host-design.md §4.1.
 model AgentRepository {
-  id                 String   @id @default(cuid())
-  agentId            String
-  agent              Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  id                   String   @id @default(cuid())
+  agentId              String
+  agent                Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
   /// "github" today; validated in code so adding a host needs no enum migration.
-  provider           String
+  provider             String
   /// Canonical lower-case owner/name for the provider.
-  repository         String
+  repository           String
   /// "read" or "write".
-  access             String
+  access               String
   /// Subset of "pull_request", "mention", "push", "review_fix".
-  triggers           String[] @default([])
+  triggers             String[] @default([])
   /// Only with the "pull_request" trigger (required there); names the agent's
   /// check. Unique per repository across all links (NULLs are distinct).
-  checkName          String?
+  checkName            String?
   /// Only with the "review_fix" trigger: how many automatic fix rounds a
   /// pull request gets before wardby stops. Null = the default (2).
-  reviewFixMaxRounds Int?
+  reviewFixMaxRounds   Int?
   /// Only with the "pull_request" trigger: holds this agent's review on a
   /// pushed head until that head's own CI finishes (see DeferredReview),
   /// instead of racing it. Default off: existing links review immediately,
   /// exactly as today.
-  waitForCi          Boolean  @default(false)
-  createdAt          DateTime @default(now())
+  waitForCi            Boolean  @default(false)
+  /// Only on a write (builder) link: Wardby marks the draft pull requests this
+  /// agent opened in the repository ready for review, once, after every Wardby
+  /// review check passed, CI is green and the merge order check (if any) is
+  /// success. Default off.
+  markReadyWhenPassing Boolean  @default(false)
+  /// Only on a coding agent's link: the base branch for runs in this repository.
+  /// Null = the coding profile's baseRef.
+  baseRef              String?
+  createdAt            DateTime @default(now())
 
   /// How this link was authorized: "host_permission" (the agent owner's
   /// verified host identity had enough access), "admin" (a wardby admin
@@ -1462,6 +1700,48 @@ model AgentIssueProject {
   @@index([provider, projectKey])
 }
 
+/// A remote MCP server an owner registered (Streamable HTTP, HTTPS only).
+model McpServer {
+  id           String           @id @default(cuid())
+  ownerId      String
+  owner        Principal        @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  /// Unique per owner; the prefix of the tool names the model sees.
+  name         String
+  /// https only; no userinfo, no fragment; the query string is kept.
+  url          String
+  /// The owner's brokered secrets sent on every request (each brokered to the URL's host).
+  secretNames  String[]         @default([])
+  /// Last tools/list result, redacted: [{ name, description, inputSchema, annotations? }].
+  toolSnapshot Json             @default("[]")
+  snapshotAt   DateTime?
+  /// From initialize: { name?, version?, protocolVersion }.
+  serverInfo   Json?
+  createdAt    DateTime         @default(now())
+  updatedAt    DateTime         @updatedAt
+  agents       AgentMcpServer[]
+
+  @@unique([ownerId, name])
+  @@index([ownerId])
+}
+
+/// An MCP server attached to an agent, with the server tools it may call.
+model AgentMcpServer {
+  agentId       String
+  agent         Agent     @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  serverId      String
+  server        McpServer @relation(fields: [serverId], references: [id], onDelete: Cascade)
+  /// Exact tool names from the server's saved list. Never empty.
+  allowedTools  String[]
+  /// Per call; null = 30000. Capped by WARDBY_TOOL_MAX_TIMEOUT_MS at call time.
+  callTimeoutMs Int?
+  attachedById  String
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+
+  @@id([agentId, serverId])
+  @@index([serverId])
+}
+
 /// Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
 model IssueFingerprint {
   id              String   @id @default(cuid())
@@ -1481,12 +1761,14 @@ model IssueFingerprint {
   @@index([createdByRunId])
 }
 
-/// A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+/// A pull request wardby opened for an issue (a Jira issue, a GitHub issue): one shape for every issue
+/// provider. Provider-neutral on both sides.
 /// Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
 model IssuePullRequest {
   id            String   @id @default(cuid())
-  /// "jira"
+  /// "jira" or "github" (an issue on a repository).
   issueProvider String
+  /// A Jira key ("PROJ-7"), or a GitHub issue's "<owner>/<repo>#<number>" (githubIssueKey).
   issueKey      String
   /// "github" today; "bitbucket" next.
   codeProvider  String
@@ -1636,6 +1918,9 @@ model LocalReview {
   pullRequest   LocalPullRequest @relation(fields: [pullRequestId], references: [id], onDelete: Cascade)
   agentId       String
   headSha       String
+  /// headSha when this review read every file of it (null otherwise): the head a later
+  /// re-review may compare from and still APPROVE (repo_pr_read's lastCoveredSha).
+  coveredSha    String?
   /// APPROVE | CHANGES_REQUESTED | COMMENT
   verdict       String
   summary       String
@@ -1739,3 +2024,77 @@ model NotificationThread {
 
   @@unique([provider, channelId, threadKey])
 }
+
+/// A code host implemented by operator-approved custom tools (docs/host-providers.md).
+/// `name` is the prefix of its repository ids: `<name>:<workspace>/<repo>`. Holds no secret values.
+model HostProvider {
+  name                   String   @id
+  contractVersion        Int
+  gitHost                String
+  apiHosts               String[]
+  gitUsername            String
+  pullRequestUrlTemplate String
+  /// Where one repository lives on the API, with `{repository}`: a repository-scoped tool's requests stay under it.
+  repositoryApiPath      String
+  /// The effective-permission endpoint, with `{workspace}` and `{repo}`. Set with a permission secret.
+  permissionApiPath      String?
+  /// How to verify and read a webhook: header names and algorithm, never the secret.
+  webhook                Json
+  webhookSecretId        String
+  webhookSecret          Secret   @relation("HostProviderWebhookSecret", fields: [webhookSecretId], references: [id], onDelete: Restrict)
+  /// Set: ask the host who has access. Unset: trustedAccounts decides.
+  permissionSecretId     String?
+  permissionSecret       Secret?  @relation("HostProviderPermissionSecret", fields: [permissionSecretId], references: [id], onDelete: Restrict)
+  createdById            String
+  createdAt              DateTime @default(now())
+  updatedAt              DateTime @updatedAt
+
+  operations      HostProviderOperation[]
+  credentials     HostProviderCredential[]
+  trustedAccounts HostProviderTrustedAccount[]
+}
+
+/// One approved snapshot: the code Wardby runs. `update_tool` changes nothing here until approved again.
+model HostProviderOperation {
+  provider     String
+  operation    String
+  /// The tool it was copied from. Null once that tool is deleted; the snapshot keeps working.
+  toolId       String?
+  code         String
+  paramsZod    String
+  /// The tool's timeoutMs when it was approved; null = the default limit.
+  timeoutMs    Int?
+  approvedById String
+  approvedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  tool         Tool?        @relation(fields: [toolId], references: [id], onDelete: SetNull)
+
+  @@id([provider, operation])
+}
+
+/// Which brokered secret serves which repositories. `credentialKind` is `static` only in v1.
+model HostProviderCredential {
+  id                String @id @default(cuid())
+  provider          String
+  repositoryPattern String
+  secretId          String
+  credentialKind    String @default("static")
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  secret       Secret       @relation("HostProviderCredentialSecret", fields: [secretId], references: [id], onDelete: Restrict)
+
+  @@unique([provider, repositoryPattern])
+}
+
+/// Host accounts allowed to start runs when the provider has no permission secret.
+model HostProviderTrustedAccount {
+  provider  String
+  accountId String
+  addedById String
+  addedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+
+  @@id([provider, accountId])
+}