@xfey/tenso 0.1.130

package/migrations/0016_external_source_mappings.sql

@@ -0,0 +1,141 @@
+CREATE TABLE external_source_mappings (
+  platform TEXT NOT NULL,
+  installation_ref TEXT NOT NULL,
+  conversation_ref TEXT NOT NULL,
+  thread_ref TEXT,
+  parent_message_ref TEXT,
+  external_message_ref TEXT NOT NULL,
+  message_id TEXT NOT NULL UNIQUE,
+  binding_ref TEXT NOT NULL,
+  receipt_key TEXT NOT NULL UNIQUE,
+  external_subject_ref TEXT NOT NULL,
+  author_account_ref TEXT NOT NULL,
+  author_display_name TEXT NOT NULL,
+  external_created_at TEXT NOT NULL,
+  accepted_at TEXT NOT NULL,
+  initial_revision_ref TEXT NOT NULL,
+  initial_observed_at TEXT NOT NULL,
+  content_sha256 TEXT NOT NULL CHECK (
+    content_sha256 GLOB 'sha256:[0-9a-f]*' AND length(content_sha256) = 71
+  ),
+  adapter_version TEXT NOT NULL,
+  latest_revision_ref TEXT NOT NULL,
+  latest_external_updated_at TEXT NOT NULL,
+  external_deleted_at TEXT,
+  PRIMARY KEY (platform, installation_ref, external_message_ref),
+  FOREIGN KEY (message_id) REFERENCES messages(id) ON DELETE RESTRICT
+);
+
+CREATE INDEX external_source_mappings_conversation_order
+  ON external_source_mappings (
+    platform,
+    installation_ref,
+    conversation_ref,
+    accepted_at,
+    message_id
+  );
+
+CREATE TABLE external_source_revision_observations (
+  platform TEXT NOT NULL,
+  installation_ref TEXT NOT NULL,
+  external_message_ref TEXT NOT NULL,
+  revision_ref TEXT NOT NULL,
+  observation_kind TEXT NOT NULL CHECK (
+    observation_kind IN ('created', 'edited', 'deleted')
+  ),
+  content_sha256 TEXT CHECK (
+    content_sha256 IS NULL
+    OR (content_sha256 GLOB 'sha256:[0-9a-f]*' AND length(content_sha256) = 71)
+  ),
+  external_updated_at TEXT NOT NULL,
+  observed_at TEXT NOT NULL,
+  adapter_version TEXT NOT NULL,
+  PRIMARY KEY (
+    platform,
+    installation_ref,
+    external_message_ref,
+    revision_ref
+  ),
+  FOREIGN KEY (platform, installation_ref, external_message_ref)
+    REFERENCES external_source_mappings (
+      platform,
+      installation_ref,
+      external_message_ref
+    )
+    ON DELETE RESTRICT,
+  CHECK (observation_kind != 'created' OR content_sha256 IS NOT NULL)
+);
+
+CREATE INDEX external_source_revision_observations_order
+  ON external_source_revision_observations (
+    platform,
+    installation_ref,
+    external_message_ref,
+    external_updated_at,
+    revision_ref
+  );
+
+CREATE TRIGGER external_source_mapping_identity_immutable
+BEFORE UPDATE OF
+  platform,
+  installation_ref,
+  conversation_ref,
+  thread_ref,
+  parent_message_ref,
+  external_message_ref,
+  message_id,
+  binding_ref,
+  receipt_key,
+  external_subject_ref,
+  author_account_ref,
+  author_display_name,
+  external_created_at,
+  accepted_at,
+  initial_revision_ref,
+  initial_observed_at,
+  content_sha256,
+  adapter_version
+ON external_source_mappings
+BEGIN
+  SELECT RAISE(ABORT, 'external source mapping evidence is immutable');
+END;
+
+CREATE TRIGGER external_source_mapping_no_delete
+BEFORE DELETE ON external_source_mappings
+BEGIN
+  SELECT RAISE(ABORT, 'external source mapping evidence is immutable');
+END;
+
+CREATE TRIGGER external_source_revision_observation_no_update
+BEFORE UPDATE ON external_source_revision_observations
+BEGIN
+  SELECT RAISE(ABORT, 'external source revision observations are append-only');
+END;
+
+CREATE TRIGGER external_source_revision_observation_no_delete
+BEFORE DELETE ON external_source_revision_observations
+BEGIN
+  SELECT RAISE(ABORT, 'external source revision observations are append-only');
+END;
+
+CREATE TRIGGER external_source_message_evidence_immutable
+BEFORE UPDATE OF
+  scope_kind,
+  clarification_round_id,
+  author_kind,
+  author_ref,
+  author_display_name,
+  author_avatar_json,
+  message_kind,
+  body,
+  refs_json,
+  created_at
+ON messages
+WHEN EXISTS (
+  SELECT 1
+  FROM external_source_mappings
+  WHERE external_source_mappings.message_id = OLD.id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'external source message evidence is immutable');
+END;

package/migrations/0017_platform_outbound_intents.sql

@@ -0,0 +1,31 @@
+CREATE TABLE platform_outbound_intents (
+  intent_ref TEXT PRIMARY KEY CHECK (intent_ref GLOB 'idem_*'),
+  platform TEXT NOT NULL CHECK (platform = 'feishu'),
+  installation_ref TEXT NOT NULL,
+  binding_ref TEXT NOT NULL,
+  trigger_message_id TEXT NOT NULL,
+  canonical_message_id TEXT NOT NULL UNIQUE,
+  disposition TEXT NOT NULL CHECK (
+    disposition IN ('pending', 'sending', 'retry_wait', 'handed_off', 'terminal')
+  ),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at TEXT,
+  last_attempt_at TEXT,
+  delivery_ref TEXT,
+  error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  handed_off_at TEXT,
+  FOREIGN KEY (trigger_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  FOREIGN KEY (canonical_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  CHECK (
+    (disposition = 'handed_off' AND delivery_ref IS NOT NULL AND handed_off_at IS NOT NULL)
+    OR disposition != 'handed_off'
+  )
+);
+
+CREATE INDEX platform_outbound_intents_due
+  ON platform_outbound_intents (disposition, next_attempt_at, created_at, intent_ref);
+
+CREATE INDEX platform_outbound_intents_trigger
+  ON platform_outbound_intents (trigger_message_id, created_at, intent_ref);

package/migrations/0018_platform_outbound_events.sql

@@ -0,0 +1,111 @@
+CREATE TABLE platform_outbound_intents_v2 (
+  intent_ref TEXT PRIMARY KEY CHECK (intent_ref GLOB 'idem_*'),
+  platform TEXT NOT NULL CHECK (platform = 'feishu'),
+  installation_ref TEXT NOT NULL,
+  binding_ref TEXT NOT NULL,
+  event_kind TEXT NOT NULL CHECK (
+    event_kind IN ('chat_response', 'needs_input', 'task_completed', 'task_failed')
+  ),
+  event_key TEXT NOT NULL UNIQUE,
+  subject_kind TEXT NOT NULL CHECK (
+    subject_kind IN ('message', 'clarification_round', 'approval_request', 'task_result')
+  ),
+  subject_ref TEXT NOT NULL,
+  target_kind TEXT NOT NULL CHECK (target_kind IN ('project', 'work')),
+  trigger_message_id TEXT,
+  canonical_message_id TEXT UNIQUE,
+  content_text TEXT CHECK (content_text IS NULL OR length(content_text) BETWEEN 1 AND 4000),
+  disposition TEXT NOT NULL CHECK (
+    disposition IN ('pending', 'sending', 'retry_wait', 'handed_off', 'terminal')
+  ),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at TEXT,
+  last_attempt_at TEXT,
+  delivery_ref TEXT,
+  error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  handed_off_at TEXT,
+  FOREIGN KEY (trigger_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  FOREIGN KEY (canonical_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  CHECK (canonical_message_id IS NOT NULL OR content_text IS NOT NULL),
+  CHECK (
+    event_kind != 'chat_response'
+    OR (
+      trigger_message_id IS NOT NULL
+      AND canonical_message_id IS NOT NULL
+      AND subject_kind = 'message'
+      AND target_kind = 'project'
+      AND content_text IS NULL
+    )
+  ),
+  CHECK (
+    (disposition = 'handed_off' AND delivery_ref IS NOT NULL AND handed_off_at IS NOT NULL)
+    OR disposition != 'handed_off'
+  )
+);
+
+INSERT INTO platform_outbound_intents_v2 (
+  intent_ref,
+  platform,
+  installation_ref,
+  binding_ref,
+  event_kind,
+  event_key,
+  subject_kind,
+  subject_ref,
+  target_kind,
+  trigger_message_id,
+  canonical_message_id,
+  content_text,
+  disposition,
+  attempt_count,
+  next_attempt_at,
+  last_attempt_at,
+  delivery_ref,
+  error_code,
+  created_at,
+  updated_at,
+  handed_off_at
+)
+SELECT
+  intent_ref,
+  platform,
+  installation_ref,
+  binding_ref,
+  'chat_response',
+  'chat_response:' || canonical_message_id,
+  'message',
+  canonical_message_id,
+  'project',
+  trigger_message_id,
+  canonical_message_id,
+  NULL,
+  disposition,
+  attempt_count,
+  next_attempt_at,
+  last_attempt_at,
+  delivery_ref,
+  error_code,
+  created_at,
+  updated_at,
+  handed_off_at
+FROM platform_outbound_intents;
+
+DROP TABLE platform_outbound_intents;
+ALTER TABLE platform_outbound_intents_v2 RENAME TO platform_outbound_intents;
+
+CREATE INDEX platform_outbound_intents_due
+  ON platform_outbound_intents (disposition, next_attempt_at, created_at, intent_ref);
+
+CREATE INDEX platform_outbound_intents_trigger
+  ON platform_outbound_intents (trigger_message_id, created_at, intent_ref);
+
+CREATE INDEX platform_outbound_intents_event
+  ON platform_outbound_intents (event_kind, subject_kind, subject_ref, created_at);
+
+CREATE TABLE platform_outbound_event_capture_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  capture_after TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);

package/migrations/0019_platform_outbound_card_content.sql

@@ -0,0 +1,76 @@
+CREATE TABLE platform_outbound_intents_v3 (
+  intent_ref TEXT PRIMARY KEY CHECK (intent_ref GLOB 'idem_*'),
+  platform TEXT NOT NULL CHECK (platform = 'feishu'),
+  installation_ref TEXT NOT NULL,
+  binding_ref TEXT NOT NULL,
+  event_kind TEXT NOT NULL CHECK (
+    event_kind IN ('chat_response', 'needs_input', 'task_completed', 'task_failed')
+  ),
+  event_key TEXT NOT NULL UNIQUE,
+  subject_kind TEXT NOT NULL CHECK (
+    subject_kind IN ('message', 'clarification_round', 'approval_request', 'task_result')
+  ),
+  subject_ref TEXT NOT NULL,
+  target_kind TEXT NOT NULL CHECK (target_kind IN ('project', 'work')),
+  trigger_message_id TEXT,
+  canonical_message_id TEXT UNIQUE,
+  content_text TEXT CHECK (content_text IS NULL OR length(content_text) BETWEEN 1 AND 4000),
+  content_json TEXT CHECK (content_json IS NULL OR length(content_json) BETWEEN 2 AND 32768),
+  disposition TEXT NOT NULL CHECK (
+    disposition IN ('pending', 'sending', 'retry_wait', 'handed_off', 'terminal')
+  ),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at TEXT,
+  last_attempt_at TEXT,
+  delivery_ref TEXT,
+  error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  handed_off_at TEXT,
+  FOREIGN KEY (trigger_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  FOREIGN KEY (canonical_message_id) REFERENCES messages(id) ON DELETE RESTRICT,
+  CHECK (
+    canonical_message_id IS NOT NULL OR content_text IS NOT NULL OR content_json IS NOT NULL
+  ),
+  CHECK (content_text IS NULL OR content_json IS NULL),
+  CHECK (
+    event_kind != 'chat_response'
+    OR (
+      trigger_message_id IS NOT NULL
+      AND canonical_message_id IS NOT NULL
+      AND subject_kind = 'message'
+      AND target_kind = 'project'
+      AND content_text IS NULL
+      AND content_json IS NULL
+    )
+  ),
+  CHECK (
+    (disposition = 'handed_off' AND delivery_ref IS NOT NULL AND handed_off_at IS NOT NULL)
+    OR disposition != 'handed_off'
+  )
+);
+
+INSERT INTO platform_outbound_intents_v3 (
+  intent_ref, platform, installation_ref, binding_ref, event_kind, event_key,
+  subject_kind, subject_ref, target_kind, trigger_message_id, canonical_message_id,
+  content_text, content_json, disposition, attempt_count, next_attempt_at,
+  last_attempt_at, delivery_ref, error_code, created_at, updated_at, handed_off_at
+)
+SELECT
+  intent_ref, platform, installation_ref, binding_ref, event_kind, event_key,
+  subject_kind, subject_ref, target_kind, trigger_message_id, canonical_message_id,
+  content_text, NULL, disposition, attempt_count, next_attempt_at,
+  last_attempt_at, delivery_ref, error_code, created_at, updated_at, handed_off_at
+FROM platform_outbound_intents;
+
+DROP TABLE platform_outbound_intents;
+ALTER TABLE platform_outbound_intents_v3 RENAME TO platform_outbound_intents;
+
+CREATE INDEX platform_outbound_intents_due
+  ON platform_outbound_intents (disposition, next_attempt_at, created_at, intent_ref);
+
+CREATE INDEX platform_outbound_intents_trigger
+  ON platform_outbound_intents (trigger_message_id, created_at, intent_ref);
+
+CREATE INDEX platform_outbound_intents_event
+  ON platform_outbound_intents (event_kind, subject_kind, subject_ref, created_at);

package/migrations/0020_managed_reference_sources.sql

@@ -0,0 +1,34 @@
+CREATE TABLE managed_reference_sources (
+  source_ref TEXT PRIMARY KEY,
+  adapter_key TEXT NOT NULL,
+  reference_path TEXT NOT NULL UNIQUE,
+  accepted_revision_ref TEXT,
+  accepted_blob_oid TEXT,
+  accepted_content_sha256 TEXT,
+  last_operation_ref TEXT,
+  last_expected_blob_oid TEXT,
+  last_outcome TEXT CHECK (last_outcome IS NULL OR last_outcome IN ('created', 'updated', 'unchanged')),
+  pending_operation_ref TEXT,
+  pending_revision_ref TEXT,
+  pending_content_sha256 TEXT,
+  pending_expected_blob_oid TEXT,
+  side_effects_pending INTEGER NOT NULL DEFAULT 0 CHECK (side_effects_pending IN (0, 1)),
+  last_checked_at TEXT,
+  last_accepted_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (accepted_revision_ref IS NULL AND accepted_blob_oid IS NULL AND accepted_content_sha256 IS NULL)
+    OR
+    (accepted_revision_ref IS NOT NULL AND accepted_blob_oid IS NOT NULL AND accepted_content_sha256 IS NOT NULL)
+  ),
+  CHECK (
+    (pending_operation_ref IS NULL AND pending_revision_ref IS NULL AND pending_content_sha256 IS NULL)
+    OR
+    (pending_operation_ref IS NOT NULL AND pending_revision_ref IS NOT NULL AND pending_content_sha256 IS NOT NULL)
+  )
+);
+
+CREATE INDEX managed_reference_sources_pending_idx
+  ON managed_reference_sources (side_effects_pending, updated_at)
+  WHERE side_effects_pending = 1;

package/migrations/0021_external_reference_reads.sql

@@ -0,0 +1,11 @@
+CREATE TABLE external_reference_reads (
+  invocation_ref TEXT NOT NULL,
+  activity_ref TEXT,
+  source_ref TEXT NOT NULL,
+  revision TEXT NOT NULL,
+  content_sha256 TEXT NOT NULL,
+  size_bytes INTEGER NOT NULL CHECK (size_bytes >= 0),
+  checked_at TEXT NOT NULL,
+  PRIMARY KEY (invocation_ref, source_ref)
+);
+CREATE INDEX external_reference_reads_activity ON external_reference_reads(activity_ref);

package/migrations/0022_clarification_projection_cursors.sql

@@ -0,0 +1,7 @@
+CREATE TABLE platform_clarification_projection_cursors (
+  round_id TEXT PRIMARY KEY REFERENCES clarification_rounds(id),
+  binding_ref TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version >= 0),
+  closed INTEGER NOT NULL DEFAULT 0 CHECK (closed IN (0, 1))
+);
+CREATE INDEX idx_platform_clarification_live ON platform_clarification_projection_cursors(closed);

package/migrations/0023_communication_language.sql

@@ -0,0 +1,14 @@
+CREATE TABLE communication_language_state (
+  owner_kind TEXT NOT NULL CHECK (owner_kind IN ('project', 'scratchpad', 'workflow', 'task')),
+  owner_ref TEXT NOT NULL CHECK (length(owner_ref) BETWEEN 1 AND 128),
+  locale TEXT NOT NULL CHECK (length(locale) BETWEEN 2 AND 20),
+  preference TEXT NOT NULL CHECK (preference IN ('auto', 'fixed')),
+  basis TEXT NOT NULL CHECK (basis IN ('discussion', 'explicit', 'inherited', 'default')),
+  policy_version INTEGER NOT NULL CHECK (policy_version = 1),
+  activity_ref TEXT,
+  source_message_id TEXT,
+  source_created_at TEXT,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (owner_kind, owner_ref),
+  CHECK ((source_message_id IS NULL) = (source_created_at IS NULL))
+);

package/migrations/0024_chat_requests.sql

@@ -0,0 +1,19 @@
+CREATE TABLE chat_requests (
+  enqueue_order INTEGER PRIMARY KEY AUTOINCREMENT,
+  trigger_message_id TEXT NOT NULL UNIQUE REFERENCES messages(id),
+  status TEXT NOT NULL CHECK (status IN ('queued', 'running', 'succeeded', 'failed')),
+  phase TEXT NOT NULL CHECK (phase IN ('queue', 'workspace_wait', 'answer', 'settled')),
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision > 0),
+  attempt_ref TEXT,
+  response_message_id TEXT UNIQUE REFERENCES messages(id),
+  failure_json TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (status = 'queued' AND phase = 'queue' AND failure_json IS NULL AND response_message_id IS NULL) OR
+    (status = 'running' AND phase IN ('workspace_wait', 'answer') AND attempt_ref IS NOT NULL AND failure_json IS NULL AND response_message_id IS NULL) OR
+    (status = 'succeeded' AND phase = 'settled' AND response_message_id IS NOT NULL AND failure_json IS NULL) OR
+    (status = 'failed' AND phase = 'settled' AND failure_json IS NOT NULL)
+  )
+);
+CREATE INDEX chat_requests_pending ON chat_requests(status, enqueue_order);

package/migrations/0025_task_compile_requests.sql

@@ -0,0 +1,50 @@
+-- Identity / closure evidence only. Pending inputs, clarification and receipts
+-- remain authoritative; this table does not schedule or replay work.
+CREATE TABLE task_compile_requests (
+  workflow_ref TEXT PRIMARY KEY,
+  accepted_activity_ref TEXT NOT NULL,
+  current_activity_ref TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  failure_code TEXT CHECK (failure_code IN ('task_compile_failed', 'scratchpad_empty_after_refresh')),
+  closed_at TEXT,
+  CHECK ((failure_code IS NULL) = (closed_at IS NULL))
+);
+
+CREATE TABLE task_compile_request_commands (
+  command_id TEXT PRIMARY KEY REFERENCES command_idempotency_records(command_id),
+  workflow_ref TEXT NOT NULL REFERENCES task_compile_requests(workflow_ref)
+);
+
+CREATE INDEX idx_task_compile_requests_latest ON task_compile_requests(created_at DESC);
+
+-- Only live submissions have provable identity at migration time. Do not infer
+-- failed historical requests from missing contexts or unrelated activities.
+INSERT INTO task_compile_requests
+  (workflow_ref, accepted_activity_ref, current_activity_ref, created_at)
+SELECT workflow_ref, accepted_activity_ref, accepted_activity_ref, requested_at
+FROM pending_task_compile_submissions;
+INSERT OR IGNORE INTO task_compile_requests
+  (workflow_ref, accepted_activity_ref, current_activity_ref, created_at)
+SELECT workflow_ref, captured_by_activity_ref, captured_by_activity_ref, submitted_at
+FROM active_task_compile_context;
+
+-- Read requirement evidence, not an authorization/token mirror. Several model
+-- invocations may encounter the same Integration-owned authorization request.
+CREATE TABLE external_reference_access_requirements (
+  invocation_ref TEXT NOT NULL,
+  request_ref TEXT NOT NULL,
+  activity_ref TEXT,
+  authorization_ref TEXT NOT NULL,
+  profile TEXT NOT NULL CHECK (profile IN ('docx', 'wiki_docx', 'drive_file')),
+  observed_at TEXT NOT NULL,
+  PRIMARY KEY (invocation_ref, request_ref)
+);
+CREATE INDEX idx_external_reference_requirements_activity
+  ON external_reference_access_requirements(activity_ref);
+
+CREATE TABLE chat_request_invocations (
+  message_id TEXT NOT NULL REFERENCES chat_requests(trigger_message_id),
+  attempt_ref TEXT NOT NULL,
+  invocation_ref TEXT NOT NULL,
+  PRIMARY KEY (message_id, attempt_ref)
+);

package/migrations/0026_context_sync_and_chat_locale.sql

@@ -0,0 +1,12 @@
+-- A started automatic maintenance attempt is not automatically replayable.
+-- Keys refer to task/result identities, not mutable repository HEAD or chat.
+CREATE TABLE context_sync_completion_attempts (
+  batch_key TEXT PRIMARY KEY NOT NULL,
+  workflow_ref TEXT NOT NULL UNIQUE,
+  started_at TEXT NOT NULL
+);
+
+-- Static failure notices retain their language across queueing and recovery.
+-- Older requests have no captured preference and retain the English fallback.
+ALTER TABLE chat_requests ADD COLUMN notice_locale TEXT NOT NULL DEFAULT 'en'
+  CHECK (notice_locale IN ('en', 'zh-Hans', 'zh-Hant'));

package/migrations/README.md

@@ -0,0 +1,55 @@
+# migrations
+
+## 作用
+
+这里保存 `apps/server` 本地 SQLite store 的 numbered SQL migrations。
+
+## 约定
+
+- migration 文件命名使用 `0001_init.sql`、`0002_<name>.sql` 形式。
+- migration 归 host server 所有，不放入 `packages/shared`。
+- `schema_migrations` 记录已应用版本、checksum 和应用时间。
+- SQLite adapter 初始化必须先开启 foreign keys、WAL 和合理 busy timeout；这些 PRAGMA 不放进 numbered migration 文件。
+
+## 当前 migrations
+
+后续 `0021`／`0022`／`0023` 分别增加外部读取证据、clarification 投影 cursor 和协作语言 metadata。`0024_chat_requests.sql` 为普通 Chat 增加持久 FIFO、状态／阶段 CHECK、attempt／revision、原始与回复 message FK；不回填历史提问，不保存正文／prompt。`0025_task_compile_requests.sql` 增加 Submit identity／明确关闭证据、command 关联、外部授权 requirement 与 Chat attempt→invocation 关联；仅回填 live pending／captured submission，不重建历史状态／command，不复制 token 或授权状态。最新 `0026_context_sync_and_chat_locale.sql` 新增自动整理 batch／workflow／start attempt 记录（不回填历史），以及 Chat 内部有限 notice locale（旧行默认英文，不改状态或 revision）。恢复仍由原 owner 负责，见 [请求状态与恢复](../../../docs/system/request-status-and-recovery.md)。
+
+- `0001_init.sql`：初始化本地 `tutti.sqlite`，包含协作 truth records、store metadata、command idempotency、clarification replay hint、索引和关键 trigger。
+- `0002_allow_sealed_round_successor_note.sql`：允许 Control Plane 在 sealed clarification round 内追加只读 Tutti successor 结论消息，同时继续禁止人类补充消息写入 sealed round。
+- `0003_drop_scratchpad_source_message_refs.sql`：从 Scratchpad 持久化中移除不再暴露给模型、API 或 UI 的来源消息追溯字段。
+- `0004_read_state.sql`：为 Chat / Worklist 未读摘要新增 read notification events 与 per-account read-state cursor，并从已有消息、任务、任务详情和 run result 回填初始事件。
+- `0005_provider_usage.sql`：新增 provider token usage append-only ledger，用于 Timeline token overview projection。
+- `0006_scratchpad_source_state.sql`：新增自动 Scratchpad refresh 的本机 source cursor / dirty / in-flight / backoff 状态表。
+- `0007_workspace_signal_read_state_scopes.sql`：扩展 read-state scope，允许 References 与 Skills 写入模块更新通知事件。
+- `0008_provider_usage_anchors.sql`：为 provider usage ledger 增加可空 activity / workflow / task / run result anchor 字段，供 Timeline 尽力把 token usage 挂到可证明的历史节点。
+- `0009_project_timeline_events.sql`：新增 Timeline 专用 append-only durable event 表，用于记录缺少其他稳定 record 的 context sync、reference summary 与历史 promotion reconcile 轻量可观测性节点；新 Run 不再写 reconcile event。
+- `0010_project_brief.sql`：新增 host-local Project Brief projection 表，用于保存四个 baseline Project Docs 的短摘要和 source fingerprint。
+- `0011_message_author_avatar.sql`：为消息作者增加可选 Relay account avatar 快照，保证跨浏览器查看历史消息时不依赖当前 viewer profile 或 presence sample。
+- `0012_scratchpad_receipts.sql`：为当前 Scratchpad 增加 `submitted` 状态字段，并新增已提交 Scratchpad 小票历史表。
+- `0013_scratchpad_receipt_sources.sql`：新增当前 Scratchpad snapshot 与 submitted receipt 的 source message id 引用表，供 Timeline Task Accepted 追溯原始聊天依据。
+- `0014_scratchpad_task_compile_context.sql`：把 Scratchpad source state 收敛为纯主群聊周期 cursor，新增 durable active Task Compile Context 与完整 source refs，并把 Current Scratchpad / receipt sources 限定为主群聊。该开发阶段 migration 不迁移旧调试数据，已有本地开发数据库需要 reset / recreate。
+- `0015_control_plane_intents.sql`：新增 Control Plane durable dispatch intent，保存 bounded kind / owner / dedupe / lane、pending-to-running claim lease 与 terminal 状态，为 Clarification、Task Compile、Scratchpad、Reference Summary 和 Run 提供可恢复的 runtime handoff；同时用 immutable pending Task Compile submission row 固化 context capture 前的 workflow / main-chat cursor boundary，不保存 prompt、消息正文、provider output、secret 或 host path。
+- `0016_external_source_mappings.sql`：新增external installation / message identity到既有`messages.id`的一对一mapping和append-only revision observation；mapped message evidence、mapping identity与observations由trigger / FK保护，不保存raw platform payload、credential或短期URL。
+- `0017_platform_outbound_intents.sql`：新增Host-owned platform outbound intent；只引用canonical / trigger message与installation / binding locator，保存handoff attempt和terminal状态，不复制回复正文或保存conversation ref / credential。
+- `0018_platform_outbound_events.sql`：把旧Chat response intent无损迁移为event-aware schema，新增stable event / subject / Project-or-Work target、approval bounded snapshot与首次status capture boundary；不回填升级前clarification / Task terminal消息。
+- `0019_platform_outbound_card_content.sql`：把approval outbound snapshot从text扩展为经过internal schema验证的structured card content，同时无损保留既有intent、handoff与重试状态；不保存conversation、platform action或callback receipt。
+- `0020_managed_reference_sources.sql`：保存opaque managed source / adapter /稳定Reference path、accepted revision / blob / digest、pending operation与写后副作用恢复checkpoint；不保存平台document locator、credential、正文、staged URL或Relay authority。
+
+## 当前实现状态
+
+- 当前 Host migrations 已到 `0026_context_sync_and_chat_locale.sql`，后续表的 owner 见上方说明。`0014` 明确采用开发数据库重建策略，不提供旧 Scratchpad source/cursor 数据兼容；`0016`–`0017`不回填既有 internal Chat message／agent response 的 external mapping／outbound intent，`0018`保留旧 intent 并阻止历史 status 回填，`0019`无损加入 structured card content，`0020`加入独立 managed Reference recovery checkpoint；`0024`不回填历史 Chat 请求，`0025`只回填 live submission identity，`0026`不推断旧任务已完成过文档检查。
+- SQLite adapter、migration runner、checksum 校验、store metadata 初始化、transaction helper 与 command recovery scan helper 已实现。
+- 协作 repository 与 Control Plane 已实现第一批业务读写；Phase 7 首批已复用 `0001_init.sql` 中的 `tasks.latest_run_result_id`、`task_details.result_json` 与 `run_results` 表完成 Run result / checks / promotion 摘要持久化。Control Plane recovery resolver 与 task-bound continuation / retry 复用现有 schema；新 Run 的 accepted checkpoint 业务 truth 继续写入最终 Run result / task detail result，Git tag / commit trailer 承担 crash recovery evidence。Timeline 默认从 `tasks`、`run_results` 与历史主群聊 `refs.worklist_feedback` 投影任务级审计节点，当前 task terminal Chat feedback 写入 `refs.task_result` 消息；`project_timeline_events` 只保留缺少稳定 record 的轻量可观测性事件和历史 reconcile 兼容记录。project workspace、working diff 与 ignored runtime state 都不进入 SQLite truth。`provider_usage_events` 只保存 token 计数、调用来源、模型名、记录时间和可空 anchor，不保存 provider secret、prompt 或 raw response。store 基础设施本身已经可以创建并迁移 `tutti.sqlite`。
+
+## PRAGMA 边界
+
+`PRAGMA foreign_keys = ON`、`PRAGMA journal_mode = WAL` 与 `PRAGMA busy_timeout = 5000` 属于 SQLite connection / adapter 初始化步骤。
+
+原因：
+
+- `journal_mode = WAL` 不能安全放进事务包裹的 migration runner。
+- numbered migration 应只包含 schema 变更，便于统一 checksum、事务执行和回滚解释。
+- store adapter 每次打开连接都应显式设置 `foreign_keys` 与 `busy_timeout`。
+
+schema 设计说明见 [../../../docs/system/sqlite-store-schema.md](../../../docs/system/sqlite-store-schema.md)。

package/node_modules/@sinclair/typebox/build/cjs/compiler/compiler.d.ts

@@ -0,0 +1,55 @@
+import { ValueErrorIterator } from '../errors/index';
+import { TypeBoxError } from '../type/error/index';
+import type { TSchema } from '../type/schema/index';
+import type { Static, StaticDecode, StaticEncode } from '../type/static/index';
+export type CheckFunction = (value: unknown) => boolean;
+export declare class TypeCheck<T extends TSchema> {
+    private readonly schema;
+    private readonly references;
+    private readonly checkFunc;
+    private readonly code;
+    private readonly hasTransform;
+    constructor(schema: T, references: TSchema[], checkFunc: CheckFunction, code: string);
+    /** Returns the generated assertion code used to validate this type. */
+    Code(): string;
+    /** Returns the schema type used to validate */
+    Schema(): T;
+    /** Returns reference types used to validate */
+    References(): TSchema[];
+    /** Returns an iterator for each error in this value. */
+    Errors(value: unknown): ValueErrorIterator;
+    /** Returns true if the value matches the compiled type. */
+    Check(value: unknown): value is Static<T>;
+    /** Decodes a value or throws if error */
+    Decode<Static = StaticDecode<T>, Result extends Static = Static>(value: unknown): Result;
+    /** Encodes a value or throws if error */
+    Encode<Static = StaticEncode<T>, Result extends Static = Static>(value: unknown): Result;
+}
+export declare class TypeCompilerUnknownTypeError extends TypeBoxError {
+    readonly schema: TSchema;
+    constructor(schema: TSchema);
+}
+export declare class TypeCompilerTypeGuardError extends TypeBoxError {
+    readonly schema: TSchema;
+    constructor(schema: TSchema);
+}
+export declare namespace Policy {
+    function IsExactOptionalProperty(value: string, key: string, expression: string): string;
+    function IsObjectLike(value: string): string;
+    function IsRecordLike(value: string): string;
+    function IsNumberLike(value: string): string;
+    function IsVoidLike(value: string): string;
+}
+export type TypeCompilerLanguageOption = 'typescript' | 'javascript';
+export interface TypeCompilerCodegenOptions {
+    language?: TypeCompilerLanguageOption;
+}
+/** Compiles Types for Runtime Type Checking */
+export declare namespace TypeCompiler {
+    /** Generates the code used to assert this type and returns it as a string */
+    function Code<T extends TSchema>(schema: T, references: TSchema[], options?: TypeCompilerCodegenOptions): string;
+    /** Generates the code used to assert this type and returns it as a string */
+    function Code<T extends TSchema>(schema: T, options?: TypeCompilerCodegenOptions): string;
+    /** Compiles a TypeBox type for optimal runtime type checking. Types must be valid TypeBox types of TSchema */
+    function Compile<T extends TSchema>(schema: T, references?: TSchema[]): TypeCheck<T>;
+}