agentwrangler 0.1.1-next.826ece4 → 0.1.1-next.adabfa3

package/dist/daemon/http.js

@@ -140,6 +140,14 @@ function requiresSessionToken(pathname) {
         return true;
     if (/^\/api\/esf\/effects\/(track|stop|close|rollback|attest-rollback)$/.test(pathname))
         return true;
+    if (pathname === "/api/work-records" || pathname === "/api/work-records/ids")
+        return true;
+    if (/^\/api\/work-records\/[^/]+\/(edit|closeout|archive|reopen|sessions|contexts|delete)$/.test(pathname))
+        return true;
+    if (/^\/api\/work-records\/[^/]+\/(sessions|contexts)\/[^/]+\/detach$/.test(pathname))
+        return true;
+    if (pathname === "/api/work-records/allocations/recompute")
+        return true;
     return false;
 }
 /**

package/dist/daemon/router.js

@@ -1,11 +1,4 @@
-/**
- * src/daemon/router.ts — minimal API route dispatcher.
- *
- * Routes /api/* requests to the LocalQueryAPI stubs.
- * WP2 and WP4 replace the stub calls with real implementations.
- *
- * All responses are JSON with no permissive CORS headers.
- */
+import { getReportedWork } from "../query/api/reported-work.js";
 import { getPractices } from "../detector/practice-registry.js";
 import { getOAuthStatus } from "../oauth/credentials.js";
 import { getGithubTokenStatus } from "../outcomes/github/credential.js";
@@ -17,6 +10,7 @@ import { getDeliveryMetrics } from "../query/api/delivery.js";
 import { EffectRequestError, listEffectEvidence, mutateEffectCycle, trackCompletedChange, } from "../query/api/effect-service.js";
 import { getClosureProxy } from "../query/api/effectiveness.js";
 import { getEfficiencyHeadroom } from "../query/api/efficiency-headroom.js";
+import { getEsfObservations, getSessionEsfObservations } from "../query/api/esf-observations.js";
 import { getHeadroomTrend } from "../query/api/headroom-trend.js";
 import { getHotSessions } from "../query/api/hot-sessions.js";
 import { adoptRecommendation, calibrateBytesPerToken, calibrateLimit, confirmApplyJob, dismissRecommendation, getApplyJob, getContextBudget, getContextComposition, getGlobalOverview, getHookConfig, getIdleSessions, getLinkageRate, getLoopGuard, getSession, getSessionDrivers, getSettings, getSuccessRate, getTurnTimeline, getWorkspaceOutcomeDetail, installHookRoute, listLedger, listLiveSessions, listRecommendations, listSessions, listWorkspaceOutcomes, listWorkspaces, openTerminalForRec, resetDatabase, rollbackApplyJob, startApplyJob, uninstallHookRoute, updateHookConfig, updateSettings, } from "../query/api/index.js";
@@ -26,6 +20,7 @@ import { getSelfChurn } from "../query/api/self-churn.js";
 import { getSessionSpendPercentile, getWeeklySelfPercentile, } from "../query/api/self-percentiles.js";
 import { getFlavorDecomposition } from "../query/api/spend-flavor.js";
 import { getCacheWriteTrend, getTrends } from "../query/api/trends.js";
+import { WorkRecordError, attachWorkRecordContextRoute, attachWorkRecordSessionRoute, closeoutWorkRecordRoute, createWorkRecordRoute, deleteWorkRecordRoute, detachWorkRecordContextRoute, detachWorkRecordSessionRoute, editWorkRecordRoute, getWorkAllocation, getWorkAllocationClaimKinds, getWorkRecord, issueWorkRecordId, listWorkRecords, recomputeWorkAllocationRoute, setWorkRecordArchivedRoute, workRecordResponse, } from "../query/api/work-records.js";
 import { getSettingsData } from "../query/settings-store.js";
 import { getScanStatus, isReady } from "./readiness.js";
 function sendJson(res, status, body) {
@@ -134,10 +129,84 @@ function jobRoute(pathname) {
     const action = m[2] === "confirm" || m[2] === "rollback" ? m[2] : "get";
     return { jobId: decodeURIComponent(m[1]), action };
 }
+function workRecordId(pathname) {
+    const match = pathname.match(/^\/api\/work-records\/([^/]+)$/);
+    return match?.[1] === undefined ? null : decodeURIComponent(match[1]);
+}
+function workRecordAction(pathname) {
+    const match = pathname.match(/^\/api\/work-records\/([^/]+)\/(edit|closeout|archive|reopen|sessions|contexts|delete)(?:\/([^/]+)\/detach)?$/);
+    if (match?.[1] === undefined || match[2] === undefined)
+        return null;
+    const result = { recordId: decodeURIComponent(match[1]), action: match[2] };
+    return match[3] === undefined ? result : { ...result, relatedId: decodeURIComponent(match[3]) };
+}
+function workRecordBody(raw, recordId, related) {
+    let body;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        throw new WorkRecordError(400, "INVALID_REQUEST", "Invalid JSON body");
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        throw new WorkRecordError(400, "INVALID_REQUEST", "request body must be an object");
+    }
+    const result = { ...body };
+    if (recordId !== undefined) {
+        if (result.work_record_id !== undefined && result.work_record_id !== recordId) {
+            throw new WorkRecordError(400, "INVALID_REQUEST", "work_record_id must match the route");
+        }
+        result.work_record_id = recordId;
+    }
+    if (related !== undefined) {
+        if (result[related.key] !== undefined && result[related.key] !== related.value) {
+            throw new WorkRecordError(400, "INVALID_REQUEST", `${related.key} must match the route`);
+        }
+        result[related.key] = related.value;
+    }
+    return result;
+}
+function sendWorkRecordError(res, error) {
+    if (error instanceof EffectRequestError) {
+        sendJson(res, error.status, { error: error.message, code: "INVALID_REQUEST" });
+        return;
+    }
+    if (error instanceof WorkRecordError) {
+        sendJson(res, error.status, { error: error.message, code: error.code });
+        return;
+    }
+    sendJson(res, 500, { error: "Internal error" });
+}
 export function handleApiRequest(_db, req, res, method, url) {
     // Strip query string for routing.
     const pathname = url.split("?")[0] ?? url;
     try {
+        if (method === "GET" && pathname === "/api/work-records/summary") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            sendJson(res, 200, getReportedWork(_db, params.get("workspace_id") || null));
+            return;
+        }
+        // GET /api/esf/observations — complete selected-turn accounting cohort.
+        if (method === "GET" && pathname === "/api/esf/observations") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            const window = resolveWindow(parseWindowFilter(url));
+            if (Date.parse(window.from) >= Date.parse(window.to)) {
+                sendJson(res, 400, { error: "from must precede to" });
+                return;
+            }
+            sendJson(res, 200, getEsfObservations(_db, {
+                workspaceId: params.get("workspace_id") || null,
+                ...window,
+            }));
+            return;
+        }
+        // Full-session aggregate: never derive this from a paginated timeline.
+        const sessionObservationId = pathname.match(/^\/api\/esf\/session-observations\/([^/]+)$/)?.[1];
+        if (method === "GET" && sessionObservationId !== undefined) {
+            const evidence = getSessionEsfObservations(_db, decodeURIComponent(sessionObservationId));
+            sendJson(res, evidence.data === null ? 404 : 200, evidence);
+            return;
+        }
         // GET /api/esf/effects — independently keyset-paged versioned and legacy evidence.
         if (method === "GET" && pathname === "/api/esf/effects") {
             const params = new URLSearchParams(url.split("?")[1] ?? "");
@@ -179,6 +248,162 @@ export function handleApiRequest(_db, req, res, method, url) {
             }));
             return;
         }
+        // ESF3 work records are local-only, structured records.  The HTTP token gate
+        // in http.ts covers every mutation and ID issuance route below.
+        if (method === "GET" && pathname === "/api/work-records") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            const workspaceId = params.get("workspace_id");
+            const includeArchived = params.get("include_archived");
+            if (workspaceId === null ||
+                workspaceId.length === 0 ||
+                (includeArchived !== null && includeArchived !== "true" && includeArchived !== "false")) {
+                sendJson(res, 400, { error: "workspace_id and include_archived are invalid" });
+                return;
+            }
+            const records = listWorkRecords(_db, workspaceId, includeArchived === "true");
+            sendJson(res, 200, workRecordResponse(records, { n: records.length, workspaceId }));
+            return;
+        }
+        if (method === "GET" && pathname.startsWith("/api/work-records/allocations/")) {
+            const allocationId = pathname.slice("/api/work-records/allocations/".length);
+            if (allocationId.length === 0 || allocationId.includes("/")) {
+                sendJson(res, 404, { error: "Not found" });
+                return;
+            }
+            try {
+                const allocation = getWorkAllocation(_db, decodeURIComponent(allocationId));
+                sendJson(res, 200, workRecordResponse(allocation, {
+                    n: allocation.eligible_session_count,
+                    workspaceId: allocation.workspace_id,
+                    claimKind: "EXPERIMENTAL",
+                    meta: {
+                        window: { from: allocation.cohort_from, to: allocation.cohort_to },
+                        qualification: {
+                            provisional_excluded: true,
+                            unpriced_turns: allocation.unpriced_turn_count,
+                            claim_kinds_count: getWorkAllocationClaimKinds(_db, allocation.allocation_revision_id),
+                            note: "Frozen ESF3 allocation; unpriced turns are not zero cost.",
+                        },
+                    },
+                }));
+            }
+            catch (error) {
+                sendWorkRecordError(res, error);
+            }
+            return;
+        }
+        const recordId = workRecordId(pathname);
+        if (method === "GET" && recordId !== null) {
+            try {
+                const record = getWorkRecord(_db, recordId);
+                sendJson(res, 200, workRecordResponse(record, { workspaceId: record.workspace_id }));
+            }
+            catch (error) {
+                sendWorkRecordError(res, error);
+            }
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records/ids") {
+            readBody(req, 1024)
+                .then((raw) => {
+                try {
+                    sendJson(res, 200, workRecordResponse(issueWorkRecordId(_db, workRecordBody(raw))));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records") {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const result = createWorkRecordRoute(_db, workRecordBody(raw));
+                    sendJson(res, 200, workRecordResponse(result, { workspaceId: result.record.workspace_id }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records/allocations/recompute") {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const result = recomputeWorkAllocationRoute(_db, workRecordBody(raw));
+                    sendJson(res, 200, workRecordResponse(result, {
+                        n: result.allocation.eligible_session_count,
+                        workspaceId: result.allocation.workspace_id,
+                        claimKind: "EXPERIMENTAL",
+                        meta: {
+                            window: {
+                                from: result.allocation.cohort_from,
+                                to: result.allocation.cohort_to,
+                            },
+                            qualification: {
+                                provisional_excluded: true,
+                                unpriced_turns: result.allocation.unpriced_turn_count,
+                                claim_kinds_count: getWorkAllocationClaimKinds(_db, result.allocation.allocation_revision_id),
+                                note: "Frozen ESF3 allocation; unpriced turns are not zero cost.",
+                            },
+                        },
+                    }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        const recordAction = workRecordAction(pathname);
+        if (recordAction !== null &&
+            ((method === "POST" && recordAction.action !== "delete") ||
+                (method === "DELETE" && recordAction.action === "delete"))) {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const related = recordAction.relatedId === undefined
+                        ? undefined
+                        : {
+                            key: recordAction.action === "contexts" ? "context_ref_id" : "session_id",
+                            value: recordAction.relatedId,
+                        };
+                    const body = workRecordBody(raw, recordAction.recordId, related);
+                    const result = recordAction.action === "edit"
+                        ? editWorkRecordRoute(_db, body)
+                        : recordAction.action === "closeout"
+                            ? closeoutWorkRecordRoute(_db, body)
+                            : recordAction.action === "archive"
+                                ? setWorkRecordArchivedRoute(_db, body, true)
+                                : recordAction.action === "reopen"
+                                    ? setWorkRecordArchivedRoute(_db, body, false)
+                                    : recordAction.action === "sessions" && recordAction.relatedId === undefined
+                                        ? attachWorkRecordSessionRoute(_db, body)
+                                        : recordAction.action === "sessions"
+                                            ? detachWorkRecordSessionRoute(_db, body)
+                                            : recordAction.action === "contexts" &&
+                                                recordAction.relatedId === undefined
+                                                ? attachWorkRecordContextRoute(_db, body)
+                                                : recordAction.action === "contexts"
+                                                    ? detachWorkRecordContextRoute(_db, body)
+                                                    : deleteWorkRecordRoute(_db, body);
+                    const workspaceId = "record" in result ? result.record.workspace_id : undefined;
+                    sendJson(res, 200, workspaceId === undefined
+                        ? workRecordResponse(result)
+                        : workRecordResponse(result, { workspaceId }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
         // GET /api/overview
         if (method === "GET" && pathname === "/api/overview") {
             sendJson(res, 200, getGlobalOverview(parseWindowFilter(url)));

package/dist/db/migrations/019_work_records.sql

@@ -0,0 +1,291 @@
+-- ESF3: privacy-preserving work records, immutable membership history, and
+-- frozen allocation reports. All human-provided values are bounded enums;
+-- opaque identifiers and timestamps are issued by the daemon.
+
+CREATE TABLE work_records (
+  work_record_id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  current_revision_no INTEGER NOT NULL CHECK (current_revision_no >= 0),
+  archived_at TEXT,
+  external_ref_id TEXT,
+  external_ref_kind TEXT CHECK (external_ref_kind IN ('ISSUE', 'PULL_REQUEST', 'TASK', 'OTHER')),
+  CHECK ((external_ref_id IS NULL) = (external_ref_kind IS NULL))
+);
+
+CREATE TABLE work_record_revisions (
+  work_record_id TEXT NOT NULL REFERENCES work_records(work_record_id) ON DELETE CASCADE,
+  revision_no INTEGER NOT NULL CHECK (revision_no >= 0),
+  task_intent TEXT NOT NULL CHECK (task_intent IN
+    ('IMPLEMENT', 'DEBUG', 'REVIEW', 'RESEARCH_PLAN', 'OTHER', 'UNKNOWN')),
+  outcome_state TEXT NOT NULL CHECK (outcome_state IN
+    ('ACTIVE', 'USEFUL', 'PARTIAL', 'UNSUCCESSFUL', 'ABANDONED', 'UNKNOWN')),
+  repair_band TEXT NOT NULL CHECK (repair_band IN
+    ('NONE', 'MINOR', 'MAJOR', 'UNREPORTED', 'UNKNOWN')),
+  effort_band TEXT NOT NULL CHECK (effort_band IN
+    ('LOW', 'MEDIUM', 'HIGH', 'UNREPORTED', 'UNKNOWN')),
+  feedback_source TEXT NOT NULL CHECK (feedback_source IN ('USER_CLOSEOUT', 'USER_EDIT', 'NONE')),
+  reported_at TEXT,
+  recorded_at TEXT NOT NULL,
+  mutation_id TEXT NOT NULL UNIQUE,
+  PRIMARY KEY (work_record_id, revision_no),
+  CHECK ((feedback_source = 'NONE' AND reported_at IS NULL)
+      OR (feedback_source <> 'NONE' AND reported_at IS NOT NULL))
+);
+
+CREATE TRIGGER trg_work_record_revision_immutable
+BEFORE UPDATE ON work_record_revisions
+BEGIN
+  SELECT RAISE(ABORT, 'work_record_revision_immutable');
+END;
+
+CREATE TRIGGER trg_work_record_identity_immutable
+BEFORE UPDATE ON work_records
+BEGIN
+  SELECT CASE WHEN NEW.work_record_id <> OLD.work_record_id
+      OR NEW.workspace_id <> OLD.workspace_id
+      OR NEW.created_at <> OLD.created_at
+      OR COALESCE(NEW.external_ref_id, '') <> COALESCE(OLD.external_ref_id, '')
+      OR COALESCE(NEW.external_ref_kind, '') <> COALESCE(OLD.external_ref_kind, '')
+    THEN RAISE(ABORT, 'work_record_identity_immutable') END;
+  SELECT CASE WHEN NEW.current_revision_no <> OLD.current_revision_no
+      AND NEW.current_revision_no <> OLD.current_revision_no + 1
+    THEN RAISE(ABORT, 'work_record_revision_pointer_invalid') END;
+END;
+
+CREATE TABLE work_record_session_links (
+  work_record_id TEXT NOT NULL REFERENCES work_records(work_record_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id),
+  linked_revision_no INTEGER NOT NULL,
+  linked_at TEXT NOT NULL,
+  unlinked_revision_no INTEGER,
+  unlinked_at TEXT,
+  link_source TEXT NOT NULL CHECK (link_source = 'USER'),
+  link_mutation_id TEXT NOT NULL UNIQUE,
+  unlink_mutation_id TEXT UNIQUE,
+  PRIMARY KEY (work_record_id, session_id, linked_revision_no),
+  FOREIGN KEY (work_record_id, linked_revision_no)
+    REFERENCES work_record_revisions(work_record_id, revision_no),
+  FOREIGN KEY (work_record_id, unlinked_revision_no)
+    REFERENCES work_record_revisions(work_record_id, revision_no),
+  CHECK ((unlinked_at IS NULL AND unlinked_revision_no IS NULL AND unlink_mutation_id IS NULL)
+      OR (unlinked_at IS NOT NULL AND unlinked_revision_no IS NOT NULL AND unlink_mutation_id IS NOT NULL)),
+  CHECK (unlinked_at IS NULL OR unlinked_at > linked_at)
+);
+
+CREATE UNIQUE INDEX idx_work_record_session_open
+  ON work_record_session_links(work_record_id, session_id) WHERE unlinked_at IS NULL;
+CREATE INDEX idx_work_record_session_links_session_open
+  ON work_record_session_links(session_id, linked_at, unlinked_at);
+
+CREATE TRIGGER trg_work_record_session_workspace_insert
+BEFORE INSERT ON work_record_session_links
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM work_records wr
+    JOIN sessions s ON s.session_id = NEW.session_id
+    WHERE wr.work_record_id = NEW.work_record_id AND wr.workspace_id = s.workspace_id
+  ) THEN RAISE(ABORT, 'work_record_session_workspace_mismatch') END;
+END;
+
+CREATE TRIGGER trg_work_record_session_workspace_update
+BEFORE UPDATE ON work_record_session_links
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM work_records wr
+    JOIN sessions s ON s.session_id = NEW.session_id
+    WHERE wr.work_record_id = NEW.work_record_id AND wr.workspace_id = s.workspace_id
+  ) THEN RAISE(ABORT, 'work_record_session_workspace_mismatch') END;
+END;
+
+CREATE TRIGGER trg_work_record_session_no_overlap
+BEFORE INSERT ON work_record_session_links
+BEGIN
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM work_record_session_links old
+    WHERE old.work_record_id = NEW.work_record_id
+      AND old.session_id = NEW.session_id
+      AND NEW.linked_at < COALESCE(old.unlinked_at, '9999-12-31T23:59:59.999Z')
+      AND old.linked_at < COALESCE(NEW.unlinked_at, '9999-12-31T23:59:59.999Z')
+  ) THEN RAISE(ABORT, 'work_record_session_interval_overlap') END;
+END;
+
+CREATE TRIGGER trg_work_record_session_closed_immutable
+BEFORE UPDATE ON work_record_session_links
+BEGIN
+  SELECT CASE WHEN OLD.unlinked_at IS NOT NULL
+    THEN RAISE(ABORT, 'work_record_session_closed_immutable') END;
+  SELECT CASE WHEN NEW.work_record_id <> OLD.work_record_id
+      OR NEW.session_id <> OLD.session_id
+      OR NEW.linked_revision_no <> OLD.linked_revision_no
+      OR NEW.linked_at <> OLD.linked_at
+      OR NEW.link_source <> OLD.link_source
+      OR NEW.link_mutation_id <> OLD.link_mutation_id
+    THEN RAISE(ABORT, 'work_record_session_link_immutable') END;
+END;
+
+CREATE TABLE work_record_context_refs (
+  work_record_id TEXT NOT NULL REFERENCES work_records(work_record_id) ON DELETE CASCADE,
+  context_kind TEXT NOT NULL CHECK (context_kind = 'WORKTREE'),
+  context_ref_id TEXT NOT NULL,
+  linked_revision_no INTEGER NOT NULL,
+  linked_at TEXT NOT NULL,
+  unlinked_revision_no INTEGER,
+  unlinked_at TEXT,
+  link_mutation_id TEXT NOT NULL UNIQUE,
+  unlink_mutation_id TEXT UNIQUE,
+  PRIMARY KEY (work_record_id, context_kind, context_ref_id, linked_revision_no),
+  FOREIGN KEY (work_record_id, linked_revision_no)
+    REFERENCES work_record_revisions(work_record_id, revision_no),
+  FOREIGN KEY (work_record_id, unlinked_revision_no)
+    REFERENCES work_record_revisions(work_record_id, revision_no),
+  CHECK ((unlinked_at IS NULL AND unlinked_revision_no IS NULL AND unlink_mutation_id IS NULL)
+      OR (unlinked_at IS NOT NULL AND unlinked_revision_no IS NOT NULL AND unlink_mutation_id IS NOT NULL)),
+  CHECK (unlinked_at IS NULL OR unlinked_at > linked_at)
+);
+
+CREATE UNIQUE INDEX idx_work_record_context_open
+  ON work_record_context_refs(work_record_id, context_kind, context_ref_id)
+  WHERE unlinked_at IS NULL;
+
+CREATE TRIGGER trg_work_record_context_no_overlap
+BEFORE INSERT ON work_record_context_refs
+BEGIN
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM work_record_context_refs old
+    WHERE old.work_record_id = NEW.work_record_id
+      AND old.context_kind = NEW.context_kind
+      AND old.context_ref_id = NEW.context_ref_id
+      AND NEW.linked_at < COALESCE(old.unlinked_at, '9999-12-31T23:59:59.999Z')
+      AND old.linked_at < COALESCE(NEW.unlinked_at, '9999-12-31T23:59:59.999Z')
+  ) THEN RAISE(ABORT, 'work_record_context_interval_overlap') END;
+END;
+
+CREATE TRIGGER trg_work_record_context_closed_immutable
+BEFORE UPDATE ON work_record_context_refs
+BEGIN
+  SELECT CASE WHEN OLD.unlinked_at IS NOT NULL
+    THEN RAISE(ABORT, 'work_record_context_closed_immutable') END;
+  SELECT CASE WHEN NEW.work_record_id <> OLD.work_record_id
+      OR NEW.context_kind <> OLD.context_kind
+      OR NEW.context_ref_id <> OLD.context_ref_id
+      OR NEW.linked_revision_no <> OLD.linked_revision_no
+      OR NEW.linked_at <> OLD.linked_at
+      OR NEW.link_mutation_id <> OLD.link_mutation_id
+    THEN RAISE(ABORT, 'work_record_context_link_immutable') END;
+END;
+
+CREATE TABLE work_record_mutations (
+  mutation_id TEXT PRIMARY KEY,
+  operation TEXT NOT NULL CHECK (operation IN
+    ('CREATE', 'EDIT', 'ARCHIVE', 'REOPEN', 'ATTACH_SESSION', 'DETACH_SESSION',
+     'ATTACH_CONTEXT', 'DETACH_CONTEXT', 'CLOSEOUT', 'RECOMPUTE_ALLOCATION')),
+  request_sha256 TEXT NOT NULL CHECK (length(request_sha256) = 64 AND request_sha256 = lower(request_sha256)),
+  work_record_id TEXT REFERENCES work_records(work_record_id) ON DELETE CASCADE,
+  expected_revision_no INTEGER CHECK (expected_revision_no IS NULL OR expected_revision_no >= 0),
+  resulting_revision_no INTEGER CHECK (resulting_revision_no IS NULL OR resulting_revision_no >= 0),
+  allocation_revision_id TEXT,
+  applied_at TEXT NOT NULL,
+  result TEXT NOT NULL CHECK (result IN ('APPLIED', 'NOOP', 'PARTIAL', 'UNSUPPORTED'))
+);
+
+CREATE TABLE work_record_tombstones (
+  work_record_id TEXT PRIMARY KEY,
+  deleted_at TEXT NOT NULL,
+  delete_mutation_id TEXT NOT NULL UNIQUE
+);
+
+CREATE TRIGGER trg_work_mutation_id_not_tombstoned
+BEFORE INSERT ON work_record_mutations
+BEGIN
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM work_record_tombstones WHERE delete_mutation_id = NEW.mutation_id
+  ) THEN RAISE(ABORT, 'work_mutation_id_conflict') END;
+END;
+
+CREATE TRIGGER trg_work_tombstone_id_not_live
+BEFORE INSERT ON work_record_tombstones
+BEGIN
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM work_record_mutations WHERE mutation_id = NEW.delete_mutation_id
+  ) THEN RAISE(ABORT, 'work_mutation_id_conflict') END;
+END;
+
+CREATE TABLE work_allocation_revisions (
+  allocation_revision_id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id),
+  cohort_from TEXT NOT NULL,
+  cohort_to TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  evidence_as_of TEXT NOT NULL,
+  contract_version TEXT NOT NULL CHECK (contract_version = 'esf-work-allocation-1'),
+  metric_definition_version TEXT NOT NULL,
+  source_ingestion_watermark TEXT NOT NULL,
+  frozen_record_count INTEGER NOT NULL CHECK (frozen_record_count >= 0),
+  report_status TEXT NOT NULL CHECK (report_status IN
+    ('COMPLETE', 'PARTIAL', 'UNSUPPORTED_VERSION', 'STALE_SOURCE', 'INSUFFICIENT_EVIDENCE')),
+  CHECK (cohort_to > cohort_from),
+  CHECK (evidence_as_of >= cohort_to)
+);
+
+CREATE TABLE work_session_allocations (
+  allocation_revision_id TEXT NOT NULL REFERENCES work_allocation_revisions(allocation_revision_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id),
+  owner_snapshot_id TEXT,
+  disposition TEXT NOT NULL CHECK (disposition IN
+    ('OWNED', 'UNALLOCATED_UNGROUPED', 'UNALLOCATED_SHARED',
+     'UNALLOCATED_AMBIGUOUS', 'UNALLOCATED_UNSUPPORTED')),
+  priced_reconciled_cost_u INTEGER NOT NULL CHECK (priced_reconciled_cost_u >= 0),
+  priced_turn_count INTEGER NOT NULL CHECK (priced_turn_count >= 0),
+  unpriced_turn_count INTEGER NOT NULL CHECK (unpriced_turn_count >= 0),
+  parser_claim_summary TEXT NOT NULL,
+  PRIMARY KEY (allocation_revision_id, session_id),
+  CHECK ((disposition = 'OWNED' AND owner_snapshot_id IS NOT NULL)
+      OR (disposition <> 'OWNED' AND owner_snapshot_id IS NULL))
+);
+
+-- Feedback snapshots remain reproducible across later edits/reopens. They are
+-- deliberately record-linked so privacy deletion cascades the structured
+-- assessment; the parent revision retains only aggregate record counts.
+CREATE TABLE work_allocation_record_snapshots (
+  allocation_revision_id TEXT NOT NULL REFERENCES work_allocation_revisions(allocation_revision_id) ON DELETE CASCADE,
+  work_record_id TEXT NOT NULL REFERENCES work_records(work_record_id) ON DELETE CASCADE,
+  revision_no INTEGER NOT NULL,
+  outcome_state TEXT NOT NULL CHECK (outcome_state IN
+    ('ACTIVE', 'USEFUL', 'PARTIAL', 'UNSUCCESSFUL', 'ABANDONED', 'UNKNOWN')),
+  feedback_source TEXT NOT NULL CHECK (feedback_source IN ('USER_CLOSEOUT', 'USER_EDIT', 'NONE')),
+  archived INTEGER NOT NULL CHECK (archived IN (0, 1)),
+  PRIMARY KEY (allocation_revision_id, work_record_id)
+);
+
+CREATE TRIGGER trg_work_allocation_revision_immutable
+BEFORE UPDATE ON work_allocation_revisions
+BEGIN
+  SELECT RAISE(ABORT, 'work_allocation_revision_immutable');
+END;
+
+CREATE TRIGGER trg_work_session_allocation_immutable
+BEFORE UPDATE ON work_session_allocations
+BEGIN
+  SELECT RAISE(ABORT, 'work_session_allocation_immutable');
+END;
+
+CREATE TRIGGER trg_work_record_allocation_snapshot_immutable
+BEFORE UPDATE ON work_allocation_record_snapshots
+BEGIN
+  SELECT RAISE(ABORT, 'work_record_allocation_snapshot_immutable');
+END;
+
+CREATE INDEX idx_work_records_workspace_current
+  ON work_records(workspace_id, archived_at, updated_at DESC);
+CREATE INDEX idx_work_record_revisions_latest
+  ON work_record_revisions(work_record_id, revision_no DESC);
+CREATE INDEX idx_work_allocations_owner
+  ON work_session_allocations(allocation_revision_id, owner_snapshot_id);
+CREATE INDEX idx_work_allocations_disposition
+  ON work_session_allocations(allocation_revision_id, disposition);
+CREATE INDEX idx_work_allocation_record_outcomes
+  ON work_allocation_record_snapshots(allocation_revision_id, feedback_source, outcome_state);
+CREATE INDEX idx_work_allocation_revisions_scope
+  ON work_allocation_revisions(workspace_id, cohort_from, cohort_to, created_at DESC);

package/dist/query/api/esf-observations.js

@@ -15,6 +15,7 @@ function sourceFingerprint(opts, rows) {
         version: "esf-cohort-source-fingerprint-1",
         window: { from: opts.from, to: opts.to },
         workspace_id: opts.workspaceId,
+        ...(opts.sessionId === undefined ? {} : { session_id: opts.sessionId }),
         turns: rows,
     }), "utf8")
         .digest("hex");
@@ -30,11 +31,14 @@ function sourceFingerprint(opts, rows) {
  */
 export function getEsfObservations(db, opts) {
     const workspaceFilter = opts.workspaceId === null ? "" : " AND t.workspace_id = ?";
+    const sessionFilter = opts.sessionId === undefined ? "" : " AND t.session_id = ?";
     const params = opts.workspaceId === null ? [opts.from, opts.to] : [opts.from, opts.to, opts.workspaceId];
+    if (opts.sessionId !== undefined)
+        params.push(opts.sessionId);
     const cohort = `WITH selected_turns AS (
       SELECT t.message_id, t.session_id, t.ts, t.cost_equiv_u, t.cost_claim, t.parser_version, t.provisional
         FROM turns t
-       WHERE t.ts >= ? AND t.ts < ?${workspaceFilter}
+       WHERE t.ts >= ? AND t.ts < ?${workspaceFilter}${sessionFilter}
     ),
     selected_sessions AS (
       SELECT DISTINCT st.session_id, s.state
@@ -249,6 +253,33 @@ export function getEsfObservations(db, opts) {
             claim_kinds_count: data.watermark.cost_claim_counts.length,
             note: "Selected-turn cohort is [from,to). Unpriced turns are unknown, not zero-cost. Test recovery is a versioned observation of completed test events, not D7 detector matching or a task outcome.",
         },
-        ...(opts.workspaceId === null ? {} : { drilldown_ids: { workspace_id: opts.workspaceId } }),
+        drilldown_ids: {
+            ...(opts.workspaceId === null ? {} : { workspace_id: opts.workspaceId }),
+            ...(opts.sessionId === undefined ? {} : { session_id: opts.sessionId }),
+        },
     });
 }
+/** Full session evidence; the exclusive end includes the final turn/tool event. */
+export function getSessionEsfObservations(db, sessionId) {
+    const session = db
+        .prepare("SELECT workspace_id FROM sessions WHERE session_id = ?")
+        .get(sessionId);
+    if (session === undefined) {
+        const missing = buildResponse(null, {
+            claim_kind: "N_A",
+            metric_definition_version: "esf-1",
+            n: 0,
+            drilldown_ids: { session_id: sessionId },
+        });
+        return { data: null, meta: missing.meta };
+    }
+    const span = db
+        .prepare(`SELECT MIN(ts) AS first_at, MAX(ts) AS last_at FROM (
+    SELECT ts FROM turns WHERE session_id = ?
+    UNION ALL SELECT ts FROM tool_events WHERE session_id = ?
+  )`)
+        .get(sessionId, sessionId);
+    const from = span.first_at ?? "1970-01-01T00:00:00.000Z";
+    const to = new Date(Date.parse(span.last_at ?? from) + 1).toISOString();
+    return getEsfObservations(db, { workspaceId: session.workspace_id, sessionId, from, to });
+}