kiokuko-dsh 0.1.0

package/migrations/008_federated_memory.sql

@@ -0,0 +1,46 @@
+-- Federated retrieval metadata. Existing structured scopes remain valid and
+-- legacy project entries stay project-only unless explicit applicability is
+-- present; no entry rows are rewritten by this migration.
+CREATE TABLE repository_fingerprints (
+    repository_id TEXT PRIMARY KEY
+        REFERENCES repositories(repository_id)
+        ON DELETE CASCADE,
+    fingerprint_json TEXT NOT NULL,
+    manifest_digest TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_entry_search_signals_type_value_entry
+    ON entry_search_signals(signal_type, normalized_value, entry_id);
+
+CREATE INDEX IF NOT EXISTS idx_entries_workspace_status
+    ON entries(workspace, status);
+
+-- Version 2 only allowed project/global delivery origins. Rebuild the small
+-- projection table so context deliveries can retain ecosystem provenance.
+CREATE TABLE context_delivery_entries_federated (
+    delivery_id TEXT NOT NULL REFERENCES context_deliveries(delivery_id) ON DELETE CASCADE,
+    entry_id TEXT NOT NULL,
+    entry_revision INTEGER NOT NULL CHECK (entry_revision > 0),
+    rank INTEGER NOT NULL CHECK (rank > 0),
+    score_components_json TEXT NOT NULL,
+    selection_reason_json TEXT NOT NULL,
+    origin_scope TEXT NOT NULL DEFAULT 'project' CHECK (origin_scope IN ('project', 'ecosystem', 'global')),
+    PRIMARY KEY (delivery_id, entry_id),
+    FOREIGN KEY (entry_id, entry_revision)
+        REFERENCES entry_revisions(entry_id, revision)
+);
+
+INSERT INTO context_delivery_entries_federated (
+    delivery_id, entry_id, entry_revision, rank,
+    score_components_json, selection_reason_json, origin_scope
+)
+SELECT delivery_id, entry_id, entry_revision, rank,
+       score_components_json, selection_reason_json, origin_scope
+  FROM context_delivery_entries;
+
+DROP TABLE context_delivery_entries;
+ALTER TABLE context_delivery_entries_federated RENAME TO context_delivery_entries;
+
+CREATE INDEX idx_context_delivery_entries_entry
+    ON context_delivery_entries(entry_id, entry_revision);

package/migrations/009_external_skill_discovery.sql

@@ -0,0 +1,126 @@
+CREATE TABLE external_skill_generation_clock (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    value INTEGER NOT NULL CHECK (typeof(value) = 'integer' AND value BETWEEN 0 AND 9007199254740991)
+);
+
+INSERT INTO external_skill_generation_clock (singleton, value) VALUES (1, 0);
+
+CREATE TABLE external_skill_generation_tokens (
+    generation INTEGER PRIMARY KEY AUTOINCREMENT
+        CHECK (typeof(generation) = 'integer' AND generation BETWEEN 1 AND 9007199254740991)
+);
+
+CREATE TABLE external_skills (
+    skill_id TEXT PRIMARY KEY,
+    generation INTEGER NOT NULL REFERENCES external_skill_generation_tokens(generation)
+        CHECK (typeof(generation) = 'integer' AND generation BETWEEN 1 AND 9007199254740991),
+    provider TEXT NOT NULL,
+    source_type TEXT NOT NULL CHECK (source_type = 'github'),
+    source_locator TEXT NOT NULL,
+    slug TEXT NOT NULL,
+    name TEXT NOT NULL,
+    install_url TEXT,
+    official_status TEXT NOT NULL CHECK (official_status IN ('curated', 'catalog-verified', 'owner-verified', 'registry-only', 'unknown')),
+    duplicate INTEGER NOT NULL DEFAULT 0 CHECK (duplicate IN (0, 1)),
+    installs INTEGER NOT NULL DEFAULT 0 CHECK (installs >= 0),
+    state TEXT NOT NULL CHECK (state IN ('discovered', 'imported', 'blocked', 'stale', 'disabled')),
+    source_workspace TEXT NOT NULL,
+    source_commit TEXT,
+    snapshot_hash TEXT,
+    metadata_json TEXT NOT NULL DEFAULT '{}',
+    first_seen_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL,
+    last_checked_at TEXT NOT NULL,
+    disabled_at TEXT,
+    UNIQUE(generation),
+    UNIQUE(source_type, source_locator, slug)
+);
+
+CREATE INDEX idx_external_skills_state_checked ON external_skills(state, last_checked_at DESC);
+CREATE INDEX idx_external_skills_source ON external_skills(source_locator, slug);
+
+CREATE TABLE external_skill_entries (
+    skill_id TEXT NOT NULL REFERENCES external_skills(skill_id) ON DELETE CASCADE,
+    source_path TEXT NOT NULL,
+    chunk_index INTEGER NOT NULL CHECK (chunk_index >= 0),
+    entry_id TEXT NOT NULL REFERENCES entries(id),
+    entry_revision INTEGER NOT NULL CHECK (entry_revision > 0),
+    content_hash TEXT NOT NULL,
+    primary_document INTEGER NOT NULL DEFAULT 0 CHECK (primary_document IN (0, 1)),
+    active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
+    imported_at TEXT NOT NULL,
+    PRIMARY KEY(skill_id, source_path, chunk_index),
+    FOREIGN KEY(entry_id, entry_revision) REFERENCES entry_revisions(entry_id, revision)
+);
+
+CREATE INDEX idx_external_skill_entries_entry ON external_skill_entries(entry_id, entry_revision);
+
+CREATE TABLE skill_discovery_cache (
+    cache_key TEXT PRIMARY KEY,
+    provider TEXT NOT NULL,
+    query_text TEXT NOT NULL,
+    owner TEXT,
+    mode TEXT NOT NULL CHECK (mode IN ('official', 'community')),
+    outcome TEXT NOT NULL CHECK (outcome IN ('success', 'empty', 'rate_limited', 'unavailable')),
+    response_json TEXT NOT NULL,
+    fetched_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_skill_discovery_cache_expiry ON skill_discovery_cache(expires_at);
+
+CREATE TABLE skill_source_failure_cache (
+    cache_key TEXT PRIMARY KEY,
+    source_type TEXT NOT NULL CHECK (source_type = 'github'),
+    source_locator TEXT NOT NULL,
+    slug TEXT NOT NULL,
+    outcome TEXT NOT NULL CHECK (outcome IN ('source_rate_limited', 'source_unavailable')),
+    fetched_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_skill_source_failure_cache_expiry ON skill_source_failure_cache(expires_at);
+
+CREATE TABLE skill_audit_failure_cache (
+    cache_key TEXT PRIMARY KEY,
+    provider TEXT NOT NULL,
+    source_type TEXT NOT NULL CHECK (source_type = 'github'),
+    source_locator TEXT NOT NULL,
+    slug TEXT NOT NULL,
+    outcome TEXT NOT NULL CHECK (outcome IN ('registry_rate_limited', 'registry_unavailable')),
+    fetched_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_skill_audit_failure_cache_expiry ON skill_audit_failure_cache(expires_at);
+
+CREATE TABLE agent_task_skill_discovery_attempts (
+    run_id TEXT PRIMARY KEY REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+    request_digest TEXT NOT NULL CHECK (
+        typeof(request_digest) = 'text'
+        AND length(request_digest) = 64
+        AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed', 'failed')),
+    summary_json TEXT,
+    failure_json TEXT,
+    started_at TEXT NOT NULL CHECK (typeof(started_at) = 'text' AND length(started_at) > 0),
+    finished_at TEXT,
+    CHECK (
+        finished_at IS NULL
+        OR (typeof(finished_at) = 'text' AND length(finished_at) > 0 AND finished_at >= started_at)
+    ),
+    CHECK (
+        (state = 'started' AND summary_json IS NULL AND failure_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(summary_json) = 'text' AND failure_json IS NULL AND finished_at IS NOT NULL)
+        OR (state = 'failed' AND summary_json IS NULL AND typeof(failure_json) = 'text' AND finished_at IS NOT NULL)
+    )
+);
+
+-- The application migration operation rewrites every revision preimage and
+-- hash to the single locale-independent canonical representation before it
+-- inserts this singleton. Leaving the row absent is never a supported state.
+CREATE TABLE entry_revision_hash_format (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    algorithm TEXT NOT NULL CHECK (algorithm = 'canonical-json-utf16-tags-v1')
+);

package/migrations/010_nudge_deliveries.sql

@@ -0,0 +1,50 @@
+CREATE TABLE nudge_deliveries (
+    id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL,
+    policy_version TEXT NOT NULL CHECK (length(policy_version) BETWEEN 1 AND 100),
+    code TEXT NOT NULL CHECK (length(code) BETWEEN 1 AND 100),
+    occurrence_id TEXT NOT NULL CHECK (length(occurrence_id) BETWEEN 1 AND 256),
+    checkpoint_id TEXT NOT NULL CHECK (length(checkpoint_id) BETWEEN 1 AND 256),
+    through_sequence INTEGER NOT NULL CHECK (through_sequence >= 0),
+    priority INTEGER NOT NULL CHECK (priority >= 1),
+    evidence_event_ids_json TEXT NOT NULL CHECK (json_valid(evidence_event_ids_json)),
+    reference_ids_json TEXT NOT NULL CHECK (json_valid(reference_ids_json)),
+    delivered_at TEXT NOT NULL,
+
+    FOREIGN KEY (run_id)
+        REFERENCES ledger_runs(run_id)
+        ON DELETE CASCADE,
+
+    UNIQUE (
+        run_id,
+        policy_version,
+        occurrence_id
+    ),
+
+    UNIQUE (
+        run_id,
+        policy_version,
+        checkpoint_id
+    )
+);
+
+CREATE INDEX nudge_deliveries_run_code_sequence
+ON nudge_deliveries (
+    run_id,
+    policy_version,
+    code,
+    through_sequence
+);
+
+CREATE INDEX nudge_deliveries_run_sequence
+ON nudge_deliveries (
+    run_id,
+    through_sequence
+);
+
+CREATE INDEX nudge_deliveries_run_checkpoint
+ON nudge_deliveries (
+    run_id,
+    policy_version,
+    checkpoint_id
+);

package/migrations/011_nudge_integrity.sql

@@ -0,0 +1,52 @@
+-- Keep the nudge table compatible with the only policy implemented by this
+-- release. Application and archive validation provide the detailed checks;
+-- these triggers protect direct SQL writers and updates as well.
+CREATE TRIGGER nudge_deliveries_integrity_insert
+BEFORE INSERT ON nudge_deliveries
+BEGIN
+    SELECT RAISE(ABORT, 'invalid nudge delivery')
+    WHERE NEW.policy_version <> 'nudges.v1'
+       OR NEW.code NOT IN ('SIDE_EFFECT_OUTCOME_UNKNOWN', 'UNRESOLVED_FAILURE', 'VERIFY_AFTER_MUTATION')
+       OR NOT (
+           (NEW.code = 'SIDE_EFFECT_OUTCOME_UNKNOWN' AND NEW.priority = 2)
+           OR (NEW.code = 'UNRESOLVED_FAILURE' AND NEW.priority = 3)
+           OR (NEW.code = 'VERIFY_AFTER_MUTATION' AND NEW.priority = 4)
+       )
+       OR CASE
+           WHEN json_valid(NEW.evidence_event_ids_json)
+             THEN json_type(NEW.evidence_event_ids_json) = 'array'
+               AND json_array_length(NEW.evidence_event_ids_json) <= 16
+           ELSE 0
+       END = 0
+       OR CASE
+           WHEN json_valid(NEW.reference_ids_json)
+             THEN json_type(NEW.reference_ids_json) = 'array'
+               AND json_array_length(NEW.reference_ids_json) <= 16
+           ELSE 0
+       END = 0;
+END;
+
+CREATE TRIGGER nudge_deliveries_integrity_update
+BEFORE UPDATE OF policy_version, code, priority, evidence_event_ids_json, reference_ids_json ON nudge_deliveries
+BEGIN
+    SELECT RAISE(ABORT, 'invalid nudge delivery')
+    WHERE NEW.policy_version <> 'nudges.v1'
+       OR NEW.code NOT IN ('SIDE_EFFECT_OUTCOME_UNKNOWN', 'UNRESOLVED_FAILURE', 'VERIFY_AFTER_MUTATION')
+       OR NOT (
+           (NEW.code = 'SIDE_EFFECT_OUTCOME_UNKNOWN' AND NEW.priority = 2)
+           OR (NEW.code = 'UNRESOLVED_FAILURE' AND NEW.priority = 3)
+           OR (NEW.code = 'VERIFY_AFTER_MUTATION' AND NEW.priority = 4)
+       )
+       OR CASE
+           WHEN json_valid(NEW.evidence_event_ids_json)
+             THEN json_type(NEW.evidence_event_ids_json) = 'array'
+               AND json_array_length(NEW.evidence_event_ids_json) <= 16
+           ELSE 0
+       END = 0
+       OR CASE
+           WHEN json_valid(NEW.reference_ids_json)
+             THEN json_type(NEW.reference_ids_json) = 'array'
+               AND json_array_length(NEW.reference_ids_json) <= 16
+           ELSE 0
+       END = 0;
+END;

package/migrations/012_context_delivery_v4.sql

@@ -0,0 +1,3 @@
+-- Reserve this version for validating released scoped deliveries.
+-- The application migration operation preserves their identities, policy,
+-- accounting, and all historical references.

package/migrations/013_enno_oduno.sql

@@ -0,0 +1,176 @@
+-- Add phase-scoped discovery attempts while preserving every v9 intake attempt.
+ALTER TABLE agent_task_skill_discovery_attempts RENAME TO agent_task_skill_discovery_attempts_v9;
+
+CREATE TABLE agent_task_skill_discovery_attempts (
+    run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+    phase TEXT NOT NULL CHECK (phase IN ('intake', 'zenki')),
+    request_digest TEXT NOT NULL CHECK (
+        typeof(request_digest) = 'text'
+        AND length(request_digest) = 64
+        AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed', 'failed')),
+    summary_json TEXT,
+    failure_json TEXT,
+    started_at TEXT NOT NULL CHECK (typeof(started_at) = 'text' AND length(started_at) > 0),
+    finished_at TEXT,
+    PRIMARY KEY (run_id, phase),
+    CHECK (
+        finished_at IS NULL
+        OR (typeof(finished_at) = 'text' AND length(finished_at) > 0 AND finished_at >= started_at)
+    ),
+    CHECK (
+        (state = 'started' AND summary_json IS NULL AND failure_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(summary_json) = 'text' AND failure_json IS NULL AND finished_at IS NOT NULL)
+        OR (state = 'failed' AND summary_json IS NULL AND typeof(failure_json) = 'text' AND finished_at IS NOT NULL)
+    )
+);
+
+INSERT INTO agent_task_skill_discovery_attempts (
+    run_id, phase, request_digest, state, summary_json, failure_json, started_at, finished_at
+)
+SELECT run_id, 'intake', request_digest, state, summary_json, failure_json, started_at, finished_at
+FROM agent_task_skill_discovery_attempts_v9;
+
+DROP TABLE agent_task_skill_discovery_attempts_v9;
+
+CREATE TABLE enno_contracts (
+    run_id TEXT PRIMARY KEY REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+    workspace TEXT NOT NULL,
+    orchestration_session_id TEXT NOT NULL CHECK (length(orchestration_session_id) BETWEEN 1 AND 256),
+    client_kind TEXT CHECK (client_kind IS NULL OR client_kind IN ('codex', 'claude', 'opencode')),
+    client_version TEXT CHECK (client_version IS NULL OR length(client_version) BETWEEN 1 AND 100),
+    client_session_id TEXT CHECK (client_session_id IS NULL OR length(client_session_id) BETWEEN 1 AND 256),
+    repository_root TEXT NOT NULL CHECK (length(repository_root) BETWEEN 1 AND 4096),
+    task_type TEXT NOT NULL CHECK (task_type IN ('build', 'debug', 'review', 'devops')),
+    status TEXT NOT NULL CHECK (status IN (
+        'intake', 'zenki_planning', 'needs_confirmation', 'goki_executing',
+        'enno_verifying', 'completed', 'blocked', 'cancelled'
+    )),
+    revision INTEGER NOT NULL CHECK (revision >= 1),
+    confirmation_state TEXT NOT NULL CHECK (confirmation_state IN (
+        'not_required', 'pending', 'approved', 'revision_requested', 'cancelled'
+    )),
+    attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts BETWEEN 0 AND 20),
+    mutation_revision INTEGER NOT NULL DEFAULT 0 CHECK (mutation_revision >= 0),
+    contract_json TEXT NOT NULL,
+    handoff_json TEXT NOT NULL,
+    intake_discovery_json TEXT NOT NULL,
+    plan_digest TEXT,
+    blocker TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE (run_id, workspace, orchestration_session_id),
+    CHECK ((client_version IS NULL AND client_session_id IS NULL) OR client_kind IS NOT NULL)
+);
+
+CREATE TRIGGER enno_contract_identity_insert_guard
+BEFORE INSERT ON enno_contracts
+BEGIN
+    SELECT RAISE(ABORT, 'enno contract run identity mismatch')
+    WHERE (SELECT workspace FROM ledger_runs WHERE run_id = NEW.run_id) IS NULL
+       OR (SELECT workspace FROM ledger_runs WHERE run_id = NEW.run_id) <> NEW.workspace
+       OR (SELECT session_id FROM run_intakes WHERE run_id = NEW.run_id) IS NULL
+       OR (SELECT session_id FROM run_intakes WHERE run_id = NEW.run_id) <> NEW.orchestration_session_id;
+END;
+
+CREATE TRIGGER enno_contract_identity_update_guard
+BEFORE UPDATE OF run_id, workspace, orchestration_session_id ON enno_contracts
+BEGIN
+    SELECT RAISE(ABORT, 'enno contract run identity mismatch')
+    WHERE (SELECT workspace FROM ledger_runs WHERE run_id = NEW.run_id) IS NULL
+       OR (SELECT workspace FROM ledger_runs WHERE run_id = NEW.run_id) <> NEW.workspace
+       OR (SELECT session_id FROM run_intakes WHERE run_id = NEW.run_id) IS NULL
+       OR (SELECT session_id FROM run_intakes WHERE run_id = NEW.run_id) <> NEW.orchestration_session_id;
+END;
+
+CREATE TRIGGER enno_client_binding_update_guard
+BEFORE UPDATE OF client_kind, client_version, client_session_id ON enno_contracts
+WHEN OLD.client_session_id IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'enno client binding is immutable')
+    WHERE NEW.client_kind IS NOT OLD.client_kind
+       OR NEW.client_version IS NOT OLD.client_version
+       OR NEW.client_session_id IS NOT OLD.client_session_id;
+END;
+
+CREATE INDEX idx_enno_contracts_session_status
+ON enno_contracts(client_kind, client_session_id, status, updated_at DESC);
+
+CREATE TABLE enno_work_units (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    work_unit_id TEXT NOT NULL CHECK (length(work_unit_id) BETWEEN 1 AND 256),
+    contract_revision INTEGER NOT NULL CHECK (contract_revision >= 1),
+    order_index INTEGER NOT NULL CHECK (order_index >= 0),
+    work_unit_json TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending', 'in_progress', 'completed', 'failed', 'blocked')),
+    attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count BETWEEN 0 AND 20),
+    result_json TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (run_id, contract_revision, work_unit_id),
+    UNIQUE (run_id, contract_revision, order_index)
+);
+
+CREATE TABLE enno_verifier_runs (
+    verifier_run_id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    work_unit_id TEXT,
+    contract_revision INTEGER NOT NULL CHECK (contract_revision >= 1),
+    mutation_revision INTEGER NOT NULL CHECK (mutation_revision >= 0),
+    verifier_id TEXT NOT NULL CHECK (length(verifier_id) BETWEEN 1 AND 256),
+    verifier_json TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('started', 'passed', 'failed', 'timeout', 'spawn_failed')),
+    exit_code INTEGER,
+    signal TEXT,
+    duration_ms INTEGER,
+    stdout_preview TEXT,
+    stderr_preview TEXT,
+    stdout_digest TEXT,
+    stderr_digest TEXT,
+    started_at TEXT NOT NULL,
+    finished_at TEXT,
+    FOREIGN KEY (run_id, contract_revision, work_unit_id)
+        REFERENCES enno_work_units(run_id, contract_revision, work_unit_id),
+    CHECK (
+        (status = 'started' AND finished_at IS NULL AND duration_ms IS NULL)
+        OR (status <> 'started' AND finished_at IS NOT NULL AND duration_ms IS NOT NULL AND duration_ms >= 0)
+    )
+);
+
+CREATE INDEX idx_enno_verifier_runs_freshness
+ON enno_verifier_runs(run_id, contract_revision, mutation_revision, status, finished_at DESC);
+
+CREATE TABLE enno_operation_receipts (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    operation TEXT NOT NULL CHECK (operation IN ('plan_submit', 'answer', 'work_report', 'finish')),
+    idempotency_key TEXT NOT NULL CHECK (length(idempotency_key) BETWEEN 1 AND 256),
+    request_digest TEXT NOT NULL CHECK (
+        length(request_digest) = 64 AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed')),
+    response_json TEXT,
+    created_at TEXT NOT NULL,
+    finished_at TEXT,
+    CHECK (
+        (state = 'started' AND response_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(response_json) = 'text' AND finished_at IS NOT NULL)
+    ),
+    PRIMARY KEY (run_id, operation, idempotency_key)
+);
+
+CREATE TABLE enno_client_continuations (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    client_kind TEXT NOT NULL CHECK (client_kind IN ('codex', 'claude', 'opencode')),
+    source_session_id TEXT NOT NULL CHECK (length(source_session_id) BETWEEN 1 AND 256),
+    contract_revision INTEGER NOT NULL CHECK (contract_revision >= 1),
+    mutation_revision INTEGER NOT NULL CHECK (mutation_revision >= 0),
+    attempts INTEGER NOT NULL CHECK (attempts BETWEEN 0 AND 20),
+    directive_digest TEXT NOT NULL CHECK (
+        length(directive_digest) = 64 AND directive_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    continuation_count INTEGER NOT NULL CHECK (continuation_count BETWEEN 0 AND 20),
+    total_count INTEGER NOT NULL CHECK (total_count BETWEEN 0 AND 20),
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (run_id, client_kind, source_session_id)
+);

package/migrations/014_oduno_reflection_phases.sql

@@ -0,0 +1,40 @@
+ALTER TABLE enno_contracts
+ADD COLUMN phase TEXT CHECK (phase IS NULL OR phase IN ('oduno_ideal', 'oduno_meditation'));
+
+ALTER TABLE enno_contracts
+ADD COLUMN ideal_json TEXT;
+
+ALTER TABLE enno_contracts
+ADD COLUMN meditation_json TEXT;
+
+ALTER TABLE enno_operation_receipts RENAME TO enno_operation_receipts_v13;
+
+CREATE TABLE enno_operation_receipts (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    operation TEXT NOT NULL CHECK (operation IN (
+        'ideal_submit', 'plan_submit', 'answer', 'work_report', 'finish', 'meditation_submit'
+    )),
+    idempotency_key TEXT NOT NULL CHECK (length(idempotency_key) BETWEEN 1 AND 256),
+    request_digest TEXT NOT NULL CHECK (
+        length(request_digest) = 64 AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed')),
+    response_json TEXT,
+    created_at TEXT NOT NULL,
+    finished_at TEXT,
+    CHECK (
+        (state = 'started' AND response_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(response_json) = 'text' AND finished_at IS NOT NULL)
+    ),
+    PRIMARY KEY (run_id, operation, idempotency_key)
+);
+
+INSERT INTO enno_operation_receipts (
+    run_id, operation, idempotency_key, request_digest, state,
+    response_json, created_at, finished_at
+)
+SELECT run_id, operation, idempotency_key, request_digest, state,
+       response_json, created_at, finished_at
+FROM enno_operation_receipts_v13;
+
+DROP TABLE enno_operation_receipts_v13;

package/migrations/015_skill_discovery_attempt_digests.sql

@@ -0,0 +1,90 @@
+ALTER TABLE agent_task_skill_discovery_attempts RENAME TO agent_task_skill_discovery_attempts_v14;
+
+-- A v14 started attempt belongs to a process that cannot be resumed safely
+-- across this schema change. Preserve the row as a terminal, retryable
+-- failure before adding the one-active-attempt index below.
+UPDATE agent_task_skill_discovery_attempts_v14
+SET state = 'failed',
+    failure_json = '{"kind":"kiokuko","code":"CONFLICT"}',
+    finished_at = started_at
+WHERE state = 'started';
+
+CREATE TABLE agent_task_skill_discovery_attempts (
+    run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+    phase TEXT NOT NULL CHECK (phase IN ('intake', 'zenki')),
+    request_digest TEXT NOT NULL CHECK (
+        typeof(request_digest) = 'text'
+        AND length(request_digest) = 64
+        AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    reserved_query_count INTEGER NOT NULL CHECK (typeof(reserved_query_count) = 'integer' AND reserved_query_count BETWEEN 0 AND 3),
+    reserved_selection_count INTEGER NOT NULL CHECK (typeof(reserved_selection_count) = 'integer' AND reserved_selection_count BETWEEN 0 AND 2),
+    consumed_query_count INTEGER NOT NULL CHECK (typeof(consumed_query_count) = 'integer' AND consumed_query_count BETWEEN 0 AND 3),
+    consumed_selection_count INTEGER NOT NULL CHECK (typeof(consumed_selection_count) = 'integer' AND consumed_selection_count BETWEEN 0 AND 2),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed', 'failed')),
+    summary_json TEXT,
+    failure_json TEXT,
+    started_at TEXT NOT NULL CHECK (typeof(started_at) = 'text' AND length(started_at) > 0),
+    finished_at TEXT,
+    PRIMARY KEY (run_id, phase, request_digest),
+    CHECK (consumed_query_count <= reserved_query_count),
+    CHECK (consumed_selection_count <= reserved_selection_count),
+    CHECK (
+        finished_at IS NULL
+        OR (typeof(finished_at) = 'text' AND length(finished_at) > 0 AND finished_at >= started_at)
+    ),
+    CHECK (
+        (state = 'started'
+            AND consumed_query_count = 0
+            AND consumed_selection_count = 0
+            AND summary_json IS NULL
+            AND failure_json IS NULL
+            AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(summary_json) = 'text' AND failure_json IS NULL AND finished_at IS NOT NULL)
+        OR (state = 'failed' AND summary_json IS NULL AND typeof(failure_json) = 'text' AND finished_at IS NOT NULL)
+    )
+);
+
+INSERT INTO agent_task_skill_discovery_attempts (
+    run_id, phase, request_digest,
+    reserved_query_count, reserved_selection_count,
+    consumed_query_count, consumed_selection_count,
+    state, summary_json, failure_json, started_at, finished_at
+)
+SELECT run_id, phase, request_digest,
+       CASE
+           WHEN state = 'completed'
+            AND json_valid(summary_json)
+            AND json_type(CASE WHEN json_valid(summary_json) THEN summary_json ELSE 'null' END, '$.queries') = 'array'
+           THEN MIN(3, json_array_length(summary_json, '$.queries'))
+           ELSE 3
+       END,
+       CASE
+           WHEN state = 'completed'
+            AND json_valid(summary_json)
+            AND json_type(CASE WHEN json_valid(summary_json) THEN summary_json ELSE 'null' END, '$.selected') = 'array'
+           THEN MIN(2, json_array_length(summary_json, '$.selected'))
+           ELSE 2
+       END,
+       CASE
+           WHEN state = 'completed'
+            AND json_valid(summary_json)
+            AND json_type(CASE WHEN json_valid(summary_json) THEN summary_json ELSE 'null' END, '$.queries') = 'array'
+           THEN MIN(3, json_array_length(summary_json, '$.queries'))
+           ELSE 3
+       END,
+       CASE
+           WHEN state = 'completed'
+            AND json_valid(summary_json)
+            AND json_type(CASE WHEN json_valid(summary_json) THEN summary_json ELSE 'null' END, '$.selected') = 'array'
+           THEN MIN(2, json_array_length(summary_json, '$.selected'))
+           ELSE 2
+       END,
+       state, summary_json, failure_json, started_at, finished_at
+FROM agent_task_skill_discovery_attempts_v14;
+
+DROP TABLE agent_task_skill_discovery_attempts_v14;
+
+CREATE UNIQUE INDEX idx_skill_discovery_attempts_active
+ON agent_task_skill_discovery_attempts(run_id, phase)
+WHERE state = 'started';

package/migrations/016_enno_advisory_rounds.sql

@@ -0,0 +1,67 @@
+ALTER TABLE enno_operation_receipts RENAME TO enno_operation_receipts_v15;
+
+CREATE TABLE enno_operation_receipts (
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    operation TEXT NOT NULL CHECK (operation IN (
+        'ideal_submit', 'advice_submit', 'plan_submit', 'answer', 'work_report', 'finish', 'meditation_submit'
+    )),
+    idempotency_key TEXT NOT NULL CHECK (length(idempotency_key) BETWEEN 1 AND 256),
+    request_digest TEXT NOT NULL CHECK (
+        length(request_digest) = 64 AND request_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    state TEXT NOT NULL CHECK (state IN ('started', 'completed')),
+    response_json TEXT,
+    created_at TEXT NOT NULL,
+    finished_at TEXT,
+    CHECK (
+        (state = 'started' AND response_json IS NULL AND finished_at IS NULL)
+        OR (state = 'completed' AND typeof(response_json) = 'text' AND finished_at IS NOT NULL)
+    ),
+    PRIMARY KEY (run_id, operation, idempotency_key)
+);
+
+INSERT INTO enno_operation_receipts (
+    run_id, operation, idempotency_key, request_digest, state,
+    response_json, created_at, finished_at
+)
+SELECT run_id, operation, idempotency_key, request_digest, state,
+       response_json, created_at, finished_at
+FROM enno_operation_receipts_v15;
+
+DROP TABLE enno_operation_receipts_v15;
+
+CREATE TABLE enno_advisory_rounds (
+    round_id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL REFERENCES enno_contracts(run_id) ON DELETE CASCADE,
+    contract_revision INTEGER NOT NULL CHECK (contract_revision >= 1),
+    mutation_revision INTEGER NOT NULL CHECK (mutation_revision >= 0),
+    phase TEXT NOT NULL CHECK (phase IN ('ideal', 'planning', 'final_review')),
+    input_digest TEXT NOT NULL CHECK (
+        length(input_digest) = 64 AND input_digest NOT GLOB '*[^0-9a-f]*'
+    ),
+    policy_version INTEGER NOT NULL CHECK (policy_version = 1),
+    source TEXT NOT NULL CHECK (source = 'host_reported'),
+    state TEXT NOT NULL CHECK (state IN ('advice_submitted', 'aggregated', 'consumed')),
+    degraded INTEGER NOT NULL CHECK (degraded IN (0, 1)),
+    aggregate_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE (run_id, contract_revision, mutation_revision, phase, input_digest)
+);
+
+CREATE INDEX idx_enno_advisory_rounds_current
+ON enno_advisory_rounds(run_id, contract_revision, mutation_revision, phase, state);
+
+CREATE TABLE enno_advisory_contributions (
+    round_id TEXT NOT NULL REFERENCES enno_advisory_rounds(round_id) ON DELETE CASCADE,
+    slot_id TEXT NOT NULL CHECK (length(slot_id) BETWEEN 1 AND 100),
+    slot_rank INTEGER NOT NULL CHECK (slot_rank BETWEEN 0 AND 2),
+    outcome TEXT NOT NULL CHECK (outcome IN ('completed', 'failed', 'timeout', 'unavailable')),
+    contribution_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (round_id, slot_id),
+    UNIQUE (round_id, slot_rank)
+);
+
+CREATE INDEX idx_enno_advisory_contributions_round
+ON enno_advisory_contributions(round_id, slot_rank);