ohwow 0.6.9 → 0.9.0

package/dist/migrations/112-deliverables-created-at-iso.sql

@@ -0,0 +1,40 @@
+-- Normalize agent_workforce_deliverables.created_at to ISO-8601 with a
+-- trailing Z, so lexicographic comparison against JS `.toISOString()`
+-- filter values in list_deliverables works correctly.
+--
+-- Background: the schema default is `datetime('now')`, which outputs
+-- `YYYY-MM-DD HH:MM:SS` (space separator, no milliseconds, no Z).
+-- One insert path (deliverables-recorder.ts) explicitly writes
+-- `new Date().toISOString()` so those rows land as
+-- `YYYY-MM-DDTHH:MM:SS.mmmZ`. Two other insert paths (saveDeliverable,
+-- task-completion.ts) omit created_at entirely and fall back to the
+-- default. That produces a mixed table: 24 rows in ISO-with-Z, 50 rows
+-- in SQL-default.
+--
+-- list_deliverables' `since` filter calls `.gte('created_at', iso)`
+-- where `iso` is always ISO-with-Z. SQLite compares lexicographically.
+-- Position 10 of the string decides: space (0x20) < 'T' (0x54), so
+-- every SQL-default row silently sorts BEFORE any ISO-with-Z filter,
+-- and gets excluded even when it's chronologically newer. Found during
+-- the M0.21 self-bench moonshot — ohwow reported 25 deliverables in
+-- the 24h window when the real answer was 38. 13 rows lost to format
+-- drift.
+--
+-- Fix:
+--   1. Backfill every row whose created_at is missing a T or Z to ISO.
+--      `strftime('%Y-%m-%dT%H:%M:%f', col) || 'Z'` produces
+--      `2026-04-13T19:46:18.000Z` regardless of the original shape.
+--   2. Do the same for updated_at since the same inserts leave it with
+--      the SQL default.
+--   3. Use LIKE filters so re-running the migration is a no-op.
+--
+-- The downstream insert sites (saveDeliverable, task-completion.ts)
+-- are fixed in the same commit so new rows land in ISO from here on.
+
+UPDATE agent_workforce_deliverables
+SET created_at = strftime('%Y-%m-%dT%H:%M:%f', created_at) || 'Z'
+WHERE created_at NOT LIKE '%T%Z';
+
+UPDATE agent_workforce_deliverables
+SET updated_at = strftime('%Y-%m-%dT%H:%M:%f', updated_at) || 'Z'
+WHERE updated_at IS NOT NULL AND updated_at NOT LIKE '%T%Z';

package/dist/migrations/113-permission-requests.sql

@@ -0,0 +1,36 @@
+-- =====================================================================
+-- Migration 113: Filesystem permission requests
+--
+-- When an agent's filesystem/bash call hits FileAccessGuard the task now
+-- throws PermissionDeniedError and lands in needs_approval instead of
+-- returning an error string that the model hallucinates around. These
+-- columns back that flow:
+--
+--   approval_reason       — typed discriminator on needs_approval rows.
+--                           'permission_denied' is the new value the
+--                           approval routing writes; existing deliverable
+--                           and verifier-escalation paths can migrate to
+--                           it incrementally.
+--   permission_request    — JSON describing the denied call (tool name,
+--                           attempted path, suggestedExact, suggestedParent,
+--                           guardReason, iteration, timestamp).
+--   permission_grants     — JSON array of ephemeral "approve once" paths
+--                           carried on a resumed child task. Read by
+--                           resolveTaskCapabilities and union'd into the
+--                           FileAccessGuard so the child can write without
+--                           persisting a row in agent_file_access_paths.
+--   resumed_from_task_id  — backref so the UI can thread resume chains
+--                           when the operator approves a denied task.
+-- =====================================================================
+
+-- @statement
+ALTER TABLE agent_workforce_tasks ADD COLUMN approval_reason TEXT;
+-- @statement
+ALTER TABLE agent_workforce_tasks ADD COLUMN permission_request TEXT;
+-- @statement
+ALTER TABLE agent_workforce_tasks ADD COLUMN permission_grants TEXT;
+-- @statement
+ALTER TABLE agent_workforce_tasks ADD COLUMN resumed_from_task_id TEXT;
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_tasks_approval_reason
+  ON agent_workforce_tasks(approval_reason);

package/dist/migrations/114-llm-calls-tool-telemetry.sql

@@ -0,0 +1,32 @@
+-- =====================================================================
+-- Migration 114: LLM call tool-use telemetry
+--
+-- Adds per-row "did this model actually call tools on this call" signal
+-- to llm_calls. The agent ReAct loops (react-loop.ts, model-router-loop.ts)
+-- will start writing rows here after commit B wires them up — today the
+-- table only has runLlmCall and orchestrator chat, so agent iterations
+-- are invisible to telemetry.
+--
+-- Columns:
+--   tool_call_count — integer count of tool_calls in the model response
+--                     for this single LLM call. NULL when not meaningful
+--                     (e.g. a generation purpose call that wasn't offered
+--                     tools). 0 is a real value — means the model was
+--                     offered tools and chose not to call any.
+--   task_shape      — 'work' when looksLikeToolWork(taskInput) is true
+--                     at the call site, 'chat' when it's false, NULL when
+--                     the call site doesn't have a task input (ad-hoc
+--                     /api/llm, orchestrator chat without a task, etc.).
+--
+-- Enables E1's selector self-healing: query the rolling tool-call rate
+-- per (model, task_shape='work') and auto-demote models with <40% rate
+-- from the FAST agent tier.
+-- =====================================================================
+
+-- @statement
+ALTER TABLE llm_calls ADD COLUMN tool_call_count INTEGER;
+-- @statement
+ALTER TABLE llm_calls ADD COLUMN task_shape TEXT;
+-- @statement
+CREATE INDEX IF NOT EXISTS llm_calls_model_shape_idx
+  ON llm_calls(model, task_shape, created_at DESC);

package/dist/migrations/115-trigger-watchdog.sql

@@ -0,0 +1,46 @@
+-- =====================================================================
+-- Migration 115: Trigger watchdog columns
+--
+-- Experiment E2: give the daemon a way to notice that a scheduled
+-- trigger has been silently miscarrying. Without this, the diary
+-- trigger shipped silent failures for 2+ weeks before anyone checked
+-- — the trigger fired, the task failed, and nothing aggregated the
+-- outcome at the trigger level.
+--
+-- Columns:
+--   local_triggers.last_succeeded_at      — ISO timestamp, set on every
+--                                           task completion that
+--                                           traces back to this trigger.
+--   local_triggers.consecutive_failures   — int counter. Incremented on
+--                                           every failed/needs_approval
+--                                           outcome; reset to 0 on
+--                                           success. Crossing the
+--                                           threshold (default 3) emits
+--                                           a trigger_stuck activity row
+--                                           so the operator's existing
+--                                           activity surface picks it up
+--                                           without new UI.
+--   agent_workforce_tasks.source_trigger_id — FK-ish back-link so the
+--                                             task finalization hook can
+--                                             find which trigger to
+--                                             update without walking the
+--                                             title prefix or parsing
+--                                             action_result JSON.
+--
+-- The resumed child task spawned by ohwow_approve_permission_request
+-- inherits source_trigger_id from its parent so a successful resume
+-- also resets the trigger counter.
+-- =====================================================================
+
+-- @statement
+ALTER TABLE local_triggers ADD COLUMN last_succeeded_at TEXT;
+-- @statement
+ALTER TABLE local_triggers ADD COLUMN consecutive_failures INTEGER DEFAULT 0;
+-- @statement
+ALTER TABLE agent_workforce_tasks ADD COLUMN source_trigger_id TEXT;
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_tasks_source_trigger
+  ON agent_workforce_tasks(source_trigger_id);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_triggers_consecutive_failures
+  ON local_triggers(consecutive_failures DESC) WHERE consecutive_failures > 0;

package/dist/migrations/116-self-findings.sql

@@ -0,0 +1,46 @@
+-- =====================================================================
+-- Migration 116: self_findings — structured ledger for self-experimentation
+--
+-- Phase 1 of the self-improvement loop. Every experiment run by the
+-- ExperimentRunner writes a row here: what was tested, what the verdict
+-- was, what intervention (if any) was applied, and what the evidence
+-- looked like. This becomes:
+--   1. The ground-truth record the next experiment reads before running
+--      so the system doesn't re-investigate things it already knows.
+--   2. The feedback substrate: E1's demotion cache, E2's trigger
+--      watchdog, the upcoming canary suite, etc. all write findings so
+--      every future Claude session (and every agent's own planning) can
+--      query a uniform "what do we know about ourselves?" surface.
+--   3. The input for the eventual meta-loop that picks the next
+--      experiment to run based on what's unknown or drifting.
+--
+-- Nothing writes here yet after this migration — the writers land in
+-- commit Phase1-B as part of the ExperimentRunner and its wrapper
+-- experiments around E1/E2. This migration is the shape-only slice.
+-- =====================================================================
+
+-- @statement
+CREATE TABLE IF NOT EXISTS self_findings (
+  id TEXT PRIMARY KEY,
+  experiment_id TEXT NOT NULL,
+  category TEXT NOT NULL,
+  subject TEXT,
+  hypothesis TEXT,
+  verdict TEXT NOT NULL CHECK (verdict IN ('pass', 'warning', 'fail', 'error')),
+  summary TEXT NOT NULL,
+  evidence TEXT NOT NULL DEFAULT '{}',
+  intervention_applied TEXT,
+  ran_at TEXT NOT NULL,
+  duration_ms INTEGER NOT NULL DEFAULT 0,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'superseded', 'revoked')),
+  superseded_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_findings_experiment ON self_findings(experiment_id, ran_at DESC);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_findings_category ON self_findings(category, ran_at DESC);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_findings_verdict ON self_findings(verdict, ran_at DESC) WHERE status = 'active';
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_findings_subject ON self_findings(subject, ran_at DESC) WHERE subject IS NOT NULL;

package/dist/migrations/117-experiment-validations.sql

@@ -0,0 +1,64 @@
+-- =====================================================================
+-- Migration 117: experiment_validations — accountability for interventions
+--
+-- Phase 3 of the self-improvement loop. Every time an Experiment's
+-- intervene() mutates system state, the runner enqueues a validation
+-- row to be processed ~15 minutes later. At validation time the
+-- experiment's validate() hook reads the stored baseline, measures
+-- current state, and returns held | failed | inconclusive. The outcome
+-- lands as a self_findings row with category='validation' so queries
+-- can trace "what the system decided and whether it was right."
+--
+-- Without this table, an intervention vanishes into history the moment
+-- it's applied — there's no way to tell tomorrow whether yesterday's
+-- stale-task-cleanup actually unblocked the queue or the queue filled
+-- up again with new zombies. The validation step is the feedback loop
+-- that makes every intervention a measurable claim instead of a
+-- fire-and-forget side effect.
+--
+-- Columns:
+--   intervention_finding_id — the self_findings row that carried the
+--                             original intervention_applied blob.
+--   experiment_id           — the experiment that owns the validate()
+--                             hook. The runner looks it up in the live
+--                             registry at validation time.
+--   baseline                — JSON snapshot captured from the
+--                             intervention's details. This is what the
+--                             validate() function gets as its first
+--                             argument.
+--   validate_at             — ISO timestamp when the runner should fire
+--                             the validation. Indexed so the due-query
+--                             stays cheap.
+--   status                  — pending | completed | skipped | error
+--                             ('skipped' = experiment no longer has
+--                             validate() by the time the row is due)
+--   outcome                 — held | failed | inconclusive — null until
+--                             validation fires.
+--   outcome_finding_id      — self_findings row the validation wrote.
+-- =====================================================================
+
+-- @statement
+CREATE TABLE IF NOT EXISTS experiment_validations (
+  id TEXT PRIMARY KEY,
+  intervention_finding_id TEXT NOT NULL,
+  experiment_id TEXT NOT NULL,
+  baseline TEXT NOT NULL DEFAULT '{}',
+  validate_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'completed', 'skipped', 'error')),
+  outcome TEXT CHECK (outcome IS NULL OR outcome IN ('held', 'failed', 'inconclusive')),
+  outcome_finding_id TEXT,
+  error_message TEXT,
+  completed_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_validations_due
+  ON experiment_validations(validate_at)
+  WHERE status = 'pending';
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_validations_experiment
+  ON experiment_validations(experiment_id, created_at DESC);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_validations_intervention
+  ON experiment_validations(intervention_finding_id);

package/dist/migrations/118-validation-rollback.sql

@@ -0,0 +1,33 @@
+-- =====================================================================
+-- Migration 118: Rollback tracking on experiment_validations
+--
+-- Phase 5-A: close the validation feedback loop by letting the runner
+-- auto-revert failed interventions. When validate() returns
+-- outcome='failed' and the experiment exposes a rollback() hook, the
+-- runner calls it, writes a rollback finding, and stamps the
+-- validation row so queries can distinguish "failed but reverted"
+-- from "failed and still bad."
+--
+-- Columns:
+--   rolled_back          — 1 when a rollback ran successfully, else 0.
+--                          Default 0 so legacy rows show as not-rolled-back.
+--   rollback_finding_id  — FK to the self_findings row the runner wrote
+--                          for the rollback. Pair with outcome_finding_id
+--                          to get the full "validation said fail,
+--                          rollback said X" trail.
+--   rolled_back_at       — ISO timestamp when the rollback ran.
+--
+-- No schema change for Experiment implementations that don't need
+-- rollback — the hook is optional on the interface.
+-- =====================================================================
+
+-- @statement
+ALTER TABLE experiment_validations ADD COLUMN rolled_back INTEGER DEFAULT 0;
+-- @statement
+ALTER TABLE experiment_validations ADD COLUMN rollback_finding_id TEXT;
+-- @statement
+ALTER TABLE experiment_validations ADD COLUMN rolled_back_at TEXT;
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_validations_rolled_back
+  ON experiment_validations(rolled_back, validate_at DESC)
+  WHERE rolled_back = 1;

package/dist/migrations/119-runtime-config-overrides.sql

@@ -0,0 +1,44 @@
+-- =====================================================================
+-- Migration 119: runtime_config_overrides — reversible config at runtime
+--
+-- Phase 5-B: key-value store for config values that an experiment
+-- can change at runtime and roll back if validation fails. Used by
+-- the upcoming tuner experiments (Phase 5-C) that adjust thresholds
+-- like STALE_THRESHOLD_MS based on observed ledger patterns.
+--
+-- Design
+-- ------
+-- Every entry has:
+--   - key          — opaque string, by convention namespaced with a
+--                    dot (e.g. "stale_task_cleanup.threshold_ms")
+--   - value        — JSON-serialized value, parsed by the consumer
+--   - set_by       — experiment_id that wrote this entry (for audit)
+--   - finding_id   — the finding row that captured the decision,
+--                    so rollbacks can link back to the original
+--                    intervention
+--   - set_at       — ISO timestamp
+--
+-- Consumers pattern:
+--   const threshold = await getRuntimeConfig(db, 'stale_task_cleanup.threshold_ms', DEFAULT);
+-- Writers pattern (inside intervene):
+--   await setRuntimeConfig(db, 'key', newValue, { setBy: exp.id, findingId });
+-- Rollback pattern (inside rollback):
+--   await deleteRuntimeConfig(db, 'key'); // reverts to caller's default
+--
+-- A module-level cache mirrors the table so hot-path reads don't hit
+-- SQLite. Cache is refreshed on daemon boot + every 60s + on every
+-- set/delete (local invalidation).
+-- =====================================================================
+
+-- @statement
+CREATE TABLE IF NOT EXISTS runtime_config_overrides (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL,
+  set_by TEXT,
+  finding_id TEXT,
+  set_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_runtime_config_set_by
+  ON runtime_config_overrides(set_by, set_at DESC);

package/dist/migrations/120-business-vitals.sql

@@ -0,0 +1,44 @@
+-- =====================================================================
+-- Migration 120: business_vitals — time-series of operator business signals
+--
+-- Week-1 "Heart": give the homeostasis controller something to read when
+-- deciding whether the runtime is producing more value than it costs.
+-- Each row is one snapshot of the operator's business at time ts.
+--
+-- Columns are all nullable (except ts / source) so partial snapshots
+-- land cleanly: a workspace with no Stripe key still accumulates
+-- daily_cost_cents rows; a workspace with Stripe but no active-user
+-- tracker still gets MRR.
+--
+-- Units:
+--   mrr            — monthly recurring revenue, cents
+--   arr            — annualized recurring revenue, cents (= mrr * 12 when
+--                    not derived from a separate feed)
+--   active_users   — count of distinct users active in the trailing window
+--   daily_cost_cents — sum of agent_workforce_tasks.cost_cents for the
+--                    local day of ts (UTC)
+--   runway_days    — cash-on-hand / burn_rate when both are known
+--   source         — producer of this row: "stripe", "manual", "import",
+--                    "tasks_aggregate", etc. Never a business-specific
+--                    name. New producers just add their own string.
+-- =====================================================================
+
+-- @statement
+CREATE TABLE IF NOT EXISTS business_vitals (
+  id               TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  workspace_id     TEXT NOT NULL,
+  ts               TEXT NOT NULL DEFAULT (datetime('now')),
+  mrr              INTEGER,
+  arr              INTEGER,
+  active_users     INTEGER,
+  daily_cost_cents INTEGER,
+  runway_days      REAL,
+  source           TEXT NOT NULL,
+  created_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_business_vitals_workspace_ts
+  ON business_vitals(workspace_id, ts DESC);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_business_vitals_source
+  ON business_vitals(source, ts DESC);

package/dist/migrations/121-x-contact-events.sql

@@ -0,0 +1,42 @@
+-- 121-x-contact-events.sql
+-- Layer-4 sales loop: substrate for attributing X signal → contact → revenue.
+--
+-- The contact_events table was introduced in 001 with columns tuned for
+-- free-text CRM notes (event_type, title, description, agent_id, task_id,
+-- metadata, created_at). The sales-loop flow needs a structured-event
+-- shape (kind, source, payload JSON, occurred_at) that can encode the
+-- funnel: x:seen, x:reached, x:replied, x:qualified, dm:received,
+-- demo:booked, plan:paid. Rather than rename or migrate data, we grow
+-- the new columns alongside the legacy ones so both consumer styles
+-- coexist. Legacy CRM tools keep writing event_type/metadata; the
+-- sales-loop path writes kind/payload/occurred_at.
+--
+-- All statements are idempotent. init.ts splits on `-- @statement` and
+-- swallows "duplicate column" errors so re-runs against a partially
+-- applied DB are safe.
+--
+-- Adds:
+--   - outreach_token + never_sync on contacts (privacy + attribution).
+--   - kind/source/payload/occurred_at on contact_events (funnel shape).
+--   - contact_id + source_event_id on revenue_entries (attribution join).
+
+ALTER TABLE agent_workforce_contacts ADD COLUMN outreach_token TEXT;
+-- @statement
+ALTER TABLE agent_workforce_contacts ADD COLUMN never_sync INTEGER NOT NULL DEFAULT 0;
+-- @statement
+ALTER TABLE agent_workforce_contact_events ADD COLUMN kind TEXT;
+-- @statement
+ALTER TABLE agent_workforce_contact_events ADD COLUMN source TEXT;
+-- @statement
+ALTER TABLE agent_workforce_contact_events ADD COLUMN payload TEXT DEFAULT '{}';
+-- @statement
+ALTER TABLE agent_workforce_contact_events ADD COLUMN occurred_at TEXT;
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_contact_events_workspace_kind
+  ON agent_workforce_contact_events(workspace_id, kind, occurred_at);
+-- @statement
+ALTER TABLE agent_workforce_revenue_entries ADD COLUMN contact_id TEXT REFERENCES agent_workforce_contacts(id);
+-- @statement
+ALTER TABLE agent_workforce_revenue_entries ADD COLUMN source_event_id TEXT REFERENCES agent_workforce_contact_events(id);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_revenue_contact ON agent_workforce_revenue_entries(contact_id);

package/dist/migrations/122-video-jobs.sql

@@ -0,0 +1,52 @@
+-- 122-video-jobs.sql
+-- Tracking table for deterministic video renders driven by the
+-- video_generation skill (src/execution/skills/video_generation.ts).
+--
+-- Each job corresponds to one VideoSpec → MP4 pipeline invocation. The
+-- spec_hash column lets us dedupe: if a prior job with the same spec
+-- hash is already 'done', callers can short-circuit and reuse that MP4
+-- instead of re-rendering.
+--
+-- Checkpoints live in a child table so a crashed daemon can resume from
+-- the last completed stage without losing earlier work (rendered voice,
+-- generated music, timing solver output).
+
+CREATE TABLE IF NOT EXISTS video_jobs (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL,
+  spec_hash TEXT NOT NULL,
+  spec_path TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN (
+    'pending','preparing','resolving','rendering','storing',
+    'done','failed','canceled'
+  )),
+  progress REAL NOT NULL DEFAULT 0,
+  stage TEXT,
+  error TEXT,
+  output_path TEXT,
+  size_bytes INTEGER,
+  duration_frames INTEGER,
+  duration_ms INTEGER,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_video_jobs_workspace_status
+  ON video_jobs(workspace_id, status);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_video_jobs_spec_hash
+  ON video_jobs(spec_hash);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_video_jobs_created
+  ON video_jobs(created_at DESC);
+-- @statement
+CREATE TABLE IF NOT EXISTS video_job_checkpoints (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  job_id TEXT NOT NULL REFERENCES video_jobs(id) ON DELETE CASCADE,
+  stage TEXT NOT NULL,
+  payload TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_vjc_job_stage
+  ON video_job_checkpoints(job_id, stage);

package/dist/migrations/123-insight-distiller.sql

@@ -0,0 +1,68 @@
+-- =====================================================================
+-- Migration 123: insight distiller — novelty baselines + feedback ledger
+--
+-- Piece 1 of the "surprise-first self-observation" bundle. Raw findings
+-- keep flowing into self_findings on the 5s reactive reschedule; this
+-- migration adds the two tables that let the system tell "the 500th
+-- identical repetition" apart from "an unusual thing just happened":
+--
+--   self_observation_baselines
+--     One row per (experiment_id, subject) that accumulates a rolling
+--     running mean + stddev over an optional numeric evidence field
+--     (`tracked_field`) via Welford's algorithm. Also tracks first-seen
+--     timestamp, sample count, last verdict, and consecutive fail
+--     count — enough to answer "have we seen this before?" and "has
+--     the verdict been stuck for a while?" without scanning the
+--     ledger. Findings-store writes this row alongside every insert
+--     and mixes the resulting novelty score into the finding's
+--     evidence.__novelty so the distiller can rank by surprise.
+--
+--   self_insight_feedback
+--     Operator / agent feedback ledger: accepted / rejected /
+--     deferred / applied actions taken on a specific finding, keyed
+--     by finding_id. Closes the loop so the strategist and
+--     experiment-author can eventually learn which suggestions
+--     actually landed well. Nothing writes here yet — the REST +
+--     MCP surfaces for recording feedback come in a later piece;
+--     this migration is the shape-only slice.
+-- =====================================================================
+
+-- @statement
+CREATE TABLE IF NOT EXISTS self_observation_baselines (
+  experiment_id     TEXT NOT NULL,
+  subject           TEXT NOT NULL,
+  first_seen_at     TEXT NOT NULL,
+  last_seen_at      TEXT NOT NULL,
+  sample_count      INTEGER NOT NULL DEFAULT 0,
+  tracked_field     TEXT,
+  running_mean      REAL,
+  running_m2        REAL,
+  last_value        REAL,
+  last_verdict      TEXT,
+  consecutive_fails INTEGER NOT NULL DEFAULT 0,
+  updated_at        TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (experiment_id, subject)
+);
+
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_baselines_last_seen
+  ON self_observation_baselines(last_seen_at DESC);
+
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_baselines_consecutive_fails
+  ON self_observation_baselines(consecutive_fails DESC)
+  WHERE consecutive_fails > 0;
+
+-- @statement
+CREATE TABLE IF NOT EXISTS self_insight_feedback (
+  id         TEXT PRIMARY KEY,
+  finding_id TEXT NOT NULL,
+  action     TEXT NOT NULL CHECK (action IN ('accepted','rejected','deferred','applied')),
+  actor      TEXT NOT NULL,
+  rationale  TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- @statement
+CREATE INDEX IF NOT EXISTS idx_insight_feedback_finding
+  ON self_insight_feedback(finding_id, created_at DESC);

package/dist/migrations/124-x-dm-messages.sql

@@ -0,0 +1,55 @@
+-- 124-x-dm-messages.sql — store the result of XDmPollerScheduler ticks.
+--
+-- The poller calls listDmsViaBrowser hourly and writes the inbox
+-- summaries here. Two tables: a current-state thread row (one per
+-- conversation_pair) and an append-only observation log keyed by the
+-- preview text's hash so we don't re-insert when nothing changed.
+--
+-- Why two tables: thread row supports "show me my inbox" queries
+-- without scanning history; observations supports "what changed when"
+-- queries used by future findings/triage. Both are write-light — DMs
+-- are low-volume.
+--
+-- Dedup key on observations is (workspace_id, conversation_pair,
+-- preview_hash). The poller computes preview_hash = sha1 of the
+-- preview text, so identical previews observed across ticks collapse
+-- to one row. New text from the same correspondent inserts a new
+-- observation and bumps the thread's last_seen_at + last_preview.
+--
+-- No FK to agent_workforce_contacts: contact linking layers on later
+-- (the operator must approve the link via the approval-queue path).
+-- Storing handle / pair without a FK keeps the ingest tick cheap and
+-- doesn't gate it on CRM state.
+
+CREATE TABLE IF NOT EXISTS x_dm_threads (
+  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  workspace_id TEXT NOT NULL,
+  conversation_pair TEXT NOT NULL,
+  primary_name TEXT,
+  last_preview TEXT,
+  last_preview_hash TEXT,
+  has_unread INTEGER NOT NULL DEFAULT 0,
+  observation_count INTEGER NOT NULL DEFAULT 0,
+  first_seen_at TEXT NOT NULL DEFAULT (datetime('now')),
+  last_seen_at TEXT NOT NULL DEFAULT (datetime('now')),
+  raw_meta TEXT,
+  UNIQUE(workspace_id, conversation_pair)
+);
+
+CREATE INDEX IF NOT EXISTS idx_x_dm_threads_workspace
+  ON x_dm_threads(workspace_id, last_seen_at DESC);
+
+CREATE TABLE IF NOT EXISTS x_dm_observations (
+  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  workspace_id TEXT NOT NULL,
+  conversation_pair TEXT NOT NULL,
+  primary_name TEXT,
+  preview_text TEXT NOT NULL,
+  preview_hash TEXT NOT NULL,
+  has_unread INTEGER NOT NULL DEFAULT 0,
+  observed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(workspace_id, conversation_pair, preview_hash)
+);
+
+CREATE INDEX IF NOT EXISTS idx_x_dm_obs_pair
+  ON x_dm_observations(workspace_id, conversation_pair, observed_at DESC);

package/dist/migrations/125-x-dm-messages-bodies.sql

@@ -0,0 +1,40 @@
+-- 125-x-dm-messages-bodies.sql — add per-message storage to the DM ingest.
+--
+-- Migration 124 introduced thread + observation tables that captured
+-- only inbox-level previews (one row per (pair, preview_hash)). That
+-- left the actual message bodies invisible — we stored the gloss the
+-- inbox shows, not the conversation. Live DOM probe (2026-04-16,
+-- scripts/probe-x-dm-dom.mjs) confirmed each message has a stable
+-- per-conversation UUID exposed via `data-testid="message-<uuid>"`,
+-- which is the right dedup key for body-level ingest.
+--
+-- Direction comes from the bubble's bg-primary (outbound) vs
+-- bg-gray-50 (inbound) class — X never exposes a sender id in the DM
+-- DOM, so this is the most reliable signal short of authenticated API
+-- access.
+--
+-- Note that we still don't store an absolute timestamp: X inlines the
+-- "x minutes ago" / "6:49 AM" tooltip into the message text and never
+-- exposes a machine-readable datetime here. observed_at (when the
+-- poller saw it) is the closest available stamp.
+
+CREATE TABLE IF NOT EXISTS x_dm_messages (
+  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  workspace_id TEXT NOT NULL,
+  conversation_pair TEXT NOT NULL,
+  message_id TEXT NOT NULL,
+  direction TEXT NOT NULL CHECK (direction IN ('outbound', 'inbound', 'unknown')),
+  text TEXT,
+  is_media INTEGER NOT NULL DEFAULT 0,
+  observed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(workspace_id, message_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_x_dm_messages_pair
+  ON x_dm_messages(workspace_id, conversation_pair, observed_at DESC);
+
+-- Bring the threads table forward with one denormalized field so the
+-- inbox query doesn't need a join to show the latest message body.
+ALTER TABLE x_dm_threads ADD COLUMN last_message_id TEXT;
+ALTER TABLE x_dm_threads ADD COLUMN last_message_text TEXT;
+ALTER TABLE x_dm_threads ADD COLUMN last_message_direction TEXT;