thinkwork-cli 0.12.11 → 0.12.15

package/dist/drizzle/0058_routines_visibility_and_owning_agent.sql

@@ -0,0 +1,61 @@
+-- Add visibility + owning_agent_id columns to the routines table
+-- (schema follow-up bundle, closing C U11 P2 residual).
+--
+-- Phase C U11 introduced the create_routine + routine_invoke MCP
+-- tools with a visibility check that conflated `agent_id` (the
+-- routine's primary execution agent) with "the agent that owns
+-- this routine for invocation purposes". This migration splits the
+-- two:
+--
+--   - `owning_agent_id`: the agent that authored / has stewardship.
+--   - `visibility`: enum-by-string (kept lower-snake to match the
+--     in-code 'agent_private' / 'tenant_shared' literals already
+--     baked into admin-ops/checkRoutineVisibility).
+--
+-- Backfill rule:
+--   * agent_id IS NOT NULL → owning_agent_id = agent_id,
+--                              visibility = 'agent_private'
+--   * agent_id IS NULL    → owning_agent_id = NULL,
+--                              visibility = 'tenant_shared'
+--
+-- This preserves the v0 conflated semantics — every existing routine
+-- with an agent stays "private to that agent", every team-scoped
+-- routine without an agent stays tenant-wide. The MCP visibility
+-- helper switches to read these columns in the same PR so behavior
+-- doesn't drift.
+--
+-- creates-column: public.routines.visibility
+-- creates-column: public.routines.owning_agent_id
+
+ALTER TABLE public.routines
+  ADD COLUMN IF NOT EXISTS visibility text NOT NULL DEFAULT 'agent_private';
+
+ALTER TABLE public.routines
+  ADD COLUMN IF NOT EXISTS owning_agent_id uuid REFERENCES public.agents(id);
+
+-- Backfill existing rows. The default 'agent_private' on the
+-- visibility column already covers the agent-owned case; we only
+-- need to flip rows without an agent to 'tenant_shared'.
+UPDATE public.routines
+   SET owning_agent_id = agent_id
+ WHERE agent_id IS NOT NULL
+   AND owning_agent_id IS NULL;
+
+UPDATE public.routines
+   SET visibility = 'tenant_shared'
+ WHERE agent_id IS NULL
+   AND visibility = 'agent_private';
+
+-- Index for the routine_invoke visibility-check path: lookups go
+-- (tenant_id, owning_agent_id) when filtering routines an agent
+-- is allowed to invoke.
+CREATE INDEX IF NOT EXISTS idx_routines_owning_agent_id
+  ON public.routines (tenant_id, owning_agent_id)
+  WHERE owning_agent_id IS NOT NULL;
+
+-- CHECK constraint pins the visibility enum at the DB layer so
+-- resolvers + the MCP tool can rely on it without joining or
+-- re-validating client-side.
+ALTER TABLE public.routines
+  ADD CONSTRAINT routines_visibility_enum
+  CHECK (visibility IN ('agent_private', 'tenant_shared'));

package/dist/drizzle/0061_routine_execution_asl_version_id.sql

@@ -0,0 +1,29 @@
+-- Routine executions: persist the ASL version row used for each run.
+--
+-- New manual Test Routine executions can then resolve the exact
+-- routine_asl_versions row even when Step Functions execution metadata
+-- does not provide a version ARN. Existing rows remain valid with null.
+--
+-- Plan:
+--   docs/plans/2026-05-02-011-feat-routine-execution-aware-editing-plan.md
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0061_routine_execution_asl_version_id.sql
+--
+-- creates-column: public.routine_executions.routine_asl_version_id
+-- creates: public.idx_routine_executions_asl_version
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+ALTER TABLE public.routine_executions
+  ADD COLUMN IF NOT EXISTS routine_asl_version_id uuid REFERENCES public.routine_asl_versions(id);
+
+CREATE INDEX IF NOT EXISTS idx_routine_executions_asl_version
+  ON public.routine_executions (routine_asl_version_id);
+
+COMMIT;

package/dist/drizzle/0062_migrate_pi_to_flue.sql

@@ -0,0 +1,110 @@
+-- Plan §005 U3 — retire AgentRuntimeType selector value `pi` → `flue`.
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — applied via psql in
+-- deploy.yml as a pre-Lambda-update step so the dispatcher never sees a
+-- `pi` value it can't route after the API code update lands).
+--
+-- The `agents.runtime` and `agent_templates.runtime` columns are both
+-- `text NOT NULL DEFAULT 'strands'` (no Postgres enum), so this is a
+-- pure data migration. No DDL.
+--
+-- Marker for db:migrate-manual drift-reporter (see CLAUDE.md "Some
+-- drizzle/*.sql files are hand-rolled..."): the reporter looks up the
+-- declared columns and confirms they exist post-deploy. We're modifying
+-- existing columns, not creating new ones, so we declare them with
+-- creates-column to satisfy the gate.
+-- creates-column: public.agents.runtime
+-- creates-column: public.agent_templates.runtime
+
+\echo '== plan §005 U3: agents.runtime + agent_templates.runtime backfill =='
+
+-- Print affected rows BEFORE the update so a developer can recover their
+-- pi-pinned configs if the rename was unexpected. No mutation in this step.
+\echo '-- agents currently set to runtime = pi --'
+SELECT
+  id,
+  tenant_id,
+  name,
+  runtime,
+  updated_at
+FROM agents
+WHERE runtime = 'pi';
+
+\echo '-- agent_templates currently set to runtime = pi --'
+SELECT
+  id,
+  name,
+  runtime,
+  updated_at
+FROM agent_templates
+WHERE runtime = 'pi';
+
+-- Loosen the CHECK constraints on both runtime columns BEFORE the
+-- UPDATE — the existing constraints only allow ('strands', 'pi'), so
+-- setting runtime = 'flue' otherwise hits:
+--
+--   ERROR: new row for relation "agents" violates check constraint
+--   "agents_runtime_check"
+--
+-- We allow the union {strands, flue, pi} during the migration so the
+-- partial-fail rollback (--single-transaction) can leave the system in
+-- a consistent state even if the UPDATE aborts mid-way. After the
+-- post-migration verification (DO block below) confirms zero rows
+-- remain on 'pi', the constraints could be tightened to
+-- {strands, flue}; we keep 'pi' tolerated for one release cycle so
+-- rollback to a pre-U3 dispatcher stays available.
+\echo '-- loosening agents.runtime CHECK constraint to allow flue --'
+ALTER TABLE agents DROP CONSTRAINT IF EXISTS agents_runtime_check;
+ALTER TABLE agents
+  ADD CONSTRAINT agents_runtime_check
+  CHECK (runtime IN ('strands', 'flue', 'pi'));
+
+\echo '-- loosening agent_templates.runtime CHECK constraint to allow flue --'
+ALTER TABLE agent_templates DROP CONSTRAINT IF EXISTS agent_templates_runtime_check;
+ALTER TABLE agent_templates
+  ADD CONSTRAINT agent_templates_runtime_check
+  CHECK (runtime IN ('strands', 'flue', 'pi'));
+
+-- Apply the rename. Both updates run inside an implicit transaction
+-- (psql --single-transaction) so a partial failure rolls the whole
+-- migration back without leaving the system in mixed state.
+\echo '-- updating agents.runtime: pi → flue --'
+UPDATE agents
+SET runtime = 'flue', updated_at = NOW()
+WHERE runtime = 'pi';
+
+\echo '-- updating agent_templates.runtime: pi → flue --'
+UPDATE agent_templates
+SET runtime = 'flue', updated_at = NOW()
+WHERE runtime = 'pi';
+
+-- Confirm zero rows remain on the old value. The DO block raises an
+-- exception when any row survived, which (combined with psql's
+-- ON_ERROR_STOP=1 + --single-transaction) aborts the migration and
+-- rolls back the UPDATEs above. Without this gate, a stale row would
+-- silently persist and the new dispatcher would map it to Strands via
+-- the default branch in normalizeAgentRuntimeType.
+\echo '-- post-migration verification: any rows still on pi? --'
+DO $$
+DECLARE
+  agents_remaining     bigint;
+  templates_remaining  bigint;
+BEGIN
+  SELECT COUNT(*) INTO agents_remaining
+  FROM agents
+  WHERE runtime = 'pi';
+
+  SELECT COUNT(*) INTO templates_remaining
+  FROM agent_templates
+  WHERE runtime = 'pi';
+
+  RAISE NOTICE 'agents still on pi: %', agents_remaining;
+  RAISE NOTICE 'agent_templates still on pi: %', templates_remaining;
+
+  IF agents_remaining > 0 OR templates_remaining > 0 THEN
+    RAISE EXCEPTION
+      'plan §005 U3 migration verification failed: % agents and % agent_templates still have runtime = ''pi''. Investigate before the dispatcher Lambda is updated — the new normalizer would silently coerce these rows to ''strands''.',
+      agents_remaining, templates_remaining;
+  END IF;
+END
+$$;

package/dist/drizzle/0063_threads_session_data.sql

@@ -0,0 +1,23 @@
+-- Plan §005 U4 — add `threads.session_data jsonb` for Pi's `SessionStore`.
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — applied via psql in
+-- deploy.yml as a pre-Terraform-apply step so the non-Strands runtime Lambda
+-- never reads/writes a column the schema doesn't have).
+--
+-- The column is nullable: pre-Pi threads coexist with NULL. Pi's
+-- AuroraSessionStore.delete() also sets the column to NULL rather than
+-- dropping the thread row, so the post-state is the same as the pre-state
+-- whenever the column is empty.
+--
+-- Marker for db:migrate-manual drift-reporter (see CLAUDE.md "Some
+-- drizzle/*.sql files are hand-rolled..."):
+-- creates-column: public.threads.session_data
+
+\echo '== plan §005 U4: threads.session_data jsonb column =='
+
+ALTER TABLE threads
+  ADD COLUMN IF NOT EXISTS session_data jsonb;
+
+-- No index — Pi keys exclusively on `threads.id` (the PK) plus
+-- `tenant_id` (existing `idx_threads_tenant_id`). Adding a GIN/BTREE index
+-- on a jsonb column we never query inside is wasted write amplification.

package/dist/drizzle/0064_tenant_credentials.sql

@@ -0,0 +1,65 @@
+-- Tenant-shared credential vault for routines and integrations.
+--
+-- Secret values live in AWS Secrets Manager. This table stores only
+-- non-secret metadata, lifecycle state, and derived runtime references.
+--
+-- Plan:
+--   docs/plans/2026-05-04-002-feat-tenant-credential-vault-routine-migration-plan.md
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0064_tenant_credentials.sql
+--
+-- creates: public.tenant_credentials
+-- creates: public.uq_tenant_credentials_slug
+-- creates: public.idx_tenant_credentials_tenant
+-- creates: public.idx_tenant_credentials_status
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS public.tenant_credentials (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  display_name text NOT NULL,
+  slug text NOT NULL,
+  kind text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  secret_ref text NOT NULL,
+  eventbridge_connection_arn text,
+  schema_json jsonb NOT NULL DEFAULT '{}'::jsonb,
+  metadata_json jsonb NOT NULL DEFAULT '{}'::jsonb,
+  last_used_at timestamp with time zone,
+  last_validated_at timestamp with time zone,
+  created_by_user_id uuid REFERENCES public.users(id),
+  deleted_at timestamp with time zone,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT tenant_credentials_kind_enum CHECK (
+    kind IN (
+      'api_key',
+      'bearer_token',
+      'basic_auth',
+      'soap_partner',
+      'webhook_signing_secret',
+      'json'
+    )
+  ),
+  CONSTRAINT tenant_credentials_status_enum CHECK (
+    status IN ('active', 'disabled', 'deleted')
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tenant_credentials_slug
+  ON public.tenant_credentials (tenant_id, slug);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_credentials_tenant
+  ON public.tenant_credentials (tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_credentials_status
+  ON public.tenant_credentials (tenant_id, status);
+
+COMMIT;

package/dist/drizzle/0067_thinkwork_computers_phase_one.sql

@@ -0,0 +1,174 @@
+-- ThinkWork Computer phase-one data foundation.
+--
+-- Plan:
+--   docs/plans/2026-05-06-005-feat-thinkwork-computer-phase-one-foundation-plan.md
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0067_thinkwork_computers_phase_one.sql
+--
+-- creates-column: public.agent_templates.template_kind
+-- creates-constraint: public.agent_templates.agent_templates_kind_allowed
+-- creates: public.idx_agent_templates_kind
+-- creates: public.computers
+-- creates: public.computer_tasks
+-- creates: public.computer_events
+-- creates: public.computer_snapshots
+-- creates: public.uq_computers_tenant_slug
+-- creates: public.uq_computers_active_owner
+-- creates: public.idx_computers_tenant_status
+-- creates: public.idx_computers_owner
+-- creates: public.idx_computers_template
+-- creates: public.idx_computers_migrated_agent
+-- creates: public.uq_computer_tasks_idempotency
+-- creates: public.idx_computer_tasks_computer_status
+-- creates: public.idx_computer_tasks_tenant_status
+-- creates: public.idx_computer_events_computer_created
+-- creates: public.idx_computer_events_task
+-- creates: public.idx_computer_snapshots_computer_created
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+ALTER TABLE public.agent_templates
+  ADD COLUMN IF NOT EXISTS template_kind text NOT NULL DEFAULT 'agent';
+
+ALTER TABLE public.agent_templates
+  DROP CONSTRAINT IF EXISTS agent_templates_kind_allowed;
+
+ALTER TABLE public.agent_templates
+  ADD CONSTRAINT agent_templates_kind_allowed CHECK (
+    template_kind IN ('agent', 'computer')
+  );
+
+CREATE INDEX IF NOT EXISTS idx_agent_templates_kind
+  ON public.agent_templates (template_kind);
+
+CREATE TABLE IF NOT EXISTS public.computers (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  owner_user_id uuid NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+  template_id uuid NOT NULL REFERENCES public.agent_templates(id),
+  name text NOT NULL,
+  slug text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  desired_runtime_status text NOT NULL DEFAULT 'running',
+  runtime_status text NOT NULL DEFAULT 'pending',
+  runtime_config jsonb,
+  live_workspace_root text,
+  efs_access_point_id text,
+  ecs_service_name text,
+  last_heartbeat_at timestamp with time zone,
+  last_active_at timestamp with time zone,
+  budget_monthly_cents integer,
+  spent_monthly_cents integer DEFAULT 0,
+  budget_paused_at timestamp with time zone,
+  budget_paused_reason text,
+  migrated_from_agent_id uuid REFERENCES public.agents(id),
+  migration_metadata jsonb,
+  created_by uuid REFERENCES public.users(id),
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT computers_status_allowed CHECK (
+    status IN ('active', 'provisioning', 'failed', 'archived')
+  ),
+  CONSTRAINT computers_desired_runtime_status_allowed CHECK (
+    desired_runtime_status IN ('running', 'stopped')
+  ),
+  CONSTRAINT computers_runtime_status_allowed CHECK (
+    runtime_status IN ('pending', 'starting', 'running', 'stopped', 'failed', 'unknown')
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_computers_tenant_slug
+  ON public.computers (tenant_id, slug);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_computers_active_owner
+  ON public.computers (tenant_id, owner_user_id)
+  WHERE status <> 'archived';
+
+CREATE INDEX IF NOT EXISTS idx_computers_tenant_status
+  ON public.computers (tenant_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_computers_owner
+  ON public.computers (owner_user_id);
+
+CREATE INDEX IF NOT EXISTS idx_computers_template
+  ON public.computers (template_id);
+
+CREATE INDEX IF NOT EXISTS idx_computers_migrated_agent
+  ON public.computers (migrated_from_agent_id);
+
+CREATE TABLE IF NOT EXISTS public.computer_tasks (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  computer_id uuid NOT NULL REFERENCES public.computers(id) ON DELETE CASCADE,
+  task_type text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  input jsonb,
+  output jsonb,
+  error jsonb,
+  idempotency_key text,
+  claimed_at timestamp with time zone,
+  completed_at timestamp with time zone,
+  created_by_user_id uuid REFERENCES public.users(id),
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT computer_tasks_status_allowed CHECK (
+    status IN ('pending', 'running', 'completed', 'failed', 'cancelled')
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_computer_tasks_idempotency
+  ON public.computer_tasks (tenant_id, computer_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_computer_tasks_computer_status
+  ON public.computer_tasks (computer_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_computer_tasks_tenant_status
+  ON public.computer_tasks (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.computer_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  computer_id uuid NOT NULL REFERENCES public.computers(id) ON DELETE CASCADE,
+  task_id uuid REFERENCES public.computer_tasks(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  level text NOT NULL DEFAULT 'info',
+  payload jsonb,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT computer_events_level_allowed CHECK (
+    level IN ('debug', 'info', 'warn', 'error')
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_computer_events_computer_created
+  ON public.computer_events (computer_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_computer_events_task
+  ON public.computer_events (task_id);
+
+CREATE TABLE IF NOT EXISTS public.computer_snapshots (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  computer_id uuid NOT NULL REFERENCES public.computers(id) ON DELETE CASCADE,
+  task_id uuid REFERENCES public.computer_tasks(id) ON DELETE SET NULL,
+  status text NOT NULL DEFAULT 'pending',
+  s3_prefix text NOT NULL,
+  manifest jsonb,
+  error jsonb,
+  completed_at timestamp with time zone,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT computer_snapshots_status_allowed CHECK (
+    status IN ('pending', 'completed', 'failed')
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_computer_snapshots_computer_created
+  ON public.computer_snapshots (computer_id, created_at);
+
+COMMIT;

package/dist/drizzle/0068_drop_system_workflows_and_activation.sql

@@ -0,0 +1,115 @@
+-- 0068_drop_system_workflows_and_activation.sql
+--
+-- Phase 2 U6 of the System Workflows revert. Final unit. Drops the 11
+-- Postgres tables that backed the SW + Activation features:
+--   - 4 activation tables (sessions, session_turns, apply_outbox, automation_candidates)
+--   - 7 SW tables (definitions, configs, extension_bindings, runs, step_events,
+--     evidence, change_events)
+-- Plus all the indexes/constraints declared by the deleted create-migrations
+-- (0038, 0039, 0041, 0059, 0060). DROP TABLE CASCADE handles the runtime
+-- removal of indexes alongside their parent tables.
+--
+-- Plan reference:
+--   docs/plans/2026-05-06-010-refactor-system-workflows-u6-postgres-schema-plan.md
+--   docs/plans/2026-05-06-001-refactor-system-workflows-activation-removal-plan.md
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0068_drop_system_workflows_and_activation.sql
+-- Then verify:
+--   psql "$DATABASE_URL" -c "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' AND table_name IN ('activation_sessions','activation_session_turns','activation_apply_outbox','activation_automation_candidates','system_workflow_definitions','system_workflow_configs','system_workflow_extension_bindings','system_workflow_runs','system_workflow_step_events','system_workflow_evidence','system_workflow_change_events');"
+--   (expect 0 rows)
+--
+-- Markers (consumed by scripts/db-migrate-manual.sh as the post-deploy drift gate):
+-- This file declares no creates. The drops markers below probe ABSENCE
+-- of each named object. Tables and indexes/constraints are dropped
+-- together via CASCADE; markers are enumerated for full audit trail of
+-- what disappears.
+--
+-- drops: public.activation_sessions
+-- drops: public.activation_session_turns
+-- drops: public.activation_apply_outbox
+-- drops: public.activation_automation_candidates
+-- drops: public.system_workflow_definitions
+-- drops: public.system_workflow_configs
+-- drops: public.system_workflow_extension_bindings
+-- drops: public.system_workflow_runs
+-- drops: public.system_workflow_step_events
+-- drops: public.system_workflow_evidence
+-- drops: public.system_workflow_change_events
+-- drops: public.idx_activation_sessions_user_status
+-- drops: public.idx_activation_sessions_tenant
+-- drops: public.uq_activation_sessions_user_in_progress
+-- drops: public.idx_activation_session_turns_session_order
+-- drops: public.idx_activation_apply_outbox_status_created
+-- drops: public.idx_activation_apply_outbox_session
+-- drops: public.idx_activation_automation_candidates_session
+-- drops: public.idx_activation_automation_candidates_user_status
+-- drops: public.uq_activation_automation_candidates_active_duplicate
+-- drops: public.idx_system_workflow_definitions_category
+-- drops: public.idx_system_workflow_definitions_status
+-- drops: public.idx_system_workflow_configs_tenant_workflow_version
+-- drops: public.idx_system_workflow_configs_tenant_workflow_status
+-- drops: public.idx_system_workflow_extension_bindings_tenant_workflow
+-- drops: public.idx_system_workflow_extension_bindings_config
+-- drops: public.idx_system_workflow_runs_sfn_arn
+-- drops: public.idx_system_workflow_runs_tenant_workflow_started
+-- drops: public.idx_system_workflow_runs_tenant_status
+-- drops: public.idx_system_workflow_runs_domain_ref
+-- drops: public.idx_system_workflow_step_events_run
+-- drops: public.idx_system_workflow_step_events_dedup
+-- drops: public.idx_system_workflow_step_events_tenant_step
+-- drops: public.idx_system_workflow_evidence_run
+-- drops: public.idx_system_workflow_evidence_tenant_type
+-- drops: public.idx_system_workflow_evidence_dedup
+-- drops: public.idx_system_workflow_change_events_tenant_workflow
+-- drops: public.idx_system_workflow_change_events_run
+-- drops: public.idx_system_workflow_runs_domain_ref_dedup
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+-- Fail fast on lock contention. The 11 tables have no live writers
+-- (U2 deleted the GraphQL surface, U3 deleted the Lambda library, U5
+-- destroyed the Step Functions module), so a 5s wait is more than
+-- sufficient; if a stale connection holds a lock past that, abort
+-- rather than wedge the cluster behind a long-held ACCESS EXCLUSIVE
+-- lock. Mirrors the pattern from 0031_thread_cleanup_drops.sql.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+-- Refuse to apply against an unexpected DB. The drop is irreversible
+-- without RDS snapshot restore, so an in-script guard against stale
+-- DATABASE_URL pointing at a localhost Postgres or a non-dev RDS is
+-- cheap insurance.
+DO $$
+BEGIN
+  IF current_database() != 'thinkwork' THEN
+    RAISE EXCEPTION 'wrong database: %, expected thinkwork', current_database();
+  END IF;
+END $$;
+
+-- ---------------------------------------------------------------------------
+-- Drop System Workflows tables (children before parents).
+-- CASCADE removes incidental constraints + drops indexes alongside their
+-- parent tables; the ordering here is belt-and-suspenders.
+-- ---------------------------------------------------------------------------
+
+DROP TABLE IF EXISTS public.system_workflow_change_events CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_evidence CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_step_events CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_runs CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_extension_bindings CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_configs CASCADE;
+DROP TABLE IF EXISTS public.system_workflow_definitions CASCADE;
+
+-- ---------------------------------------------------------------------------
+-- Drop Activation tables (children before parents).
+-- ---------------------------------------------------------------------------
+
+DROP TABLE IF EXISTS public.activation_apply_outbox CASCADE;
+DROP TABLE IF EXISTS public.activation_automation_candidates CASCADE;
+DROP TABLE IF EXISTS public.activation_session_turns CASCADE;
+DROP TABLE IF EXISTS public.activation_sessions CASCADE;
+
+COMMIT;