thinkwork-cli 0.12.11 → 0.12.15

package/dist/drizzle/0018_skill_runs.sql

@@ -0,0 +1,84 @@
+-- skill_runs — audit log + idempotency surface for composition invocations.
+--
+-- See docs/plans/2026-04-21-003-feat-composable-skills-with-learnings-plan.md
+-- (Unit 4). This table is an audit log, NOT an execution substrate — runs
+-- complete inside a single AgentCore Runtime session and only the final
+-- outcome is recorded here.
+--
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0018_skill_runs.sql
+--
+-- Drift detection:
+--   bash scripts/db-migrate-manual.sh
+--
+-- Pre-migration invariant: no existing table named skill_runs.
+--   SELECT to_regclass('public.skill_runs'); must return NULL.
+--
+-- creates: public.skill_runs
+-- creates: public.uq_skill_runs_dedup_active
+
+CREATE TABLE "skill_runs" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	"agent_id" uuid,
+	"invoker_user_id" uuid NOT NULL,
+	"skill_id" text NOT NULL,
+	"skill_version" integer NOT NULL DEFAULT 1,
+	"invocation_source" text NOT NULL,
+	"inputs" jsonb NOT NULL DEFAULT '{}'::jsonb,
+	"resolved_inputs" jsonb NOT NULL DEFAULT '{}'::jsonb,
+	"resolved_inputs_hash" text NOT NULL,
+	"status" text NOT NULL DEFAULT 'running',
+	"delivery_channels" jsonb NOT NULL DEFAULT '[]'::jsonb,
+	"started_at" timestamp with time zone NOT NULL DEFAULT now(),
+	"finished_at" timestamp with time zone,
+	"delivered_artifact_ref" jsonb,
+	"delete_at" timestamp with time zone NOT NULL DEFAULT (now() + interval '30 days'),
+	"feedback_signal" text,
+	"feedback_note" text,
+	"failure_reason" text,
+	"created_at" timestamp with time zone NOT NULL DEFAULT now(),
+	"updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+	CONSTRAINT "retention_ceiling"
+		CHECK (delete_at <= started_at + interval '180 days'),
+	CONSTRAINT "status_allowed"
+		CHECK (status IN ('running','complete','failed','cancelled','invoker_deprovisioned','skipped_disabled','cost_bounded_error')),
+	CONSTRAINT "invocation_source_allowed"
+		CHECK (invocation_source IN ('chat','scheduled','catalog','webhook')),
+	CONSTRAINT "feedback_signal_allowed"
+		CHECK (feedback_signal IS NULL OR feedback_signal IN ('positive','negative'))
+);
+--> statement-breakpoint
+
+ALTER TABLE "skill_runs" ADD CONSTRAINT "skill_runs_tenant_id_tenants_id_fk"
+	FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id")
+	ON DELETE no action ON UPDATE no action;
+--> statement-breakpoint
+
+ALTER TABLE "skill_runs" ADD CONSTRAINT "skill_runs_agent_id_agents_id_fk"
+	FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id")
+	ON DELETE no action ON UPDATE no action;
+--> statement-breakpoint
+
+CREATE INDEX "idx_skill_runs_tenant_started" ON "skill_runs"
+	USING btree ("tenant_id","started_at");
+--> statement-breakpoint
+
+CREATE INDEX "idx_skill_runs_invoker" ON "skill_runs"
+	USING btree ("invoker_user_id");
+--> statement-breakpoint
+
+CREATE INDEX "idx_skill_runs_tenant_skill" ON "skill_runs"
+	USING btree ("tenant_id","skill_id");
+--> statement-breakpoint
+
+CREATE INDEX "idx_skill_runs_delete_at" ON "skill_runs"
+	USING btree ("delete_at");
+--> statement-breakpoint
+
+-- Dedup: only rows still in 'running' status can collide. Once a run
+-- flips to a terminal status its slot is freed and a re-invocation with
+-- the same inputs inserts cleanly as a fresh reconciler tick.
+CREATE UNIQUE INDEX "uq_skill_runs_dedup_active" ON "skill_runs"
+	USING btree ("tenant_id","invoker_user_id","skill_id","resolved_inputs_hash")
+	WHERE status = 'running';

package/dist/drizzle/0019_condemned_dragon_man.sql

@@ -0,0 +1,95 @@
+-- NOTE: mutation_idempotency table + FK + indexes were intentionally
+-- stripped from this generated migration. They were already applied to every
+-- stage by the hand-rolled drizzle/0020_mutation_idempotency.sql that shipped
+-- in PR #405 (65da2f6); the drizzle journal simply wasn't refreshed, so when
+-- db:generate ran for the sandbox schema it re-included the table. Keeping
+-- them here would make this migration fail with "relation already exists" on
+-- every environment. The 0019 snapshot file does include mutation_idempotency
+-- so future db:generate runs stay consistent.
+CREATE TABLE "sandbox_invocations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	"run_id" uuid,
+	"agent_id" uuid,
+	"user_id" uuid NOT NULL,
+	"template_id" text,
+	"tool_call_id" text,
+	"session_id" text,
+	"environment_id" text NOT NULL,
+	"invocation_source" text,
+	"started_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"finished_at" timestamp with time zone,
+	"duration_ms" integer,
+	"exit_status" text,
+	"stdout_bytes" bigint,
+	"stderr_bytes" bigint,
+	"stdout_truncated" boolean DEFAULT false NOT NULL,
+	"stderr_truncated" boolean DEFAULT false NOT NULL,
+	"peak_memory_mb" integer,
+	"outbound_hosts" jsonb,
+	"executed_code_hash" text,
+	"failure_reason" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"delete_at" timestamp with time zone DEFAULT now() + interval '30 days' NOT NULL,
+	CONSTRAINT "sandbox_invocations_retention_ceiling" CHECK ("sandbox_invocations"."delete_at" <= "sandbox_invocations"."started_at" + interval '180 days'),
+	CONSTRAINT "sandbox_invocations_exit_status_allowed" CHECK ("sandbox_invocations"."exit_status" IS NULL OR "sandbox_invocations"."exit_status" IN ('ok','error','timeout','oom','cap_exceeded','provisioning','connection_revoked')),
+	CONSTRAINT "sandbox_invocations_source_allowed" CHECK ("sandbox_invocations"."invocation_source" IS NULL OR "sandbox_invocations"."invocation_source" IN ('chat','scheduled','composition'))
+);
+--> statement-breakpoint
+CREATE TABLE "sandbox_agent_hourly_counters" (
+	"tenant_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"utc_hour" timestamp with time zone NOT NULL,
+	"invocations_count" integer DEFAULT 0 NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "sandbox_agent_hourly_counters_tenant_id_agent_id_utc_hour_pk" PRIMARY KEY("tenant_id","agent_id","utc_hour")
+);
+--> statement-breakpoint
+CREATE TABLE "sandbox_tenant_daily_counters" (
+	"tenant_id" uuid NOT NULL,
+	"utc_date" date NOT NULL,
+	"invocations_count" integer DEFAULT 0 NOT NULL,
+	"wall_clock_seconds" integer DEFAULT 0 NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "sandbox_tenant_daily_counters_tenant_id_utc_date_pk" PRIMARY KEY("tenant_id","utc_date")
+);
+--> statement-breakpoint
+CREATE TABLE "tenant_policy_events" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	"actor_user_id" uuid NOT NULL,
+	"event_type" text NOT NULL,
+	"before_value" text,
+	"after_value" text,
+	"source" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "tenant_policy_events_event_type_allowed" CHECK ("tenant_policy_events"."event_type" IN ('sandbox_enabled','compliance_tier')),
+	CONSTRAINT "tenant_policy_events_source_allowed" CHECK ("tenant_policy_events"."source" IN ('graphql','reconciler','sql'))
+);
+--> statement-breakpoint
+ALTER TABLE "tenants" ADD COLUMN "sandbox_enabled" boolean DEFAULT true NOT NULL;--> statement-breakpoint
+-- Rollout-safe: the DEFAULT true is forward-facing semantics (new tenants
+-- created post-migration opt in automatically). Existing tenants must NOT
+-- auto-opt-in before Phase 3b enforcement (pre-flight + quota + audit) lands;
+-- flip them all to false in the same transaction. Operator action re-enables
+-- per tenant during the staged rollout described in the plan's Operational
+-- Notes.
+UPDATE "tenants" SET "sandbox_enabled" = false;--> statement-breakpoint
+ALTER TABLE "tenants" ADD COLUMN "compliance_tier" text DEFAULT 'standard' NOT NULL;--> statement-breakpoint
+ALTER TABLE "tenants" ADD COLUMN "sandbox_interpreter_public_id" text;--> statement-breakpoint
+ALTER TABLE "tenants" ADD COLUMN "sandbox_interpreter_internal_id" text;--> statement-breakpoint
+ALTER TABLE "sandbox_invocations" ADD CONSTRAINT "sandbox_invocations_tenant_id_tenants_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sandbox_invocations" ADD CONSTRAINT "sandbox_invocations_run_id_skill_runs_id_fk" FOREIGN KEY ("run_id") REFERENCES "public"."skill_runs"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sandbox_invocations" ADD CONSTRAINT "sandbox_invocations_agent_id_agents_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sandbox_agent_hourly_counters" ADD CONSTRAINT "sandbox_agent_hourly_counters_tenant_id_tenants_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sandbox_agent_hourly_counters" ADD CONSTRAINT "sandbox_agent_hourly_counters_agent_id_agents_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sandbox_tenant_daily_counters" ADD CONSTRAINT "sandbox_tenant_daily_counters_tenant_id_tenants_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "tenant_policy_events" ADD CONSTRAINT "tenant_policy_events_tenant_id_tenants_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_sandbox_invocations_tenant_started" ON "sandbox_invocations" USING btree ("tenant_id","started_at");--> statement-breakpoint
+CREATE INDEX "idx_sandbox_invocations_tenant_agent_started" ON "sandbox_invocations" USING btree ("tenant_id","agent_id","started_at");--> statement-breakpoint
+CREATE INDEX "idx_sandbox_invocations_user" ON "sandbox_invocations" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "idx_sandbox_invocations_run" ON "sandbox_invocations" USING btree ("run_id");--> statement-breakpoint
+CREATE INDEX "idx_sandbox_invocations_delete_at" ON "sandbox_invocations" USING btree ("delete_at");--> statement-breakpoint
+CREATE INDEX "idx_tenant_policy_events_tenant_created" ON "tenant_policy_events" USING btree ("tenant_id","created_at");--> statement-breakpoint
+ALTER TABLE "tenants" ADD CONSTRAINT "tenants_compliance_tier_allowed" CHECK ("tenants"."compliance_tier" IN ('standard','regulated','hipaa'));--> statement-breakpoint
+ALTER TABLE "tenants" ADD CONSTRAINT "tenants_sandbox_requires_standard_tier" CHECK (NOT ("tenants"."sandbox_enabled" = true AND "tenants"."compliance_tier" != 'standard'));

package/dist/drizzle/0019_webhook_skill_runs.sql

@@ -0,0 +1,58 @@
+-- Unit 8 — webhook ingress pattern + tenant system-user actor.
+--
+-- See docs/plans/2026-04-21-003-feat-composable-skills-with-learnings-plan.md
+-- (Unit 8). Two changes:
+--
+--   1. skill_runs.triggered_by_run_id — optional link from one reconciler
+--      tick back to the run that spawned the task whose completion fired
+--      this tick. Populated by the task-event webhook handler.
+--   2. tenant_system_users — one stable uuid per tenant that owns webhook-
+--      triggered composition runs. Compiled-in scope: invoke-only. See the
+--      schema file for the rationale.
+--
+-- Apply manually (matches 0018_skill_runs.sql convention):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0019_webhook_skill_runs.sql
+--
+-- Drift detection:
+--   bash scripts/db-migrate-manual.sh
+--
+-- Pre-migration invariants:
+--   - skill_runs exists (applied via 0018_skill_runs.sql).
+--   - tenant_system_users does not exist yet.
+--
+-- creates: public.tenant_system_users
+-- creates: public.uq_tenant_system_users_tenant
+-- creates: public.idx_skill_runs_triggered_by
+-- creates-column: public.skill_runs.triggered_by_run_id
+
+-- ---------------------------------------------------------------------------
+-- 1. skill_runs.triggered_by_run_id
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE "skill_runs"
+	ADD COLUMN IF NOT EXISTS "triggered_by_run_id" uuid;
+--> statement-breakpoint
+
+CREATE INDEX IF NOT EXISTS "idx_skill_runs_triggered_by"
+	ON "skill_runs" USING btree ("triggered_by_run_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- 2. tenant_system_users
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "tenant_system_users" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	"created_at" timestamp with time zone NOT NULL DEFAULT now()
+);
+--> statement-breakpoint
+
+ALTER TABLE "tenant_system_users"
+	ADD CONSTRAINT "tenant_system_users_tenant_id_tenants_id_fk"
+	FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id")
+	ON DELETE no action ON UPDATE no action;
+--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_tenant_system_users_tenant"
+	ON "tenant_system_users" USING btree ("tenant_id");

package/dist/drizzle/0020_crazy_the_anarchist.sql

@@ -0,0 +1,9 @@
+-- NOTE: skill_runs.completion_hmac_secret was intentionally stripped from
+-- this generated migration. It was already applied to every stage by the
+-- hand-rolled drizzle/0021_skill_runs_completion_hmac.sql that shipped with
+-- the composable-skills hardening work (#422). The drizzle journal wasn't
+-- refreshed, so db:generate re-included the column when it ran for this
+-- unit. Keeping that line here would fail with "column already exists" on
+-- every environment. The 0020 snapshot file does capture the column so
+-- future db:generate runs stay consistent.
+ALTER TABLE "agent_templates" ADD COLUMN "sandbox" jsonb;

package/dist/drizzle/0020_mutation_idempotency.sql

@@ -0,0 +1,64 @@
+-- mutation_idempotency — server-authoritative idempotency for admin-skill mutations
+--
+-- See docs/plans/2026-04-22-004-feat-thinkwork-admin-skill-plan.md (Unit 4).
+-- Lets the thinkwork-admin Python skill retry a mutation with the same
+-- idempotency_key and receive the original result without re-executing.
+-- Protects the stamp-out-an-enterprise recipe from spawning duplicate
+-- rows on transient failures + replays.
+--
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0020_mutation_idempotency.sql
+--
+-- Drift detection:
+--   pnpm db:migrate-manual
+--
+-- Pre-migration invariant: no existing table named mutation_idempotency.
+--   SELECT to_regclass('public.mutation_idempotency'); must return NULL.
+--
+-- Divergence from skill_runs: mutation_idempotency uses a FULL unique index
+-- (not partial-on-status='running') because a succeeded mutation's key
+-- MUST block a duplicate retry and return the stored result. skill_runs
+-- can use a partial index because a failed composition is safe to re-run.
+-- Full index also sidesteps the ON-CONFLICT-on-partial-index gotcha noted
+-- at startSkillRun.mutation.ts:127-129.
+--
+-- creates: public.mutation_idempotency
+-- creates: public.uq_mutation_idempotency_key
+
+CREATE TABLE "mutation_idempotency" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	-- Plain uuid without FK to users — skill_runs.invoker_user_id follows
+	-- the same precedent. Service-auth callers may assert principalIds
+	-- whose users row is managed elsewhere; an FK here would foot-gun
+	-- that path without adding safety the row itself needs.
+	"invoker_user_id" uuid NOT NULL,
+	"mutation_name" text NOT NULL,
+	-- Client-supplied recipe-step key OR server-derived resolved_inputs_hash.
+	-- Unique per (tenant, invoker, mutation).
+	"idempotency_key" text NOT NULL,
+	-- SHA256 over canonicalized inputs, always server-computed. Kept for
+	-- audit/debug even when the client provided a distinct key.
+	"resolved_inputs_hash" text NOT NULL,
+	"status" text NOT NULL DEFAULT 'pending',
+	"result_json" jsonb,
+	"failure_reason" text,
+	"created_at" timestamp with time zone NOT NULL DEFAULT now(),
+	"completed_at" timestamp with time zone,
+	CONSTRAINT "status_allowed"
+		CHECK (status IN ('pending','succeeded','failed'))
+);
+--> statement-breakpoint
+
+ALTER TABLE "mutation_idempotency" ADD CONSTRAINT "mutation_idempotency_tenant_id_tenants_id_fk"
+	FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id")
+	ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+
+-- FULL unique index (deliberate divergence from skill_runs' partial index).
+CREATE UNIQUE INDEX "uq_mutation_idempotency_key" ON "mutation_idempotency"
+	USING btree ("tenant_id","invoker_user_id","mutation_name","idempotency_key");
+--> statement-breakpoint
+
+CREATE INDEX "idx_mutation_idempotency_tenant_created" ON "mutation_idempotency"
+	USING btree ("tenant_id","created_at");

package/dist/drizzle/0021_crm_work_links.sql

@@ -0,0 +1,76 @@
+-- CRM work links for Twenty-native launch/resume proof.
+-- creates: public.crm_work_links
+-- creates: public.uq_crm_work_links_active_outcome
+-- creates: public.idx_crm_work_links_thread
+-- creates: public.idx_crm_work_links_goal
+-- creates: public.idx_crm_work_links_provider_record
+-- creates-constraint: public.crm_work_links_provider_allowed
+-- creates-constraint: public.crm_work_links_object_type_allowed
+-- creates-constraint: public.crm_work_links_workflow_key_allowed
+-- creates-constraint: public.crm_work_links_state_allowed
+-- creates-constraint: public.crm_work_links_status_handle_state_allowed
+-- creates-constraint: public.crm_work_links_last_writeback_state_allowed
+
+CREATE TABLE IF NOT EXISTS public.crm_work_links (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  object_type text NOT NULL,
+  object_id text NOT NULL,
+  object_url text,
+  workflow_key text NOT NULL,
+  outcome_key text NOT NULL DEFAULT 'default',
+  space_id uuid REFERENCES public.spaces(id) ON DELETE SET NULL,
+  thread_id uuid REFERENCES public.threads(id) ON DELETE SET NULL,
+  goal_id uuid REFERENCES public.goals(id) ON DELETE SET NULL,
+  requester_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  last_writeback_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  plugin_install_id uuid REFERENCES public.plugin_installs(id) ON DELETE SET NULL,
+  mcp_server_id uuid REFERENCES public.tenant_mcp_servers(id) ON DELETE SET NULL,
+  state text NOT NULL DEFAULT 'active',
+  status_handle_state text NOT NULL DEFAULT 'pending',
+  status_handle_url text,
+  status_handle_action text,
+  last_writeback_state text NOT NULL DEFAULT 'pending',
+  failure_code text,
+  failure_message text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  started_at timestamptz NOT NULL DEFAULT now(),
+  last_resumed_at timestamptz,
+  deactivated_at timestamptz,
+  archived_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT crm_work_links_provider_allowed
+    CHECK (provider IN ('twenty')),
+  CONSTRAINT crm_work_links_object_type_allowed
+    CHECK (object_type IN ('opportunity')),
+  CONSTRAINT crm_work_links_workflow_key_allowed
+    CHECK (workflow_key IN ('customer_onboarding')),
+  CONSTRAINT crm_work_links_state_allowed
+    CHECK (state IN ('starting','active','completed','cancelled','failed','archived')),
+  CONSTRAINT crm_work_links_status_handle_state_allowed
+    CHECK (status_handle_state IN ('pending','posted','requires_reauth','writeback_blocked','failed')),
+  CONSTRAINT crm_work_links_last_writeback_state_allowed
+    CHECK (last_writeback_state IN ('pending','posted','requires_reauth','blocked','failed','skipped'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_crm_work_links_active_outcome
+  ON public.crm_work_links (
+    tenant_id,
+    provider,
+    object_type,
+    object_id,
+    workflow_key,
+    outcome_key
+  )
+  WHERE state IN ('starting','active');
+
+CREATE INDEX IF NOT EXISTS idx_crm_work_links_thread
+  ON public.crm_work_links (tenant_id, thread_id);
+
+CREATE INDEX IF NOT EXISTS idx_crm_work_links_goal
+  ON public.crm_work_links (tenant_id, goal_id);
+
+CREATE INDEX IF NOT EXISTS idx_crm_work_links_provider_record
+  ON public.crm_work_links (tenant_id, provider, object_type, object_id);

package/dist/drizzle/0021_skill_runs_completion_hmac.sql

@@ -0,0 +1,33 @@
+-- skill_runs.completion_hmac_secret — per-run secret for the
+-- /api/skills/complete callback.
+--
+-- See docs/plans/2026-04-22-005-feat-composable-skills-hardening-handoff-plan.md
+-- (PR #1, change 3). startSkillRunService generates a fresh secret at insert,
+-- stores it in this column, and ships it to the agentcore container inside
+-- the run_skill envelope. post_skill_run_complete computes
+-- HMAC-SHA256(secret, runId) and sends it as X-Skill-Run-Signature:
+-- sha256=<hex>. completeSkillRunService reads the secret from the row,
+-- timing-safe-compares, and NULLs the column on successful terminal
+-- transition (single-use). Missing-or-mismatched → 401.
+--
+-- The column is nullable because:
+--   * rows inserted before this migration have no secret,
+--   * burning the secret on completion requires setting it to NULL.
+-- A NULL secret at /api/skills/complete time is treated as "already
+-- completed" — repeat completion attempts get 401, which the Python
+-- retry path already treats as terminal (not retried).
+--
+-- Apply manually (matches 0018/0019/0020 convention):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0021_skill_runs_completion_hmac.sql
+--
+-- Drift detection:
+--   pnpm db:migrate-manual
+--
+-- Pre-migration invariants:
+--   - skill_runs exists (applied via 0018_skill_runs.sql).
+--   - skill_runs.completion_hmac_secret does not exist yet.
+--
+-- creates-column: public.skill_runs.completion_hmac_secret
+
+ALTER TABLE "skill_runs"
+	ADD COLUMN IF NOT EXISTS "completion_hmac_secret" text;

package/dist/drizzle/0022_add_billing_tables.sql

@@ -0,0 +1,70 @@
+-- Stripe billing tables + pending_owner_email column on tenants.
+--
+-- Paired with packages/database-pg/drizzle/0022_stripe_billing_indexes.sql,
+-- which adds the partial unique index on tenants.pending_owner_email and the
+-- single-active-subscription-per-tenant partial unique index on
+-- stripe_subscriptions.
+--
+-- See docs/plans/2026-04-22-008-feat-stripe-pricing-and-post-checkout-onboarding-plan.md
+-- (Unit 3).
+--
+-- Apply manually (matches 0018/0019/0020/0021 convention):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0022_add_billing_tables.sql
+--
+-- Drift detection:
+--   pnpm db:migrate-manual
+--
+-- creates-column: public.tenants.pending_owner_email
+-- creates: public.stripe_customers
+-- creates: public.stripe_subscriptions
+-- creates: public.stripe_events
+-- creates: public.stripe_customers_stripe_customer_id_uidx
+-- creates: public.stripe_subscriptions_stripe_subscription_id_uidx
+
+ALTER TABLE "tenants" ADD COLUMN "pending_owner_email" text;
+
+CREATE TABLE "stripe_customers" (
+	"tenant_id" uuid PRIMARY KEY NOT NULL,
+	"stripe_customer_id" text NOT NULL,
+	"email" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE "stripe_subscriptions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL,
+	"stripe_subscription_id" text NOT NULL,
+	"stripe_price_id" text NOT NULL,
+	"status" text NOT NULL,
+	"current_period_end" timestamp with time zone,
+	"cancel_at_period_end" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE "stripe_events" (
+	"stripe_event_id" text PRIMARY KEY NOT NULL,
+	"event_type" text NOT NULL,
+	"processed_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+DO $$ BEGIN
+ ALTER TABLE "stripe_customers" ADD CONSTRAINT "stripe_customers_tenant_id_tenants_id_fk"
+   FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+
+DO $$ BEGIN
+ ALTER TABLE "stripe_subscriptions" ADD CONSTRAINT "stripe_subscriptions_tenant_id_tenants_id_fk"
+   FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "stripe_customers_stripe_customer_id_uidx"
+  ON "stripe_customers" ("stripe_customer_id");
+
+CREATE UNIQUE INDEX IF NOT EXISTS "stripe_subscriptions_stripe_subscription_id_uidx"
+  ON "stripe_subscriptions" ("stripe_subscription_id");

package/dist/drizzle/0022_seed_thinkwork_admin_permissions.sql

@@ -0,0 +1,160 @@
+-- Unit 4 (R13/R14) — Seed `thinkwork-admin` permissions.operations on
+-- every existing agent_templates row whose skills list includes the
+-- skill but hasn't yet authored an operations allowlist.
+--
+-- See docs/plans/2026-04-22-008-feat-agent-skill-permissions-ui-plan.md
+-- (Unit 4). The thinkwork-admin skill's authz middle layer requires
+-- `agent_skills.permissions.operations` to be populated before any op
+-- call succeeds (see packages/api/src/graphql/resolvers/core/authz.ts,
+-- `requireAgentAllowsOperation`). Agents inherit from the template
+-- when their own permissions is null — so seeding the template is
+-- sufficient to unblock every existing agent that carries the skill.
+--
+-- The 29 ops below are the `default_enabled: true` entries in
+-- packages/skill-catalog/thinkwork-admin/skill.yaml as of this
+-- migration. Destructive opt-ins (remove_tenant_member,
+-- remove_team_agent, remove_team_user, sync_template_to_all_agents)
+-- are NOT seeded — operators opt into them deliberately via the UI
+-- landing in Phase 4.
+--
+-- If the manifest's default_enabled set changes after this ships, a
+-- new migration (not an edit of this one) adds or removes the ops
+-- for existing templates. This file is frozen.
+--
+-- Apply manually (matches the 0019/0020 convention):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0022_seed_thinkwork_admin_permissions.sql
+--
+-- Drift detection:
+--   bash scripts/db-migrate-manual.sh
+--
+-- Pre-migration invariants:
+--   - agent_templates exists with a jsonb `skills` column.
+--   - skill_catalog exists and has a row for slug='thinkwork-admin'.
+--
+-- Idempotency: the UPDATE only rewrites jsonb array elements whose
+-- `permissions` is NULL, an empty object, or missing the `operations`
+-- key. Running the file twice is a no-op. Operators who pre-authored
+-- permissions via direct SQL retain their choices.
+--
+-- creates: public.view_thinkwork_admin_permissions_seeded
+--
+-- Sentinel view below is the drift-reporter anchor. It expresses the
+-- post-migration invariant so db-migrate-manual.sh has something
+-- concrete to check in CI — this is otherwise a pure-data migration
+-- with no schema object.
+
+-- Pre-flight: refuse to run against a DB that's missing the target
+-- tables. Fail loudly rather than silently doing nothing.
+DO $$
+BEGIN
+  IF to_regclass('public.agent_templates') IS NULL THEN
+    RAISE EXCEPTION 'agent_templates not found; apply earlier migrations first';
+  END IF;
+END $$;
+
+-- ---------------------------------------------------------------------------
+-- Seed thinkwork-admin permissions.operations on every template that
+-- lists the skill.
+--
+-- Strategy: for each agent_templates row, rebuild `skills` by mapping
+-- over the array. For entries where skill_id='thinkwork-admin' and
+-- permissions is missing/empty/lacks-operations, stitch in the default
+-- ops. All other entries pass through untouched.
+-- ---------------------------------------------------------------------------
+
+UPDATE agent_templates AS t
+SET skills = sub.new_skills
+FROM (
+  SELECT
+    id,
+    (
+      SELECT jsonb_agg(
+        CASE
+          WHEN (elem->>'skill_id') = 'thinkwork-admin'
+            AND (
+              NOT (elem ? 'permissions')
+              OR elem->'permissions' IS NULL
+              OR jsonb_typeof(elem->'permissions') = 'null'
+              OR elem->'permissions' = '{}'::jsonb
+              OR NOT (elem->'permissions' ? 'operations')
+            )
+          THEN jsonb_set(
+            elem,
+            '{permissions}',
+            jsonb_build_object(
+              'operations',
+              jsonb_build_array(
+                'me',
+                'get_tenant',
+                'get_tenant_by_slug',
+                'get_user',
+                'list_tenant_members',
+                'list_agents',
+                'get_agent',
+                'list_all_tenant_agents',
+                'list_templates',
+                'get_template',
+                'list_linked_agents_for_template',
+                'list_teams',
+                'get_team',
+                'list_artifacts',
+                'get_artifact',
+                'update_tenant',
+                'add_tenant_member',
+                'update_tenant_member',
+                'invite_member',
+                'create_team',
+                'add_team_agent',
+                'add_team_user',
+                'create_agent',
+                'set_agent_skills',
+                'set_agent_capabilities',
+                'create_agent_template',
+                'create_agent_from_template',
+                'sync_template_to_agent',
+                'accept_template_update'
+              )
+            )
+          )
+          ELSE elem
+        END
+        ORDER BY ordinality
+      )
+      FROM jsonb_array_elements(t.skills) WITH ORDINALITY AS arr(elem, ordinality)
+    ) AS new_skills
+  FROM agent_templates AS t
+  WHERE jsonb_typeof(t.skills) = 'array'
+    AND t.skills @> '[{"skill_id": "thinkwork-admin"}]'::jsonb
+) AS sub
+WHERE t.id = sub.id
+  AND sub.new_skills IS NOT NULL
+  AND sub.new_skills IS DISTINCT FROM t.skills;
+
+-- ---------------------------------------------------------------------------
+-- Drift-reporter sentinel.
+--
+-- A trivial view asserting the post-migration invariant: every template
+-- referencing thinkwork-admin has a non-null permissions.operations
+-- array for that skill. Reporter gates on the view's existence, which
+-- proves the migration ran. The view itself is cheap (no rows unless
+-- there's a drift) and expresses intent in SQL rather than prose.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE VIEW public.view_thinkwork_admin_permissions_seeded AS
+SELECT
+  t.id AS template_id,
+  t.tenant_id,
+  t.slug
+FROM agent_templates t,
+     jsonb_array_elements(t.skills) AS s
+WHERE (s->>'skill_id') = 'thinkwork-admin'
+  AND (
+    NOT (s ? 'permissions')
+    OR s->'permissions' IS NULL
+    OR jsonb_typeof(s->'permissions') = 'null'
+    OR NOT (s->'permissions' ? 'operations')
+  );
+
+COMMENT ON VIEW public.view_thinkwork_admin_permissions_seeded IS
+  'Unit 4 invariant check — rows here indicate a thinkwork-admin template '
+  'assignment missing permissions.operations. Expected to be empty post-seed.';