thinkwork-cli 0.12.12 → 0.12.15

package/dist/drizzle/0182_agent_loops.sql

@@ -0,0 +1,260 @@
+-- AgentLoop foundation schema.
+-- Plan: docs/plans/2026-06-22-001-feat-agent-loop-foundation-plan.md (U1).
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0182_agent_loops.sql
+--
+-- Pre-flight:
+--   SELECT to_regclass('public.tenants') AS tenants;
+--   SELECT to_regclass('public.users') AS users;
+--   SELECT to_regclass('public.agents') AS agents;
+--   SELECT to_regclass('public.scheduled_jobs') AS scheduled_jobs;
+--
+-- creates: public.agent_loops
+-- creates: public.agent_loop_versions
+-- creates: public.agent_loop_runs
+-- creates: public.agent_loop_iterations
+-- creates: public.agent_loop_judgments
+-- creates: public.agent_loop_evidence
+-- creates: public.agent_loops_tenant_slug_uidx
+-- creates: public.agent_loops_tenant_lifecycle_idx
+-- creates: public.agent_loops_tenant_enabled_idx
+-- creates: public.agent_loops_tenant_last_run_idx
+-- creates: public.agent_loop_versions_loop_version_uidx
+-- creates: public.agent_loop_versions_tenant_loop_idx
+-- creates: public.agent_loop_runs_tenant_status_idx
+-- creates: public.agent_loop_runs_loop_created_idx
+-- creates: public.agent_loop_runs_tenant_correlation_idx
+-- creates: public.agent_loop_runs_tenant_idempotency_uidx
+-- creates: public.agent_loop_iterations_run_number_uidx
+-- creates: public.agent_loop_iterations_tenant_status_idx
+-- creates: public.agent_loop_iterations_wakeup_idx
+-- creates: public.agent_loop_iterations_thread_turn_idx
+-- creates: public.agent_loop_judgments_run_idx
+-- creates: public.agent_loop_judgments_iteration_idx
+-- creates: public.agent_loop_judgments_tenant_outcome_idx
+-- creates: public.agent_loop_evidence_run_idx
+-- creates: public.agent_loop_evidence_loop_idx
+-- creates: public.agent_loop_evidence_iteration_idx
+-- creates: public.agent_loop_evidence_source_idx
+-- creates: public.idx_scheduled_jobs_agent_loop
+-- creates-column: public.scheduled_jobs.agent_loop_id
+-- creates-constraint: public.agent_loops.agent_loops_lifecycle_status_check
+-- creates-constraint: public.agent_loops.agent_loops_trigger_family_check
+-- creates-constraint: public.agent_loop_versions.agent_loop_versions_status_check
+-- creates-constraint: public.agent_loop_runs.agent_loop_runs_status_check
+-- creates-constraint: public.agent_loop_runs.agent_loop_runs_trigger_family_check
+-- creates-constraint: public.agent_loop_iterations.agent_loop_iterations_status_check
+-- creates-constraint: public.agent_loop_judgments.agent_loop_judgments_mode_check
+-- creates-constraint: public.agent_loop_judgments.agent_loop_judgments_outcome_check
+-- creates-constraint: public.agent_loop_evidence.agent_loop_evidence_redaction_state_check
+
+DO $$
+BEGIN
+  IF to_regclass('public.tenants') IS NULL THEN
+    RAISE EXCEPTION 'tenants not found; apply core tenant migrations first';
+  END IF;
+  IF to_regclass('public.users') IS NULL THEN
+    RAISE EXCEPTION 'users not found; apply core user migrations first';
+  END IF;
+  IF to_regclass('public.agents') IS NULL THEN
+    RAISE EXCEPTION 'agents not found; apply agent migrations first';
+  END IF;
+  IF to_regclass('public.scheduled_jobs') IS NULL THEN
+    RAISE EXCEPTION 'scheduled_jobs not found; apply scheduled job migrations first';
+  END IF;
+  IF to_regclass('public.agent_wakeup_requests') IS NULL THEN
+    RAISE EXCEPTION 'agent_wakeup_requests not found; apply wakeup queue migrations first';
+  END IF;
+  IF to_regclass('public.thread_turns') IS NULL THEN
+    RAISE EXCEPTION 'thread_turns not found; apply scheduled job execution migrations first';
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS public.agent_loops (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  slug text NOT NULL,
+  description text,
+  lifecycle_status text NOT NULL DEFAULT 'draft',
+  enabled boolean NOT NULL DEFAULT true,
+  owner_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  owner_agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  primary_trigger_family text NOT NULL DEFAULT 'manual',
+  current_version_id uuid,
+  current_version_number integer,
+  last_run_id uuid,
+  last_run_status text,
+  last_run_at timestamp with time zone,
+  last_run_summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  accepted_run_count integer NOT NULL DEFAULT 0,
+  rejected_run_count integer NOT NULL DEFAULT 0,
+  escalated_run_count integer NOT NULL DEFAULT 0,
+  total_cost_usd_cents bigint NOT NULL DEFAULT 0,
+  cost_per_accepted_run_usd_cents bigint,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loops_lifecycle_status_check CHECK (lifecycle_status IN ('draft', 'active', 'paused', 'archived')),
+  CONSTRAINT agent_loops_trigger_family_check CHECK (primary_trigger_family IN ('manual', 'schedule', 'api', 'webhook', 'app_event', 'n8n'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS agent_loops_tenant_slug_uidx
+  ON public.agent_loops (tenant_id, slug);
+CREATE INDEX IF NOT EXISTS agent_loops_tenant_lifecycle_idx
+  ON public.agent_loops (tenant_id, lifecycle_status);
+CREATE INDEX IF NOT EXISTS agent_loops_tenant_enabled_idx
+  ON public.agent_loops (tenant_id, enabled);
+CREATE INDEX IF NOT EXISTS agent_loops_tenant_last_run_idx
+  ON public.agent_loops (tenant_id, last_run_at);
+
+CREATE TABLE IF NOT EXISTS public.agent_loop_versions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  agent_loop_id uuid NOT NULL REFERENCES public.agent_loops(id) ON DELETE CASCADE,
+  version_number integer NOT NULL,
+  version_status text NOT NULL DEFAULT 'draft',
+  trigger_spec jsonb NOT NULL,
+  goal_spec jsonb NOT NULL,
+  worker_spec jsonb NOT NULL,
+  judge_spec jsonb NOT NULL,
+  loop_policy jsonb NOT NULL,
+  evidence_policy jsonb NOT NULL DEFAULT '{"redactionState":"summary_only","retainRawEvidence":false}'::jsonb,
+  source_metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by_actor_type text,
+  created_by_actor_id uuid,
+  published_at timestamp with time zone,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loop_versions_status_check CHECK (version_status IN ('draft', 'active', 'superseded', 'archived'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS agent_loop_versions_loop_version_uidx
+  ON public.agent_loop_versions (agent_loop_id, version_number);
+CREATE INDEX IF NOT EXISTS agent_loop_versions_tenant_loop_idx
+  ON public.agent_loop_versions (tenant_id, agent_loop_id);
+
+CREATE TABLE IF NOT EXISTS public.agent_loop_runs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  agent_loop_id uuid NOT NULL REFERENCES public.agent_loops(id) ON DELETE CASCADE,
+  agent_loop_version_id uuid REFERENCES public.agent_loop_versions(id) ON DELETE SET NULL,
+  status text NOT NULL DEFAULT 'queued',
+  trigger_family text NOT NULL,
+  trigger_source text,
+  scheduled_job_id uuid,
+  actor_type text,
+  actor_id uuid,
+  idempotency_key text,
+  correlation_id text,
+  current_iteration integer NOT NULL DEFAULT 0,
+  terminal_reason text,
+  policy_snapshot jsonb NOT NULL DEFAULT '{}'::jsonb,
+  input_summary jsonb,
+  output_summary jsonb,
+  started_at timestamp with time zone,
+  finished_at timestamp with time zone,
+  last_event_at timestamp with time zone,
+  error_code text,
+  error_message text,
+  total_cost_usd_cents bigint,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loop_runs_status_check CHECK (status IN ('queued', 'running', 'waiting_for_human', 'completed', 'failed', 'budget_stopped', 'escalated', 'canceled', 'skipped')),
+  CONSTRAINT agent_loop_runs_trigger_family_check CHECK (trigger_family IN ('manual', 'schedule', 'api', 'webhook', 'app_event', 'n8n'))
+);
+
+CREATE INDEX IF NOT EXISTS agent_loop_runs_tenant_status_idx
+  ON public.agent_loop_runs (tenant_id, status);
+CREATE INDEX IF NOT EXISTS agent_loop_runs_loop_created_idx
+  ON public.agent_loop_runs (agent_loop_id, created_at);
+CREATE INDEX IF NOT EXISTS agent_loop_runs_tenant_correlation_idx
+  ON public.agent_loop_runs (tenant_id, correlation_id);
+CREATE UNIQUE INDEX IF NOT EXISTS agent_loop_runs_tenant_idempotency_uidx
+  ON public.agent_loop_runs (tenant_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS public.agent_loop_iterations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  agent_loop_run_id uuid NOT NULL REFERENCES public.agent_loop_runs(id) ON DELETE CASCADE,
+  iteration_number integer NOT NULL,
+  status text NOT NULL DEFAULT 'queued',
+  goal_mode_action text,
+  agent_wakeup_request_id uuid REFERENCES public.agent_wakeup_requests(id) ON DELETE SET NULL,
+  thread_turn_id uuid REFERENCES public.thread_turns(id) ON DELETE SET NULL,
+  input_summary jsonb,
+  output_summary jsonb,
+  started_at timestamp with time zone,
+  finished_at timestamp with time zone,
+  error_code text,
+  error_message text,
+  total_cost_usd_cents bigint,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loop_iterations_status_check CHECK (status IN ('queued', 'running', 'completed', 'failed', 'budget_stopped', 'waiting_for_human', 'canceled'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS agent_loop_iterations_run_number_uidx
+  ON public.agent_loop_iterations (agent_loop_run_id, iteration_number);
+CREATE INDEX IF NOT EXISTS agent_loop_iterations_tenant_status_idx
+  ON public.agent_loop_iterations (tenant_id, status);
+CREATE INDEX IF NOT EXISTS agent_loop_iterations_wakeup_idx
+  ON public.agent_loop_iterations (agent_wakeup_request_id);
+CREATE INDEX IF NOT EXISTS agent_loop_iterations_thread_turn_idx
+  ON public.agent_loop_iterations (thread_turn_id);
+
+CREATE TABLE IF NOT EXISTS public.agent_loop_judgments (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  agent_loop_run_id uuid NOT NULL REFERENCES public.agent_loop_runs(id) ON DELETE CASCADE,
+  agent_loop_iteration_id uuid REFERENCES public.agent_loop_iterations(id) ON DELETE CASCADE,
+  judge_mode text NOT NULL,
+  outcome text NOT NULL,
+  confidence integer,
+  rationale text,
+  terminal_reason text,
+  structured_output jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loop_judgments_mode_check CHECK (judge_mode IN ('self_check', 'human_approval', 'model_judge', 'reviewer_agent', 'eval_threshold', 'external_callback')),
+  CONSTRAINT agent_loop_judgments_outcome_check CHECK (outcome IN ('complete', 'continue', 'failed', 'budget_stopped', 'needs_human_approval', 'escalated'))
+);
+
+CREATE INDEX IF NOT EXISTS agent_loop_judgments_run_idx
+  ON public.agent_loop_judgments (agent_loop_run_id);
+CREATE INDEX IF NOT EXISTS agent_loop_judgments_iteration_idx
+  ON public.agent_loop_judgments (agent_loop_iteration_id);
+CREATE INDEX IF NOT EXISTS agent_loop_judgments_tenant_outcome_idx
+  ON public.agent_loop_judgments (tenant_id, outcome);
+
+CREATE TABLE IF NOT EXISTS public.agent_loop_evidence (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  agent_loop_id uuid NOT NULL REFERENCES public.agent_loops(id) ON DELETE CASCADE,
+  agent_loop_run_id uuid REFERENCES public.agent_loop_runs(id) ON DELETE CASCADE,
+  agent_loop_iteration_id uuid REFERENCES public.agent_loop_iterations(id) ON DELETE SET NULL,
+  agent_loop_judgment_id bigint REFERENCES public.agent_loop_judgments(id) ON DELETE SET NULL,
+  evidence_type text NOT NULL,
+  source_system text NOT NULL,
+  source_id text,
+  uri text,
+  summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  redaction_state text NOT NULL DEFAULT 'summary_only',
+  sensitivity text,
+  retention_expires_at timestamp with time zone,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT agent_loop_evidence_redaction_state_check CHECK (redaction_state IN ('summary_only', 'redacted', 'offloaded', 'raw_allowed'))
+);
+
+CREATE INDEX IF NOT EXISTS agent_loop_evidence_run_idx
+  ON public.agent_loop_evidence (agent_loop_run_id);
+CREATE INDEX IF NOT EXISTS agent_loop_evidence_loop_idx
+  ON public.agent_loop_evidence (agent_loop_id);
+CREATE INDEX IF NOT EXISTS agent_loop_evidence_iteration_idx
+  ON public.agent_loop_evidence (agent_loop_iteration_id);
+CREATE INDEX IF NOT EXISTS agent_loop_evidence_source_idx
+  ON public.agent_loop_evidence (tenant_id, source_system, source_id);
+
+ALTER TABLE public.scheduled_jobs
+  ADD COLUMN IF NOT EXISTS agent_loop_id uuid;
+
+CREATE INDEX IF NOT EXISTS idx_scheduled_jobs_agent_loop
+  ON public.scheduled_jobs (agent_loop_id);

package/dist/drizzle/0183_okf_artifact_manifests.sql

@@ -0,0 +1,52 @@
+-- Purpose: widen brain.artifact_manifests so OKF bundle versions and current
+--   manifest pointers can be recorded as generated projection evidence.
+-- Plan: docs/plans/2026-06-22-002-feat-okf-wiki-navigator-plan.md U1
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0183_okf_artifact_manifests.sql
+-- Pre-flight:
+--   SELECT to_regclass('brain.artifact_manifests');
+-- creates-constraint: brain.artifact_manifests.brain_artifact_manifests_kind_allowed
+-- creates-constraint: brain.artifact_manifests.brain_artifact_manifests_source_kind_allowed
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+DO $$
+BEGIN
+  IF to_regclass('brain.artifact_manifests') IS NULL THEN
+    RAISE EXCEPTION 'brain.artifact_manifests not found; apply Company Brain artifact manifest migrations first';
+  END IF;
+END $$;
+
+SELECT pg_advisory_lock(hashtext('migration:0183_okf_artifact_manifests'));
+
+ALTER TABLE brain.artifact_manifests
+  DROP CONSTRAINT IF EXISTS brain_artifact_manifests_kind_allowed;
+
+ALTER TABLE brain.artifact_manifests
+  ADD CONSTRAINT brain_artifact_manifests_kind_allowed
+  CHECK (
+    manifest_kind IN (
+      'source_artifact',
+      'ingestion_manifest',
+      'migration_snapshot',
+      'vault_projection',
+      'export',
+      'okf_bundle',
+      'okf_current_manifest'
+    )
+  );
+
+ALTER TABLE brain.artifact_manifests
+  DROP CONSTRAINT IF EXISTS brain_artifact_manifests_source_kind_allowed;
+
+ALTER TABLE brain.artifact_manifests
+  ADD CONSTRAINT brain_artifact_manifests_source_kind_allowed
+  CHECK (
+    source_kind IS NULL
+    OR source_kind IN ('thread', 'wiki', 'brain', 'observations', 'okf')
+  );
+
+SELECT pg_advisory_unlock(hashtext('migration:0183_okf_artifact_manifests'));

package/dist/drizzle/0184_skill_catalog_trust_cache.sql

@@ -0,0 +1,35 @@
+-- Purpose: cache the latest skill trust report on the per-tenant S3 catalog
+--   index so the Skill Detail trust sheet can render the last report without
+--   rerunning SkillSpector on every open.
+-- Apply manually:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0184_skill_catalog_trust_cache.sql
+-- Pre-flight:
+--   SELECT to_regclass('public.skill_catalog');
+-- creates-column: public.skill_catalog.trust_report
+-- creates-column: public.skill_catalog.trust_report_content_sha
+-- creates-column: public.skill_catalog.trust_report_pipeline_version
+-- creates-column: public.skill_catalog.trust_report_updated_at
+-- creates-column: public.skill_catalog.signature_status
+-- creates-column: public.skill_catalog.signature_payload
+-- creates-column: public.skill_catalog.signed_content_sha
+-- creates-column: public.skill_catalog.signed_payload_hash
+-- creates-column: public.skill_catalog.signed_at
+-- creates-column: public.skill_catalog.signed_by_user_id
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('migration:0184_skill_catalog_trust_cache'));
+
+ALTER TABLE public.skill_catalog
+  ADD COLUMN IF NOT EXISTS trust_report jsonb,
+  ADD COLUMN IF NOT EXISTS trust_report_content_sha text,
+  ADD COLUMN IF NOT EXISTS trust_report_pipeline_version text,
+  ADD COLUMN IF NOT EXISTS trust_report_updated_at timestamptz,
+  ADD COLUMN IF NOT EXISTS signature_status text,
+  ADD COLUMN IF NOT EXISTS signature_payload jsonb,
+  ADD COLUMN IF NOT EXISTS signed_content_sha text,
+  ADD COLUMN IF NOT EXISTS signed_payload_hash text,
+  ADD COLUMN IF NOT EXISTS signed_at timestamptz,
+  ADD COLUMN IF NOT EXISTS signed_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL;
+
+COMMIT;

package/dist/drizzle/0185_agent_loop_space.sql

@@ -0,0 +1,16 @@
+-- 0185_agent_loop_space.sql
+--
+-- Adds the explicit Space an Automation/AgentLoop should run in. Existing
+-- loops keep falling back to the default Agent space until configured.
+--
+-- Manual application:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0185_agent_loop_space.sql
+--
+-- creates-column: public.agent_loops.space_id
+-- creates: public.agent_loops_tenant_space_idx
+
+ALTER TABLE public.agent_loops
+  ADD COLUMN IF NOT EXISTS space_id uuid REFERENCES public.spaces(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS agent_loops_tenant_space_idx
+  ON public.agent_loops (tenant_id, space_id);

package/dist/drizzle/0186_tenant_mcp_runtime_metadata.sql

@@ -0,0 +1,10 @@
+-- Purpose: Store non-secret runtime metadata for MCP dispatch without mixing
+--          plugin-provided link hints into auth_config or approval hashes.
+--
+-- creates-column: public.tenant_mcp_servers.runtime_metadata
+
+ALTER TABLE public.tenant_mcp_servers
+  ADD COLUMN IF NOT EXISTS runtime_metadata jsonb;
+
+COMMENT ON COLUMN public.tenant_mcp_servers.runtime_metadata IS
+  'Non-secret runtime metadata for MCP dispatch, such as plugin record-link hints.';

package/dist/drizzle/0187_native_work_items.sql

@@ -0,0 +1,220 @@
+-- 0187_native_work_items.sql
+--
+-- Purpose: create the native Work Item substrate for ThinkWork-owned task state.
+-- Plan: THNK-69 Native work item tracking capability.
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0187_native_work_items.sql
+--
+-- creates: public.work_item_statuses
+-- creates: public.work_items
+-- creates: public.work_item_thread_links
+-- creates: public.work_item_events
+-- creates: public.work_item_saved_views
+-- creates: public.work_item_external_refs
+-- creates: public.uq_work_item_statuses_space_name
+-- creates: public.uq_work_item_statuses_space_default
+-- creates: public.idx_work_item_statuses_space_order
+-- creates: public.idx_work_items_space_status
+-- creates: public.idx_work_items_space_due
+-- creates: public.idx_work_items_owner_user
+-- creates: public.idx_work_items_owner_agent
+-- creates: public.idx_work_items_template_source
+-- creates: public.uq_work_item_thread_links_pair
+-- creates: public.idx_work_item_thread_links_thread
+-- creates: public.idx_work_item_thread_links_space
+-- creates: public.idx_work_item_events_item_created
+-- creates: public.idx_work_item_events_thread
+-- creates: public.uq_work_item_saved_views_user_name
+-- creates: public.uq_work_item_saved_views_user_default
+-- creates: public.idx_work_item_saved_views_user
+-- creates: public.idx_work_item_saved_views_space
+-- creates: public.uq_work_item_external_refs_provider
+-- creates: public.idx_work_item_external_refs_item
+-- creates-constraint: public.work_item_statuses.work_item_statuses_category_allowed
+-- creates-constraint: public.work_items.work_items_priority_allowed
+-- creates-constraint: public.work_item_thread_links.work_item_thread_links_relationship_allowed
+-- creates-constraint: public.work_item_events.work_item_events_type_allowed
+-- creates-constraint: public.work_item_saved_views.work_item_saved_views_type_allowed
+-- creates-constraint: public.work_item_saved_views.work_item_saved_views_owner_required
+-- creates-constraint: public.work_item_external_refs.work_item_external_refs_provider_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS public.work_item_statuses (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  description text,
+  color text,
+  icon text,
+  category text NOT NULL DEFAULT 'todo',
+  is_active boolean NOT NULL DEFAULT true,
+  is_final boolean NOT NULL DEFAULT false,
+  is_default boolean NOT NULL DEFAULT false,
+  display_order integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT work_item_statuses_category_allowed
+    CHECK (category IN ('todo', 'active', 'blocked', 'done', 'skipped'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_statuses_space_name
+  ON public.work_item_statuses (tenant_id, space_id, name);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_statuses_space_default
+  ON public.work_item_statuses (tenant_id, space_id)
+  WHERE is_default = true;
+
+CREATE INDEX IF NOT EXISTS idx_work_item_statuses_space_order
+  ON public.work_item_statuses (tenant_id, space_id, display_order);
+
+CREATE TABLE IF NOT EXISTS public.work_items (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  status_id uuid REFERENCES public.work_item_statuses(id) ON DELETE RESTRICT,
+  title text NOT NULL,
+  notes text,
+  priority text NOT NULL DEFAULT 'normal',
+  owner_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  owner_agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  due_at timestamptz,
+  required boolean NOT NULL DEFAULT true,
+  applicable boolean NOT NULL DEFAULT true,
+  blocked boolean NOT NULL DEFAULT false,
+  completed_at timestamptz,
+  completed_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  completed_by_agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  created_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  created_by_agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  template_source_id uuid REFERENCES public.space_checklist_items(id) ON DELETE SET NULL,
+  metadata jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  archived_at timestamptz,
+  CONSTRAINT work_items_priority_allowed
+    CHECK (priority IN ('low', 'normal', 'high', 'urgent'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_items_space_status
+  ON public.work_items (tenant_id, space_id, status_id);
+
+CREATE INDEX IF NOT EXISTS idx_work_items_space_due
+  ON public.work_items (tenant_id, space_id, due_at);
+
+CREATE INDEX IF NOT EXISTS idx_work_items_owner_user
+  ON public.work_items (tenant_id, owner_user_id, archived_at);
+
+CREATE INDEX IF NOT EXISTS idx_work_items_owner_agent
+  ON public.work_items (tenant_id, owner_agent_id, archived_at);
+
+CREATE INDEX IF NOT EXISTS idx_work_items_template_source
+  ON public.work_items (tenant_id, template_source_id);
+
+CREATE TABLE IF NOT EXISTS public.work_item_thread_links (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  work_item_id uuid NOT NULL REFERENCES public.work_items(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  relationship text NOT NULL DEFAULT 'primary',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT work_item_thread_links_relationship_allowed
+    CHECK (relationship IN ('primary', 'mentioned', 'evidence', 'follow_up'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_thread_links_pair
+  ON public.work_item_thread_links (tenant_id, work_item_id, thread_id);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_thread_links_thread
+  ON public.work_item_thread_links (tenant_id, thread_id);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_thread_links_space
+  ON public.work_item_thread_links (tenant_id, space_id);
+
+CREATE TABLE IF NOT EXISTS public.work_item_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
+  work_item_id uuid NOT NULL REFERENCES public.work_items(id) ON DELETE CASCADE,
+  thread_id uuid REFERENCES public.threads(id) ON DELETE SET NULL,
+  actor_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  actor_agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  previous_status_id uuid REFERENCES public.work_item_statuses(id) ON DELETE SET NULL,
+  new_status_id uuid REFERENCES public.work_item_statuses(id) ON DELETE SET NULL,
+  message text,
+  metadata jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT work_item_events_type_allowed
+    CHECK (event_type IN ('created', 'updated', 'status_changed', 'completed', 'blocked', 'unblocked', 'assigned', 'due_date_changed', 'applicability_changed', 'linked_thread', 'agent_action'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_events_item_created
+  ON public.work_item_events (tenant_id, work_item_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_events_thread
+  ON public.work_item_events (tenant_id, thread_id);
+
+CREATE TABLE IF NOT EXISTS public.work_item_saved_views (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id uuid REFERENCES public.users(id) ON DELETE CASCADE,
+  space_id uuid REFERENCES public.spaces(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  view_type text NOT NULL DEFAULT 'list',
+  filters jsonb,
+  grouping jsonb,
+  sorting jsonb,
+  view_config jsonb,
+  is_private boolean NOT NULL DEFAULT true,
+  is_default boolean NOT NULL DEFAULT false,
+  is_favorite boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT work_item_saved_views_type_allowed
+    CHECK (view_type IN ('list', 'board')),
+  CONSTRAINT work_item_saved_views_owner_required
+    CHECK (user_id IS NOT NULL OR is_private = false)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_saved_views_user_name
+  ON public.work_item_saved_views (tenant_id, user_id, name);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_saved_views_user_default
+  ON public.work_item_saved_views (tenant_id, user_id)
+  WHERE is_default = true;
+
+CREATE INDEX IF NOT EXISTS idx_work_item_saved_views_user
+  ON public.work_item_saved_views (tenant_id, user_id, is_favorite);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_saved_views_space
+  ON public.work_item_saved_views (tenant_id, space_id);
+
+CREATE TABLE IF NOT EXISTS public.work_item_external_refs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  work_item_id uuid NOT NULL REFERENCES public.work_items(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  external_id text NOT NULL,
+  external_url text,
+  metadata jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT work_item_external_refs_provider_allowed
+    CHECK (provider IN ('thinkwork', 'lastmile', 'linear', 'plane', 'twenty'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_work_item_external_refs_provider
+  ON public.work_item_external_refs (tenant_id, provider, external_id);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_external_refs_item
+  ON public.work_item_external_refs (tenant_id, work_item_id);
+
+COMMIT;