thinkwork-cli 0.12.12 → 0.12.16

package/dist/drizzle/0188_company_etl_plugin_rename.sql

@@ -0,0 +1,99 @@
+-- Rename persisted Data Integrations plugin keys to Company ETL.
+-- Plan: THNK-71 U3, Rename Data Integrations plugin to Company ETL.
+--
+-- Apply through deploy.yml before the GraphQL Lambda serving the renamed
+-- catalog is deployed:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction -f packages/database-pg/drizzle/0188_company_etl_plugin_rename.sql
+--
+-- Drift detection:
+--   bash scripts/db-migrate-manual.sh packages/database-pg/drizzle/0188_company_etl_plugin_rename.sql
+--
+-- Pre-flight:
+--   SELECT to_regclass('public.plugin_installs') AS plugin_installs;
+--   SELECT to_regclass('public.plugin_entitlements') AS plugin_entitlements;
+--   SELECT to_regclass('public.plugin_install_keys') AS plugin_install_keys;
+--
+-- creates: public.view_company_etl_plugin_rename_0188
+
+DO $$
+BEGIN
+  IF to_regclass('public.plugin_installs') IS NULL THEN
+    RAISE EXCEPTION 'plugin_installs not found; apply application plugin migrations first';
+  END IF;
+  IF to_regclass('public.plugin_entitlements') IS NULL THEN
+    RAISE EXCEPTION 'plugin_entitlements not found; apply premium plugin migrations first';
+  END IF;
+  IF to_regclass('public.plugin_install_keys') IS NULL THEN
+    RAISE EXCEPTION 'plugin_install_keys not found; apply premium plugin migrations first';
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM public.plugin_installs
+    WHERE plugin_key IN ('data-integrations', 'company-etl')
+    GROUP BY tenant_id
+    HAVING COUNT(DISTINCT plugin_key) = 2
+  ) THEN
+    RAISE EXCEPTION 'company-etl rename conflict: tenant has both data-integrations and company-etl plugin_installs rows';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM public.plugin_entitlements
+    WHERE plugin_key IN ('data-integrations', 'company-etl')
+      AND status = 'active'
+    GROUP BY tenant_id
+    HAVING COUNT(DISTINCT plugin_key) = 2
+  ) THEN
+    RAISE EXCEPTION 'company-etl rename conflict: tenant has both active data-integrations and company-etl plugin_entitlements rows';
+  END IF;
+END $$;
+
+UPDATE public.plugin_installs
+SET
+  plugin_key = 'company-etl',
+  pinned_payload_sha256 = '49681471c865d81257872da252538f84345f42b43299c27764fc2714bb2e8abf',
+  updated_at = now()
+WHERE plugin_key = 'data-integrations';
+
+UPDATE public.plugin_entitlements
+SET
+  plugin_key = 'company-etl',
+  entitlement_product_key = CASE
+    WHEN entitlement_product_key = 'data-integrations' THEN 'company-etl'
+    ELSE entitlement_product_key
+  END,
+  updated_at = now()
+WHERE plugin_key = 'data-integrations';
+
+UPDATE public.plugin_install_keys
+SET
+  plugin_key = 'company-etl',
+  entitlement_product_key = CASE
+    WHEN entitlement_product_key = 'data-integrations' THEN 'company-etl'
+    ELSE entitlement_product_key
+  END,
+  updated_at = now()
+WHERE plugin_key = 'data-integrations';
+
+CREATE OR REPLACE VIEW public.view_company_etl_plugin_rename_0188 AS
+SELECT
+  NOT EXISTS (
+    SELECT 1 FROM public.plugin_installs WHERE plugin_key = 'data-integrations'
+  ) AS plugin_installs_migrated,
+  NOT EXISTS (
+    SELECT 1 FROM public.plugin_entitlements WHERE plugin_key = 'data-integrations'
+  ) AS plugin_entitlements_migrated,
+  NOT EXISTS (
+    SELECT 1 FROM public.plugin_install_keys WHERE plugin_key = 'data-integrations'
+  ) AS plugin_install_keys_migrated,
+  NOT EXISTS (
+    SELECT 1
+    FROM public.plugin_installs
+    WHERE plugin_key = 'company-etl'
+      AND pinned_version = '0.1.0'
+      AND pinned_payload_sha256 <> '49681471c865d81257872da252538f84345f42b43299c27764fc2714bb2e8abf'
+  ) AS company_etl_pinned_payload_digest_current;

package/dist/drizzle/0189_trace_cost_substrate.sql

@@ -0,0 +1,247 @@
+-- Trusted trace and cost accounting substrate.
+-- Plan: docs/plans/2026-06-25-003-feat-trace-cost-substrate-plan.md (U1).
+--
+-- creates: public.trace_runs
+-- creates: public.trace_events
+-- creates: public.trace_source_evidence
+-- creates: public.trace_cost_reconciliation_facts
+-- creates: public.trace_runs_tenant_trace_uidx
+-- creates: public.trace_runs_thread_turn_idx
+-- creates: public.trace_runs_thread_idx
+-- creates: public.trace_runs_agent_created_idx
+-- creates: public.trace_events_run_observed_idx
+-- creates: public.trace_events_parent_idx
+-- creates: public.trace_events_request_idx
+-- creates: public.trace_events_turn_type_idx
+-- creates: public.trace_source_evidence_run_idx
+-- creates: public.trace_source_evidence_event_idx
+-- creates: public.trace_source_evidence_source_idx
+-- creates: public.trace_cost_recon_facts_cost_event_idx
+-- creates: public.trace_cost_recon_facts_trace_event_idx
+-- creates: public.trace_cost_recon_facts_state_idx
+-- creates: public.trace_cost_recon_facts_request_idx
+-- creates-column: public.cost_events.trace_event_id
+-- creates-column: public.cost_events.reconciliation_state
+-- creates-column: public.cost_events.reconciliation_source
+-- creates-column: public.cost_events.reconciliation_at
+-- creates-column: public.cost_events.source_evidence_ref
+
+DO $$
+BEGIN
+  IF to_regclass('public.tenants') IS NULL THEN
+    RAISE EXCEPTION 'tenants not found; apply core tenant migrations first';
+  END IF;
+  IF to_regclass('public.users') IS NULL THEN
+    RAISE EXCEPTION 'users not found; apply core user migrations first';
+  END IF;
+  IF to_regclass('public.agents') IS NULL THEN
+    RAISE EXCEPTION 'agents not found; apply agent migrations first';
+  END IF;
+  IF to_regclass('public.thread_turns') IS NULL THEN
+    RAISE EXCEPTION 'thread_turns not found; apply scheduled job execution migrations first';
+  END IF;
+  IF to_regclass('public.cost_events') IS NULL THEN
+    RAISE EXCEPTION 'cost_events not found; apply cost event migrations first';
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS public.trace_runs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  trace_id text NOT NULL,
+  thread_id uuid,
+  thread_turn_id uuid REFERENCES public.thread_turns(id) ON DELETE SET NULL,
+  agent_id uuid REFERENCES public.agents(id) ON DELETE SET NULL,
+  user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  runtime_type text,
+  runtime_session_id text,
+  status text NOT NULL DEFAULT 'open',
+  started_at timestamp with time zone,
+  finished_at timestamp with time zone,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS trace_runs_tenant_trace_uidx
+  ON public.trace_runs (tenant_id, trace_id);
+CREATE INDEX IF NOT EXISTS trace_runs_thread_turn_idx
+  ON public.trace_runs (thread_turn_id);
+CREATE INDEX IF NOT EXISTS trace_runs_thread_idx
+  ON public.trace_runs (tenant_id, thread_id);
+CREATE INDEX IF NOT EXISTS trace_runs_agent_created_idx
+  ON public.trace_runs (agent_id, created_at);
+
+CREATE TABLE IF NOT EXISTS public.trace_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  trace_run_id uuid NOT NULL REFERENCES public.trace_runs(id) ON DELETE CASCADE,
+  parent_event_id uuid REFERENCES public.trace_events(id) ON DELETE SET NULL,
+  thread_turn_id uuid REFERENCES public.thread_turns(id) ON DELETE SET NULL,
+  request_id text,
+  parent_request_id text,
+  event_type text NOT NULL,
+  event_status text,
+  observed_at timestamp with time zone NOT NULL DEFAULT now(),
+  duration_ms integer,
+  payload_summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  source_evidence_ref jsonb NOT NULL DEFAULT '{}'::jsonb,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT trace_events_type_check CHECK (
+    event_type IN (
+      'turn',
+      'runtime_phase',
+      'model_invocation',
+      'tool_invocation',
+      'memory_context_lookup',
+      'workspace_hydration',
+      'response_finalization',
+      'agent_profile_run',
+      'sub_agent_lane',
+      'cost_observation'
+    )
+  )
+);
+
+CREATE INDEX IF NOT EXISTS trace_events_run_observed_idx
+  ON public.trace_events (trace_run_id, observed_at);
+CREATE INDEX IF NOT EXISTS trace_events_parent_idx
+  ON public.trace_events (parent_event_id);
+CREATE INDEX IF NOT EXISTS trace_events_request_idx
+  ON public.trace_events (tenant_id, request_id);
+CREATE INDEX IF NOT EXISTS trace_events_turn_type_idx
+  ON public.trace_events (thread_turn_id, event_type);
+
+CREATE TABLE IF NOT EXISTS public.trace_source_evidence (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  trace_run_id uuid REFERENCES public.trace_runs(id) ON DELETE CASCADE,
+  trace_event_id uuid REFERENCES public.trace_events(id) ON DELETE CASCADE,
+  source_type text NOT NULL,
+  source_system text NOT NULL,
+  source_id text,
+  uri text,
+  observed_at timestamp with time zone,
+  summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  redaction_state text NOT NULL DEFAULT 'summary_only',
+  retention_expires_at timestamp with time zone,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT trace_source_evidence_source_type_check CHECK (
+    source_type IN (
+      'runtime',
+      'agentcore_span',
+      'bedrock_invocation_log',
+      'aws_cur',
+      'operator',
+      'backfill'
+    )
+  )
+);
+
+CREATE INDEX IF NOT EXISTS trace_source_evidence_run_idx
+  ON public.trace_source_evidence (trace_run_id);
+CREATE INDEX IF NOT EXISTS trace_source_evidence_event_idx
+  ON public.trace_source_evidence (trace_event_id);
+CREATE INDEX IF NOT EXISTS trace_source_evidence_source_idx
+  ON public.trace_source_evidence (tenant_id, source_type, source_id);
+
+CREATE TABLE IF NOT EXISTS public.trace_cost_reconciliation_facts (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  trace_run_id uuid REFERENCES public.trace_runs(id) ON DELETE CASCADE,
+  trace_event_id uuid REFERENCES public.trace_events(id) ON DELETE SET NULL,
+  cost_event_id uuid REFERENCES public.cost_events(id) ON DELETE SET NULL,
+  source_evidence_id uuid REFERENCES public.trace_source_evidence(id) ON DELETE SET NULL,
+  reconciliation_state text NOT NULL,
+  reconciliation_scope text NOT NULL,
+  provider text,
+  model text,
+  request_id text,
+  attribution_level text,
+  runtime_input_tokens integer,
+  runtime_output_tokens integer,
+  runtime_cached_read_tokens integer,
+  provider_input_tokens integer,
+  provider_output_tokens integer,
+  provider_cached_read_tokens integer,
+  runtime_amount_usd numeric(12, 6),
+  provider_amount_usd numeric(12, 6),
+  billed_amount_usd numeric(12, 6),
+  variance_usd numeric(12, 6),
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  reconciled_at timestamp with time zone NOT NULL DEFAULT now(),
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT trace_cost_recon_facts_state_check CHECK (
+    reconciliation_state IN (
+      'runtime-reported',
+      'invocation-reconciled',
+      'bill-reconciled',
+      'mismatch',
+      'unreconciled/error'
+    )
+  ),
+  CONSTRAINT trace_cost_recon_facts_scope_check CHECK (
+    reconciliation_scope IN (
+      'runtime',
+      'invocation',
+      'bill',
+      'aggregate',
+      'operator_resolution'
+    )
+  )
+);
+
+CREATE INDEX IF NOT EXISTS trace_cost_recon_facts_cost_event_idx
+  ON public.trace_cost_reconciliation_facts (cost_event_id);
+CREATE INDEX IF NOT EXISTS trace_cost_recon_facts_trace_event_idx
+  ON public.trace_cost_reconciliation_facts (trace_event_id);
+CREATE INDEX IF NOT EXISTS trace_cost_recon_facts_state_idx
+  ON public.trace_cost_reconciliation_facts (
+    tenant_id,
+    reconciliation_state,
+    reconciled_at
+  );
+CREATE INDEX IF NOT EXISTS trace_cost_recon_facts_request_idx
+  ON public.trace_cost_reconciliation_facts (tenant_id, provider, request_id);
+
+ALTER TABLE public.cost_events
+  ADD COLUMN IF NOT EXISTS trace_event_id uuid,
+  ADD COLUMN IF NOT EXISTS reconciliation_state text NOT NULL DEFAULT 'runtime-reported',
+  ADD COLUMN IF NOT EXISTS reconciliation_source text,
+  ADD COLUMN IF NOT EXISTS reconciliation_at timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS source_evidence_ref jsonb;
+
+CREATE INDEX IF NOT EXISTS idx_cost_events_trace_event
+  ON public.cost_events (trace_event_id);
+CREATE INDEX IF NOT EXISTS idx_cost_events_reconciliation_state
+  ON public.cost_events (tenant_id, reconciliation_state, created_at);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'cost_events_reconciliation_state_check'
+  ) THEN
+    ALTER TABLE public.cost_events
+      ADD CONSTRAINT cost_events_reconciliation_state_check CHECK (
+        reconciliation_state IN (
+          'runtime-reported',
+          'invocation-reconciled',
+          'bill-reconciled',
+          'mismatch',
+          'unreconciled/error'
+        )
+      );
+  END IF;
+END $$;
+
+COMMENT ON TABLE public.trace_runs IS
+  'Canonical trace run identity for ThinkWork agent execution evidence.';
+COMMENT ON TABLE public.trace_events IS
+  'Append-only canonical trace event and observation records.';
+COMMENT ON TABLE public.trace_source_evidence IS
+  'Safe references and summaries for provider/runtime/billing source evidence.';
+COMMENT ON TABLE public.trace_cost_reconciliation_facts IS
+  'Append-only facts that reconcile runtime usage, provider invocation evidence, and billing exports.';

package/dist/drizzle/0190_billing_export_reconciliation.sql

@@ -0,0 +1,101 @@
+-- creates: public.billing_export_imports
+-- creates: public.billing_export_line_items
+-- creates-column: public.cost_events.billing_account_id
+-- creates-column: public.cost_events.billing_service_code
+-- creates-column: public.cost_events.billing_operation
+-- creates-column: public.cost_events.billing_period_start
+-- creates-column: public.cost_events.billing_period_end
+-- creates-column: public.cost_events.billing_attribution_level
+
+ALTER TABLE "cost_events"
+  ADD COLUMN IF NOT EXISTS "billing_account_id" text,
+  ADD COLUMN IF NOT EXISTS "billing_service_code" text,
+  ADD COLUMN IF NOT EXISTS "billing_operation" text,
+  ADD COLUMN IF NOT EXISTS "billing_period_start" timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS "billing_period_end" timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS "billing_attribution_level" text;
+
+CREATE INDEX IF NOT EXISTS "idx_cost_events_billing_period"
+  ON "cost_events" ("tenant_id", "billing_service_code", "billing_period_start");
+
+CREATE TABLE IF NOT EXISTS "billing_export_imports" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "provider" text DEFAULT 'aws' NOT NULL,
+  "source_type" text DEFAULT 'aws_cur' NOT NULL,
+  "manifest_bucket" text NOT NULL,
+  "manifest_key" text NOT NULL,
+  "billing_period_start" timestamp with time zone NOT NULL,
+  "billing_period_end" timestamp with time zone NOT NULL,
+  "status" text DEFAULT 'imported' NOT NULL,
+  "row_count" integer DEFAULT 0 NOT NULL,
+  "error_count" integer DEFAULT 0 NOT NULL,
+  "error_summary" text,
+  "metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "imported_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "billing_export_imports_status_check"
+    CHECK ("status" IN ('imported', 'imported_with_errors', 'failed'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "billing_export_imports_manifest_uidx"
+  ON "billing_export_imports" ("provider", "manifest_bucket", "manifest_key");
+
+CREATE INDEX IF NOT EXISTS "billing_export_imports_period_idx"
+  ON "billing_export_imports" (
+    "provider",
+    "billing_period_start",
+    "billing_period_end"
+  );
+
+CREATE TABLE IF NOT EXISTS "billing_export_line_items" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "import_id" uuid NOT NULL REFERENCES "billing_export_imports"("id") ON DELETE cascade,
+  "tenant_id" uuid REFERENCES "tenants"("id") ON DELETE set null,
+  "provider" text DEFAULT 'aws' NOT NULL,
+  "line_item_id" text NOT NULL,
+  "usage_account_id" text,
+  "service_code" text NOT NULL,
+  "operation" text NOT NULL,
+  "line_item_type" text,
+  "usage_start" timestamp with time zone NOT NULL,
+  "usage_end" timestamp with time zone NOT NULL,
+  "billing_period_start" timestamp with time zone NOT NULL,
+  "billing_period_end" timestamp with time zone NOT NULL,
+  "amount_usd" numeric(12, 6) NOT NULL,
+  "usage_amount" numeric(20, 6),
+  "currency" text DEFAULT 'USD' NOT NULL,
+  "model" text DEFAULT 'unknown' NOT NULL,
+  "region" text,
+  "resource_id" text,
+  "attribution_level" text NOT NULL,
+  "attribution_key" text NOT NULL,
+  "source_uri" text NOT NULL,
+  "raw_row" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "billing_export_line_items_attribution_check"
+    CHECK ("attribution_level" IN ('tenant', 'account', 'service_window'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "billing_export_line_items_import_line_uidx"
+  ON "billing_export_line_items" ("import_id", "line_item_id");
+
+CREATE INDEX IF NOT EXISTS "billing_export_line_items_period_idx"
+  ON "billing_export_line_items" (
+    "provider",
+    "billing_period_start",
+    "billing_period_end"
+  );
+
+CREATE INDEX IF NOT EXISTS "billing_export_line_items_tenant_idx"
+  ON "billing_export_line_items" (
+    "tenant_id",
+    "service_code",
+    "billing_period_start"
+  );
+
+CREATE INDEX IF NOT EXISTS "billing_export_line_items_attribution_idx"
+  ON "billing_export_line_items" (
+    "provider",
+    "attribution_level",
+    "attribution_key"
+  );

package/dist/drizzle/0191_open_engine_work_item_queue.sql

@@ -0,0 +1,66 @@
+-- Add Open Engine queue state to native Work Items.
+--
+-- Work Items are the persisted queue substrate for ThinkWork Open Engine:
+-- agents can discover eligible items by queue key, claim them with expiring
+-- leases, and respect human holds independently of generic blocked state.
+--
+-- creates-column: public.work_items.open_engine_enabled
+-- creates-column: public.work_items.open_engine_queue_key
+-- creates-column: public.work_items.open_engine_claimed_by_agent_id
+-- creates-column: public.work_items.open_engine_claimed_at
+-- creates-column: public.work_items.open_engine_claim_expires_at
+-- creates-column: public.work_items.open_engine_human_hold
+-- creates-column: public.work_items.open_engine_human_hold_reason
+-- creates-column: public.work_items.open_engine_scheduled_at
+-- creates-column: public.work_items.open_engine_dependency_state
+-- creates-column: public.work_items.open_engine_routing
+-- creates: public.idx_work_items_open_engine_ready
+-- creates: public.idx_work_items_open_engine_claim
+-- creates-constraint: public.work_items.work_items_open_engine_dependency_state_allowed
+
+ALTER TABLE public.work_items
+  ADD COLUMN IF NOT EXISTS open_engine_enabled boolean DEFAULT false NOT NULL,
+  ADD COLUMN IF NOT EXISTS open_engine_queue_key text,
+  ADD COLUMN IF NOT EXISTS open_engine_claimed_by_agent_id uuid REFERENCES public.agents(id) ON DELETE set null,
+  ADD COLUMN IF NOT EXISTS open_engine_claimed_at timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS open_engine_claim_expires_at timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS open_engine_human_hold boolean DEFAULT false NOT NULL,
+  ADD COLUMN IF NOT EXISTS open_engine_human_hold_reason text,
+  ADD COLUMN IF NOT EXISTS open_engine_scheduled_at timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS open_engine_dependency_state text DEFAULT 'ready' NOT NULL,
+  ADD COLUMN IF NOT EXISTS open_engine_routing jsonb;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'work_items_open_engine_dependency_state_allowed'
+      AND conrelid = 'public.work_items'::regclass
+  ) THEN
+    ALTER TABLE public.work_items
+      ADD CONSTRAINT work_items_open_engine_dependency_state_allowed
+      CHECK (open_engine_dependency_state IN ('ready', 'waiting'));
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_work_items_open_engine_ready
+  ON public.work_items (
+    tenant_id,
+    open_engine_queue_key,
+    open_engine_scheduled_at,
+    open_engine_claim_expires_at,
+    updated_at
+  )
+  WHERE open_engine_enabled = true
+    AND archived_at IS NULL
+    AND open_engine_human_hold = false
+    AND blocked = false
+    AND open_engine_dependency_state = 'ready';
+
+CREATE INDEX IF NOT EXISTS idx_work_items_open_engine_claim
+  ON public.work_items (
+    tenant_id,
+    open_engine_claimed_by_agent_id,
+    open_engine_claim_expires_at
+  );

package/dist/drizzle/0192_work_item_labels.sql

@@ -0,0 +1,44 @@
+-- creates: public.work_item_labels
+-- creates: public.work_item_label_assignments
+-- creates: public.uq_work_item_labels_tenant_slug
+-- creates: public.idx_work_item_labels_tenant_active
+-- creates: public.uq_work_item_label_assignments_pair
+-- creates: public.idx_work_item_label_assignments_label
+-- creates: public.idx_work_item_label_assignments_item
+
+CREATE TABLE IF NOT EXISTS "work_item_labels" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE cascade,
+  "name" text NOT NULL,
+  "slug" text NOT NULL,
+  "color" text,
+  "description" text,
+  "created_by_user_id" uuid REFERENCES "users"("id") ON DELETE set null,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "archived_at" timestamp with time zone
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_work_item_labels_tenant_slug"
+  ON "work_item_labels" ("tenant_id", "slug");
+
+CREATE INDEX IF NOT EXISTS "idx_work_item_labels_tenant_active"
+  ON "work_item_labels" ("tenant_id", "archived_at", "name");
+
+CREATE TABLE IF NOT EXISTS "work_item_label_assignments" (
+  "tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE cascade,
+  "work_item_id" uuid NOT NULL REFERENCES "work_items"("id") ON DELETE cascade,
+  "label_id" uuid NOT NULL REFERENCES "work_item_labels"("id") ON DELETE cascade,
+  "created_by_user_id" uuid REFERENCES "users"("id") ON DELETE set null,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_work_item_label_assignments_pair"
+  ON "work_item_label_assignments" ("tenant_id", "work_item_id", "label_id");
+
+CREATE INDEX IF NOT EXISTS "idx_work_item_label_assignments_label"
+  ON "work_item_label_assignments" ("tenant_id", "label_id", "work_item_id");
+
+CREATE INDEX IF NOT EXISTS "idx_work_item_label_assignments_item"
+  ON "work_item_label_assignments" ("tenant_id", "work_item_id");
+

package/dist/drizzle/0193_work_item_documents.sql

@@ -0,0 +1,31 @@
+-- Work Item Documents: tenant-scoped S3-backed document metadata.
+-- creates: public.work_item_documents
+-- creates: public.idx_work_item_documents_item_active
+-- creates: public.idx_work_item_documents_tenant_kind
+-- creates-constraint: public.work_item_documents.work_item_documents_kind_allowed
+
+CREATE TABLE IF NOT EXISTS work_item_documents (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  work_item_id uuid NOT NULL REFERENCES work_items(id) ON DELETE CASCADE,
+  kind text NOT NULL DEFAULT 'note',
+  title text NOT NULL,
+  content_type text NOT NULL DEFAULT 'text/markdown',
+  s3_key text NOT NULL,
+  size_bytes integer NOT NULL DEFAULT 0,
+  checksum_sha256 text,
+  metadata jsonb,
+  created_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_by_agent_id uuid REFERENCES agents(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  archived_at timestamptz,
+  CONSTRAINT work_item_documents_kind_allowed
+    CHECK (kind IN ('plan','progress','spec','evidence','handoff','note','other'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_documents_item_active
+  ON work_item_documents (tenant_id, work_item_id, archived_at, updated_at);
+
+CREATE INDEX IF NOT EXISTS idx_work_item_documents_tenant_kind
+  ON work_item_documents (tenant_id, kind, archived_at);