thinkwork-cli 0.12.15 → 0.12.17

package/dist/drizzle/0201_brain_dream_runs.sql

@@ -0,0 +1,72 @@
+-- Dream-state audit ledger: per-bank staged plan → atomic apply → applied markers.
+-- Plan: docs/plans/2026-07-03-001-feat-thinkwork-brain-memory-architecture-plan.md (U4, KTD-2).
+--
+-- creates: public.brain_dream_runs
+-- creates: public.brain_dream_runs_dedupe_key_uidx
+-- creates: public.brain_dream_runs_tenant_bank_idx
+-- creates: public.brain_dream_runs_tenant_status_idx
+-- creates: public.brain_dream_actions
+-- creates: public.brain_dream_actions_run_ordinal_uidx
+-- creates: public.brain_dream_actions_run_status_idx
+-- creates-constraint: public.brain_dream_runs.brain_dream_runs_tenant_id_tenants_id_fk
+-- creates-constraint: public.brain_dream_runs.brain_dream_runs_status_check
+-- creates-constraint: public.brain_dream_actions.brain_dream_actions_run_id_brain_dream_runs_id_fk
+-- creates-constraint: public.brain_dream_actions.brain_dream_actions_type_check
+-- creates-constraint: public.brain_dream_actions.brain_dream_actions_status_check
+
+DO $$
+BEGIN
+  IF to_regclass('public.tenants') IS NULL THEN
+    RAISE EXCEPTION 'tenants not found; apply core tenant migrations first';
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS "brain_dream_runs" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "tenant_id" uuid NOT NULL,
+  "bank_id" text NOT NULL,
+  "dedupe_key" text NOT NULL,
+  "status" text NOT NULL DEFAULT 'planned',
+  "planned_counts" jsonb,
+  "applied_counts" jsonb,
+  "error_message" text,
+  "started_at" timestamp with time zone,
+  "finished_at" timestamp with time zone,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "brain_dream_runs_tenant_id_tenants_id_fk"
+    FOREIGN KEY ("tenant_id") REFERENCES "public"."tenants"("id") ON DELETE cascade,
+  CONSTRAINT "brain_dream_runs_status_check"
+    CHECK (status IN ('planned', 'applying', 'applied', 'failed', 'skipped'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "brain_dream_runs_dedupe_key_uidx"
+  ON "brain_dream_runs" ("dedupe_key");
+CREATE INDEX IF NOT EXISTS "brain_dream_runs_tenant_bank_idx"
+  ON "brain_dream_runs" ("tenant_id", "bank_id", "created_at");
+CREATE INDEX IF NOT EXISTS "brain_dream_runs_tenant_status_idx"
+  ON "brain_dream_runs" ("tenant_id", "status");
+
+CREATE TABLE IF NOT EXISTS "brain_dream_actions" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "run_id" uuid NOT NULL,
+  "ordinal" integer NOT NULL,
+  "action_type" text NOT NULL,
+  "status" text NOT NULL DEFAULT 'staged',
+  "target" jsonb,
+  "reason" text,
+  "applied_at" timestamp with time zone,
+  "error_message" text,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "brain_dream_actions_run_id_brain_dream_runs_id_fk"
+    FOREIGN KEY ("run_id") REFERENCES "public"."brain_dream_runs"("id") ON DELETE cascade,
+  CONSTRAINT "brain_dream_actions_type_check"
+    CHECK (action_type IN ('quarantine', 'forget', 'consolidate')),
+  CONSTRAINT "brain_dream_actions_status_check"
+    CHECK (status IN ('staged', 'applied', 'skipped'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "brain_dream_actions_run_ordinal_uidx"
+  ON "brain_dream_actions" ("run_id", "ordinal");
+CREATE INDEX IF NOT EXISTS "brain_dream_actions_run_status_idx"
+  ON "brain_dream_actions" ("run_id", "status");

package/dist/drizzle/0202_backfill_thread_participants_from_senders.sql

@@ -0,0 +1,110 @@
+-- Purpose: make thread_participants a truthful record of who is actually in a
+-- thread, so Thread Mode derivation (plan 2026-07-03-003 U3) does not
+-- misclassify already-multiplayer threads at ship time (R13, AE7), and so
+-- non-space threads can carry participant rows at all (R14).
+--
+-- Two changes, applied atomically:
+--   1. Schema: make thread_participants.space_id NULLABLE. Non-space threads
+--      (no owning Space) get participant rows whose space_id is null. This is
+--      the ALTER matching src/schema/thread-participants.ts (space_id no longer
+--      .notNull()). db:generate could not emit a journaled migration here — the
+--      drizzle snapshot (meta/) is frozen ~180 migrations behind HEAD and every
+--      recent schema change is a hand-rolled file + deploy.yml step, so this
+--      follows that established convention.
+--   2. Data: backfill one participant row per (tenant, thread, distinct human
+--      message sender) for existing threads, so reply-joiners who never got a
+--      row are counted. Agent/system senders are excluded.
+--
+-- Idempotent: DROP NOT NULL is a no-op if already dropped; the INSERT uses
+-- ON CONFLICT DO NOTHING against the partial unique index on
+-- (tenant_id, thread_id, user_id). Re-running is safe.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0202_backfill_thread_participants_from_senders.sql
+--
+-- creates: public.view_thread_participants_sender_backfilled
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('thread_participants_sender_backfill_0202'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '180s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.thread_participants') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.thread_participants does not exist';
+  END IF;
+  IF to_regclass('public.threads') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.threads does not exist';
+  END IF;
+  IF to_regclass('public.messages') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.messages does not exist';
+  END IF;
+END $$;
+
+-- 1. Non-space participation (R14): drop the NOT NULL on space_id so non-space
+--    threads can carry rows. Idempotent.
+ALTER TABLE public.thread_participants
+  ALTER COLUMN space_id DROP NOT NULL;
+
+-- 2. Backfill sender participation from distinct human message senders.
+--    sender_type 'user'/'human' are the human sender labels; agent/system
+--    senders are excluded so they never become participants. Joining users
+--    guards the FK (thread_participants.user_id -> users.id) against any
+--    orphaned sender_id. space_id rides from the thread and is null for
+--    non-space threads.
+INSERT INTO public.thread_participants (
+  tenant_id,
+  thread_id,
+  space_id,
+  participant_type,
+  user_id,
+  role,
+  source,
+  notification_preference,
+  created_at,
+  updated_at
+)
+SELECT
+  m.tenant_id,
+  m.thread_id,
+  t.space_id,
+  'user',
+  m.sender_id,
+  'member',
+  'sender',
+  'subscribed',
+  MIN(m.created_at),
+  now()
+FROM public.messages m
+JOIN public.threads t
+  ON t.id = m.thread_id
+ AND t.tenant_id = m.tenant_id
+JOIN public.users u
+  ON u.id = m.sender_id
+ AND u.tenant_id = m.tenant_id
+WHERE m.sender_type IN ('user', 'human')
+  AND m.sender_id IS NOT NULL
+GROUP BY m.tenant_id, m.thread_id, t.space_id, m.sender_id
+ON CONFLICT (tenant_id, thread_id, user_id)
+  WHERE user_id IS NOT NULL
+DO NOTHING;
+
+-- Drift marker + summary. Its presence is what the drift reporter probes; the
+-- view only exists if the whole transaction (ALTER + backfill) committed.
+CREATE OR REPLACE VIEW public.view_thread_participants_sender_backfilled AS
+SELECT
+  COUNT(*) FILTER (WHERE source = 'sender')::int AS sender_backfill_rows,
+  COUNT(*) FILTER (WHERE space_id IS NULL)::int AS non_space_rows,
+  now() AS checked_at
+FROM public.thread_participants;
+
+COMMENT ON VIEW public.view_thread_participants_sender_backfilled IS
+  'Drift marker and summary for 0202_backfill_thread_participants_from_senders.sql.';
+
+COMMIT;

package/dist/drizzle/0203_threads_mode_override.sql

@@ -0,0 +1,61 @@
+-- Purpose: add the per-thread Thread Mode override column that backs
+-- server-authoritative Thread Mode (plan 2026-07-03-003 U3, R3). NULL means the
+-- mode is derived from human participant count (0–1 → agent, 2+ →
+-- multiplayer); a non-null value pins the mode for every participant until
+-- changed. Set from the thread info panel via updateThread(modeOverride).
+--
+-- Schema-only change matching src/schema/threads.ts (threads.mode_override
+-- text, CHECK IN ('agent','multiplayer')). db:generate could not emit a
+-- journaled migration here — the drizzle snapshot (meta/) is frozen ~180
+-- migrations behind HEAD and every recent schema change is a hand-rolled file
+-- plus a deploy.yml step, so this follows that established convention
+-- (precedent: 0202_backfill_thread_participants_from_senders.sql).
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS is a no-op if the column exists; the
+-- CHECK constraint is added only when absent (guarded by pg_constraint). Safe
+-- to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0203_threads_mode_override.sql
+--
+-- creates-column: public.threads.mode_override
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('threads_mode_override_0203'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.threads') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.threads does not exist';
+  END IF;
+END $$;
+
+-- 1. Add the nullable override column. Idempotent.
+ALTER TABLE public.threads
+  ADD COLUMN IF NOT EXISTS mode_override text;
+
+-- 2. Constrain the allowed values. NULL is permitted (derived mode); non-null
+--    must be one of the two modes. Added only when the named constraint does
+--    not already exist so re-runs are no-ops.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'threads_mode_override_allowed'
+      AND conrelid = 'public.threads'::regclass
+  ) THEN
+    ALTER TABLE public.threads
+      ADD CONSTRAINT threads_mode_override_allowed
+      CHECK (mode_override IS NULL OR mode_override IN ('agent','multiplayer'));
+  END IF;
+END $$;
+
+COMMIT;

package/dist/drizzle/0204_thread_turns_triggering_message_id.sql

@@ -0,0 +1,48 @@
+-- Purpose: add the durable turn→triggering-message link that backs the
+-- per-message dispatch indicator (plan 2026-07-03-003 U6, R6/R7, KTD3). A
+-- non-null value is the id of the USER message whose send dispatched this
+-- turn; the web UI pairs turns to messages by this id and falls back to
+-- today's timestamp pairing for legacy (null) rows. Stamped by BOTH dispatch
+-- handlers — chat-agent-invoke (direct invoke) and wakeup-processor (fallback
+-- / mention / resume) — from the messageId already carried on every dispatch
+-- payload.
+--
+-- Schema-only change matching src/schema/scheduled-jobs.ts
+-- (thread_turns.triggering_message_id uuid, nullable). NO foreign key: turns
+-- may outlive the message row, and the sibling thread_id column on this table
+-- is likewise an un-referenced uuid — matched here. db:generate could not emit
+-- a journaled migration (the drizzle snapshot in meta/ is frozen ~180
+-- migrations behind HEAD; every recent schema change is a hand-rolled file
+-- plus a deploy.yml step), so this follows that established convention
+-- (precedent: 0203_threads_mode_override.sql).
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS is a no-op if the column exists. Safe
+-- to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0204_thread_turns_triggering_message_id.sql
+--
+-- creates-column: public.thread_turns.triggering_message_id
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('thread_turns_triggering_message_id_0204'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.thread_turns') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.thread_turns does not exist';
+  END IF;
+END $$;
+
+-- Add the nullable triggering-message link. Idempotent.
+ALTER TABLE public.thread_turns
+  ADD COLUMN IF NOT EXISTS triggering_message_id uuid;
+
+COMMIT;

package/dist/drizzle/0205_routines_git_python.sql

@@ -0,0 +1,185 @@
+-- Purpose: schema substrate for deterministic git-backed routines
+-- (plan 2026-07-03-004 U1, KTD-1/KTD-7/KTD-11).
+--
+--   1. routines.engine CHECK gains 'git_python'.
+--   2. routines gains git_python-only pointer columns (module_path,
+--      fixture_paths, credential_refs, validated_sha, disabled_reason).
+--      Code itself never lives in the DB (R1) — the tenant GitHub repo is
+--      the single source of truth.
+--   3. routine_executions gains commit_sha / validated_sha / cache_served
+--      (every git run answers "what exactly ran?", R4/R6) and relaxes
+--      state_machine_arn + sfn_execution_arn to nullable — git_python
+--      executions have no Step Functions involvement. The unique index on
+--      sfn_execution_arn is NULL-tolerant in Postgres.
+--   4. New routine_code_cache table — DB index over the S3 read-through
+--      code cache keyed by commit SHA; authoritative for "validated SHA
+--      per routine".
+--   5. New routine_repair_events table — durable repair-ladder history
+--      backing the visible repair log.
+--
+-- Schema-only change matching src/schema/{routines,routine-executions,
+-- routine-code-cache,routine-repair-events}.ts. db:generate cannot emit a
+-- journaled migration (the drizzle snapshot in meta/ is frozen ~180
+-- migrations behind HEAD); hand-rolled per convention
+-- (precedent: 0203_threads_mode_override.sql).
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS / CREATE TABLE IF NOT EXISTS /
+-- CREATE INDEX IF NOT EXISTS; constraint changes guarded by pg_constraint
+-- lookups; DROP NOT NULL is a no-op when already nullable. Safe to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0205_routines_git_python.sql
+--
+-- creates-column: public.routines.module_path
+-- creates-column: public.routines.fixture_paths
+-- creates-column: public.routines.credential_refs
+-- creates-column: public.routines.validated_sha
+-- creates-column: public.routines.disabled_reason
+-- creates-column: public.routine_executions.commit_sha
+-- creates-column: public.routine_executions.validated_sha
+-- creates-column: public.routine_executions.cache_served
+-- creates: public.routine_code_cache
+-- creates: public.routine_repair_events
+-- creates: public.idx_routine_code_cache_routine_sha
+-- creates: public.idx_routine_code_cache_tenant
+-- creates: public.idx_routine_repair_events_routine_created
+-- creates: public.idx_routine_repair_events_tenant
+-- creates-constraint: public.routine_code_cache.routine_code_cache_fixture_status_enum
+-- creates-constraint: public.routine_repair_events.routine_repair_events_event_type_enum
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('routines_git_python_0205'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.routines') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.routines does not exist';
+  END IF;
+  IF to_regclass('public.routine_executions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.routine_executions does not exist';
+  END IF;
+END $$;
+
+-- 1. Extend the engine CHECK to admit 'git_python'. Drop + re-add under
+--    the same name; guarded so re-runs are no-ops once the new definition
+--    is in place.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'routines_engine_enum'
+      AND conrelid = 'public.routines'::regclass
+      AND pg_get_constraintdef(oid) NOT LIKE '%git_python%'
+  ) THEN
+    ALTER TABLE public.routines DROP CONSTRAINT routines_engine_enum;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'routines_engine_enum'
+      AND conrelid = 'public.routines'::regclass
+  ) THEN
+    ALTER TABLE public.routines
+      ADD CONSTRAINT routines_engine_enum
+      CHECK (engine IN ('legacy_python', 'step_functions', 'git_python'));
+  END IF;
+END $$;
+
+-- 2. git_python pointer columns on routines. All nullable (null on
+--    legacy_python / step_functions rows).
+ALTER TABLE public.routines
+  ADD COLUMN IF NOT EXISTS module_path text,
+  ADD COLUMN IF NOT EXISTS fixture_paths jsonb,
+  ADD COLUMN IF NOT EXISTS credential_refs jsonb,
+  ADD COLUMN IF NOT EXISTS validated_sha text,
+  ADD COLUMN IF NOT EXISTS disabled_reason text;
+
+-- 3. git_python execution columns + relax SFN-only NOT NULLs.
+ALTER TABLE public.routine_executions
+  ADD COLUMN IF NOT EXISTS commit_sha text,
+  ADD COLUMN IF NOT EXISTS validated_sha text,
+  ADD COLUMN IF NOT EXISTS cache_served boolean;
+
+ALTER TABLE public.routine_executions
+  ALTER COLUMN state_machine_arn DROP NOT NULL,
+  ALTER COLUMN sfn_execution_arn DROP NOT NULL;
+
+-- 4. routine_code_cache — S3 SHA-cache index (S3 canonical, DB derived).
+CREATE TABLE IF NOT EXISTS public.routine_code_cache (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  routine_id uuid NOT NULL REFERENCES public.routines(id),
+  sha text NOT NULL,
+  s3_key text NOT NULL,
+  fixture_status text NOT NULL DEFAULT 'pending',
+  fixture_result_json text,
+  fetched_at timestamptz NOT NULL DEFAULT now(),
+  validated_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_routine_code_cache_routine_sha
+  ON public.routine_code_cache (routine_id, sha);
+CREATE INDEX IF NOT EXISTS idx_routine_code_cache_tenant
+  ON public.routine_code_cache (tenant_id);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'routine_code_cache_fixture_status_enum'
+      AND conrelid = 'public.routine_code_cache'::regclass
+  ) THEN
+    ALTER TABLE public.routine_code_cache
+      ADD CONSTRAINT routine_code_cache_fixture_status_enum
+      CHECK (fixture_status IN ('pending', 'green', 'red'));
+  END IF;
+END $$;
+
+-- 5. routine_repair_events — repair-ladder history (visible repair log).
+CREATE TABLE IF NOT EXISTS public.routine_repair_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  routine_id uuid NOT NULL REFERENCES public.routines(id),
+  execution_id uuid REFERENCES public.routine_executions(id),
+  event_type text NOT NULL,
+  thread_ref text,
+  from_sha text,
+  to_sha text,
+  gate_result text,
+  envelope_verdict text,
+  budget_snapshot integer,
+  detail_json jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_routine_repair_events_routine_created
+  ON public.routine_repair_events (routine_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_routine_repair_events_tenant
+  ON public.routine_repair_events (tenant_id);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'routine_repair_events_event_type_enum'
+      AND conrelid = 'public.routine_repair_events'::regclass
+  ) THEN
+    ALTER TABLE public.routine_repair_events
+      ADD CONSTRAINT routine_repair_events_event_type_enum
+      CHECK (event_type IN ('retry', 'revert', 'repair_attempt', 'pending_commit', 'disabled', 'infra_failure'));
+  END IF;
+END $$;
+
+COMMIT;

package/dist/drizzle/0206_agent_loop_versions_routine_actions.sql

@@ -0,0 +1,40 @@
+-- Purpose: add the routine-actions field to Automation versions
+-- (deterministic routines v1, plan 2026-07-03-004 U5, R7). Null on
+-- versions without routine actions; otherwise a jsonb
+-- {actions: [{routineId, input?, label?}], agentTurn: boolean} where
+-- agentTurn=false marks a routine-only Automation (run completes with
+-- zero agent turns / no wakeup).
+--
+-- Schema-only change matching src/schema/agent-loops.ts
+-- (agent_loop_versions.routine_actions_spec jsonb). Hand-rolled per
+-- convention — the drizzle snapshot in meta/ is frozen
+-- (precedent: 0205_routines_git_python.sql).
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS. Safe to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0206_agent_loop_versions_routine_actions.sql
+--
+-- creates-column: public.agent_loop_versions.routine_actions_spec
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('agent_loop_versions_routine_actions_0206'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+END $$;
+
+ALTER TABLE public.agent_loop_versions
+  ADD COLUMN IF NOT EXISTS routine_actions_spec jsonb;
+
+COMMIT;

package/dist/drizzle/0207_tenant_credentials_github_repo_kind.sql

@@ -0,0 +1,52 @@
+-- Purpose: admit 'github_repo' in the tenant_credentials kind CHECK
+-- (deterministic routines v1, plan 2026-07-03-004 U2 follow-up). U2
+-- (#3273) added the GraphQL enum value, REQUIRED_FIELDS entry, and
+-- save-time connection validation but missed the DB CHECK — the first
+-- real save of a routine-repo credential violated
+-- tenant_credentials_kind_enum. Caught during the U9 acceptance sweep.
+--
+-- Hand-rolled per convention (drizzle snapshot frozen; precedent
+-- 0205/0206). Drop + re-add under the same name, guarded so re-runs are
+-- no-ops once the new definition is in place.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0207_tenant_credentials_github_repo_kind.sql
+--
+-- creates-constraint: public.tenant_credentials.tenant_credentials_kind_enum
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('tenant_credentials_github_repo_0207'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'tenant_credentials_kind_enum'
+      AND conrelid = 'public.tenant_credentials'::regclass
+      AND pg_get_constraintdef(oid) NOT LIKE '%github_repo%'
+  ) THEN
+    ALTER TABLE public.tenant_credentials
+      DROP CONSTRAINT tenant_credentials_kind_enum;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'tenant_credentials_kind_enum'
+      AND conrelid = 'public.tenant_credentials'::regclass
+  ) THEN
+    ALTER TABLE public.tenant_credentials
+      ADD CONSTRAINT tenant_credentials_kind_enum
+      CHECK (kind IN ('api_key','bearer_token','basic_auth','soap_partner','webhook_signing_secret','json','github_repo'));
+  END IF;
+END $$;
+
+COMMIT;