thinkwork-cli 0.12.15 → 0.12.17

package/dist/drizzle/0212_fold_webhooks_into_automations.sql

@@ -0,0 +1,312 @@
+-- Purpose: fold standalone webhooks into Automations (THINK-137 U8, R8). The
+-- Settings → Webhooks surface retires; every webhook that a user could
+-- manage is henceforth an Automation with a `webhook` trigger. This migration
+-- converts each convertible `webhooks` row (target_type agent|routine, NOT
+-- connector-created) into an Automation (`agent_loops` + `agent_loop_versions`)
+-- and re-points the webhook row at that loop with target_type='automation',
+-- PRESERVING the token so inbound URLs keep working.
+--
+-- Convertible set (matches the plan's agent|routine target scope):
+--   target_type IN ('agent','routine')
+--   AND connect_provider_id IS NULL   -- connector-created rows are NOT user-
+--                                        managed webhooks; they stay untouched
+--   AND agent_loop_id IS NULL         -- not already an Automation
+--   AND target_type <> 'automation'   -- (redundant with the IN, kept explicit)
+--
+-- Left UNTOUCHED (deliberately):
+--   * target_type='task' rows (external-task connector webhooks) — out of the
+--     convertible set; their handler branch survives.
+--   * any row with connect_provider_id set (connector-minted) — untouched.
+--   * target_type='automation' rows — already new-model.
+--
+-- Per-target mapping (mirrors targetSpecFromLegacy + saveAgentLoop defaults):
+--   * agent target →
+--       target_spec {kind:'agent_thread', agentThread:{instructions:<prompt or
+--         default>, workerId:<agent_id>, workerType:'agent',
+--         threadMode:'new_per_run'}}
+--       worker_spec {type:'agent', id:<agent_id>, toolHints:[], config:{}}
+--   * routine target →
+--       target_spec {kind:'routine', routine:{routineId:<routine_id>}}
+--       worker_spec points at the tenant's platform-default agent (worker_spec
+--         is NOT NULL but is never read for a routine-kind dispatch; the
+--         placeholder keeps the column shape valid for later re-saves).
+--   The NOT-NULL legacy spec columns (trigger/goal/worker/judge/loop) get the
+--   SAME fixed defaults saveAgentLoop writes: judge self_check, loop_policy
+--   {maxIterations:1, failBehavior:'return_blocker', escalateOnFailure:false},
+--   trigger {family:'webhook', enabled:true, config:{}}. evidence_policy uses
+--   its column default.
+--
+-- run_as_user_id CHOICE: left NULL (system identity). webhooks.created_by_id is
+-- untyped `text` (system|user via created_by_type) and is NOT a users FK, so it
+-- cannot be trusted as a run-as identity. A NULL run_as_user_id means the run
+-- acts as the system identity — exactly the pre-migration behavior, where the
+-- agent branch enqueued wakeups with requested_by_actor_type='system'.
+--
+-- NULL-space agent rows (none on dev; written for customer stages): an
+-- agent_thread automation needs a home Space (R4). When the source webhook has
+-- no space_id, the Automation is created DISABLED (agent_loops.enabled=false),
+-- the webhook row stays disabled, and a deduplicated inbox item
+-- (type='automation_needs_space', entity_type='agent_loop', entity_id=<loop>)
+-- is filed so an operator assigns a Space and re-enables. A disabled loop makes
+-- the inbound token resolve to a dispatcher skip (agent_loop_disabled →
+-- HTTP 200 "ignored"), never an error. Routine targets are headless and never
+-- need a Space, so they convert enabled regardless.
+-- INBOX CHOICE: a new explicit `automation_needs_space` type (over reusing a
+-- headless-failure shape) — it names the exact operator action and carries the
+-- loop id as entity_id for the deep link.
+--
+-- Idempotent: only webhooks in the convertible set are processed, and
+-- conversion sets webhooks.agent_loop_id + target_type='automation', which drops
+-- the row out of the set — a re-run is a no-op. The inbox insert is guarded by
+-- NOT EXISTS on (tenant_id, type, entity_id). The drift-marker VIEW is CREATE OR
+-- REPLACE. Safe to re-run. dev converts exactly ONE row (the agent webhook with
+-- a Space); customer stages convert 0.
+--
+-- Pure SQL (no psql vars). Hand-rolled per convention (0210/0211 precedent):
+-- advisory lock, pre-flight guards, DO-block loop, drift-marker view.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0212_fold_webhooks_into_automations.sql
+--
+-- creates: public.view_webhooks_folded_into_automations
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('think137_fold_webhooks_into_automations_0212'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.webhooks') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.webhooks does not exist';
+  END IF;
+  IF to_regclass('public.agent_loops') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loops does not exist';
+  END IF;
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+  IF to_regclass('public.inbox_items') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.inbox_items does not exist';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'webhooks'
+      AND column_name = 'agent_loop_id'
+  ) THEN
+    RAISE EXCEPTION 'pre-flight: public.webhooks.agent_loop_id missing (apply 0210 first)';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'agent_loop_versions'
+      AND column_name = 'target_spec'
+  ) THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions.target_spec missing (apply 0210 first)';
+  END IF;
+END $$;
+
+DO $$
+DECLARE
+  w               RECORD;
+  v_loop_id       uuid;
+  v_version_id    uuid;
+  v_slug          text;
+  v_target_kind   text;
+  v_instructions  text;
+  v_has_space     boolean;
+  v_loop_enabled  boolean;
+  v_worker_id     uuid;
+  v_target_spec   jsonb;
+  v_goal_spec     jsonb;
+  v_worker_spec   jsonb;
+BEGIN
+  FOR w IN
+    SELECT *
+    FROM public.webhooks
+    WHERE target_type IN ('agent', 'routine')
+      AND connect_provider_id IS NULL
+      AND agent_loop_id IS NULL
+      AND target_type <> 'automation'
+    ORDER BY created_at
+  LOOP
+    v_target_kind := CASE WHEN w.target_type = 'routine' THEN 'routine' ELSE 'agent_thread' END;
+    v_has_space := w.space_id IS NOT NULL;
+
+    -- agent_thread automations need a Space (R4). No Space ⇒ create disabled +
+    -- file an operator inbox item. Routine targets are headless; always enabled
+    -- to the webhook's own enabled flag.
+    IF v_target_kind = 'agent_thread' AND NOT v_has_space THEN
+      v_loop_enabled := false;
+    ELSE
+      v_loop_enabled := w.enabled;
+    END IF;
+
+    -- Unique slug: slugify(name) + short webhook-id suffix so the
+    -- (tenant_id, slug) unique index never collides across converted rows.
+    v_slug := regexp_replace(lower(coalesce(w.name, 'webhook')), '[^a-z0-9]+', '-', 'g');
+    v_slug := regexp_replace(v_slug, '(^-+|-+$)', '', 'g');
+    v_slug := left(nullif(v_slug, ''), 60);
+    v_slug := coalesce(v_slug, 'webhook') || '-' || left(replace(w.id::text, '-', ''), 8);
+
+    v_instructions := coalesce(
+      nullif(btrim(w.prompt), ''),
+      'Handle the incoming webhook payload and complete the requested work.'
+    );
+
+    IF v_target_kind = 'agent_thread' THEN
+      v_worker_id := w.agent_id;
+      v_worker_spec := jsonb_build_object(
+        'type', 'agent',
+        'id', w.agent_id,
+        'toolHints', '[]'::jsonb,
+        'config', '{}'::jsonb
+      );
+      v_goal_spec := jsonb_build_object(
+        'objective', v_instructions,
+        'completionCriteria', '[]'::jsonb
+      );
+      v_target_spec := jsonb_build_object(
+        'kind', 'agent_thread',
+        'agentThread', jsonb_build_object(
+          'instructions', v_instructions,
+          'workerId', w.agent_id,
+          'workerType', 'agent',
+          'threadMode', 'new_per_run'
+        )
+      );
+    ELSE
+      -- routine target — worker_spec is unread for routine dispatch but the
+      -- column is NOT NULL; point it at a real platform-default agent when one
+      -- exists so a later re-save re-normalizes cleanly.
+      v_worker_id := (
+        SELECT a.id FROM public.agents a
+        WHERE a.tenant_id = w.tenant_id AND a.type = 'agent'
+        ORDER BY (a.is_platform_default) DESC NULLS LAST, a.created_at
+        LIMIT 1
+      );
+      v_worker_spec := jsonb_build_object(
+        'type', 'agent',
+        'id', coalesce(v_worker_id, '00000000-0000-0000-0000-000000000000'::uuid),
+        'toolHints', '[]'::jsonb,
+        'config', '{}'::jsonb
+      );
+      v_goal_spec := jsonb_build_object(
+        'objective', coalesce(nullif(btrim(w.name), ''), 'Webhook routine'),
+        'completionCriteria', '[]'::jsonb
+      );
+      v_target_spec := jsonb_build_object(
+        'kind', 'routine',
+        'routine', jsonb_build_object('routineId', w.routine_id)
+      );
+    END IF;
+
+    INSERT INTO public.agent_loops (
+      tenant_id, name, slug, description, lifecycle_status, enabled,
+      space_id, run_as_user_id, primary_trigger_family
+    )
+    VALUES (
+      w.tenant_id,
+      coalesce(nullif(btrim(w.name), ''), 'Webhook automation'),
+      v_slug,
+      w.description,
+      'active',
+      v_loop_enabled,
+      w.space_id,
+      NULL,          -- run_as_user_id: system identity (see header)
+      'webhook'
+    )
+    RETURNING id INTO v_loop_id;
+
+    INSERT INTO public.agent_loop_versions (
+      tenant_id, agent_loop_id, version_number, version_status,
+      trigger_spec, goal_spec, worker_spec, judge_spec, loop_policy,
+      target_spec, created_by_actor_type, published_at
+    )
+    VALUES (
+      w.tenant_id,
+      v_loop_id,
+      1,
+      'active',
+      jsonb_build_object('family', 'webhook', 'enabled', true, 'config', '{}'::jsonb),
+      v_goal_spec,
+      v_worker_spec,
+      jsonb_build_object('mode', 'self_check', 'criteria', '[]'::jsonb, 'config', '{}'::jsonb),
+      jsonb_build_object('maxIterations', 1, 'failBehavior', 'return_blocker', 'escalateOnFailure', false),
+      v_target_spec,
+      'system',
+      now()
+    )
+    RETURNING id INTO v_version_id;
+
+    UPDATE public.agent_loops
+    SET current_version_id = v_version_id,
+        current_version_number = 1,
+        updated_at = now()
+    WHERE id = v_loop_id;
+
+    -- Re-point the webhook at the new Automation. Token PRESERVED; enabled
+    -- mirrors the loop (disabled for the NULL-space agent case).
+    UPDATE public.webhooks
+    SET target_type = 'automation',
+        agent_loop_id = v_loop_id,
+        enabled = v_loop_enabled,
+        updated_at = now()
+    WHERE id = w.id;
+
+    -- NULL-space agent row: file a deduplicated operator inbox item.
+    IF v_target_kind = 'agent_thread' AND NOT v_has_space THEN
+      IF NOT EXISTS (
+        SELECT 1 FROM public.inbox_items i
+        WHERE i.tenant_id = w.tenant_id
+          AND i.type = 'automation_needs_space'
+          AND i.entity_type = 'agent_loop'
+          AND i.entity_id = v_loop_id
+      ) THEN
+        INSERT INTO public.inbox_items (
+          tenant_id, requester_type, type, status, title, description,
+          entity_type, entity_id, config
+        )
+        VALUES (
+          w.tenant_id,
+          'system',
+          'automation_needs_space',
+          'pending',
+          'Automation needs a Space',
+          format(
+            'The webhook "%s" became an Automation but has no Space, so it is disabled. Assign a Space and re-enable it to accept inbound deliveries.',
+            coalesce(nullif(btrim(w.name), ''), 'webhook')
+          ),
+          'agent_loop',
+          v_loop_id,
+          jsonb_build_object('webhookId', w.id, 'source', 'think137_u8_fold')
+        );
+      END IF;
+    END IF;
+  END LOOP;
+END $$;
+
+-- Drift marker + summary. Presence proves the fold transaction committed.
+CREATE OR REPLACE VIEW public.view_webhooks_folded_into_automations AS
+SELECT
+  COUNT(*) FILTER (
+    WHERE target_type = 'automation' AND agent_loop_id IS NOT NULL
+  )::int AS automation_webhooks,
+  COUNT(*) FILTER (
+    WHERE target_type IN ('agent', 'routine')
+      AND connect_provider_id IS NULL
+      AND agent_loop_id IS NULL
+  )::int AS unconverted_convertible_webhooks,
+  COUNT(*) FILTER (WHERE connect_provider_id IS NOT NULL)::int AS connector_webhooks,
+  COUNT(*) FILTER (WHERE target_type = 'task')::int AS task_webhooks,
+  now() AS checked_at
+FROM public.webhooks;
+
+COMMENT ON VIEW public.view_webhooks_folded_into_automations IS
+  'Drift marker and summary for 0212_fold_webhooks_into_automations.sql (THINK-137 U8).';
+
+COMMIT;

package/dist/drizzle/0213_agent_loop_versions_judge_evidence_nullable.sql

@@ -0,0 +1,63 @@
+-- Purpose: drop the NOT NULL constraint on
+-- agent_loop_versions.judge_spec and agent_loop_versions.evidence_policy
+-- (THINK-137 U10, PR A — code removal + nullability).
+--
+-- The judge / evidence / ROI feature was removed in this PR: finalize no longer
+-- records judgments/evidence, saveAgentLoop no longer writes judge_spec /
+-- evidence_policy, and the GraphQL + web readers are gone. Both columns were
+-- NOT NULL, so saveAgentLoop can only legally stop writing them once they are
+-- nullable. This migration makes that write-stop legal. The COLUMNS themselves
+-- (and the agent_loop_judgments / agent_loop_evidence tables and the ROI
+-- counters) are DROPPED in the follow-up PR B, after this deploys and
+-- saveAgentLoop is observed creating Automations live.
+--
+-- Schema-only migration on an existing column. Following the 0202/0211
+-- precedent for hand-rolled DDL that Drizzle's generator does not track, it
+-- publishes a drift-marker VIEW whose columns reflect the resulting nullability
+-- so the drift reporter (scripts/db-migrate-manual.sh) can prove the ALTER
+-- committed; the `-- creates:` marker below is what the reporter probes.
+--
+-- Idempotent: ALTER COLUMN ... DROP NOT NULL is a no-op when the constraint is
+-- already gone; the marker view is CREATE OR REPLACE. Safe to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0213_agent_loop_versions_judge_evidence_nullable.sql
+--
+-- creates: public.view_agent_loop_versions_judge_evidence_nullable
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('agent_loop_versions_judge_evidence_nullable_0213'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+END $$;
+
+ALTER TABLE public.agent_loop_versions ALTER COLUMN judge_spec DROP NOT NULL;
+ALTER TABLE public.agent_loop_versions ALTER COLUMN evidence_policy DROP NOT NULL;
+
+-- Drift marker. Its boolean columns reflect the resulting nullability so the
+-- reporter can prove both constraints were dropped.
+CREATE OR REPLACE VIEW public.view_agent_loop_versions_judge_evidence_nullable AS
+SELECT
+  bool_or(column_name = 'judge_spec' AND is_nullable = 'YES') AS judge_spec_nullable,
+  bool_or(column_name = 'evidence_policy' AND is_nullable = 'YES') AS evidence_policy_nullable,
+  now() AS checked_at
+FROM information_schema.columns
+WHERE table_schema = 'public'
+  AND table_name = 'agent_loop_versions'
+  AND column_name IN ('judge_spec', 'evidence_policy');
+
+COMMENT ON VIEW public.view_agent_loop_versions_judge_evidence_nullable IS
+  'Drift marker for 0213_agent_loop_versions_judge_evidence_nullable.sql.';
+
+COMMIT;

package/dist/drizzle/0214_think137_drop_judge_evidence_roi.sql

@@ -0,0 +1,99 @@
+-- Purpose: DROP the judge / evidence / ROI schema for Automations
+-- (THINK-137 U10, PR B — destructive schema removal).
+--
+-- Migration ordering: this is the SECOND and final U10 migration. PR A (0213)
+-- removed every reader/writer of the judge / evidence / ROI feature from code
+-- and made agent_loop_versions.judge_spec + evidence_policy nullable so
+-- saveAgentLoop could legally stop writing them. PR A has deployed and
+-- saveAgentLoop was observed creating Automations live WITHOUT these columns.
+-- Only now — after the code-removal PR is live — is it safe to DROP the
+-- columns and tables nothing reads or writes anymore. Running this before PR A
+-- deployed would break live writers, hence the strict A→B ordering.
+--
+-- Drops (in FK-safe order):
+--   1. public.agent_loop_evidence      (has FK agent_loop_judgment_id ->
+--                                        agent_loop_judgments.id, so it goes
+--                                        FIRST)
+--   2. public.agent_loop_judgments
+--   3. public.agent_loops.{accepted_run_count, rejected_run_count,
+--        escalated_run_count, total_cost_usd_cents,
+--        cost_per_accepted_run_usd_cents}   (ROI counters)
+--   4. public.agent_loop_versions.{judge_spec, evidence_policy}
+--        (already nullable from 0213)
+--
+-- Explicitly NOT touched: agent_loops' goal_spec/worker_spec/loop_policy/
+-- target_spec/policy_snapshot are deferred to U11; agent_loop_runs and
+-- agent_loop_iterations keep their own total_cost_usd_cents (U4 cost-cap gate);
+-- workflow_runs.total_cost_usd_cents is unrelated.
+--
+-- This is a hand-rolled DDL migration that Drizzle's generator does not track.
+-- Following the 0210-0213 precedent it uses drop markers (`-- drops:` /
+-- `-- drops-column:`) so the drift reporter (scripts/db-migrate-manual.sh) can
+-- prove each object is ABSENT (DROPPED) in the target DB after apply. It also
+-- drops the now-meaningless 0213 drift-marker view, whose only reason to exist
+-- was to prove the nullability step that this migration supersedes.
+--
+-- Idempotent: every statement uses IF EXISTS, so re-running is a no-op.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0214_think137_drop_judge_evidence_roi.sql
+--
+-- drops: public.agent_loop_evidence
+-- drops: public.agent_loop_judgments
+-- drops-column: public.agent_loops.accepted_run_count
+-- drops-column: public.agent_loops.rejected_run_count
+-- drops-column: public.agent_loops.escalated_run_count
+-- drops-column: public.agent_loops.total_cost_usd_cents
+-- drops-column: public.agent_loops.cost_per_accepted_run_usd_cents
+-- drops-column: public.agent_loop_versions.judge_spec
+-- drops-column: public.agent_loop_versions.evidence_policy
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('think137_drop_judge_evidence_roi_0214'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+-- Pre-flight: the parent tables whose columns we alter must exist. (The
+-- judge/evidence tables themselves are dropped with IF EXISTS, so their
+-- absence is fine.)
+DO $$
+BEGIN
+  IF to_regclass('public.agent_loops') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loops does not exist';
+  END IF;
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+END $$;
+
+-- Drop the now-obsolete 0213 drift-marker view. It probed judge_spec /
+-- evidence_policy nullability via information_schema (a name reference, not a
+-- real column dependency), so it does not block the column drops — but it is
+-- meaningless once the columns are gone.
+DROP VIEW IF EXISTS public.view_agent_loop_versions_judge_evidence_nullable;
+
+-- 1. Evidence first (FK agent_loop_judgment_id -> agent_loop_judgments.id).
+DROP TABLE IF EXISTS public.agent_loop_evidence;
+
+-- 2. Then judgments.
+DROP TABLE IF EXISTS public.agent_loop_judgments;
+
+-- 3. ROI counters on agent_loops (NOT agent_loop_runs/iterations cost columns).
+ALTER TABLE public.agent_loops
+  DROP COLUMN IF EXISTS accepted_run_count,
+  DROP COLUMN IF EXISTS rejected_run_count,
+  DROP COLUMN IF EXISTS escalated_run_count,
+  DROP COLUMN IF EXISTS total_cost_usd_cents,
+  DROP COLUMN IF EXISTS cost_per_accepted_run_usd_cents;
+
+-- 4. judge_spec / evidence_policy on agent_loop_versions (nullable since 0213).
+ALTER TABLE public.agent_loop_versions
+  DROP COLUMN IF EXISTS judge_spec,
+  DROP COLUMN IF EXISTS evidence_policy;
+
+COMMIT;

package/dist/drizzle/0215_agent_loop_versions_goal_worker_policy_nullable.sql

@@ -0,0 +1,70 @@
+-- Purpose: drop the NOT NULL constraint on
+-- agent_loop_versions.goal_spec, .worker_spec, and .loop_policy
+-- (THINK-159 U11, PR A — code removal + nullability).
+--
+-- target_spec is now the SOLE dispatch source: resolveDispatchableVersion,
+-- finalize-projection, the schedule/manual/webhook dispatch SELECTs, and the
+-- automations list all derive goal/worker/loop-policy from target_spec (or the
+-- DEFAULT_LOOP_POLICY) and no longer read these three columns. saveAgentLoop
+-- has stopped writing them, and the GraphQL + web readers are gone. All three
+-- columns were NOT NULL, so the write-stop is only legal once they are
+-- nullable. This migration makes that write-stop legal. The COLUMNS themselves
+-- are DROPPED in the follow-up PR B, after this deploys and saveAgentLoop is
+-- observed creating Automations live.
+--
+-- Behavior-preserving: every live version row already carries a backfilled
+-- target_spec (migration 0211), and the form never set loop_policy, so every
+-- stored loop_policy already equalled DEFAULT_LOOP_POLICY.
+--
+-- Schema-only migration on existing columns. Following the 0202/0211/0213
+-- precedent for hand-rolled DDL that Drizzle's generator does not track, it
+-- publishes a drift-marker VIEW whose columns reflect the resulting nullability
+-- so the drift reporter (scripts/db-migrate-manual.sh) can prove the ALTERs
+-- committed; the `-- creates:` marker below is what the reporter probes.
+--
+-- Idempotent: ALTER COLUMN ... DROP NOT NULL is a no-op when the constraint is
+-- already gone; the marker view is CREATE OR REPLACE. Safe to re-run.
+--
+-- Apply manually (verification pass before merge):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0215_agent_loop_versions_goal_worker_policy_nullable.sql
+--
+-- creates: public.view_agent_loop_versions_goal_worker_policy_nullable
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('agent_loop_versions_goal_worker_policy_nullable_0215'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+BEGIN
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+END $$;
+
+ALTER TABLE public.agent_loop_versions ALTER COLUMN goal_spec DROP NOT NULL;
+ALTER TABLE public.agent_loop_versions ALTER COLUMN worker_spec DROP NOT NULL;
+ALTER TABLE public.agent_loop_versions ALTER COLUMN loop_policy DROP NOT NULL;
+
+-- Drift marker. Its boolean columns reflect the resulting nullability so the
+-- reporter can prove all three constraints were dropped.
+CREATE OR REPLACE VIEW public.view_agent_loop_versions_goal_worker_policy_nullable AS
+SELECT
+  bool_or(column_name = 'goal_spec' AND is_nullable = 'YES') AS goal_spec_nullable,
+  bool_or(column_name = 'worker_spec' AND is_nullable = 'YES') AS worker_spec_nullable,
+  bool_or(column_name = 'loop_policy' AND is_nullable = 'YES') AS loop_policy_nullable,
+  now() AS checked_at
+FROM information_schema.columns
+WHERE table_schema = 'public'
+  AND table_name = 'agent_loop_versions'
+  AND column_name IN ('goal_spec', 'worker_spec', 'loop_policy');
+
+COMMENT ON VIEW public.view_agent_loop_versions_goal_worker_policy_nullable IS
+  'Drift marker for 0215_agent_loop_versions_goal_worker_policy_nullable.sql.';
+
+COMMIT;

package/dist/drizzle/0216_drop_agent_loop_versions_goal_worker_policy.sql

@@ -0,0 +1,81 @@
+-- Purpose: DROP the now-inert agent_loop_versions.goal_spec, .worker_spec,
+-- .loop_policy columns and promote target_spec to NOT NULL (THINK-159 U11,
+-- PR B — the destructive follow-up to PR A #3351).
+--
+-- PR A (deployed) made target_spec the sole dispatch source: resolveDispatchableVersion
+-- derives goalSpec/workerSpec from target_spec.agentThread and synthesizes
+-- DEFAULT_LOOP_POLICY; saveAgentLoop stopped writing the three columns;
+-- migration 0215 made them nullable. Every version row has target_spec
+-- (backfilled by 0211), so the columns are pure dead weight.
+--
+-- Ordering (expand/contract, per docs/solutions/workflow-issues/
+-- dropping-orm-declared-columns-needs-def-removal-deploy-first.md): this file's
+-- companion PR removes the Drizzle column DEFINITIONS from
+-- src/schema/agent-loops.ts, so the deployed ORM stops emitting them in
+-- `.select()` star reads. This DROP is applied to a stage ONLY AFTER that
+-- def-removal code is live there — never pre-applied while a prior deploy's
+-- ORM still declares the columns.
+--
+-- Pre-flight: aborts if any version row has NULL target_spec (would become
+-- undispatchable once the legacy fallback is gone). Idempotent (IF EXISTS).
+--
+-- Apply manually (verification pass before merge, AFTER the def-removal deploy):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 --single-transaction \
+--     -f packages/database-pg/drizzle/0216_drop_agent_loop_versions_goal_worker_policy.sql
+--
+-- drops-column: public.agent_loop_versions.goal_spec
+-- drops-column: public.agent_loop_versions.worker_spec
+-- drops-column: public.agent_loop_versions.loop_policy
+-- creates: public.view_agent_loop_versions_target_spec_required
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('think159_drop_goal_worker_policy_0216'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+DO $$
+DECLARE
+  null_target_spec_count bigint;
+BEGIN
+  IF to_regclass('public.agent_loop_versions') IS NULL THEN
+    RAISE EXCEPTION 'pre-flight: public.agent_loop_versions does not exist';
+  END IF;
+  SELECT count(*) INTO null_target_spec_count
+  FROM public.agent_loop_versions
+  WHERE target_spec IS NULL;
+  IF null_target_spec_count > 0 THEN
+    RAISE EXCEPTION
+      'pre-flight: % agent_loop_versions rows have NULL target_spec; re-run the 0211 backfill before dropping the legacy columns',
+      null_target_spec_count;
+  END IF;
+END $$;
+
+-- Obsolete nullability drift-marker view from 0215 (its columns are dropped
+-- below); mirrors 0214 dropping the 0213 marker view.
+DROP VIEW IF EXISTS public.view_agent_loop_versions_goal_worker_policy_nullable;
+
+ALTER TABLE public.agent_loop_versions ALTER COLUMN target_spec SET NOT NULL;
+
+ALTER TABLE public.agent_loop_versions
+  DROP COLUMN IF EXISTS goal_spec,
+  DROP COLUMN IF EXISTS worker_spec,
+  DROP COLUMN IF EXISTS loop_policy;
+
+-- Drift marker: presence proves the drop transaction committed and target_spec
+-- is now required.
+CREATE OR REPLACE VIEW public.view_agent_loop_versions_target_spec_required AS
+SELECT
+  bool_or(column_name = 'target_spec' AND is_nullable = 'NO') AS target_spec_not_null,
+  bool_and(column_name NOT IN ('goal_spec', 'worker_spec', 'loop_policy')) AS legacy_columns_dropped,
+  now() AS checked_at
+FROM information_schema.columns
+WHERE table_schema = 'public' AND table_name = 'agent_loop_versions';
+
+COMMENT ON VIEW public.view_agent_loop_versions_target_spec_required IS
+  'Drift marker for 0216_drop_agent_loop_versions_goal_worker_policy.sql (THINK-159 U11).';
+
+COMMIT;

package/dist/drizzle/0217_agents_capability_folder_dispatch.sql

@@ -0,0 +1,12 @@
+-- THINK-173 U5 (R20): per-agent capability-folder migration flag.
+-- When true, dispatch reads the agent's capability surface from the
+-- rendered folder manifest instead of the legacy MCP tables. Flipped
+-- atomically per agent by the U11 backfill after its divergence check
+-- passes. Additive + default false — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0217_agents_capability_folder_dispatch.sql
+-- creates-column: public.agents.capability_folder_dispatch
+
+ALTER TABLE public.agents
+  ADD COLUMN IF NOT EXISTS capability_folder_dispatch boolean NOT NULL DEFAULT false;

package/dist/drizzle/0218_document_plates.sql

@@ -0,0 +1,30 @@
+-- THINK-153 U1: tenant-scoped document plate registry.
+-- Platform plates are code-defined (packages/api plate-definitions.ts);
+-- this table stores only tenant deltas (origin = 'platform_override') and
+-- tenant-created plates (origin = 'tenant'). Additive — safe to apply ahead
+-- of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0218_document_plates.sql
+-- creates: public.document_plates
+
+CREATE TABLE IF NOT EXISTS public.document_plates (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  slug text NOT NULL,
+  origin text NOT NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  hidden boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT document_plates_origin_check
+    CHECK (origin IN ('platform_override', 'tenant')),
+  CONSTRAINT document_plates_slug_check
+    CHECK (slug ~ '^[a-z0-9][a-z0-9-]{0,63}$')
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS document_plates_tenant_slug_uidx
+  ON public.document_plates (tenant_id, slug);
+
+CREATE INDEX IF NOT EXISTS document_plates_tenant_idx
+  ON public.document_plates (tenant_id);