thinkwork-cli 0.12.17 → 0.13.1

package/dist/drizzle/0232_memory_source_thin_ledger.sql

@@ -0,0 +1,176 @@
+-- THINK-193 U1: external-memory-compounding thin ledger.
+-- Contents:
+--   * memory_processor_configs — one processor per shared scope (partial
+--     unique on active target).
+--   * memory_source_configs — source bindings under a processor.
+--   * memory_source_checkpoints — CAS cursor per source partition.
+--   * memory_evidence_items — evidence ledger with lifecycle + lineage inputs.
+--   * memory_run_items — per-run stage idempotency ledger.
+--   * memory_derivations — evidence -> Hindsight projection lineage.
+--
+-- NOT done here (deliberately): no claims tables, no identity tables —
+-- thin U1 set only.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0232_memory_source_thin_ledger.sql
+-- creates: public.memory_processor_configs
+-- creates: public.memory_source_configs
+-- creates: public.memory_source_checkpoints
+-- creates: public.memory_evidence_items
+-- creates: public.memory_run_items
+-- creates: public.memory_derivations
+
+CREATE TABLE IF NOT EXISTS public.memory_processor_configs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  mode text NOT NULL,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  workflow_id uuid REFERENCES public.workflows(id) ON DELETE SET NULL,
+  enabled boolean NOT NULL DEFAULT true,
+  status text NOT NULL DEFAULT 'active',
+  budget jsonb NOT NULL DEFAULT '{}'::jsonb,
+  config_version integer NOT NULL DEFAULT 1,
+  created_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_processor_configs_mode_check
+    CHECK (mode IN ('personal', 'shared')),
+  CONSTRAINT memory_processor_configs_target_scope_check
+    CHECK (target_scope IN ('user', 'space', 'tenant')),
+  CONSTRAINT memory_processor_configs_status_check
+    CHECK (status IN ('active', 'disabled'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_processor_configs_active_target_uidx
+  ON public.memory_processor_configs (tenant_id, mode, target_scope, target_id)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_processor_configs_tenant_idx
+  ON public.memory_processor_configs (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_source_configs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  processor_config_id uuid NOT NULL
+    REFERENCES public.memory_processor_configs(id) ON DELETE CASCADE,
+  source_family text NOT NULL,
+  source_binding_key text NOT NULL,
+  enabled boolean NOT NULL DEFAULT true,
+  boundary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  policy_version integer NOT NULL DEFAULT 1,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_source_configs_source_family_check
+    CHECK (source_family IN ('twenty', 'firecrawl', 'email', 'bedrock_kb'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_configs_binding_uidx
+  ON public.memory_source_configs (processor_config_id, source_family, source_binding_key);
+
+CREATE INDEX IF NOT EXISTS memory_source_configs_tenant_idx
+  ON public.memory_source_configs (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_source_checkpoints (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  partition_key text NOT NULL,
+  "cursor" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  version integer NOT NULL DEFAULT 0,
+  last_advanced_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_checkpoints_partition_uidx
+  ON public.memory_source_checkpoints (source_config_id, partition_key);
+
+CREATE TABLE IF NOT EXISTS public.memory_evidence_items (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  source_item_id text NOT NULL,
+  source_version text NOT NULL,
+  source_timestamp timestamptz,
+  content_hash text NOT NULL,
+  acquisition_run_id uuid REFERENCES public.workflow_runs(id) ON DELETE SET NULL,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  lifecycle text NOT NULL DEFAULT 'active',
+  sensitivity text,
+  snapshot_ref text,
+  normalized_snapshot jsonb,
+  extraction_recipe jsonb NOT NULL DEFAULT '{}'::jsonb,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_evidence_items_target_scope_check
+    CHECK (target_scope IN ('space', 'tenant')),
+  CONSTRAINT memory_evidence_items_lifecycle_check
+    CHECK (lifecycle IN ('active', 'superseded', 'deleted', 'deferred', 'failed'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_evidence_items_source_version_uidx
+  ON public.memory_evidence_items (source_config_id, source_item_id, source_version);
+
+CREATE INDEX IF NOT EXISTS memory_evidence_items_tenant_idx
+  ON public.memory_evidence_items (tenant_id);
+
+CREATE INDEX IF NOT EXISTS memory_evidence_items_source_lifecycle_idx
+  ON public.memory_evidence_items (source_config_id, lifecycle);
+
+CREATE TABLE IF NOT EXISTS public.memory_run_items (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  workflow_run_id uuid NOT NULL
+    REFERENCES public.workflow_runs(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  source_item_id text NOT NULL,
+  stage text NOT NULL,
+  result text NOT NULL,
+  detail jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_run_items_stage_check
+    CHECK (stage IN ('acquire', 'extract', 'project', 'resolve', 'retain', 'compound', 'graph', 'wiki', 'preflight')),
+  CONSTRAINT memory_run_items_result_check
+    CHECK (result IN ('seen', 'changed', 'retracted', 'deferred', 'failed', 'noop'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_run_items_stage_uidx
+  ON public.memory_run_items (workflow_run_id, source_config_id, source_item_id, stage);
+
+CREATE INDEX IF NOT EXISTS memory_run_items_run_idx
+  ON public.memory_run_items (workflow_run_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_derivations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  evidence_item_id uuid NOT NULL
+    REFERENCES public.memory_evidence_items(id) ON DELETE CASCADE,
+  projection_key text NOT NULL,
+  target_bank_id text NOT NULL,
+  hindsight_document_id text NOT NULL,
+  current_version text NOT NULL,
+  lifecycle text NOT NULL DEFAULT 'active',
+  retracted_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_derivations_lifecycle_check
+    CHECK (lifecycle IN ('active', 'superseded', 'retracted'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_derivations_active_projection_uidx
+  ON public.memory_derivations (source_config_id, projection_key)
+  WHERE lifecycle = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_derivations_tenant_idx
+  ON public.memory_derivations (tenant_id);
+
+CREATE INDEX IF NOT EXISTS memory_derivations_evidence_idx
+  ON public.memory_derivations (evidence_item_id);

package/dist/drizzle/0232_message_source_event_id.sql

@@ -0,0 +1,9 @@
+-- creates-column: public.messages.source_event_id
+-- creates: public.uq_messages_tenant_source_event_id
+
+ALTER TABLE public.messages
+  ADD COLUMN IF NOT EXISTS source_event_id text;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_messages_tenant_source_event_id
+  ON public.messages (tenant_id, source_event_id)
+  WHERE source_event_id IS NOT NULL;

package/dist/drizzle/0233_msteams_install_and_links.sql

@@ -0,0 +1,151 @@
+-- Purpose: add Microsoft Teams application persistence for tenant installs, user links, and Teams conversation mapping.
+-- Plan: THINK-84 (U6 install path; msteams_threads is created now so one migration covers the domain for U7)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0233_msteams_install_and_links.sql
+-- After applying, RE-APPLY 0227_analyst_reader_role.sql and 0230_analyst_rls.sql:
+-- their regenerated grant/RLS sections cover the msteams tables, and databases
+-- that ran them before these tables existed have no analyst grants/policies
+-- for them (0230's msteams policy markers gate this in the drift reporter;
+-- 0227's grants are not marker-checkable).
+-- creates: public.msteams_tenant_installs
+-- creates: public.msteams_user_links
+-- creates: public.msteams_threads
+-- creates: public.uq_msteams_tenant_installs_entra_tenant
+-- creates: public.uq_msteams_tenant_installs_tenant_entra_tenant
+-- creates: public.uq_msteams_tenant_installs_tenant_active
+-- creates: public.idx_msteams_tenant_installs_tenant_status
+-- creates: public.uq_msteams_user_links_entra_tenant_aad_object
+-- creates: public.idx_msteams_user_links_tenant_user
+-- creates: public.idx_msteams_user_links_user
+-- creates: public.uq_msteams_threads_entra_tenant_conversation
+-- creates: public.idx_msteams_threads_thread
+-- creates: public.idx_msteams_threads_tenant_entra_tenant
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_installed_by_user_id_users_id_fk
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_status_allowed
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_consent_status_allowed
+-- creates-constraint: public.msteams_user_links.msteams_user_links_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_entra_tenant_id_installs_entra_tenant_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_user_id_users_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_status_allowed
+-- creates-constraint: public.msteams_threads.msteams_threads_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_threads.msteams_threads_entra_tenant_id_installs_entra_tenant_id_fk
+-- creates-constraint: public.msteams_threads.msteams_threads_thread_id_threads_id_fk
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS public.msteams_tenant_installs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  bot_app_id text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  consent_status text NOT NULL DEFAULT 'pending',
+  installed_by_user_id uuid,
+  installed_at timestamptz,
+  uninstalled_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_tenant_installs_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_tenant_installs_installed_by_user_id_users_id_fk
+    FOREIGN KEY (installed_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT msteams_tenant_installs_status_allowed
+    CHECK (status IN ('pending','active','uninstalled','revoked')),
+  CONSTRAINT msteams_tenant_installs_consent_status_allowed
+    CHECK (consent_status IN ('pending','granted','admin_required','revoked'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_entra_tenant
+  ON public.msteams_tenant_installs (entra_tenant_id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_tenant_entra_tenant
+  ON public.msteams_tenant_installs (tenant_id, entra_tenant_id);
+
+-- A ThinkWork tenant has at most one ACTIVE Entra binding; concurrent
+-- consent callbacks cannot race two bindings live.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_tenant_active
+  ON public.msteams_tenant_installs (tenant_id)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_msteams_tenant_installs_tenant_status
+  ON public.msteams_tenant_installs (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.msteams_user_links (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  aad_object_id text NOT NULL,
+  user_id uuid NOT NULL,
+  display_name text,
+  status text NOT NULL DEFAULT 'active',
+  linked_at timestamptz NOT NULL DEFAULT now(),
+  unlinked_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_user_links_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_user_links_entra_tenant_id_installs_entra_tenant_id_fk
+    FOREIGN KEY (entra_tenant_id)
+    REFERENCES public.msteams_tenant_installs(entra_tenant_id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_user_links_user_id_users_id_fk
+    FOREIGN KEY (user_id)
+    REFERENCES public.users(id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_user_links_status_allowed
+    CHECK (status IN ('active','unlinked','orphaned','suspended'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_user_links_entra_tenant_aad_object
+  ON public.msteams_user_links (entra_tenant_id, aad_object_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_user_links_tenant_user
+  ON public.msteams_user_links (tenant_id, user_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_user_links_user
+  ON public.msteams_user_links (user_id);
+
+CREATE TABLE IF NOT EXISTS public.msteams_threads (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  conversation_id text NOT NULL,
+  service_url text NOT NULL,
+  thread_id uuid NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_threads_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_threads_entra_tenant_id_installs_entra_tenant_id_fk
+    FOREIGN KEY (entra_tenant_id)
+    REFERENCES public.msteams_tenant_installs(entra_tenant_id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_threads_thread_id_threads_id_fk
+    FOREIGN KEY (thread_id)
+    REFERENCES public.threads(id)
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_threads_entra_tenant_conversation
+  ON public.msteams_threads (entra_tenant_id, conversation_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_threads_thread
+  ON public.msteams_threads (thread_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_threads_tenant_entra_tenant
+  ON public.msteams_threads (tenant_id, entra_tenant_id);
+
+COMMIT;

package/dist/drizzle/0233_workflow_memory_stage_tokens.sql

@@ -0,0 +1,20 @@
+-- THINK-193 U1: widen workflow_task_tokens purpose domain with
+-- 'memory_stage' (task tokens held while a memory pipeline stage runs).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0233_workflow_memory_stage_tokens.sql
+-- creates-constraint: public.workflow_task_tokens.workflow_task_tokens_purpose_check_v2
+--
+-- The constraint is RENAMED (_v2), not redefined in place: the drift
+-- reporter probes constraints by NAME only, so redefining under the old
+-- name would report APPLIED on environments still carrying the narrow
+-- 0221 list. The _v2 name makes an unapplied widening visible as MISSING.
+
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_purpose_check;
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_purpose_check_v2;
+ALTER TABLE public.workflow_task_tokens
+  ADD CONSTRAINT workflow_task_tokens_purpose_check_v2 CHECK (
+    purpose IN ('agent_step', 'approval', 'memory_stage')
+  );

package/dist/drizzle/0234_memory_claim_lifecycle.sql

@@ -0,0 +1,160 @@
+-- THINK-193 U2: external-memory claim lifecycle.
+-- Contents:
+--   * memory_source_authorizations — explicit grant, the MAXIMUM readable
+--     envelope per (processor, family, binding) (partial unique on active).
+--   * memory_claims — durable ontology-shaped claims with a null-safe
+--     fingerprint unique index (COALESCE folds NULL effective_from).
+--   * memory_claim_evidence — many-to-many claim <- evidence support edges.
+--   * memory_retraction_attempts — idempotent multi-system retraction ledger
+--     (retain-attempts-shaped: status/attempt/lock columns, partial unique so
+--     a completed retraction can be re-queued later).
+--   * memory_evidence_items.snapshot_expires_at — app-enforced S3 snapshot TTL.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0234_memory_claim_lifecycle.sql
+-- creates: public.memory_source_authorizations
+-- creates: public.memory_claims
+-- creates: public.memory_claim_evidence
+-- creates: public.memory_retraction_attempts
+-- creates-column: public.memory_evidence_items.snapshot_expires_at
+
+CREATE TABLE IF NOT EXISTS public.memory_source_authorizations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  processor_config_id uuid NOT NULL
+    REFERENCES public.memory_processor_configs(id) ON DELETE CASCADE,
+  source_family text NOT NULL,
+  source_binding_key text NOT NULL,
+  boundary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  granted_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  grant_version integer NOT NULL DEFAULT 1,
+  status text NOT NULL DEFAULT 'active',
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  sensitivity jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_source_authorizations_source_family_check
+    CHECK (source_family IN ('twenty', 'firecrawl', 'email', 'bedrock_kb')),
+  CONSTRAINT memory_source_authorizations_status_check
+    CHECK (status IN ('active', 'revoked', 'expired'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_authorizations_active_uidx
+  ON public.memory_source_authorizations (processor_config_id, source_family, source_binding_key)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_source_authorizations_tenant_idx
+  ON public.memory_source_authorizations (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_claims (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  canonical_subject_id uuid,
+  subject_key text NOT NULL,
+  subject_entity_type text NOT NULL DEFAULT 'customer',
+  ontology_predicate text NOT NULL,
+  value jsonb NOT NULL,
+  value_hash text NOT NULL,
+  effective_from timestamptz,
+  effective_to timestamptz,
+  status text NOT NULL DEFAULT 'active',
+  conflict_state text NOT NULL DEFAULT 'none',
+  extraction_version text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_claims_target_scope_check
+    CHECK (target_scope IN ('space', 'tenant')),
+  CONSTRAINT memory_claims_status_check
+    CHECK (status IN ('active', 'superseded', 'retracted')),
+  CONSTRAINT memory_claims_conflict_state_check
+    CHECK (conflict_state IN ('none', 'conflicted'))
+);
+
+-- Null-safe fingerprint: COALESCE folds NULL effective_from into '-infinity'
+-- so duplicate open-ended claims collide instead of coexisting.
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claims_fingerprint_uidx
+  ON public.memory_claims (
+    tenant_id,
+    target_scope,
+    target_id,
+    subject_key,
+    ontology_predicate,
+    value_hash,
+    COALESCE(effective_from, '-infinity'::timestamptz)
+  );
+
+CREATE INDEX IF NOT EXISTS memory_claims_target_subject_idx
+  ON public.memory_claims (tenant_id, target_scope, target_id, subject_key);
+
+CREATE INDEX IF NOT EXISTS memory_claims_tenant_status_idx
+  ON public.memory_claims (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.memory_claim_evidence (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  claim_id uuid NOT NULL
+    REFERENCES public.memory_claims(id) ON DELETE CASCADE,
+  evidence_item_id uuid NOT NULL
+    REFERENCES public.memory_evidence_items(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  status text NOT NULL DEFAULT 'active',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  retracted_at timestamptz,
+  CONSTRAINT memory_claim_evidence_status_check
+    CHECK (status IN ('active', 'retracted'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claim_evidence_pair_uidx
+  ON public.memory_claim_evidence (claim_id, evidence_item_id);
+
+CREATE INDEX IF NOT EXISTS memory_claim_evidence_evidence_idx
+  ON public.memory_claim_evidence (evidence_item_id);
+
+CREATE INDEX IF NOT EXISTS memory_claim_evidence_claim_status_idx
+  ON public.memory_claim_evidence (claim_id, status);
+
+CREATE TABLE IF NOT EXISTS public.memory_retraction_attempts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  scope text NOT NULL,
+  derivation_id uuid REFERENCES public.memory_derivations(id) ON DELETE SET NULL,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'hindsight',
+  provider_document_id text NOT NULL,
+  target_bank_id text NOT NULL,
+  status text NOT NULL DEFAULT 'queued',
+  attempt_count integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 5,
+  next_retry_at timestamptz,
+  locked_at timestamptz,
+  locked_by text,
+  error_class text,
+  error_message text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz,
+  CONSTRAINT memory_retraction_attempts_scope_check
+    CHECK (scope IN ('derivation', 'source')),
+  CONSTRAINT memory_retraction_attempts_status_check
+    CHECK (status IN ('queued', 'running', 'supports_updated', 'provider_deleted', 'reconsolidated', 'retracted', 'failed', 'dead_lettered')),
+  CONSTRAINT memory_retraction_attempts_attempt_count_nonnegative
+    CHECK (attempt_count >= 0),
+  CONSTRAINT memory_retraction_attempts_max_attempts_positive
+    CHECK (max_attempts > 0)
+);
+
+-- Partial unique — a completed retraction can be re-queued later.
+CREATE UNIQUE INDEX IF NOT EXISTS memory_retraction_attempts_document_uidx
+  ON public.memory_retraction_attempts (tenant_id, provider, provider_document_id)
+  WHERE status NOT IN ('retracted', 'dead_lettered');
+
+CREATE INDEX IF NOT EXISTS memory_retraction_attempts_due_idx
+  ON public.memory_retraction_attempts (status, next_retry_at, created_at);
+
+ALTER TABLE public.memory_evidence_items
+  ADD COLUMN IF NOT EXISTS snapshot_expires_at timestamptz;

package/dist/drizzle/0235_workflow_token_execution_claim.sql

@@ -0,0 +1,34 @@
+-- THINK-193 U1 (Codex F1/F7/F9): durable pre-execution claim for workflow
+-- task tokens. Adds the 'executing' status (pending -> executing -> consumed),
+-- lease columns (locked_at/locked_by, stale claims are re-claimable), and a
+-- persisted completion result for safe redrive after a SendTaskSuccess
+-- transient failure.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0235_workflow_token_execution_claim.sql
+-- creates-constraint: public.workflow_task_tokens.workflow_task_tokens_status_check_v2
+-- creates-column: public.workflow_task_tokens.locked_at
+-- creates-column: public.workflow_task_tokens.locked_by
+-- creates-column: public.workflow_task_tokens.result
+--
+-- The constraint is RENAMED (_v2), not redefined in place: the drift
+-- reporter probes constraints by NAME only, so redefining under the old
+-- name would report APPLIED on environments still carrying the narrow
+-- three-status list. The _v2 name makes an unapplied widening visible as
+-- MISSING. (Same precedent as 0233's purpose-check widening.)
+
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS locked_at timestamptz;
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS locked_by text;
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS result jsonb;
+
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_status_check;
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_status_check_v2;
+ALTER TABLE public.workflow_task_tokens
+  ADD CONSTRAINT workflow_task_tokens_status_check_v2 CHECK (
+    status IN ('pending', 'executing', 'consumed', 'expired')
+  );

package/dist/drizzle/0236_memory_retraction_fencing.sql

@@ -0,0 +1,50 @@
+-- THINK-193 U2 (Codex P1/P2 merge blockers): retraction saga worker fencing
+-- and durable source-erase aggregate markers.
+-- Contents:
+--   * memory_retraction_attempts.lock_generation — fencing token; every CAS
+--     claim increments it and all saga transitions (recordProgress /
+--     finalizeInternalState / markRetracted / markFailed) CAS on
+--     (locked_by, lock_generation) so a worker reclaimed past a stale lease
+--     can never clobber the newer claimant's progress.
+--   * memory_retraction_attempts.reconsolidation_note — non-null when the
+--     reconsolidation step was skipped (delete-capable adapter without a
+--     consolidator): durable skipped-with-reason, distinct from success.
+--   * scope CHECK v2 — adds 'erase': one durable aggregate marker row per
+--     source erase (synthetic erase:<sourceConfigId> document id under the
+--     existing partial unique document index). Markers are excluded from the
+--     per-document saga; the scheduled memory-retraction-drainer keys its
+--     self-finalizing cleanup sweep (S3 snapshot prefix -> evidence purge ->
+--     checkpoints LAST) on them, covering sources with zero derivations.
+--     NEW constraint name: the drift reporter probes by name only.
+--
+-- No status CHECK changes: the status value set is unchanged; only the
+-- saga's transition ORDER moved (provider delete now precedes the internal
+-- finalize transaction).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0236_memory_retraction_fencing.sql
+-- creates-column: public.memory_retraction_attempts.lock_generation
+-- creates-column: public.memory_retraction_attempts.reconsolidation_note
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_scope_check_v2
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS lock_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS reconsolidation_note text;
+
+ALTER TABLE public.memory_retraction_attempts
+  DROP CONSTRAINT IF EXISTS memory_retraction_attempts_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_scope_check_v2'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_scope_check_v2
+      CHECK (scope IN ('derivation', 'source', 'erase'));
+  END IF;
+END $$;