thinkwork-cli 0.13.0 → 0.13.2

package/dist/drizzle/0230_analyst_rls.sql

@@ -62,6 +62,15 @@
 -- creates-policy: public.agent_operation_leases.analyst_tenant_isolation
 -- creates-policy: public.eval_results.analyst_tenant_isolation
 -- creates-policy: public.plugin_components.analyst_tenant_isolation
+--
+-- THINK-84 U6: the msteams tables landed after this file was first applied,
+-- so their policies are declared explicitly — the drift gate must force a
+-- re-apply on databases that ran 0230 before the msteams tables existed.
+-- (0227's grants for the same tables are not marker-checkable; re-apply
+-- 0227 alongside 0233 and this file — see the 0233 header.)
+-- creates-policy: public.msteams_tenant_installs.analyst_tenant_isolation
+-- creates-policy: public.msteams_user_links.analyst_tenant_isolation
+-- creates-policy: public.msteams_threads.analyst_tenant_isolation
 
 \set ON_ERROR_STOP on
 
@@ -335,32 +344,59 @@ BEGIN
   ELSE
     missing := missing || 'billing_export_line_items'::text;
   END IF;
-  IF to_regclass('public.brain_dream_actions') IS NOT NULL THEN
-    ALTER TABLE public.brain_dream_actions ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.brain_dream_actions;
-    CREATE POLICY analyst_tenant_isolation ON public.brain_dream_actions
+  IF to_regclass('public.budget_policies') IS NOT NULL THEN
+    ALTER TABLE public.budget_policies ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.budget_policies;
+    CREATE POLICY analyst_tenant_isolation ON public.budget_policies
       FOR SELECT TO analyst_reader
-      USING (EXISTS (SELECT 1 FROM public.brain_dream_runs p WHERE p.id = public.brain_dream_actions.run_id AND p.tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid));
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'brain_dream_actions'::text;
+    missing := missing || 'budget_policies'::text;
   END IF;
-  IF to_regclass('public.brain_dream_runs') IS NOT NULL THEN
-    ALTER TABLE public.brain_dream_runs ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.brain_dream_runs;
-    CREATE POLICY analyst_tenant_isolation ON public.brain_dream_runs
+  IF to_regclass('public.capability_broker_calls') IS NOT NULL THEN
+    ALTER TABLE public.capability_broker_calls ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_broker_calls;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_broker_calls
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'brain_dream_runs'::text;
+    missing := missing || 'capability_broker_calls'::text;
   END IF;
-  IF to_regclass('public.budget_policies') IS NOT NULL THEN
-    ALTER TABLE public.budget_policies ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.budget_policies;
-    CREATE POLICY analyst_tenant_isolation ON public.budget_policies
+  IF to_regclass('public.capability_broker_sessions') IS NOT NULL THEN
+    ALTER TABLE public.capability_broker_sessions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_broker_sessions;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_broker_sessions
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'budget_policies'::text;
+    missing := missing || 'capability_broker_sessions'::text;
+  END IF;
+  IF to_regclass('public.capability_connection_proposals') IS NOT NULL THEN
+    ALTER TABLE public.capability_connection_proposals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_connection_proposals;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_connection_proposals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_connection_proposals'::text;
+  END IF;
+  IF to_regclass('public.capability_definitions') IS NOT NULL THEN
+    ALTER TABLE public.capability_definitions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_definitions;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_definitions
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_definitions'::text;
+  END IF;
+  IF to_regclass('public.capability_routine_proposals') IS NOT NULL THEN
+    ALTER TABLE public.capability_routine_proposals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_routine_proposals;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_routine_proposals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_routine_proposals'::text;
   END IF;
   IF to_regclass('public.connections') IS NOT NULL THEN
     ALTER TABLE public.connections ENABLE ROW LEVEL SECURITY;
@@ -632,6 +668,15 @@ BEGIN
   ELSE
     missing := missing || 'guardrails'::text;
   END IF;
+  IF to_regclass('public.harness_tool_execution_events') IS NOT NULL THEN
+    ALTER TABLE public.harness_tool_execution_events ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.harness_tool_execution_events;
+    CREATE POLICY analyst_tenant_isolation ON public.harness_tool_execution_events
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'harness_tool_execution_events'::text;
+  END IF;
   IF to_regclass('public.inbox_item_comments') IS NOT NULL THEN
     ALTER TABLE public.inbox_item_comments ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.inbox_item_comments;
@@ -659,6 +704,15 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
+  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
+    ALTER TABLE public.knowledge_base_documents ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_base_documents;
+    CREATE POLICY analyst_tenant_isolation ON public.knowledge_base_documents
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'knowledge_base_documents'::text;
+  END IF;
   IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
     ALTER TABLE public.knowledge_bases ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_bases;
@@ -668,51 +722,6 @@ BEGIN
   ELSE
     missing := missing || 'knowledge_bases'::text;
   END IF;
-  IF to_regclass('public.knowledge_graph_entities') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_entities ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_entities;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_entities
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_entities'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_evidence') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_evidence ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_evidence;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_evidence
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_evidence'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_ingest_runs') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_ingest_runs ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_ingest_runs;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_ingest_runs
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_ingest_runs'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_observation_cursors') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_observation_cursors ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_observation_cursors;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_observation_cursors
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_observation_cursors'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_relationships') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_relationships ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_relationships;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_relationships
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_relationships'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     ALTER TABLE public.linked_task_events ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.linked_task_events;
@@ -758,14 +767,95 @@ BEGIN
   ELSE
     missing := missing || 'managed_applications'::text;
   END IF;
-  IF to_regclass('public.memory_retain_attempts') IS NOT NULL THEN
-    ALTER TABLE public.memory_retain_attempts ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_retain_attempts;
-    CREATE POLICY analyst_tenant_isolation ON public.memory_retain_attempts
+  IF to_regclass('public.memory_claim_evidence') IS NOT NULL THEN
+    ALTER TABLE public.memory_claim_evidence ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_claim_evidence;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_claim_evidence
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'memory_retain_attempts'::text;
+    missing := missing || 'memory_claim_evidence'::text;
+  END IF;
+  IF to_regclass('public.memory_claims') IS NOT NULL THEN
+    ALTER TABLE public.memory_claims ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_claims;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_claims
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_claims'::text;
+  END IF;
+  IF to_regclass('public.memory_derivations') IS NOT NULL THEN
+    ALTER TABLE public.memory_derivations ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_derivations;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_derivations
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_derivations'::text;
+  END IF;
+  IF to_regclass('public.memory_evidence_items') IS NOT NULL THEN
+    ALTER TABLE public.memory_evidence_items ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_evidence_items;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_evidence_items
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_evidence_items'::text;
+  END IF;
+  IF to_regclass('public.memory_processor_configs') IS NOT NULL THEN
+    ALTER TABLE public.memory_processor_configs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_processor_configs;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_processor_configs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_processor_configs'::text;
+  END IF;
+  IF to_regclass('public.memory_retraction_attempts') IS NOT NULL THEN
+    ALTER TABLE public.memory_retraction_attempts ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_retraction_attempts;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_retraction_attempts
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_retraction_attempts'::text;
+  END IF;
+  IF to_regclass('public.memory_run_items') IS NOT NULL THEN
+    ALTER TABLE public.memory_run_items ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_run_items;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_run_items
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_run_items'::text;
+  END IF;
+  IF to_regclass('public.memory_source_authorizations') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_authorizations ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_authorizations;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_authorizations
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_source_authorizations'::text;
+  END IF;
+  IF to_regclass('public.memory_source_checkpoints') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_checkpoints ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_checkpoints;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_checkpoints
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_source_checkpoints'::text;
+  END IF;
+  IF to_regclass('public.memory_source_configs') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_configs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_configs;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_configs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_source_configs'::text;
   END IF;
   IF to_regclass('public.message_artifacts') IS NOT NULL THEN
     ALTER TABLE public.message_artifacts ENABLE ROW LEVEL SECURITY;
@@ -794,6 +884,33 @@ BEGIN
   ELSE
     missing := missing || 'messages'::text;
   END IF;
+  IF to_regclass('public.msteams_tenant_installs') IS NOT NULL THEN
+    ALTER TABLE public.msteams_tenant_installs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_tenant_installs;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_tenant_installs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_tenant_installs'::text;
+  END IF;
+  IF to_regclass('public.msteams_threads') IS NOT NULL THEN
+    ALTER TABLE public.msteams_threads ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_threads;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_threads
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_threads'::text;
+  END IF;
+  IF to_regclass('public.msteams_user_links') IS NOT NULL THEN
+    ALTER TABLE public.msteams_user_links ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_user_links;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_user_links
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_user_links'::text;
+  END IF;
   IF to_regclass('public.mutation_idempotency') IS NOT NULL THEN
     ALTER TABLE public.mutation_idempotency ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.mutation_idempotency;
@@ -1226,6 +1343,15 @@ BEGIN
   ELSE
     missing := missing || 'tenant_policy_events'::text;
   END IF;
+  IF to_regclass('public.tenant_service_principals') IS NOT NULL THEN
+    ALTER TABLE public.tenant_service_principals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tenant_service_principals;
+    CREATE POLICY analyst_tenant_isolation ON public.tenant_service_principals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'tenant_service_principals'::text;
+  END IF;
   IF to_regclass('public.tenant_settings') IS NOT NULL THEN
     ALTER TABLE public.tenant_settings ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tenant_settings;

package/dist/drizzle/0232_memory_source_thin_ledger.sql

@@ -0,0 +1,176 @@
+-- THINK-193 U1: external-memory-compounding thin ledger.
+-- Contents:
+--   * memory_processor_configs — one processor per shared scope (partial
+--     unique on active target).
+--   * memory_source_configs — source bindings under a processor.
+--   * memory_source_checkpoints — CAS cursor per source partition.
+--   * memory_evidence_items — evidence ledger with lifecycle + lineage inputs.
+--   * memory_run_items — per-run stage idempotency ledger.
+--   * memory_derivations — evidence -> Hindsight projection lineage.
+--
+-- NOT done here (deliberately): no claims tables, no identity tables —
+-- thin U1 set only.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0232_memory_source_thin_ledger.sql
+-- creates: public.memory_processor_configs
+-- creates: public.memory_source_configs
+-- creates: public.memory_source_checkpoints
+-- creates: public.memory_evidence_items
+-- creates: public.memory_run_items
+-- creates: public.memory_derivations
+
+CREATE TABLE IF NOT EXISTS public.memory_processor_configs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  mode text NOT NULL,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  workflow_id uuid REFERENCES public.workflows(id) ON DELETE SET NULL,
+  enabled boolean NOT NULL DEFAULT true,
+  status text NOT NULL DEFAULT 'active',
+  budget jsonb NOT NULL DEFAULT '{}'::jsonb,
+  config_version integer NOT NULL DEFAULT 1,
+  created_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_processor_configs_mode_check
+    CHECK (mode IN ('personal', 'shared')),
+  CONSTRAINT memory_processor_configs_target_scope_check
+    CHECK (target_scope IN ('user', 'space', 'tenant')),
+  CONSTRAINT memory_processor_configs_status_check
+    CHECK (status IN ('active', 'disabled'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_processor_configs_active_target_uidx
+  ON public.memory_processor_configs (tenant_id, mode, target_scope, target_id)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_processor_configs_tenant_idx
+  ON public.memory_processor_configs (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_source_configs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  processor_config_id uuid NOT NULL
+    REFERENCES public.memory_processor_configs(id) ON DELETE CASCADE,
+  source_family text NOT NULL,
+  source_binding_key text NOT NULL,
+  enabled boolean NOT NULL DEFAULT true,
+  boundary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  policy_version integer NOT NULL DEFAULT 1,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_source_configs_source_family_check
+    CHECK (source_family IN ('twenty', 'firecrawl', 'email', 'bedrock_kb'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_configs_binding_uidx
+  ON public.memory_source_configs (processor_config_id, source_family, source_binding_key);
+
+CREATE INDEX IF NOT EXISTS memory_source_configs_tenant_idx
+  ON public.memory_source_configs (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_source_checkpoints (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  partition_key text NOT NULL,
+  "cursor" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  version integer NOT NULL DEFAULT 0,
+  last_advanced_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_checkpoints_partition_uidx
+  ON public.memory_source_checkpoints (source_config_id, partition_key);
+
+CREATE TABLE IF NOT EXISTS public.memory_evidence_items (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  source_item_id text NOT NULL,
+  source_version text NOT NULL,
+  source_timestamp timestamptz,
+  content_hash text NOT NULL,
+  acquisition_run_id uuid REFERENCES public.workflow_runs(id) ON DELETE SET NULL,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  lifecycle text NOT NULL DEFAULT 'active',
+  sensitivity text,
+  snapshot_ref text,
+  normalized_snapshot jsonb,
+  extraction_recipe jsonb NOT NULL DEFAULT '{}'::jsonb,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_evidence_items_target_scope_check
+    CHECK (target_scope IN ('space', 'tenant')),
+  CONSTRAINT memory_evidence_items_lifecycle_check
+    CHECK (lifecycle IN ('active', 'superseded', 'deleted', 'deferred', 'failed'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_evidence_items_source_version_uidx
+  ON public.memory_evidence_items (source_config_id, source_item_id, source_version);
+
+CREATE INDEX IF NOT EXISTS memory_evidence_items_tenant_idx
+  ON public.memory_evidence_items (tenant_id);
+
+CREATE INDEX IF NOT EXISTS memory_evidence_items_source_lifecycle_idx
+  ON public.memory_evidence_items (source_config_id, lifecycle);
+
+CREATE TABLE IF NOT EXISTS public.memory_run_items (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  workflow_run_id uuid NOT NULL
+    REFERENCES public.workflow_runs(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  source_item_id text NOT NULL,
+  stage text NOT NULL,
+  result text NOT NULL,
+  detail jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_run_items_stage_check
+    CHECK (stage IN ('acquire', 'extract', 'project', 'resolve', 'retain', 'compound', 'graph', 'wiki', 'preflight')),
+  CONSTRAINT memory_run_items_result_check
+    CHECK (result IN ('seen', 'changed', 'retracted', 'deferred', 'failed', 'noop'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_run_items_stage_uidx
+  ON public.memory_run_items (workflow_run_id, source_config_id, source_item_id, stage);
+
+CREATE INDEX IF NOT EXISTS memory_run_items_run_idx
+  ON public.memory_run_items (workflow_run_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_derivations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  evidence_item_id uuid NOT NULL
+    REFERENCES public.memory_evidence_items(id) ON DELETE CASCADE,
+  projection_key text NOT NULL,
+  target_bank_id text NOT NULL,
+  hindsight_document_id text NOT NULL,
+  current_version text NOT NULL,
+  lifecycle text NOT NULL DEFAULT 'active',
+  retracted_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_derivations_lifecycle_check
+    CHECK (lifecycle IN ('active', 'superseded', 'retracted'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_derivations_active_projection_uidx
+  ON public.memory_derivations (source_config_id, projection_key)
+  WHERE lifecycle = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_derivations_tenant_idx
+  ON public.memory_derivations (tenant_id);
+
+CREATE INDEX IF NOT EXISTS memory_derivations_evidence_idx
+  ON public.memory_derivations (evidence_item_id);

package/dist/drizzle/0232_message_source_event_id.sql

@@ -0,0 +1,9 @@
+-- creates-column: public.messages.source_event_id
+-- creates: public.uq_messages_tenant_source_event_id
+
+ALTER TABLE public.messages
+  ADD COLUMN IF NOT EXISTS source_event_id text;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_messages_tenant_source_event_id
+  ON public.messages (tenant_id, source_event_id)
+  WHERE source_event_id IS NOT NULL;

package/dist/drizzle/0233_msteams_install_and_links.sql

@@ -0,0 +1,151 @@
+-- Purpose: add Microsoft Teams application persistence for tenant installs, user links, and Teams conversation mapping.
+-- Plan: THINK-84 (U6 install path; msteams_threads is created now so one migration covers the domain for U7)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0233_msteams_install_and_links.sql
+-- After applying, RE-APPLY 0227_analyst_reader_role.sql and 0230_analyst_rls.sql:
+-- their regenerated grant/RLS sections cover the msteams tables, and databases
+-- that ran them before these tables existed have no analyst grants/policies
+-- for them (0230's msteams policy markers gate this in the drift reporter;
+-- 0227's grants are not marker-checkable).
+-- creates: public.msteams_tenant_installs
+-- creates: public.msteams_user_links
+-- creates: public.msteams_threads
+-- creates: public.uq_msteams_tenant_installs_entra_tenant
+-- creates: public.uq_msteams_tenant_installs_tenant_entra_tenant
+-- creates: public.uq_msteams_tenant_installs_tenant_active
+-- creates: public.idx_msteams_tenant_installs_tenant_status
+-- creates: public.uq_msteams_user_links_entra_tenant_aad_object
+-- creates: public.idx_msteams_user_links_tenant_user
+-- creates: public.idx_msteams_user_links_user
+-- creates: public.uq_msteams_threads_entra_tenant_conversation
+-- creates: public.idx_msteams_threads_thread
+-- creates: public.idx_msteams_threads_tenant_entra_tenant
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_installed_by_user_id_users_id_fk
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_status_allowed
+-- creates-constraint: public.msteams_tenant_installs.msteams_tenant_installs_consent_status_allowed
+-- creates-constraint: public.msteams_user_links.msteams_user_links_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_entra_tenant_id_installs_entra_tenant_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_user_id_users_id_fk
+-- creates-constraint: public.msteams_user_links.msteams_user_links_status_allowed
+-- creates-constraint: public.msteams_threads.msteams_threads_tenant_id_tenants_id_fk
+-- creates-constraint: public.msteams_threads.msteams_threads_entra_tenant_id_installs_entra_tenant_id_fk
+-- creates-constraint: public.msteams_threads.msteams_threads_thread_id_threads_id_fk
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS public.msteams_tenant_installs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  bot_app_id text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  consent_status text NOT NULL DEFAULT 'pending',
+  installed_by_user_id uuid,
+  installed_at timestamptz,
+  uninstalled_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_tenant_installs_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_tenant_installs_installed_by_user_id_users_id_fk
+    FOREIGN KEY (installed_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT msteams_tenant_installs_status_allowed
+    CHECK (status IN ('pending','active','uninstalled','revoked')),
+  CONSTRAINT msteams_tenant_installs_consent_status_allowed
+    CHECK (consent_status IN ('pending','granted','admin_required','revoked'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_entra_tenant
+  ON public.msteams_tenant_installs (entra_tenant_id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_tenant_entra_tenant
+  ON public.msteams_tenant_installs (tenant_id, entra_tenant_id);
+
+-- A ThinkWork tenant has at most one ACTIVE Entra binding; concurrent
+-- consent callbacks cannot race two bindings live.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_tenant_installs_tenant_active
+  ON public.msteams_tenant_installs (tenant_id)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_msteams_tenant_installs_tenant_status
+  ON public.msteams_tenant_installs (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.msteams_user_links (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  aad_object_id text NOT NULL,
+  user_id uuid NOT NULL,
+  display_name text,
+  status text NOT NULL DEFAULT 'active',
+  linked_at timestamptz NOT NULL DEFAULT now(),
+  unlinked_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_user_links_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_user_links_entra_tenant_id_installs_entra_tenant_id_fk
+    FOREIGN KEY (entra_tenant_id)
+    REFERENCES public.msteams_tenant_installs(entra_tenant_id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_user_links_user_id_users_id_fk
+    FOREIGN KEY (user_id)
+    REFERENCES public.users(id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_user_links_status_allowed
+    CHECK (status IN ('active','unlinked','orphaned','suspended'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_user_links_entra_tenant_aad_object
+  ON public.msteams_user_links (entra_tenant_id, aad_object_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_user_links_tenant_user
+  ON public.msteams_user_links (tenant_id, user_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_user_links_user
+  ON public.msteams_user_links (user_id);
+
+CREATE TABLE IF NOT EXISTS public.msteams_threads (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  entra_tenant_id text NOT NULL,
+  conversation_id text NOT NULL,
+  service_url text NOT NULL,
+  thread_id uuid NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT msteams_threads_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT msteams_threads_entra_tenant_id_installs_entra_tenant_id_fk
+    FOREIGN KEY (entra_tenant_id)
+    REFERENCES public.msteams_tenant_installs(entra_tenant_id)
+    ON DELETE RESTRICT,
+  CONSTRAINT msteams_threads_thread_id_threads_id_fk
+    FOREIGN KEY (thread_id)
+    REFERENCES public.threads(id)
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_msteams_threads_entra_tenant_conversation
+  ON public.msteams_threads (entra_tenant_id, conversation_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_threads_thread
+  ON public.msteams_threads (thread_id);
+
+CREATE INDEX IF NOT EXISTS idx_msteams_threads_tenant_entra_tenant
+  ON public.msteams_threads (tenant_id, entra_tenant_id);
+
+COMMIT;