thinkwork-cli 0.13.0 → 0.13.2

package/dist/drizzle/0239_canonical_entity_identity.sql

@@ -0,0 +1,257 @@
+-- THINK-193 U4: canonical entity identity.
+-- Contents:
+--   * identity.* schema (greenfield pgSchema per the feature-schema
+--     extraction pattern — no compat views needed for new tables):
+--       - identity.canonical_entities — stable instance registry with
+--         merged-redirect invariant CHECK.
+--       - identity.entity_source_mappings — exact mapping wins; unique per
+--         (tenant, source_system, namespace, external_id).
+--       - identity.entity_identity_claims — natural-key evidence; plain
+--         lookup index (per-rule uniqueness enforced in the matcher).
+--       - identity.entity_resolution_cases — operator ambiguity queue;
+--         partial unique coalesces open cases by signature.
+--       - identity.entity_resolution_events — append-only audit (no split).
+--   * knowledge_graph_entities.canonical_entity_id + resolution_state.
+--   * wiki.pages.canonical_entity_id + partial unique for tenant Entity pages.
+--   * ontology.entity_types.identity_rules + identity_rules_version.
+--   * memory_claims.canonical_subject_id FK (column landed in 0234).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0239_canonical_entity_identity.sql
+-- creates: identity.canonical_entities
+-- creates: identity.entity_source_mappings
+-- creates: identity.entity_identity_claims
+-- creates: identity.entity_resolution_cases
+-- creates: identity.entity_resolution_events
+-- creates: identity.uq_entity_source_mappings_source_identity
+-- creates: identity.uq_entity_resolution_cases_open_signature
+-- creates-column: public.knowledge_graph_entities.canonical_entity_id
+-- creates-column: public.knowledge_graph_entities.resolution_state
+-- creates-column: wiki.pages.canonical_entity_id
+-- creates-column: ontology.entity_types.identity_rules
+-- creates-column: ontology.entity_types.identity_rules_version
+-- creates: public.idx_kg_entities_tenant_canonical
+-- creates: wiki.uq_pages_tenant_canonical_entity
+-- creates-constraint: public.knowledge_graph_entities.knowledge_graph_entities_resolution_state_allowed
+-- creates-constraint: public.memory_claims.memory_claims_canonical_subject_id_fk
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('canonical_entity_identity_0239'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+CREATE SCHEMA IF NOT EXISTS identity;
+COMMENT ON SCHEMA identity IS
+  'Canonical entity instance registry (THINK-193 U4): mappings, natural-key claims, and operator resolution queue.';
+
+-- ---------------------------------------------------------------------------
+-- identity.canonical_entities
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.canonical_entities (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  entity_type_slug text NOT NULL,
+  display_name text NOT NULL,
+  normalized_name text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  merged_into_id uuid REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  version integer NOT NULL DEFAULT 1,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT canonical_entities_status_allowed
+    CHECK (status IN ('active','merged','archived')),
+  CONSTRAINT canonical_entities_merged_redirect_required
+    CHECK ((status = 'merged') = (merged_into_id IS NOT NULL))
+);
+
+CREATE INDEX IF NOT EXISTS idx_canonical_entities_tenant_status
+  ON identity.canonical_entities (tenant_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_canonical_entities_tenant_type_name
+  ON identity.canonical_entities (tenant_id, entity_type_slug, normalized_name);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_source_mappings
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_source_mappings (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  canonical_entity_id uuid NOT NULL
+    REFERENCES identity.canonical_entities(id) ON DELETE CASCADE,
+  source_system text NOT NULL,
+  namespace text NOT NULL DEFAULT '',
+  external_id text NOT NULL,
+  visibility text NOT NULL DEFAULT 'tenant',
+  created_by text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_source_mappings_visibility_allowed
+    CHECK (visibility IN ('tenant','private')),
+  CONSTRAINT entity_source_mappings_created_by_allowed
+    CHECK (created_by IN ('rule','operator','backfill'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_entity_source_mappings_source_identity
+  ON identity.entity_source_mappings (tenant_id, source_system, namespace, external_id);
+
+CREATE INDEX IF NOT EXISTS idx_entity_source_mappings_canonical
+  ON identity.entity_source_mappings (canonical_entity_id);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_identity_claims
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_identity_claims (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  canonical_entity_id uuid NOT NULL
+    REFERENCES identity.canonical_entities(id) ON DELETE CASCADE,
+  rule_slug text NOT NULL,
+  rule_version integer NOT NULL DEFAULT 1,
+  key_kind text NOT NULL,
+  normalized_value text NOT NULL,
+  value_hash text NOT NULL,
+  confidence numeric(5,4),
+  precedence integer NOT NULL DEFAULT 0,
+  visibility text NOT NULL DEFAULT 'tenant',
+  state text NOT NULL DEFAULT 'active',
+  evidence jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_identity_claims_visibility_allowed
+    CHECK (visibility IN ('tenant','private')),
+  CONSTRAINT entity_identity_claims_state_allowed
+    CHECK (state IN ('active','superseded','rejected'))
+);
+
+-- Plain lookup index: per-rule uniqueness scope is enforced by the matcher
+-- against the approved rule's `unique` flag, not one global unique index.
+CREATE INDEX IF NOT EXISTS idx_entity_identity_claims_lookup
+  ON identity.entity_identity_claims (tenant_id, key_kind, value_hash);
+
+CREATE INDEX IF NOT EXISTS idx_entity_identity_claims_canonical
+  ON identity.entity_identity_claims (canonical_entity_id);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_resolution_cases
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_resolution_cases (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  signature_hash text NOT NULL,
+  entity_type_slug text NOT NULL,
+  display_hint text,
+  candidates jsonb NOT NULL DEFAULT '[]'::jsonb,
+  conflicting_claims jsonb NOT NULL DEFAULT '[]'::jsonb,
+  impact_summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  item_count integer NOT NULL DEFAULT 1,
+  status text NOT NULL DEFAULT 'open',
+  decision text,
+  decided_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  resolved_canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  decided_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_resolution_cases_status_allowed
+    CHECK (status IN ('open','resolved','expired')),
+  CONSTRAINT entity_resolution_cases_decision_allowed
+    CHECK (decision IS NULL OR decision IN ('link','create','defer','reject','merge'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_entity_resolution_cases_open_signature
+  ON identity.entity_resolution_cases (tenant_id, signature_hash)
+  WHERE status = 'open';
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_cases_tenant_status_created
+  ON identity.entity_resolution_cases (tenant_id, status, created_at);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_resolution_events — append-only audit
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_resolution_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  case_id uuid REFERENCES identity.entity_resolution_cases(id) ON DELETE SET NULL,
+  canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  actor_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_resolution_events_type_allowed
+    CHECK (event_type IN ('create','link','defer','reject','merge'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_events_tenant_created
+  ON identity.entity_resolution_events (tenant_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_events_case
+  ON identity.entity_resolution_events (case_id);
+
+-- ---------------------------------------------------------------------------
+-- Projection columns
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.knowledge_graph_entities
+  ADD COLUMN IF NOT EXISTS canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+
+ALTER TABLE public.knowledge_graph_entities
+  ADD COLUMN IF NOT EXISTS resolution_state text NOT NULL DEFAULT 'legacy';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'knowledge_graph_entities_resolution_state_allowed'
+      AND conrelid = 'public.knowledge_graph_entities'::regclass
+  ) THEN
+    ALTER TABLE public.knowledge_graph_entities
+      ADD CONSTRAINT knowledge_graph_entities_resolution_state_allowed
+      CHECK (resolution_state IN ('resolved','deferred','private','legacy'));
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_kg_entities_tenant_canonical
+  ON public.knowledge_graph_entities (tenant_id, canonical_entity_id)
+  WHERE canonical_entity_id IS NOT NULL;
+
+ALTER TABLE wiki.pages
+  ADD COLUMN IF NOT EXISTS canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_pages_tenant_canonical_entity
+  ON wiki.pages (tenant_id, canonical_entity_id)
+  WHERE owner_id IS NULL AND canonical_entity_id IS NOT NULL AND type = 'entity';
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS identity_rules jsonb NOT NULL DEFAULT '[]'::jsonb;
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS identity_rules_version integer NOT NULL DEFAULT 0;
+
+-- memory_claims.canonical_subject_id landed as a bare uuid in 0234; the
+-- identity registry now exists, so wire the FK.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_claims_canonical_subject_id_fk'
+      AND conrelid = 'public.memory_claims'::regclass
+  ) THEN
+    ALTER TABLE public.memory_claims
+      ADD CONSTRAINT memory_claims_canonical_subject_id_fk
+      FOREIGN KEY (canonical_subject_id)
+      REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+COMMIT;

package/dist/drizzle/0240_memory_personal_scope.sql

@@ -0,0 +1,45 @@
+-- THINK-193 U6: personal (user-scoped) external-memory evidence + claims.
+-- The Gmail email tracer writes evidence and claims into the owner's User
+-- Bank (target_scope 'user'); the U1/U2 CHECK constraints only allowed the
+-- shared scopes. Replace both constraints with _v2 versions that include
+-- 'user'. Shared-only surfaces stay guarded in code (SharedTargetScope,
+-- graph/wiki hard-reject user_* banks).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0240_memory_personal_scope.sql
+-- creates-constraint: public.memory_evidence_items.memory_evidence_items_target_scope_check_v2
+-- drops-constraint: public.memory_evidence_items.memory_evidence_items_target_scope_check
+-- creates-constraint: public.memory_claims.memory_claims_target_scope_check_v2
+-- drops-constraint: public.memory_claims.memory_claims_target_scope_check
+
+ALTER TABLE public.memory_evidence_items
+  DROP CONSTRAINT IF EXISTS memory_evidence_items_target_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_evidence_items_target_scope_check_v2'
+      AND conrelid = 'public.memory_evidence_items'::regclass
+  ) THEN
+    ALTER TABLE public.memory_evidence_items
+      ADD CONSTRAINT memory_evidence_items_target_scope_check_v2
+      CHECK (target_scope IN ('user', 'space', 'tenant'));
+  END IF;
+END $$;
+
+ALTER TABLE public.memory_claims
+  DROP CONSTRAINT IF EXISTS memory_claims_target_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_claims_target_scope_check_v2'
+      AND conrelid = 'public.memory_claims'::regclass
+  ) THEN
+    ALTER TABLE public.memory_claims
+      ADD CONSTRAINT memory_claims_target_scope_check_v2
+      CHECK (target_scope IN ('user', 'space', 'tenant'));
+  END IF;
+END $$;

package/dist/drizzle/0241_knowledge_base_document_manifest.sql

@@ -0,0 +1,67 @@
+-- THINK-193 U7: Bedrock Knowledge Base document-projection manifest.
+-- Contents:
+--   * public.knowledge_base_documents — ONE row per (knowledge_base_id,
+--     data_source_id, document_key). The row id is the document's stable
+--     manifest identity across editions; `edition` increments on etag/content
+--     change; effective_to closes only at verified deletion
+--     (ingest_status 'absent_verified'). Edition history lives in
+--     memory_evidence_items.source_version (edition + content hash).
+--   * uq_kb_documents_identity — the manifest key.
+--   * idx_kb_documents_kb_updated — the bedrock_kb adapter's acquisition
+--     cursor (changed editions since (updated_at, id)).
+--   * idx_kb_documents_kb_ingest_status — settlement scan for 'deleting'.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0241_knowledge_base_document_manifest.sql
+-- creates: public.knowledge_base_documents
+-- creates: public.uq_kb_documents_identity
+-- creates: public.idx_kb_documents_tenant
+-- creates: public.idx_kb_documents_kb_updated
+-- creates: public.idx_kb_documents_kb_ingest_status
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_ingest_status_check
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_projection_status_check
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_edition_positive
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS public.knowledge_base_documents (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  knowledge_base_id uuid NOT NULL REFERENCES public.knowledge_bases(id) ON DELETE CASCADE,
+  data_source_id text NOT NULL,
+  document_key text NOT NULL,
+  s3_version_id text,
+  etag text,
+  content_hash text,
+  edition integer NOT NULL DEFAULT 1,
+  effective_from timestamptz,
+  effective_to timestamptz,
+  ingest_status text NOT NULL DEFAULT 'pending',
+  projection_status text NOT NULL DEFAULT 'pending',
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT knowledge_base_documents_ingest_status_check CHECK (
+    ingest_status IN ('pending', 'ingesting', 'indexed', 'failed', 'deleting', 'absent_verified')
+  ),
+  CONSTRAINT knowledge_base_documents_projection_status_check CHECK (
+    projection_status IN ('pending', 'projected', 'skipped', 'failed', 'retracting', 'retracted')
+  ),
+  CONSTRAINT knowledge_base_documents_edition_positive CHECK (edition >= 1)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_kb_documents_identity
+  ON public.knowledge_base_documents (knowledge_base_id, data_source_id, document_key);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_tenant
+  ON public.knowledge_base_documents (tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_kb_updated
+  ON public.knowledge_base_documents (knowledge_base_id, updated_at, id);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_kb_ingest_status
+  ON public.knowledge_base_documents (knowledge_base_id, ingest_status);
+
+COMMIT;

package/dist/drizzle/0242_search_queries.sql

@@ -0,0 +1,28 @@
+-- THINK-263 R15/KTD-8: search-query telemetry (the flywheel sensor).
+-- One append-only row per broker query with per-leg hit counts and statuses.
+-- Raw query text is retained as the future wiki-compile demand-queue input;
+-- retention policy: rows older than 180 days are eligible for deletion
+-- (operational sweep, not enforced in-schema). Operator read paths must be
+-- tenant-scoped. Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0242_search_queries.sql
+-- creates: public.search_queries
+
+CREATE TABLE IF NOT EXISTS public.search_queries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id uuid,
+  query_id uuid,
+  query_text text NOT NULL,
+  sources jsonb NOT NULL,
+  leg_hit_counts jsonb NOT NULL,
+  leg_statuses jsonb NOT NULL,
+  total_hits integer NOT NULL DEFAULT 0,
+  escalated boolean NOT NULL DEFAULT false,
+  duration_ms integer,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_search_queries_tenant_created
+  ON public.search_queries (tenant_id, created_at DESC);

package/dist/drizzle/0243_section_sources_thread_refs.sql

@@ -0,0 +1,12 @@
+-- THINK-263 U2/R14: thread backpointers on wiki section provenance.
+-- Nullable text[] stamped at compile time from cited memory records'
+-- provenance (U1 write-time stamps); backfilled for historical rows by
+-- packages/api/scripts/backfill-section-source-thread-refs.mts. Additive — safe to apply
+-- ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0243_section_sources_thread_refs.sql
+-- creates-column: wiki.section_sources.source_thread_ids
+
+ALTER TABLE wiki.section_sources
+  ADD COLUMN IF NOT EXISTS source_thread_ids text[];

package/dist/drizzle/0244_system_automations_and_memory_stage_overrides.sql

@@ -0,0 +1,45 @@
+-- THINK-264: Personal Memory Processing becomes a first-class system Automation.
+--
+-- Two independent additions:
+--
+-- 1. agent_loops.kind / .system_key — platform-provisioned Automations. A
+--    `system` row renders in the Automations inventory like any other, can be
+--    enabled/disabled, but is never hand-created and never deletable. The
+--    partial unique index makes ensure-on-read provisioning idempotent under
+--    concurrency (two parallel reads cannot mint two personal-memory loops).
+--
+-- 2. memory_processor_configs.stage_overrides — per-stage toggles for the
+--    optional tail of the memory pipeline (compound/graph/wiki). The
+--    acquire → project → resolve → retain spine is deliberately NOT
+--    disableable; see the app-side TOGGLEABLE_MEMORY_STAGES allowlist, which
+--    is the enforcement point. This column only stores intent.
+--
+-- Hand-rolled (partial unique index + CHECKs); not in meta/_journal.json.
+--
+-- creates-column: public.agent_loops.kind
+-- creates-column: public.agent_loops.system_key
+-- creates-column: public.memory_processor_configs.stage_overrides
+-- creates: public.agent_loops_system_owner_uidx
+
+ALTER TABLE public.agent_loops
+  ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'user',
+  ADD COLUMN IF NOT EXISTS system_key text;
+
+ALTER TABLE public.agent_loops
+  DROP CONSTRAINT IF EXISTS agent_loops_kind_check;
+ALTER TABLE public.agent_loops
+  ADD CONSTRAINT agent_loops_kind_check CHECK (kind IN ('user', 'system'));
+
+-- A system row is exactly identified by its key; a user row must not carry one.
+ALTER TABLE public.agent_loops
+  DROP CONSTRAINT IF EXISTS agent_loops_system_key_check;
+ALTER TABLE public.agent_loops
+  ADD CONSTRAINT agent_loops_system_key_check
+  CHECK ((kind = 'system') = (system_key IS NOT NULL));
+
+CREATE UNIQUE INDEX IF NOT EXISTS agent_loops_system_owner_uidx
+  ON public.agent_loops (tenant_id, system_key, owner_user_id)
+  WHERE system_key IS NOT NULL;
+
+ALTER TABLE public.memory_processor_configs
+  ADD COLUMN IF NOT EXISTS stage_overrides jsonb NOT NULL DEFAULT '{}'::jsonb;

package/dist/drizzle/0245_wiki_page_render.sql

@@ -0,0 +1,21 @@
+-- THINK-273 (THINK-270 U2): persisted wiki page plate renders.
+-- Nullable render columns on wiki.pages: the compositor-produced
+-- self-contained HTML plate render, the plate slug it was compiled with,
+-- and the render timestamp. Best-effort — all three are set together or
+-- all NULL (compile failure, oversize output, or a page that predates
+-- render persistence). Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0245_wiki_page_render.sql
+-- creates-column: wiki.pages.render_html
+-- creates-column: wiki.pages.render_plate_slug
+-- creates-column: wiki.pages.rendered_at
+
+BEGIN;
+
+ALTER TABLE wiki.pages
+  ADD COLUMN IF NOT EXISTS render_html text,
+  ADD COLUMN IF NOT EXISTS render_plate_slug text,
+  ADD COLUMN IF NOT EXISTS rendered_at timestamptz;
+
+COMMIT;

package/dist/drizzle/0246_automation_workflow_ownership.sql

@@ -0,0 +1,30 @@
+-- Automations are private to their owning user on the main product surface.
+-- Canonical Workflow projections previously inherited the workflows table
+-- defaults (tenant_shared + no owner), which made a linked Automation callable
+-- through triggerWorkflowRun even when the AgentLoop path was owner-scoped.
+--
+-- Reassert the source AgentLoop's ownership on every existing projection and
+-- make all Automation-backed Workflows private. An ownerless legacy row then
+-- fails closed at invocation instead of becoming tenant-callable.
+--
+-- Hand-rolled data backfill + partial owner index; not in meta/_journal.json.
+-- creates: public.workflows_source_owner_idx
+
+UPDATE public.workflows AS workflow
+SET
+  visibility = 'agent_private',
+  owner_user_id = automation.owner_user_id,
+  owner_agent_id = automation.owner_agent_id,
+  updated_at = now()
+FROM public.agent_loops AS automation
+WHERE workflow.tenant_id = automation.tenant_id
+  AND workflow.source_agent_loop_id = automation.id
+  AND (
+    workflow.visibility IS DISTINCT FROM 'agent_private'
+    OR workflow.owner_user_id IS DISTINCT FROM automation.owner_user_id
+    OR workflow.owner_agent_id IS DISTINCT FROM automation.owner_agent_id
+  );
+
+CREATE INDEX IF NOT EXISTS workflows_source_owner_idx
+  ON public.workflows (tenant_id, owner_user_id)
+  WHERE source_agent_loop_id IS NOT NULL;