thinkwork-cli 0.13.0 → 0.13.2

package/dist/drizzle/0258_pending_tool_approvals.sql

@@ -0,0 +1,84 @@
+-- THINK-302 U11: pending_tool_approvals — parked-turn HITL ledger.
+--
+-- A distinct pending kind from pending_user_questions (KTD-5): a gated tool
+-- call parks the turn and this row is the recoverable ledger. Two partial
+-- unique indexes drizzle-kit cannot express live here:
+--   * one `pending` approval per thread (the one-slot invariant, R32) — so
+--     an approval can COEXIST with a pending question (separate tables/slots),
+--     and the intake endpoint returns 409 on a second concurrent park.
+--   * resume-replay uniqueness (thread_turn_id, tool_call_id, manifest
+--     fingerprint) — a stale approval cannot authorize a drifted definition
+--     and a retried intake is idempotent.
+--
+-- Ships INERT: no writer touches this table until U11b; U12 consumes it.
+--
+-- Hand-rolled (partial indices, CHECK constraints); not in meta/_journal.json.
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f drizzle/0258_pending_tool_approvals.sql
+-- creates: public.pending_tool_approvals
+-- creates: public.pending_tool_approvals_one_pending_per_thread
+-- creates: public.pending_tool_approvals_resume_identity
+-- creates: public.idx_pending_tool_approvals_tenant
+-- creates: public.idx_pending_tool_approvals_thread_status
+-- creates: public.idx_pending_tool_approvals_message
+-- creates: public.idx_pending_tool_approvals_purge
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0258_pending_tool_approvals'));
+
+CREATE TABLE IF NOT EXISTS public.pending_tool_approvals (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  thread_turn_id uuid NOT NULL REFERENCES public.thread_turns(id),
+  message_id uuid NOT NULL REFERENCES public.messages(id) ON DELETE CASCADE,
+  manifest_fingerprint text NOT NULL,
+  tool_call_id text NOT NULL,
+  class text NOT NULL,
+  slug text NOT NULL,
+  marker_sha text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  requesting_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  encrypted_payload text,
+  display_summary jsonb NOT NULL,
+  approved_by uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  answered_via text,
+  answered_at timestamptz,
+  payload_purged_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT pending_tool_approvals_status_allowed
+    CHECK (status IN ('pending','approved','denied','cancelled')),
+  CONSTRAINT pending_tool_approvals_answered_via_allowed
+    CHECK (answered_via IS NULL OR answered_via IN ('card','slack','governance','archive','reaper')),
+  CONSTRAINT pending_tool_approvals_terminal_consistency
+    CHECK ((status = 'pending') = (answered_at IS NULL))
+);
+
+-- One pending approval per thread (the one-slot invariant). Partial so
+-- terminal rows never block a new park, and so it is INDEPENDENT of the
+-- pending_user_questions slot (an approval + a question can both be pending).
+CREATE UNIQUE INDEX IF NOT EXISTS pending_tool_approvals_one_pending_per_thread
+  ON public.pending_tool_approvals (thread_id)
+  WHERE status = 'pending';
+
+-- Resume-replay identity: a park is unique per (turn, tool call, pinned
+-- manifest) so a retried intake is idempotent and a stale approval cannot
+-- authorize a drifted definition.
+CREATE UNIQUE INDEX IF NOT EXISTS pending_tool_approvals_resume_identity
+  ON public.pending_tool_approvals (thread_turn_id, tool_call_id, manifest_fingerprint);
+
+CREATE INDEX IF NOT EXISTS idx_pending_tool_approvals_tenant
+  ON public.pending_tool_approvals (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_pending_tool_approvals_thread_status
+  ON public.pending_tool_approvals (thread_id, status);
+CREATE INDEX IF NOT EXISTS idx_pending_tool_approvals_message
+  ON public.pending_tool_approvals (message_id);
+-- Reaper scan: terminal rows whose payload is not yet purged, by age.
+CREATE INDEX IF NOT EXISTS idx_pending_tool_approvals_purge
+  ON public.pending_tool_approvals (status, payload_purged_at);
+
+SELECT pg_advisory_unlock(hashtext('migration:0258_pending_tool_approvals'));

package/dist/drizzle/0259_tenant_capability_registry_trust.sql

@@ -0,0 +1,19 @@
+-- THINK-302 U3b: per-tenant capability registry-trust gate (KTD-8).
+--
+-- Off for every tenant at migration time; flipped on per tenant
+-- (dev → TEI → McPherson) as the capability approval registry replaces
+-- per-folder sidecar signatures. Read by the workspace renderer
+-- (compose-tuple) to decide registry-trust vs legacy sidecar admission.
+--
+-- Additive, idempotent column add. Hand-rolled only so it carries a
+-- drift-gate marker alongside the sibling hand-rolled capability migrations;
+-- db:push would also add it from the ORM definition.
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f drizzle/0259_tenant_capability_registry_trust.sql
+-- creates-column: public.tenants.capability_registry_trust
+
+\set ON_ERROR_STOP on
+
+ALTER TABLE public.tenants
+  ADD COLUMN IF NOT EXISTS capability_registry_trust boolean NOT NULL DEFAULT false;

package/dist/drizzle/0260_scheduled_jobs_run_as_user.sql

@@ -0,0 +1,20 @@
+-- THINK-302 U7 (R28/KTD-14): run-as identity for wakeup/scheduled turns.
+--
+-- The user a scheduled/wakeup turn runs AS, so it composes that user's +
+-- the run-in-space's capability scopes. A job with no run_as_user_id
+-- compiles root + sub-agent only — it NEVER inherits the creator's grants.
+-- Set/cleared only through an authorized surface (KTD-14 save-time authz);
+-- dispatch-time revalidation drops stale grants.
+--
+-- Additive, idempotent nullable-FK column add (ON DELETE SET NULL so a
+-- deactivated user's jobs degrade to root-only rather than break).
+-- Hand-rolled only to carry the drift-gate marker; db:push would also add it.
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f drizzle/0260_scheduled_jobs_run_as_user.sql
+-- creates-column: public.scheduled_jobs.run_as_user_id
+
+\set ON_ERROR_STOP on
+
+ALTER TABLE public.scheduled_jobs
+  ADD COLUMN IF NOT EXISTS run_as_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL;

package/dist/drizzle/0261_managed_harness_multiplayer.sql

@@ -0,0 +1,313 @@
+-- creates: public.harness_managed_thread_enrollments
+-- creates: public.thread_public_events
+-- creates: public.harness_participant_sessions
+-- creates: public.harness_participant_session_events
+-- creates: public.harness_governed_tool_executions
+-- creates: public.harness_disclosure_decisions
+-- creates-function: public.capture_harness_message_public_event
+-- creates-function: public.capture_harness_artifact_public_event
+-- creates-trigger: public.messages.trg_capture_harness_message_public_event
+-- creates-trigger: public.message_artifacts.trg_capture_harness_artifact_public_event
+-- Managed multiplayer Harness proof ledger. Hand-rolled because this migration
+-- also installs admission triggers over existing canonical message tables.
+
+CREATE TABLE IF NOT EXISTS public.harness_managed_thread_enrollments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  logical_agent_id uuid NOT NULL REFERENCES public.agents(id),
+  trust_profile text NOT NULL,
+  harness_arn text NOT NULL,
+  qualifier text NOT NULL,
+  resolved_version text NOT NULL,
+  session_strategy text NOT NULL DEFAULT 'fresh'
+    CHECK (session_strategy = 'fresh'),
+  prior_runtime text NOT NULL,
+  status text NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'restoring', 'restored', 'failed')),
+  enrolled_by_user_id uuid NOT NULL REFERENCES public.users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  restored_at timestamptz,
+  UNIQUE (tenant_id, thread_id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_enrollment_active_profile
+  ON public.harness_managed_thread_enrollments (tenant_id, trust_profile)
+  WHERE status = 'active';
+
+CREATE TABLE IF NOT EXISTS public.thread_public_events (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  source_kind text NOT NULL CHECK (source_kind IN ('message', 'message_artifact')),
+  source_id uuid NOT NULL,
+  source_version text NOT NULL,
+  event_kind text NOT NULL CHECK (event_kind IN ('insert', 'invalidate')),
+  canonical_digest text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, thread_id, source_kind, source_id, source_version)
+);
+
+CREATE INDEX IF NOT EXISTS idx_thread_public_events_prefix
+  ON public.thread_public_events (tenant_id, thread_id, id);
+
+CREATE TABLE IF NOT EXISTS public.harness_participant_sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  enrollment_id uuid NOT NULL REFERENCES public.harness_managed_thread_enrollments(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  participant_user_id uuid NOT NULL REFERENCES public.users(id),
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  runtime_session_id text NOT NULL UNIQUE,
+  generation integer NOT NULL DEFAULT 1 CHECK (generation = 1),
+  captured_high_water bigint NOT NULL,
+  applied_high_water bigint,
+  qualifier text NOT NULL,
+  resolved_version text NOT NULL,
+  base_fingerprint text NOT NULL,
+  participant_fingerprint text NOT NULL,
+  state text NOT NULL DEFAULT 'allocated'
+    CHECK (state IN ('allocated', 'running', 'finalizing', 'completed', 'abandoned')),
+  failure_reason text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  started_at timestamptz,
+  finished_at timestamptz,
+  UNIQUE (tenant_id, turn_id),
+  CHECK (
+    (state IN ('completed', 'abandoned') AND finished_at IS NOT NULL)
+    OR (state NOT IN ('completed', 'abandoned') AND finished_at IS NULL)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_harness_participant_sessions_thread
+  ON public.harness_participant_sessions
+  (tenant_id, thread_id, participant_user_id, created_at);
+
+CREATE TABLE IF NOT EXISTS public.harness_participant_session_events (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  event_type text NOT NULL,
+  from_state text,
+  to_state text NOT NULL
+    CHECK (to_state IN ('allocated', 'running', 'finalizing', 'completed', 'abandoned')),
+  reason_code text,
+  applied_high_water bigint,
+  evidence jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_harness_session_events_session
+  ON public.harness_participant_session_events (session_id, id);
+
+CREATE TABLE IF NOT EXISTS public.harness_governed_tool_executions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  participant_user_id uuid NOT NULL REFERENCES public.users(id),
+  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
+  idempotency_key text NOT NULL,
+  audience text NOT NULL,
+  operation text NOT NULL,
+  tool_use_id text NOT NULL,
+  input_digest text NOT NULL,
+  state text NOT NULL DEFAULT 'claimed'
+    CHECK (state IN ('claimed', 'completed', 'failed', 'ambiguous')),
+  policy_decision_id text,
+  credential_owner_alias text,
+  sanitized_result jsonb,
+  failure_reason text,
+  claimed_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz,
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_harness_governed_tool_turn
+  ON public.harness_governed_tool_executions (turn_id);
+
+CREATE TABLE IF NOT EXISTS public.harness_disclosure_decisions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  participant_user_id uuid NOT NULL REFERENCES public.users(id),
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
+  operation text NOT NULL,
+  projection_digest text NOT NULL,
+  status text NOT NULL
+    CHECK (status IN ('published', 'withheld', 'confirmation_required')),
+  reason_code text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_harness_disclosure_turn
+  ON public.harness_disclosure_decisions (turn_id);
+
+CREATE OR REPLACE FUNCTION public.capture_harness_message_public_event()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  digest_value text;
+  version_value text;
+  event_value text;
+  admitted_before boolean;
+  admitted_now boolean;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM public.thread_public_events e
+      WHERE e.tenant_id = OLD.tenant_id
+        AND e.thread_id = OLD.thread_id
+        AND e.source_kind = 'message'
+        AND e.source_id = OLD.id
+    ) THEN
+      RETURN OLD;
+    END IF;
+    digest_value := encode(digest(concat_ws('|', OLD.role, coalesce(OLD.content, ''), coalesce(OLD.parts::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
+    version_value := 'delete:' || digest_value;
+    event_value := 'invalidate';
+    INSERT INTO public.thread_public_events (
+      tenant_id, thread_id, source_kind, source_id, source_version,
+      event_kind, canonical_digest
+    ) VALUES (
+      OLD.tenant_id, OLD.thread_id, 'message', OLD.id,
+      version_value, event_value, digest_value
+    ) ON CONFLICT DO NOTHING;
+    RETURN OLD;
+  END IF;
+
+  admitted_now := NEW.role IN ('user', 'assistant')
+    AND coalesce(NEW.metadata->>'visibility', 'public') = 'public'
+    AND coalesce(NEW.metadata->>'disclosure_status', 'published') NOT IN ('withheld', 'confirmation_required')
+    AND EXISTS (
+      SELECT 1 FROM public.harness_managed_thread_enrollments e
+      WHERE e.tenant_id = NEW.tenant_id
+        AND e.thread_id = NEW.thread_id
+        AND e.status = 'active'
+    );
+
+  IF TG_OP = 'UPDATE' THEN
+    admitted_before := EXISTS (
+      SELECT 1 FROM public.thread_public_events e
+      WHERE e.tenant_id = OLD.tenant_id
+        AND e.thread_id = OLD.thread_id
+        AND e.source_kind = 'message'
+        AND e.source_id = OLD.id
+    );
+    IF admitted_before THEN
+      digest_value := encode(digest(concat_ws('|', OLD.role, coalesce(OLD.content, ''), coalesce(OLD.parts::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
+      version_value := 'invalidate:update:' || encode(digest(concat_ws('|', NEW.role, coalesce(NEW.content, ''), coalesce(NEW.parts::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
+      INSERT INTO public.thread_public_events (
+        tenant_id, thread_id, source_kind, source_id, source_version,
+        event_kind, canonical_digest
+      ) VALUES (
+        OLD.tenant_id, OLD.thread_id, 'message', OLD.id,
+        version_value, 'invalidate', digest_value
+      ) ON CONFLICT DO NOTHING;
+    END IF;
+  END IF;
+
+  IF NOT admitted_now THEN
+    RETURN NEW;
+  END IF;
+
+  digest_value := encode(digest(concat_ws('|', NEW.role, coalesce(NEW.content, ''), coalesce(NEW.parts::text, '')), 'sha256'), 'hex');
+  version_value := lower(TG_OP) || ':' || digest_value || ':' || encode(digest(coalesce(NEW.metadata::text, ''), 'sha256'), 'hex');
+  INSERT INTO public.thread_public_events (
+    tenant_id, thread_id, source_kind, source_id, source_version,
+    event_kind, canonical_digest
+  ) VALUES (
+    NEW.tenant_id, NEW.thread_id, 'message', NEW.id,
+    version_value, 'insert', digest_value
+  ) ON CONFLICT DO NOTHING;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_capture_harness_message_public_event ON public.messages;
+CREATE TRIGGER trg_capture_harness_message_public_event
+AFTER INSERT OR UPDATE OR DELETE ON public.messages
+FOR EACH ROW EXECUTE FUNCTION public.capture_harness_message_public_event();
+
+CREATE OR REPLACE FUNCTION public.capture_harness_artifact_public_event()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  digest_value text;
+  version_value text;
+  admitted_before boolean;
+  admitted_now boolean;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM public.thread_public_events e
+      WHERE e.tenant_id = OLD.tenant_id
+        AND e.thread_id = OLD.thread_id
+        AND e.source_kind = 'message_artifact'
+        AND e.source_id = OLD.id
+    ) THEN
+      RETURN OLD;
+    END IF;
+    digest_value := encode(digest(concat_ws('|', OLD.artifact_type, coalesce(OLD.name, ''), coalesce(OLD.artifact_id::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
+    INSERT INTO public.thread_public_events (
+      tenant_id, thread_id, source_kind, source_id, source_version,
+      event_kind, canonical_digest
+    ) VALUES (
+      OLD.tenant_id, OLD.thread_id, 'message_artifact', OLD.id,
+      'delete:' || digest_value, 'invalidate', digest_value
+    ) ON CONFLICT DO NOTHING;
+    RETURN OLD;
+  END IF;
+
+  admitted_now := EXISTS (
+    SELECT 1 FROM public.harness_managed_thread_enrollments e
+    WHERE e.tenant_id = NEW.tenant_id
+      AND e.thread_id = NEW.thread_id
+      AND e.status = 'active'
+  ) AND coalesce(NEW.metadata->>'access_state', 'public') = 'public';
+
+  IF TG_OP = 'UPDATE' THEN
+    admitted_before := EXISTS (
+      SELECT 1 FROM public.thread_public_events e
+      WHERE e.tenant_id = OLD.tenant_id
+        AND e.thread_id = OLD.thread_id
+        AND e.source_kind = 'message_artifact'
+        AND e.source_id = OLD.id
+    );
+    IF admitted_before THEN
+      digest_value := encode(digest(concat_ws('|', OLD.artifact_type, coalesce(OLD.name, ''), coalesce(OLD.artifact_id::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
+      version_value := 'invalidate:update:' || encode(digest(concat_ws('|', NEW.artifact_type, coalesce(NEW.name, ''), coalesce(NEW.artifact_id::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
+      INSERT INTO public.thread_public_events (
+        tenant_id, thread_id, source_kind, source_id, source_version,
+        event_kind, canonical_digest
+      ) VALUES (
+        OLD.tenant_id, OLD.thread_id, 'message_artifact', OLD.id,
+        version_value, 'invalidate', digest_value
+      ) ON CONFLICT DO NOTHING;
+    END IF;
+  END IF;
+
+  IF NOT admitted_now THEN
+    RETURN NEW;
+  END IF;
+
+  digest_value := encode(digest(concat_ws('|', NEW.artifact_type, coalesce(NEW.name, ''), coalesce(NEW.artifact_id::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
+  INSERT INTO public.thread_public_events (
+    tenant_id, thread_id, source_kind, source_id, source_version,
+    event_kind, canonical_digest
+  ) VALUES (
+    NEW.tenant_id, NEW.thread_id, 'message_artifact', NEW.id,
+    lower(TG_OP) || ':' || digest_value, 'insert', digest_value
+  ) ON CONFLICT DO NOTHING;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_capture_harness_artifact_public_event ON public.message_artifacts;
+CREATE TRIGGER trg_capture_harness_artifact_public_event
+AFTER INSERT OR UPDATE OR DELETE ON public.message_artifacts
+FOR EACH ROW EXECUTE FUNCTION public.capture_harness_artifact_public_event();