thinkwork-cli 0.13.1 → 0.13.2

package/dist/drizzle/0262_auth_subscription_tickets.sql

@@ -0,0 +1,59 @@
+-- One-use AppSync authorization tickets and durable revocation invalidations.
+-- creates: public.auth_subscription_tickets
+-- creates: public.auth_subscription_invalidations
+
+CREATE TABLE IF NOT EXISTS "auth_subscription_tickets" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "nonce_digest" text NOT NULL,
+  "kind" text NOT NULL,
+  "status" text DEFAULT 'issued' NOT NULL,
+  "stage" text NOT NULL,
+  "appsync_api_id" text NOT NULL,
+  "key_id" text NOT NULL,
+  "cognito_issuer" text NOT NULL,
+  "cognito_sub" text NOT NULL,
+  "user_id" uuid NOT NULL REFERENCES "users"("id") ON DELETE restrict,
+  "tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE restrict,
+  "auth_route_client_id" uuid NOT NULL REFERENCES "auth_route_clients"("id") ON DELETE restrict,
+  "operation_name" text,
+  "operation_hash" text,
+  "resource_kind" text,
+  "resource_id" text,
+  "expires_at" timestamp with time zone NOT NULL,
+  "consumed_at" timestamp with time zone,
+  "revoked_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "auth_subscription_tickets_kind_allowed"
+    CHECK ("kind" IN ('connect', 'registration')),
+  CONSTRAINT "auth_subscription_tickets_status_allowed"
+    CHECK ("status" IN ('issued', 'consumed', 'expired', 'revoked')),
+  CONSTRAINT "auth_subscription_tickets_operation_shape"
+    CHECK (("kind" = 'connect' AND "operation_name" IS NULL AND "operation_hash" IS NULL)
+      OR ("kind" = 'registration' AND "operation_name" IS NOT NULL AND "operation_hash" IS NOT NULL))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_auth_subscription_tickets_nonce"
+  ON "auth_subscription_tickets" ("nonce_digest");
+CREATE INDEX IF NOT EXISTS "idx_auth_subscription_tickets_principal"
+  ON "auth_subscription_tickets" ("cognito_issuer", "cognito_sub", "status");
+CREATE INDEX IF NOT EXISTS "idx_auth_subscription_tickets_expiry"
+  ON "auth_subscription_tickets" ("status", "expires_at");
+
+CREATE TABLE IF NOT EXISTS "auth_subscription_invalidations" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE restrict,
+  "user_id" uuid REFERENCES "users"("id") ON DELETE restrict,
+  "resource_kind" text NOT NULL,
+  "resource_id" text,
+  "reason" text NOT NULL,
+  "status" text DEFAULT 'pending' NOT NULL,
+  "attempts" integer DEFAULT 0 NOT NULL,
+  "available_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "processed_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "auth_subscription_invalidations_status_allowed"
+    CHECK ("status" IN ('pending', 'processing', 'complete', 'failed'))
+);
+
+CREATE INDEX IF NOT EXISTS "idx_auth_subscription_invalidations_pending"
+  ON "auth_subscription_invalidations" ("status", "available_at");

package/dist/drizzle/0262_parallel_harness_threads.sql

@@ -0,0 +1,9 @@
+-- creates: public.idx_harness_enrollment_active_profile
+-- Allow multiple normal Composer threads to remain pinned to the same
+-- tenant/trust-profile Harness while Pi threads continue independently.
+
+DROP INDEX IF EXISTS public.uq_harness_enrollment_active_profile;
+
+CREATE INDEX IF NOT EXISTS idx_harness_enrollment_active_profile
+  ON public.harness_managed_thread_enrollments (tenant_id, trust_profile)
+  WHERE status = 'active';

package/dist/drizzle/0263_agentcore_runtime_identifier.sql

@@ -0,0 +1,69 @@
+-- creates-constraint: public.agents.agents_runtime_check
+-- Canonicalize the application runtime identifier from the proof-era
+-- `harness` token to `agentcore`. AWS resource names, OAuth scopes, and
+-- diagnostics may still use Harness terminology; persisted runtime routing
+-- state must not.
+--
+-- Hand-rolled (NOT registered in meta/_journal.json) — apply via psql:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0263_agentcore_runtime_identifier.sql
+
+BEGIN;
+
+UPDATE public.agents
+SET runtime = 'agentcore'
+WHERE lower(runtime) = 'harness';
+
+UPDATE public.agents
+SET runtime_config = jsonb_set(
+  runtime_config,
+  '{defaultThreadRuntime}',
+  '"agentcore"'::jsonb,
+  true
+)
+WHERE jsonb_typeof(runtime_config) = 'object'
+  AND lower(runtime_config ->> 'defaultThreadRuntime') = 'harness';
+
+UPDATE public.threads
+SET metadata = jsonb_set(
+  metadata,
+  '{requestedRuntime}',
+  '"agentcore"'::jsonb,
+  true
+)
+WHERE jsonb_typeof(metadata) = 'object'
+  AND lower(metadata ->> 'requestedRuntime') = 'harness';
+
+UPDATE public.messages
+SET metadata = jsonb_set(
+  metadata,
+  '{requestedRuntime}',
+  '"agentcore"'::jsonb,
+  true
+)
+WHERE jsonb_typeof(metadata) = 'object'
+  AND lower(metadata ->> 'requestedRuntime') = 'harness';
+
+UPDATE public.thread_turns
+SET runtime_type = 'agentcore'
+WHERE lower(runtime_type) = 'harness';
+
+UPDATE public.cost_events
+SET runtime_type = 'agentcore'
+WHERE lower(runtime_type) = 'harness';
+
+UPDATE public.trace_runs
+SET runtime_type = 'agentcore'
+WHERE lower(runtime_type) = 'harness';
+
+UPDATE public.harness_managed_thread_enrollments
+SET prior_runtime = 'agentcore'
+WHERE lower(prior_runtime) = 'harness';
+
+ALTER TABLE public.agents
+  DROP CONSTRAINT IF EXISTS agents_runtime_check;
+
+ALTER TABLE public.agents
+  ADD CONSTRAINT agents_runtime_check
+  CHECK (runtime IN ('strands', 'flue', 'pi', 'agentcore'));
+
+COMMIT;

package/dist/drizzle/0263_drop_workos_auth_runtime.sql

@@ -0,0 +1,236 @@
+-- 0263_drop_workos_auth_runtime.sql
+--
+-- Final guarded retirement of the WorkOS login broker. Historical migrations
+-- 0174/0175 remain in the repository; this migration removes their runtime
+-- tables only after a completed native-auth cutover proves identity,
+-- client-shutdown, token-drain, realtime-drain, and zero-reader/writer gates.
+-- Raw WorkOS profile/session data is deliberately purged, not archived.
+--
+-- drops: public.workos_auth_bridges
+-- drops: public.workos_auth_sessions
+-- creates-constraint: public.plugin_components.plugin_components_type_allowed
+-- creates-constraint: public.auth_provider_resources.auth_provider_resources_lifecycle_state_allowed
+-- creates-constraint: public.auth_route_clients.auth_route_clients_lifecycle_allowed
+-- deployment-phase: auth-retired
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '30s';
+SET LOCAL statement_timeout = '300s';
+
+SELECT pg_advisory_xact_lock(hashtext('drop_workos_auth_runtime'));
+SELECT set_config('thinkwork.auth_retirement_stage', :'stage', true);
+
+DO $$
+DECLARE
+  cutover record;
+  residue_exists boolean;
+  table_has_rows boolean;
+  pending_count bigint;
+BEGIN
+  IF current_database() != 'thinkwork' THEN
+    RAISE EXCEPTION 'wrong database: %, expected thinkwork', current_database();
+  END IF;
+
+  SELECT
+    EXISTS (
+      SELECT 1 FROM public.auth_provider_resources
+      WHERE provider_kind = 'legacy_workos' OR lifecycle_state = 'coexistence'
+    )
+    OR EXISTS (
+      SELECT 1 FROM public.auth_route_clients
+      WHERE lifecycle_state = 'coexistence'
+    )
+    OR EXISTS (
+      SELECT 1 FROM public.plugin_installs WHERE plugin_key = 'workos-auth'
+  )
+  INTO residue_exists;
+
+  IF to_regclass('public.workos_auth_bridges') IS NOT NULL THEN
+    EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.workos_auth_bridges)'
+      INTO table_has_rows;
+    residue_exists := residue_exists OR table_has_rows;
+  END IF;
+  IF to_regclass('public.workos_auth_sessions') IS NOT NULL THEN
+    EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.workos_auth_sessions)'
+      INTO table_has_rows;
+    residue_exists := residue_exists OR table_has_rows;
+  END IF;
+
+  IF NOT residue_exists THEN
+    RAISE NOTICE 'No WorkOS auth data exists — empty historical tables may be retired without cutover evidence';
+    RETURN;
+  END IF;
+
+  SELECT * INTO cutover
+  FROM public.auth_cutover_runs
+  WHERE stage = current_setting('thinkwork.auth_retirement_stage')
+  ORDER BY created_at DESC, id DESC
+  LIMIT 1;
+
+  IF cutover.id IS NULL THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: no auth_cutover_runs evidence for stage %',
+      current_setting('thinkwork.auth_retirement_stage');
+  END IF;
+
+  IF cutover.status <> 'complete' OR cutover.completed_at IS NULL THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: newest auth_cutover_runs evidence for stage % is %',
+      current_setting('thinkwork.auth_retirement_stage'), cutover.status;
+  END IF;
+
+  IF COALESCE((cutover.terminal_dispositions->>'allTerminal')::boolean, false) IS NOT TRUE
+    OR COALESCE((cutover.terminal_dispositions->>'unresolved')::bigint, -1) <> 0
+    OR COALESCE((cutover.terminal_dispositions->>'signoutExpected')::bigint, -1) <= 0
+    OR COALESCE((cutover.terminal_dispositions->>'signoutAttempts')::bigint, -1)
+      <> COALESCE((cutover.terminal_dispositions->>'signoutExpected')::bigint, -2)
+    OR COALESCE((cutover.terminal_dispositions->>'signoutFailures')::bigint, -1) <> 0
+    OR COALESCE((cutover.terminal_dispositions->>'compatibilityFallbackReads')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: identity/signout/fallback evidence is incomplete';
+  END IF;
+
+  IF COALESCE((cutover.client_shutdown_evidence->>'workosStartsEnabled')::boolean, true) IS NOT FALSE
+    OR COALESCE((cutover.client_shutdown_evidence->>'legacyClientsEnabled')::bigint, -1) <> 0
+    OR COALESCE((cutover.client_shutdown_evidence->>'legacyAudiencesAccepted')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: legacy clients or audiences remain enabled';
+  END IF;
+
+  IF COALESCE((cutover.drain_evidence->>'drainCompleted')::boolean, false) IS NOT TRUE
+    OR COALESCE((cutover.drain_evidence->>'legacyRouteTraffic')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'workosTableReads')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'workosTableWrites')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'activeLegacySubscriptions')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: traffic, persistence, or realtime drain evidence is incomplete';
+  END IF;
+
+  IF COALESCE(cutover.drain_evidence->'provenance'->>'domain', '')
+      <> 'thinkwork.auth-cutover-evidence.v1'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'source', '')
+      <> 'verify-native-auth-cutover'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'stage', '')
+      <> current_setting('thinkwork.auth_retirement_stage')
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'runId', '') <> cutover.id::text
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'deploymentRevision', '')
+      !~ '^([a-f0-9]{40}|[a-f0-9]{64})$'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'payloadHash', '')
+      !~ '^[a-f0-9]{64}$'
+    OR length(COALESCE(cutover.drain_evidence->'provenance'->>'signature', '')) < 40
+    OR (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz < cutover.started_at
+    OR cutover.completed_at < (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz
+    OR cutover.completed_at > (cutover.drain_evidence->'provenance'->>'expiresAt')::timestamptz
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: signed stage/revision/time provenance is missing or stale';
+  END IF;
+
+  IF COALESCE((cutover.drain_evidence->>'guardEnabled')::boolean, false) IS NOT TRUE
+    -- AppSync GraphQL WebSocket connections can survive for 24 hours, longer
+    -- than the legacy clients' one-hour ID/access tokens.
+    OR COALESCE((cutover.drain_evidence->>'requiredSoakSeconds')::bigint, 0) < 86400
+    OR COALESCE(cutover.drain_evidence->>'deploymentRevision', '')
+      <> COALESCE(cutover.drain_evidence->'provenance'->>'deploymentRevision', '')
+    OR cutover.drain_evidence->>'baselineDatabaseStatsResetAt' IS NULL
+    OR cutover.drain_evidence->>'databaseStatsResetAt' IS NULL
+    OR cutover.drain_evidence->>'baselineDatabaseStatsResetAt'
+      <> cutover.drain_evidence->>'databaseStatsResetAt'
+    OR cutover.drain_evidence->>'soakStartedAt' IS NULL
+    OR (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz
+      < (cutover.drain_evidence->>'soakStartedAt')::timestamptz
+        + make_interval(secs => (cutover.drain_evidence->>'requiredSoakSeconds')::integer)
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: revision-bound drain soak is missing or incomplete';
+  END IF;
+
+  SELECT count(*) INTO pending_count
+  FROM public.auth_identity_enrollments enrollment
+  JOIN public.auth_provider_resources resource
+    ON resource.id = enrollment.auth_provider_resource_id
+  WHERE (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence')
+    AND enrollment.status = 'pending'
+    AND enrollment.expires_at > now();
+  IF pending_count <> 0 THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: % live legacy identity enrollment(s)', pending_count;
+  END IF;
+
+  IF to_regclass('public.workos_auth_sessions') IS NOT NULL THEN
+    EXECUTE 'SELECT count(*) FROM public.workos_auth_sessions WHERE status = ''active'' AND expires_at > now()'
+      INTO pending_count;
+    IF pending_count <> 0 THEN
+      RAISE EXCEPTION 'WorkOS retirement blocked: % active WorkOS session(s)', pending_count;
+    END IF;
+  END IF;
+
+  IF to_regclass('public.workos_auth_bridges') IS NOT NULL THEN
+    EXECUTE 'SELECT count(*) FROM public.workos_auth_bridges WHERE status = ''pending'' AND expires_at > now()'
+      INTO pending_count;
+    IF pending_count <> 0 THEN
+      RAISE EXCEPTION 'WorkOS retirement blocked: % live WorkOS bridge(s)', pending_count;
+    END IF;
+  END IF;
+END $$;
+
+DROP TABLE IF EXISTS public.workos_auth_bridges;
+DROP TABLE IF EXISTS public.workos_auth_sessions;
+
+DELETE FROM public.auth_identity_proofs proof
+USING public.user_auth_identities identity, public.auth_provider_resources resource
+WHERE proof.user_auth_identity_id = identity.id
+  AND identity.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.auth_identity_enrollments enrollment
+USING public.auth_provider_resources resource
+WHERE enrollment.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.user_auth_identities identity
+USING public.auth_provider_resources resource
+WHERE identity.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.tenant_auth_provider_references reference
+USING public.auth_provider_resources resource
+WHERE reference.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.auth_provider_resources
+WHERE provider_kind = 'legacy_workos' OR lifecycle_state = 'coexistence';
+
+DELETE FROM public.auth_route_clients WHERE lifecycle_state = 'coexistence';
+DELETE FROM public.plugin_installs WHERE plugin_key = 'workos-auth';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM public.plugin_components WHERE component_type = 'auth-provider'
+  ) THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: non-retired auth-provider plugin components remain';
+  END IF;
+END $$;
+
+ALTER TABLE public.plugin_components
+  DROP CONSTRAINT IF EXISTS plugin_components_type_allowed;
+ALTER TABLE public.plugin_components
+  ADD CONSTRAINT plugin_components_type_allowed
+  CHECK (component_type IN ('mcp-server', 'skills', 'infrastructure', 'ui-surface'));
+
+ALTER TABLE public.auth_provider_resources
+  ALTER COLUMN connection_key DROP DEFAULT,
+  ALTER COLUMN provider_kind DROP DEFAULT,
+  ALTER COLUMN lifecycle_state SET DEFAULT 'native';
+ALTER TABLE public.auth_provider_resources
+  DROP CONSTRAINT IF EXISTS auth_provider_resources_lifecycle_state_allowed;
+ALTER TABLE public.auth_provider_resources
+  ADD CONSTRAINT auth_provider_resources_lifecycle_state_allowed
+  CHECK (lifecycle_state IN ('native', 'denied'));
+
+ALTER TABLE public.auth_route_clients
+  DROP CONSTRAINT IF EXISTS auth_route_clients_lifecycle_allowed;
+ALTER TABLE public.auth_route_clients
+  ADD CONSTRAINT auth_route_clients_lifecycle_allowed
+  CHECK (lifecycle_state IN ('native', 'denied'));
+
+COMMIT;

package/dist/drizzle/0264_auth_enrollment_attempt_limits.sql

@@ -0,0 +1,15 @@
+-- Cap recipient-challenge guesses across every route for an enrollment grant.
+-- creates-column: public.auth_identity_enrollments.failed_attempts
+-- creates-column: public.auth_identity_enrollments.locked_at
+-- creates-constraint: public.auth_identity_enrollments.auth_identity_enrollments_failed_attempts_nonnegative
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD COLUMN IF NOT EXISTS failed_attempts integer NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS locked_at timestamptz;
+
+ALTER TABLE public.auth_identity_enrollments
+  DROP CONSTRAINT IF EXISTS auth_identity_enrollments_failed_attempts_nonnegative;
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD CONSTRAINT auth_identity_enrollments_failed_attempts_nonnegative
+  CHECK (failed_attempts >= 0);

package/dist/drizzle/0264_harness_tool_execution_ledger.sql

@@ -0,0 +1,113 @@
+-- creates: public.harness_tool_execution_events
+-- creates: public.idx_harness_tool_execution_turn
+-- creates: public.uq_harness_tool_execution_started
+-- creates: public.uq_harness_tool_execution_terminal
+-- creates-function: public.reject_harness_tool_execution_event_mutation
+-- creates-function: public.validate_harness_tool_execution_event_insert
+-- creates-trigger: public.harness_tool_execution_events.trg_reject_harness_tool_execution_event_mutation
+-- creates-trigger: public.harness_tool_execution_events.trg_validate_harness_tool_execution_event_insert
+-- Target-side Harness tool evidence. This is a sanitized append-only event
+-- stream, separate from the governed-effect claim/result cache in migration
+-- 0261. Targets write before credential resolution and once at terminal state.
+
+CREATE TABLE IF NOT EXISTS public.harness_tool_execution_events (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  principal_type text NOT NULL CHECK (principal_type IN ('user', 'service')),
+  principal_id text NOT NULL,
+  tool_use_id text NOT NULL,
+  operation text NOT NULL,
+  policy_revision text NOT NULL,
+  policy_decision_id text,
+  idempotency_key text NOT NULL,
+  credential_owner_alias text,
+  event_type text NOT NULL
+    CHECK (event_type IN ('started','completed','failed','uncertain')),
+  input_preview jsonb,
+  output_preview jsonb,
+  error_preview jsonb,
+  provider_request_id text,
+  duration_ms integer CHECK (duration_ms IS NULL OR duration_ms >= 0),
+  provider_cost_usd numeric(18,8)
+    CHECK (provider_cost_usd IS NULL OR provider_cost_usd >= 0),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (
+    (
+      event_type = 'started'
+      AND input_preview IS NOT NULL
+      AND output_preview IS NULL
+      AND error_preview IS NULL
+      AND provider_request_id IS NULL
+      AND duration_ms IS NULL
+      AND provider_cost_usd IS NULL
+    )
+    OR (
+      event_type IN ('completed','failed','uncertain')
+      AND input_preview IS NULL
+    )
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_tool_execution_started
+  ON public.harness_tool_execution_events (tenant_id, idempotency_key)
+  WHERE event_type = 'started';
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_tool_execution_terminal
+  ON public.harness_tool_execution_events (tenant_id, idempotency_key)
+  WHERE event_type IN ('completed','failed','uncertain');
+
+CREATE INDEX IF NOT EXISTS idx_harness_tool_execution_turn
+  ON public.harness_tool_execution_events (tenant_id, thread_id, turn_id, id);
+
+CREATE OR REPLACE FUNCTION public.validate_harness_tool_execution_event_insert()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.event_type = 'started' THEN
+    RETURN NEW;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM public.harness_tool_execution_events started
+    WHERE started.tenant_id = NEW.tenant_id
+      AND started.idempotency_key = NEW.idempotency_key
+      AND started.event_type = 'started'
+      AND started.thread_id = NEW.thread_id
+      AND started.turn_id = NEW.turn_id
+      AND started.principal_type = NEW.principal_type
+      AND started.principal_id = NEW.principal_id
+      AND started.tool_use_id = NEW.tool_use_id
+      AND started.operation = NEW.operation
+      AND started.policy_revision = NEW.policy_revision
+  ) THEN
+    RAISE EXCEPTION 'harness_tool_execution_terminal_without_matching_start';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_validate_harness_tool_execution_event_insert
+  ON public.harness_tool_execution_events;
+CREATE TRIGGER trg_validate_harness_tool_execution_event_insert
+BEFORE INSERT ON public.harness_tool_execution_events
+FOR EACH ROW EXECUTE FUNCTION public.validate_harness_tool_execution_event_insert();
+
+CREATE OR REPLACE FUNCTION public.reject_harness_tool_execution_event_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'harness_tool_execution_events_are_append_only';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_reject_harness_tool_execution_event_mutation
+  ON public.harness_tool_execution_events;
+CREATE TRIGGER trg_reject_harness_tool_execution_event_mutation
+BEFORE UPDATE OR DELETE ON public.harness_tool_execution_events
+FOR EACH ROW EXECUTE FUNCTION public.reject_harness_tool_execution_event_mutation();

package/dist/drizzle/0265_eval_runs_requester_identity.sql

@@ -0,0 +1,28 @@
+-- creates-column: public.eval_runs.requester_user_id
+-- creates: public.idx_eval_runs_requester_user_id
+-- Exact human principal used to resolve per-user identity and capabilities for
+-- production-shaped AgentCore Harness evaluation turns. Nullable preserves
+-- legacy Pi evaluation rows; Harness dispatch fails closed when it is absent.
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS requester_user_id uuid;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'eval_runs_requester_user_id_users_id_fk'
+      AND conrelid = 'public.eval_runs'::regclass
+  ) THEN
+    ALTER TABLE public.eval_runs
+      ADD CONSTRAINT eval_runs_requester_user_id_users_id_fk
+      FOREIGN KEY (requester_user_id)
+      REFERENCES public.users(id)
+      ON DELETE SET NULL;
+  END IF;
+END
+$$;
+
+CREATE INDEX IF NOT EXISTS idx_eval_runs_requester_user_id
+  ON public.eval_runs (requester_user_id);

package/dist/drizzle/0265_require_fully_valid_auth_publication.sql

@@ -0,0 +1,27 @@
+-- 0265_require_fully_valid_auth_publication.sql
+-- Partially validated providers must never be published or admitted. Existing
+-- rows are unpublished before the stricter canonical constraint is installed.
+-- creates-constraint: public.auth_provider_resources.auth_provider_resources_no_public_without_valid
+
+BEGIN;
+
+UPDATE public.auth_provider_resources
+SET public_options_published = false,
+    updated_at = now()
+WHERE public_options_published = true
+  AND validation_status <> 'valid';
+
+ALTER TABLE public.auth_provider_resources
+  DROP CONSTRAINT IF EXISTS auth_provider_resources_no_public_without_valid;
+
+ALTER TABLE public.auth_provider_resources
+  ADD CONSTRAINT auth_provider_resources_no_public_without_valid
+  CHECK (
+    public_options_published = false
+    OR (
+      validation_status = 'valid'
+      AND lifecycle_state <> 'denied'
+    )
+  );
+
+COMMIT;

package/dist/drizzle/0266_auth_identity_recovery_grants.sql

@@ -0,0 +1,9 @@
+-- 0266_auth_identity_recovery_grants.sql
+-- creates-constraint: public.auth_identity_enrollments.auth_identity_enrollments_grant_kind_allowed
+
+ALTER TABLE public.auth_identity_enrollments
+  DROP CONSTRAINT IF EXISTS auth_identity_enrollments_grant_kind_allowed;
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD CONSTRAINT auth_identity_enrollments_grant_kind_allowed
+  CHECK (recipient_grant_kind IN ('membership', 'pending_owner', 'identity_recovery', 'session_migration'));

package/dist/drizzle/0266_eval_profiles_runtime_type.sql

@@ -0,0 +1,12 @@
+-- creates-column: public.eval_profiles.runtime_type
+-- creates-constraint: public.eval_profiles.eval_profiles_runtime_type_check
+
+ALTER TABLE public.eval_profiles
+  ADD COLUMN IF NOT EXISTS runtime_type text NOT NULL DEFAULT 'pi';
+
+ALTER TABLE public.eval_profiles
+  DROP CONSTRAINT IF EXISTS eval_profiles_runtime_type_check;
+
+ALTER TABLE public.eval_profiles
+  ADD CONSTRAINT eval_profiles_runtime_type_check
+  CHECK (runtime_type IN ('pi', 'agentcore'));

package/dist/drizzle/0267_ontology_candidate_rejections.sql

@@ -0,0 +1,53 @@
+-- Purpose: durable candidate-rejection fingerprints (KTD-6 / R13) and the
+--   `deferred` change-set item status (R15) for the Ontology Living Map.
+-- Plan: docs/plans/2026-07-18-001-feat-ontology-living-map-plan.md (U2)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0267_ontology_candidate_rejections.sql
+-- creates: ontology.candidate_rejections
+-- creates: ontology.uq_ontology_candidate_rejections_fingerprint
+-- creates: ontology.idx_ontology_candidate_rejections_tenant
+-- creates-constraint: ontology.candidate_rejections.ontology_candidate_rejections_tenant_id_tenants_id_fk
+-- creates-constraint: ontology.candidate_rejections.ontology_candidate_rejections_kind_allowed
+-- creates-constraint: ontology.change_set_items.ontology_change_set_items_status_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS ontology.candidate_rejections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  kind text NOT NULL,
+  slug text NOT NULL,
+  fingerprint text NOT NULL,
+  rejected_by uuid,
+  rejected_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT ontology_candidate_rejections_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT ontology_candidate_rejections_rejected_by_users_id_fk
+    FOREIGN KEY (rejected_by)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT ontology_candidate_rejections_kind_allowed
+    CHECK (kind IN ('entity_type','relationship_type','facet_template','external_mapping'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_ontology_candidate_rejections_fingerprint
+  ON ontology.candidate_rejections (tenant_id, kind, fingerprint);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_candidate_rejections_tenant
+  ON ontology.candidate_rejections (tenant_id);
+
+-- R15: excluded-at-approval items become `deferred` (re-reviewable) — widen
+-- the item status CHECK to admit the new value.
+ALTER TABLE ontology.change_set_items
+  DROP CONSTRAINT IF EXISTS ontology_change_set_items_status_allowed;
+ALTER TABLE ontology.change_set_items
+  ADD CONSTRAINT ontology_change_set_items_status_allowed
+  CHECK (status IN ('pending_review','approved','rejected','applied','deferred'));
+
+COMMIT;