thinkwork-cli 0.13.1 → 1.0.0

package/dist/drizzle/0263_drop_workos_auth_runtime.sql

@@ -0,0 +1,236 @@
+-- 0263_drop_workos_auth_runtime.sql
+--
+-- Final guarded retirement of the WorkOS login broker. Historical migrations
+-- 0174/0175 remain in the repository; this migration removes their runtime
+-- tables only after a completed native-auth cutover proves identity,
+-- client-shutdown, token-drain, realtime-drain, and zero-reader/writer gates.
+-- Raw WorkOS profile/session data is deliberately purged, not archived.
+--
+-- drops: public.workos_auth_bridges
+-- drops: public.workos_auth_sessions
+-- creates-constraint: public.plugin_components.plugin_components_type_allowed
+-- creates-constraint: public.auth_provider_resources.auth_provider_resources_lifecycle_state_allowed
+-- creates-constraint: public.auth_route_clients.auth_route_clients_lifecycle_allowed
+-- deployment-phase: auth-retired
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '30s';
+SET LOCAL statement_timeout = '300s';
+
+SELECT pg_advisory_xact_lock(hashtext('drop_workos_auth_runtime'));
+SELECT set_config('thinkwork.auth_retirement_stage', :'stage', true);
+
+DO $$
+DECLARE
+  cutover record;
+  residue_exists boolean;
+  table_has_rows boolean;
+  pending_count bigint;
+BEGIN
+  IF current_database() != 'thinkwork' THEN
+    RAISE EXCEPTION 'wrong database: %, expected thinkwork', current_database();
+  END IF;
+
+  SELECT
+    EXISTS (
+      SELECT 1 FROM public.auth_provider_resources
+      WHERE provider_kind = 'legacy_workos' OR lifecycle_state = 'coexistence'
+    )
+    OR EXISTS (
+      SELECT 1 FROM public.auth_route_clients
+      WHERE lifecycle_state = 'coexistence'
+    )
+    OR EXISTS (
+      SELECT 1 FROM public.plugin_installs WHERE plugin_key = 'workos-auth'
+  )
+  INTO residue_exists;
+
+  IF to_regclass('public.workos_auth_bridges') IS NOT NULL THEN
+    EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.workos_auth_bridges)'
+      INTO table_has_rows;
+    residue_exists := residue_exists OR table_has_rows;
+  END IF;
+  IF to_regclass('public.workos_auth_sessions') IS NOT NULL THEN
+    EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.workos_auth_sessions)'
+      INTO table_has_rows;
+    residue_exists := residue_exists OR table_has_rows;
+  END IF;
+
+  IF NOT residue_exists THEN
+    RAISE NOTICE 'No WorkOS auth data exists — empty historical tables may be retired without cutover evidence';
+    RETURN;
+  END IF;
+
+  SELECT * INTO cutover
+  FROM public.auth_cutover_runs
+  WHERE stage = current_setting('thinkwork.auth_retirement_stage')
+  ORDER BY created_at DESC, id DESC
+  LIMIT 1;
+
+  IF cutover.id IS NULL THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: no auth_cutover_runs evidence for stage %',
+      current_setting('thinkwork.auth_retirement_stage');
+  END IF;
+
+  IF cutover.status <> 'complete' OR cutover.completed_at IS NULL THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: newest auth_cutover_runs evidence for stage % is %',
+      current_setting('thinkwork.auth_retirement_stage'), cutover.status;
+  END IF;
+
+  IF COALESCE((cutover.terminal_dispositions->>'allTerminal')::boolean, false) IS NOT TRUE
+    OR COALESCE((cutover.terminal_dispositions->>'unresolved')::bigint, -1) <> 0
+    OR COALESCE((cutover.terminal_dispositions->>'signoutExpected')::bigint, -1) <= 0
+    OR COALESCE((cutover.terminal_dispositions->>'signoutAttempts')::bigint, -1)
+      <> COALESCE((cutover.terminal_dispositions->>'signoutExpected')::bigint, -2)
+    OR COALESCE((cutover.terminal_dispositions->>'signoutFailures')::bigint, -1) <> 0
+    OR COALESCE((cutover.terminal_dispositions->>'compatibilityFallbackReads')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: identity/signout/fallback evidence is incomplete';
+  END IF;
+
+  IF COALESCE((cutover.client_shutdown_evidence->>'workosStartsEnabled')::boolean, true) IS NOT FALSE
+    OR COALESCE((cutover.client_shutdown_evidence->>'legacyClientsEnabled')::bigint, -1) <> 0
+    OR COALESCE((cutover.client_shutdown_evidence->>'legacyAudiencesAccepted')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: legacy clients or audiences remain enabled';
+  END IF;
+
+  IF COALESCE((cutover.drain_evidence->>'drainCompleted')::boolean, false) IS NOT TRUE
+    OR COALESCE((cutover.drain_evidence->>'legacyRouteTraffic')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'workosTableReads')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'workosTableWrites')::bigint, -1) <> 0
+    OR COALESCE((cutover.drain_evidence->>'activeLegacySubscriptions')::bigint, -1) <> 0
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: traffic, persistence, or realtime drain evidence is incomplete';
+  END IF;
+
+  IF COALESCE(cutover.drain_evidence->'provenance'->>'domain', '')
+      <> 'thinkwork.auth-cutover-evidence.v1'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'source', '')
+      <> 'verify-native-auth-cutover'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'stage', '')
+      <> current_setting('thinkwork.auth_retirement_stage')
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'runId', '') <> cutover.id::text
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'deploymentRevision', '')
+      !~ '^([a-f0-9]{40}|[a-f0-9]{64})$'
+    OR COALESCE(cutover.drain_evidence->'provenance'->>'payloadHash', '')
+      !~ '^[a-f0-9]{64}$'
+    OR length(COALESCE(cutover.drain_evidence->'provenance'->>'signature', '')) < 40
+    OR (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz < cutover.started_at
+    OR cutover.completed_at < (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz
+    OR cutover.completed_at > (cutover.drain_evidence->'provenance'->>'expiresAt')::timestamptz
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: signed stage/revision/time provenance is missing or stale';
+  END IF;
+
+  IF COALESCE((cutover.drain_evidence->>'guardEnabled')::boolean, false) IS NOT TRUE
+    -- AppSync GraphQL WebSocket connections can survive for 24 hours, longer
+    -- than the legacy clients' one-hour ID/access tokens.
+    OR COALESCE((cutover.drain_evidence->>'requiredSoakSeconds')::bigint, 0) < 86400
+    OR COALESCE(cutover.drain_evidence->>'deploymentRevision', '')
+      <> COALESCE(cutover.drain_evidence->'provenance'->>'deploymentRevision', '')
+    OR cutover.drain_evidence->>'baselineDatabaseStatsResetAt' IS NULL
+    OR cutover.drain_evidence->>'databaseStatsResetAt' IS NULL
+    OR cutover.drain_evidence->>'baselineDatabaseStatsResetAt'
+      <> cutover.drain_evidence->>'databaseStatsResetAt'
+    OR cutover.drain_evidence->>'soakStartedAt' IS NULL
+    OR (cutover.drain_evidence->'provenance'->>'observedAt')::timestamptz
+      < (cutover.drain_evidence->>'soakStartedAt')::timestamptz
+        + make_interval(secs => (cutover.drain_evidence->>'requiredSoakSeconds')::integer)
+  THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: revision-bound drain soak is missing or incomplete';
+  END IF;
+
+  SELECT count(*) INTO pending_count
+  FROM public.auth_identity_enrollments enrollment
+  JOIN public.auth_provider_resources resource
+    ON resource.id = enrollment.auth_provider_resource_id
+  WHERE (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence')
+    AND enrollment.status = 'pending'
+    AND enrollment.expires_at > now();
+  IF pending_count <> 0 THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: % live legacy identity enrollment(s)', pending_count;
+  END IF;
+
+  IF to_regclass('public.workos_auth_sessions') IS NOT NULL THEN
+    EXECUTE 'SELECT count(*) FROM public.workos_auth_sessions WHERE status = ''active'' AND expires_at > now()'
+      INTO pending_count;
+    IF pending_count <> 0 THEN
+      RAISE EXCEPTION 'WorkOS retirement blocked: % active WorkOS session(s)', pending_count;
+    END IF;
+  END IF;
+
+  IF to_regclass('public.workos_auth_bridges') IS NOT NULL THEN
+    EXECUTE 'SELECT count(*) FROM public.workos_auth_bridges WHERE status = ''pending'' AND expires_at > now()'
+      INTO pending_count;
+    IF pending_count <> 0 THEN
+      RAISE EXCEPTION 'WorkOS retirement blocked: % live WorkOS bridge(s)', pending_count;
+    END IF;
+  END IF;
+END $$;
+
+DROP TABLE IF EXISTS public.workos_auth_bridges;
+DROP TABLE IF EXISTS public.workos_auth_sessions;
+
+DELETE FROM public.auth_identity_proofs proof
+USING public.user_auth_identities identity, public.auth_provider_resources resource
+WHERE proof.user_auth_identity_id = identity.id
+  AND identity.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.auth_identity_enrollments enrollment
+USING public.auth_provider_resources resource
+WHERE enrollment.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.user_auth_identities identity
+USING public.auth_provider_resources resource
+WHERE identity.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.tenant_auth_provider_references reference
+USING public.auth_provider_resources resource
+WHERE reference.auth_provider_resource_id = resource.id
+  AND (resource.provider_kind = 'legacy_workos' OR resource.lifecycle_state = 'coexistence');
+
+DELETE FROM public.auth_provider_resources
+WHERE provider_kind = 'legacy_workos' OR lifecycle_state = 'coexistence';
+
+DELETE FROM public.auth_route_clients WHERE lifecycle_state = 'coexistence';
+DELETE FROM public.plugin_installs WHERE plugin_key = 'workos-auth';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM public.plugin_components WHERE component_type = 'auth-provider'
+  ) THEN
+    RAISE EXCEPTION 'WorkOS retirement blocked: non-retired auth-provider plugin components remain';
+  END IF;
+END $$;
+
+ALTER TABLE public.plugin_components
+  DROP CONSTRAINT IF EXISTS plugin_components_type_allowed;
+ALTER TABLE public.plugin_components
+  ADD CONSTRAINT plugin_components_type_allowed
+  CHECK (component_type IN ('mcp-server', 'skills', 'infrastructure', 'ui-surface'));
+
+ALTER TABLE public.auth_provider_resources
+  ALTER COLUMN connection_key DROP DEFAULT,
+  ALTER COLUMN provider_kind DROP DEFAULT,
+  ALTER COLUMN lifecycle_state SET DEFAULT 'native';
+ALTER TABLE public.auth_provider_resources
+  DROP CONSTRAINT IF EXISTS auth_provider_resources_lifecycle_state_allowed;
+ALTER TABLE public.auth_provider_resources
+  ADD CONSTRAINT auth_provider_resources_lifecycle_state_allowed
+  CHECK (lifecycle_state IN ('native', 'denied'));
+
+ALTER TABLE public.auth_route_clients
+  DROP CONSTRAINT IF EXISTS auth_route_clients_lifecycle_allowed;
+ALTER TABLE public.auth_route_clients
+  ADD CONSTRAINT auth_route_clients_lifecycle_allowed
+  CHECK (lifecycle_state IN ('native', 'denied'));
+
+COMMIT;

package/dist/drizzle/0264_auth_enrollment_attempt_limits.sql

@@ -0,0 +1,15 @@
+-- Cap recipient-challenge guesses across every route for an enrollment grant.
+-- creates-column: public.auth_identity_enrollments.failed_attempts
+-- creates-column: public.auth_identity_enrollments.locked_at
+-- creates-constraint: public.auth_identity_enrollments.auth_identity_enrollments_failed_attempts_nonnegative
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD COLUMN IF NOT EXISTS failed_attempts integer NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS locked_at timestamptz;
+
+ALTER TABLE public.auth_identity_enrollments
+  DROP CONSTRAINT IF EXISTS auth_identity_enrollments_failed_attempts_nonnegative;
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD CONSTRAINT auth_identity_enrollments_failed_attempts_nonnegative
+  CHECK (failed_attempts >= 0);

package/dist/drizzle/0265_eval_runs_requester_identity.sql

@@ -0,0 +1,28 @@
+-- creates-column: public.eval_runs.requester_user_id
+-- creates: public.idx_eval_runs_requester_user_id
+-- Exact human principal used to resolve per-user identity and capabilities for
+-- production-shaped AgentCore Harness evaluation turns. Nullable preserves
+-- legacy Pi evaluation rows; Harness dispatch fails closed when it is absent.
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS requester_user_id uuid;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'eval_runs_requester_user_id_users_id_fk'
+      AND conrelid = 'public.eval_runs'::regclass
+  ) THEN
+    ALTER TABLE public.eval_runs
+      ADD CONSTRAINT eval_runs_requester_user_id_users_id_fk
+      FOREIGN KEY (requester_user_id)
+      REFERENCES public.users(id)
+      ON DELETE SET NULL;
+  END IF;
+END
+$$;
+
+CREATE INDEX IF NOT EXISTS idx_eval_runs_requester_user_id
+  ON public.eval_runs (requester_user_id);

package/dist/drizzle/0265_require_fully_valid_auth_publication.sql

@@ -0,0 +1,27 @@
+-- 0265_require_fully_valid_auth_publication.sql
+-- Partially validated providers must never be published or admitted. Existing
+-- rows are unpublished before the stricter canonical constraint is installed.
+-- creates-constraint: public.auth_provider_resources.auth_provider_resources_no_public_without_valid
+
+BEGIN;
+
+UPDATE public.auth_provider_resources
+SET public_options_published = false,
+    updated_at = now()
+WHERE public_options_published = true
+  AND validation_status <> 'valid';
+
+ALTER TABLE public.auth_provider_resources
+  DROP CONSTRAINT IF EXISTS auth_provider_resources_no_public_without_valid;
+
+ALTER TABLE public.auth_provider_resources
+  ADD CONSTRAINT auth_provider_resources_no_public_without_valid
+  CHECK (
+    public_options_published = false
+    OR (
+      validation_status = 'valid'
+      AND lifecycle_state <> 'denied'
+    )
+  );
+
+COMMIT;

package/dist/drizzle/0266_auth_identity_recovery_grants.sql

@@ -0,0 +1,9 @@
+-- 0266_auth_identity_recovery_grants.sql
+-- creates-constraint: public.auth_identity_enrollments.auth_identity_enrollments_grant_kind_allowed
+
+ALTER TABLE public.auth_identity_enrollments
+  DROP CONSTRAINT IF EXISTS auth_identity_enrollments_grant_kind_allowed;
+
+ALTER TABLE public.auth_identity_enrollments
+  ADD CONSTRAINT auth_identity_enrollments_grant_kind_allowed
+  CHECK (recipient_grant_kind IN ('membership', 'pending_owner', 'identity_recovery', 'session_migration'));

package/dist/drizzle/0266_eval_profiles_runtime_type.sql

@@ -0,0 +1,12 @@
+-- creates-column: public.eval_profiles.runtime_type
+-- creates-constraint: public.eval_profiles.eval_profiles_runtime_type_check
+
+ALTER TABLE public.eval_profiles
+  ADD COLUMN IF NOT EXISTS runtime_type text NOT NULL DEFAULT 'pi';
+
+ALTER TABLE public.eval_profiles
+  DROP CONSTRAINT IF EXISTS eval_profiles_runtime_type_check;
+
+ALTER TABLE public.eval_profiles
+  ADD CONSTRAINT eval_profiles_runtime_type_check
+  CHECK (runtime_type IN ('pi', 'agentcore'));

package/dist/drizzle/0267_ontology_candidate_rejections.sql

@@ -0,0 +1,53 @@
+-- Purpose: durable candidate-rejection fingerprints (KTD-6 / R13) and the
+--   `deferred` change-set item status (R15) for the Ontology Living Map.
+-- Plan: docs/plans/2026-07-18-001-feat-ontology-living-map-plan.md (U2)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0267_ontology_candidate_rejections.sql
+-- creates: ontology.candidate_rejections
+-- creates: ontology.uq_ontology_candidate_rejections_fingerprint
+-- creates: ontology.idx_ontology_candidate_rejections_tenant
+-- creates-constraint: ontology.candidate_rejections.ontology_candidate_rejections_tenant_id_tenants_id_fk
+-- creates-constraint: ontology.candidate_rejections.ontology_candidate_rejections_kind_allowed
+-- creates-constraint: ontology.change_set_items.ontology_change_set_items_status_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+CREATE TABLE IF NOT EXISTS ontology.candidate_rejections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  kind text NOT NULL,
+  slug text NOT NULL,
+  fingerprint text NOT NULL,
+  rejected_by uuid,
+  rejected_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT ontology_candidate_rejections_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT ontology_candidate_rejections_rejected_by_users_id_fk
+    FOREIGN KEY (rejected_by)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT ontology_candidate_rejections_kind_allowed
+    CHECK (kind IN ('entity_type','relationship_type','facet_template','external_mapping'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_ontology_candidate_rejections_fingerprint
+  ON ontology.candidate_rejections (tenant_id, kind, fingerprint);
+
+CREATE INDEX IF NOT EXISTS idx_ontology_candidate_rejections_tenant
+  ON ontology.candidate_rejections (tenant_id);
+
+-- R15: excluded-at-approval items become `deferred` (re-reviewable) — widen
+-- the item status CHECK to admit the new value.
+ALTER TABLE ontology.change_set_items
+  DROP CONSTRAINT IF EXISTS ontology_change_set_items_status_allowed;
+ALTER TABLE ontology.change_set_items
+  ADD CONSTRAINT ontology_change_set_items_status_allowed
+  CHECK (status IN ('pending_review','approved','rejected','applied','deferred'));
+
+COMMIT;

package/dist/drizzle/0268_identity_crosswalk_routing.sql

@@ -0,0 +1,182 @@
+-- THINK-321 U1: identity crosswalk routing vocabulary and linkage.
+-- Plan: docs/plans/2026-07-19-001-feat-ontology-identity-crosswalk-agent-routing-plan.md (U1)
+-- Contents:
+--   * identity.entity_source_mappings — `created_by` CHECK gains 'user'
+--     (in-turn confirm attribution); nullable created_by_user_id +
+--     created_thread_ref audit columns.
+--   * identity.entity_resolution_events — `event_type` CHECK gains
+--     'revoke' and 'split' (the V1 "no split" restriction is lifted).
+--   * identity.mapping_rejections — negative evidence: rejected
+--     (source identity <-> canonical entity) pairings, honored by the
+--     matcher (KTD-6).
+--   * identity.source_system_connectors — source_system -> tenant connector
+--     linkage, read fail-closed by resolve (KTD-5).
+--   * identity.match_jobs — bootstrap/drift match jobs mirroring
+--     ontology.suggestion_scan_jobs (KTD-7).
+--   * identity.mapping_candidate_sets — in-turn confirm echo-check store:
+--     written by propose, invalidated on confirm/decline/re-propose,
+--     expired rows refused (KTD-2).
+-- Constraint widening ships BEFORE any writer code (this unit has none).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change).
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0268_identity_crosswalk_routing.sql
+-- creates-column: identity.entity_source_mappings.created_by_user_id
+-- creates-column: identity.entity_source_mappings.created_thread_ref
+-- creates-constraint: identity.entity_source_mappings.entity_source_mappings_created_by_allowed
+-- creates-constraint: identity.entity_resolution_events.entity_resolution_events_type_allowed
+-- creates: identity.mapping_rejections
+-- creates: identity.uq_mapping_rejections_pairing
+-- creates: identity.idx_mapping_rejections_tenant_canonical
+-- creates-constraint: identity.mapping_rejections.mapping_rejections_created_by_allowed
+-- creates: identity.source_system_connectors
+-- creates-constraint: identity.source_system_connectors.source_system_connectors_connector_slug_fk
+-- creates: identity.match_jobs
+-- creates: identity.uq_identity_match_jobs_dedupe
+-- creates: identity.idx_identity_match_jobs_tenant_status
+-- creates-constraint: identity.match_jobs.match_jobs_status_allowed
+-- creates: identity.mapping_candidate_sets
+-- creates: identity.idx_mapping_candidate_sets_tenant_thread
+-- creates-constraint: identity.mapping_candidate_sets.mapping_candidate_sets_status_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('identity_crosswalk_routing_0268'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_source_mappings — user attribution vocabulary
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE identity.entity_source_mappings
+  ADD COLUMN IF NOT EXISTS created_by_user_id uuid
+    REFERENCES public.users(id) ON DELETE SET NULL;
+
+ALTER TABLE identity.entity_source_mappings
+  ADD COLUMN IF NOT EXISTS created_thread_ref text;
+
+ALTER TABLE identity.entity_source_mappings
+  DROP CONSTRAINT IF EXISTS entity_source_mappings_created_by_allowed;
+ALTER TABLE identity.entity_source_mappings
+  ADD CONSTRAINT entity_source_mappings_created_by_allowed
+  CHECK (created_by IN ('rule','operator','backfill','user'));
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_resolution_events — revoke + split event vocabulary
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE identity.entity_resolution_events
+  DROP CONSTRAINT IF EXISTS entity_resolution_events_type_allowed;
+ALTER TABLE identity.entity_resolution_events
+  ADD CONSTRAINT entity_resolution_events_type_allowed
+  CHECK (event_type IN ('create','link','defer','reject','merge','revoke','split'));
+
+-- ---------------------------------------------------------------------------
+-- identity.mapping_rejections — negative evidence (KTD-6)
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.mapping_rejections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_system text NOT NULL,
+  namespace text NOT NULL DEFAULT '',
+  external_id text NOT NULL,
+  canonical_entity_id uuid NOT NULL
+    REFERENCES identity.canonical_entities(id) ON DELETE CASCADE,
+  reason text,
+  created_by text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT mapping_rejections_created_by_allowed
+    CHECK (created_by IN ('user','operator','rule','system'))
+);
+
+-- One rejection row per (source identity, canonical entity) pairing.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_mapping_rejections_pairing
+  ON identity.mapping_rejections
+    (tenant_id, source_system, namespace, external_id, canonical_entity_id);
+
+CREATE INDEX IF NOT EXISTS idx_mapping_rejections_tenant_canonical
+  ON identity.mapping_rejections (tenant_id, canonical_entity_id);
+
+-- ---------------------------------------------------------------------------
+-- identity.source_system_connectors — source_system -> connector link (KTD-5)
+-- ---------------------------------------------------------------------------
+
+-- The composite FK targets the plain unique index uq_tenant_mcp_servers_slug
+-- on public.tenant_mcp_servers (tenant_id, slug) — Postgres accepts a
+-- non-partial unique index as an FK target. ON UPDATE/DELETE CASCADE keeps
+-- the link from dangling when a connector is renamed or removed; resolve
+-- reads it fail-closed either way.
+CREATE TABLE IF NOT EXISTS identity.source_system_connectors (
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  source_system text NOT NULL,
+  connector_slug text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, source_system),
+  CONSTRAINT source_system_connectors_connector_slug_fk
+    FOREIGN KEY (tenant_id, connector_slug)
+    REFERENCES public.tenant_mcp_servers (tenant_id, slug)
+    ON UPDATE CASCADE
+    ON DELETE CASCADE
+);
+
+-- ---------------------------------------------------------------------------
+-- identity.match_jobs — bootstrap/drift match jobs (KTD-7)
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.match_jobs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  status text NOT NULL DEFAULT 'pending',
+  trigger text NOT NULL DEFAULT 'manual',
+  dedupe_key text,
+  source_systems jsonb NOT NULL DEFAULT '[]'::jsonb,
+  result jsonb NOT NULL DEFAULT '{}'::jsonb,
+  metrics jsonb NOT NULL DEFAULT '{}'::jsonb,
+  error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  started_at timestamptz,
+  finished_at timestamptz,
+  CONSTRAINT match_jobs_status_allowed
+    CHECK (status IN ('pending','running','succeeded','failed'))
+);
+
+-- Insert-or-load dedupe: at most one job per live dedupe key.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_identity_match_jobs_dedupe
+  ON identity.match_jobs (tenant_id, dedupe_key)
+  WHERE dedupe_key IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_identity_match_jobs_tenant_status
+  ON identity.match_jobs (tenant_id, status);
+
+-- ---------------------------------------------------------------------------
+-- identity.mapping_candidate_sets — confirm echo-check store (KTD-2)
+-- ---------------------------------------------------------------------------
+
+-- Lifecycle: written by propose (status='open'); invalidated on
+-- confirm/decline/re-propose (confirmed/declined/superseded); expired rows
+-- are refused. confirm_mapping succeeds only when the echoed candidate id
+-- matches the recorded selection on an open, unexpired row for the thread.
+CREATE TABLE IF NOT EXISTS identity.mapping_candidate_sets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_ref text NOT NULL,
+  source_system text NOT NULL,
+  namespace text NOT NULL DEFAULT '',
+  target_entity_ref jsonb,
+  candidates jsonb NOT NULL DEFAULT '[]'::jsonb,
+  status text NOT NULL DEFAULT 'open',
+  selected_candidate_id text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz,
+  CONSTRAINT mapping_candidate_sets_status_allowed
+    CHECK (status IN ('open','confirmed','declined','superseded','expired'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_mapping_candidate_sets_tenant_thread
+  ON identity.mapping_candidate_sets (tenant_id, thread_ref);
+
+COMMIT;

package/dist/drizzle/0269_ontology_system_map.sql

@@ -0,0 +1,31 @@
+-- Purpose: type-level system map (THINK-321 U3 / KTD-3 / R6) — per-entity-type
+--   declarations of which attached system holds which facets, shaped
+--   `{ facet, sourceSystem, note? }`, plus the `identity_map` change-set item
+--   type that governs edits (never a direct write).
+-- Plan: docs/plans/2026-07-19-001-feat-ontology-identity-crosswalk-agent-routing-plan.md (U3)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0269_ontology_system_map.sql
+-- creates-column: ontology.entity_types.system_map
+-- creates-column: ontology.entity_types.system_map_version
+-- creates-constraint: ontology.change_set_items.ontology_change_set_items_type_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS system_map jsonb NOT NULL DEFAULT '[]'::jsonb;
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS system_map_version integer NOT NULL DEFAULT 0;
+
+-- R6: `identity_map` change-set items carry system-map edits through the
+-- change-set approval loop — widen the item type CHECK to admit the value.
+ALTER TABLE ontology.change_set_items
+  DROP CONSTRAINT IF EXISTS ontology_change_set_items_type_allowed;
+ALTER TABLE ontology.change_set_items
+  ADD CONSTRAINT ontology_change_set_items_type_allowed
+  CHECK (item_type IN ('entity_type','relationship_type','facet_template','external_mapping','identity_map'));
+
+COMMIT;