thinkwork-cli 0.13.2 → 1.0.0

package/dist/drizzle/0271_ontology_twin_declarations.sql

@@ -0,0 +1,47 @@
+-- Purpose: Company Brain twin declarations (plan 2026-07-21-001 U3 / KTD-3) —
+--   per-entity-type facet declarations (clone policy + cadence + attribute
+--   mappings) and page-section declarations, per-relationship-type source
+--   bindings (deterministic FK edge population), plus the three change-set
+--   item types that govern edits (`facet_declaration`, `relationship_binding`,
+--   `page_section`). The compiled twin mapping export is regenerated from
+--   these columns on every change-set apply.
+-- Plan: docs/plans/2026-07-21-001-feat-company-brain-digital-twin-plan.md (U3)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0271_ontology_twin_declarations.sql
+-- creates-column: ontology.entity_types.twin_facets
+-- creates-column: ontology.entity_types.twin_facets_version
+-- creates-column: ontology.entity_types.page_sections
+-- creates-column: ontology.entity_types.page_sections_version
+-- creates-column: ontology.relationship_types.source_binding
+-- creates-column: ontology.relationship_types.source_binding_version
+-- creates-constraint: ontology.change_set_items.ontology_change_set_items_type_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS twin_facets jsonb NOT NULL DEFAULT '[]'::jsonb;
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS twin_facets_version integer NOT NULL DEFAULT 0;
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS page_sections jsonb NOT NULL DEFAULT '[]'::jsonb;
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS page_sections_version integer NOT NULL DEFAULT 0;
+
+ALTER TABLE ontology.relationship_types
+  ADD COLUMN IF NOT EXISTS source_binding jsonb NOT NULL DEFAULT '{}'::jsonb;
+ALTER TABLE ontology.relationship_types
+  ADD COLUMN IF NOT EXISTS source_binding_version integer NOT NULL DEFAULT 0;
+
+-- Widen the item-type CHECK to admit the three twin declaration item types
+-- (constraint-widening deploys before writer code per house convention).
+ALTER TABLE ontology.change_set_items
+  DROP CONSTRAINT IF EXISTS ontology_change_set_items_type_allowed;
+ALTER TABLE ontology.change_set_items
+  ADD CONSTRAINT ontology_change_set_items_type_allowed
+  CHECK (item_type IN ('entity_type','relationship_type','facet_template','external_mapping','identity_map','facet_declaration','relationship_binding','page_section'));
+
+COMMIT;

package/dist/drizzle/0272_identity_graph_projection_cursor.sql

@@ -0,0 +1,23 @@
+-- Purpose: twin graph projector consumer state (Company Brain U5 / KTD-4) —
+--   per-tenant cursor over identity.entity_resolution_events. The cursor is
+--   the source of truth for the projector; nudge invokes are latency only.
+-- Plan: docs/plans/2026-07-21-001-feat-company-brain-digital-twin-plan.md (U5)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0272_identity_graph_projection_cursor.sql
+-- creates: identity.graph_projection_cursors
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+CREATE TABLE IF NOT EXISTS identity.graph_projection_cursors (
+    tenant_id             UUID PRIMARY KEY REFERENCES public.tenants(id) ON DELETE CASCADE,
+    last_event_created_at TIMESTAMPTZ,
+    last_event_id         UUID,
+    last_snapshot_cursor  TEXT,
+    updated_at            TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/dist/drizzle/0273_twin_materialization_suggestions.sql

@@ -0,0 +1,29 @@
+-- Purpose: materialization suggestions (Company Brain U8 / R8) — when a
+--   cohort question needs a limited/unclonable facet, the gap surfaces to
+--   operators on the ontology surface as a persisted, deduped, dismissible
+--   suggestion with a hit counter (one row per tenant + entity type + facet).
+-- Plan: docs/plans/2026-07-21-001-feat-company-brain-digital-twin-plan.md (U8)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0273_twin_materialization_suggestions.sql
+-- creates: public.twin_materialization_suggestions
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+CREATE TABLE IF NOT EXISTS public.twin_materialization_suggestions (
+    id               UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id        UUID        NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+    entity_type_slug TEXT        NOT NULL,
+    facet_slug       TEXT        NOT NULL,
+    hit_count        INTEGER     NOT NULL DEFAULT 1,
+    last_question    TEXT,
+    dismissed_at     TIMESTAMPTZ,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (tenant_id, entity_type_slug, facet_slug)
+);
+
+COMMIT;

package/dist/drizzle/0274_tenant_mcp_twin_keys.sql

@@ -0,0 +1,59 @@
+-- tenant_mcp_twin_keys — per-tenant Bearer keys for the Company Brain MCP
+-- server (THINK-333).
+--
+-- The agent path to /mcp/twin authenticates with a `tkt_`-prefixed key.
+-- The mcp-twin handler hashes the incoming Bearer with SHA-256 and looks
+-- it up here where revoked_at IS NULL — the matched row IS the tenant
+-- selection (no tenant id is embedded in the token, so there is no
+-- select-then-verify ambiguity). Raw keys are never stored — only the
+-- hash + metadata. Rotation inserts a fresh row and revokes the old one.
+--
+-- Mirrors tenant_mcp_admin_keys (drizzle/0024) structurally; a separate
+-- table so twin revocation never entangles the admin-ops scope.
+--
+-- Apply manually (matches the 0018+ hand-rolled convention):
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0274_tenant_mcp_twin_keys.sql
+--
+-- Drift detection:
+--   pnpm db:migrate-manual
+--
+-- Pre-migration invariants:
+--   - tenants exists.
+--   - tenant_mcp_twin_keys does not yet exist.
+--     SELECT to_regclass('public.tenant_mcp_twin_keys'); -- must be NULL
+--
+-- creates: public.tenant_mcp_twin_keys
+-- creates: public.uq_tenant_mcp_twin_keys_hash
+-- creates: public.uq_tenant_mcp_twin_keys_active_name
+-- creates: public.idx_tenant_mcp_twin_keys_tenant
+
+CREATE TABLE "tenant_mcp_twin_keys" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"tenant_id" uuid NOT NULL REFERENCES "tenants"("id") ON DELETE CASCADE,
+	-- SHA-256 hex digest of the raw key. 64 chars; text keeps tooling friendly.
+	"key_hash" text NOT NULL,
+	-- Human label; "default" for the provisioned connector key.
+	"name" text NOT NULL,
+	"created_at" timestamptz NOT NULL DEFAULT now(),
+	-- Who created the key. Nullable for service-provisioned keys.
+	"created_by_user_id" uuid,
+	-- Bumped on every successful auth by the mcp-twin handler. Async,
+	-- best-effort (failure to update does not block the request).
+	"last_used_at" timestamptz,
+	-- Soft-delete. NULL = active. Rotation sets now() on the old row; the
+	-- row is retained for audit + to prevent hash reuse.
+	"revoked_at" timestamptz
+);
+
+-- Global uniqueness on hash — a single-row lookup resolves the tenant.
+CREATE UNIQUE INDEX "uq_tenant_mcp_twin_keys_hash"
+	ON "tenant_mcp_twin_keys" ("key_hash");
+
+-- Per-tenant uniqueness on name among active rows. Partial index so a
+-- rotated/revoked "default" does not block minting a fresh "default".
+CREATE UNIQUE INDEX "uq_tenant_mcp_twin_keys_active_name"
+	ON "tenant_mcp_twin_keys" ("tenant_id", "name")
+	WHERE "revoked_at" IS NULL;
+
+CREATE INDEX "idx_tenant_mcp_twin_keys_tenant"
+	ON "tenant_mcp_twin_keys" ("tenant_id", "created_at");

package/dist/drizzle/0275_identity_bulk_rebuild_fence.sql

@@ -0,0 +1,30 @@
+-- Purpose: bulk-rebuild lane fence + extract-time watermark (THINK-331) —
+--   per-tenant CAS fence on the projector cursor row. bulk_load_started_at
+--   non-null = a bulk-rebuild holds the fence (heartbeat, refreshed on every
+--   resume/poll); bulk_load_id is the Neptune loader job id (null until the
+--   loader starts). The watermark pair is captured SQL-side BEFORE the
+--   Postgres extract so the success tail fast-forwards the cursor only past
+--   events the extract reflected — events committed during the load window
+--   replay through the nudge lane. Additive-only; lands before the code that
+--   reads it (safe ordering).
+-- Plan: docs/plans/2026-07-22-004-feat-identity-projector-bulk-rebuild-plan.md (U2)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0275_identity_bulk_rebuild_fence.sql
+-- creates-column: identity.graph_projection_cursors.bulk_load_id
+-- creates-column: identity.graph_projection_cursors.bulk_load_started_at
+-- creates-column: identity.graph_projection_cursors.bulk_watermark_created_at
+-- creates-column: identity.graph_projection_cursors.bulk_watermark_event_id
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+ALTER TABLE identity.graph_projection_cursors
+    ADD COLUMN IF NOT EXISTS bulk_load_id              TEXT,
+    ADD COLUMN IF NOT EXISTS bulk_load_started_at      TIMESTAMPTZ,
+    ADD COLUMN IF NOT EXISTS bulk_watermark_created_at TIMESTAMPTZ,
+    ADD COLUMN IF NOT EXISTS bulk_watermark_event_id   UUID;
+
+COMMIT;

package/dist/drizzle/0276_tool_execution_ledger_allow_cascade_delete.sql

@@ -0,0 +1,18 @@
+-- creates-trigger: public.tool_execution_events.trg_reject_tool_execution_event_mutation
+-- Thread deletion was impossible for any thread whose agent ran tools: the
+-- ledger declares thread_id/turn_id/tenant_id FKs ON DELETE CASCADE, but the
+-- append-only guard trigger fired on the cascaded DELETE too and aborted the
+-- whole deleteThread transaction with `tool_execution_events_are_append_only`.
+--
+-- Recreate the guard with WHEN (pg_trigger_depth() = 0): direct UPDATE/DELETE
+-- statements are still rejected (the WHEN clause sees depth 0 and the guard
+-- raises), while deletes arriving through FK referential-action triggers run
+-- at depth >= 1 and are allowed — which is exactly the lifecycle the CASCADE
+-- clauses on this table already promised.
+DROP TRIGGER IF EXISTS trg_reject_tool_execution_event_mutation
+  ON public.tool_execution_events;
+CREATE TRIGGER trg_reject_tool_execution_event_mutation
+BEFORE UPDATE OR DELETE ON public.tool_execution_events
+FOR EACH ROW
+WHEN (pg_trigger_depth() = 0)
+EXECUTE FUNCTION public.reject_tool_execution_event_mutation();

package/dist/drizzle/0277_knowledge_base_sources.sql

@@ -0,0 +1,107 @@
+-- External S3 KB source U1: a Knowledge Base holds N data sources instead of
+-- one implied upload prefix.
+-- Contents:
+--   * public.knowledge_base_sources — one row per Bedrock data source of a
+--     KB. kind 'managed-upload' is the platform upload prefix (backfilled as
+--     source #0 from the KB's implied prefix + aws_data_source_id);
+--     's3-connect' points at an existing customer bucket/prefix read in
+--     place; 'snapshot' is a reserved enum value only. `bucket` is NULL for
+--     managed-upload (workspace bucket resolved at runtime).
+--   * uq_kb_sources_managed_upload — one managed-upload source per KB.
+--   * public.knowledge_base_documents.source_id — nullable FK to the source
+--     row (data_source_id keeps the AWS identity; this is the row reference),
+--     backfilled to the managed-upload source.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0277_knowledge_base_sources.sql
+-- creates: public.knowledge_base_sources
+-- creates: public.idx_kb_sources_kb
+-- creates: public.idx_kb_sources_tenant
+-- creates: public.uq_kb_sources_managed_upload
+-- creates: public.idx_kb_documents_source
+-- creates-column: public.knowledge_base_documents.source_id
+-- creates-constraint: public.knowledge_base_sources.knowledge_base_sources_kind_check
+-- creates-constraint: public.knowledge_base_sources.knowledge_base_sources_access_status_check
+-- creates-constraint: public.knowledge_base_sources.knowledge_base_sources_s3_connect_location_check
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS public.knowledge_base_sources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  knowledge_base_id uuid NOT NULL REFERENCES public.knowledge_bases(id) ON DELETE CASCADE,
+  kind text NOT NULL,
+  bucket text,
+  prefix text,
+  filter_patterns jsonb,
+  bucket_owner_account_id text,
+  parsing_strategy text NOT NULL DEFAULT 'DEFAULT',
+  aws_data_source_id text,
+  access_status text NOT NULL DEFAULT 'pending',
+  last_sync_at timestamptz,
+  last_sync_status text,
+  document_count integer DEFAULT 0,
+  error_message text,
+  sentinel_document_key text,
+  sentinel_phrase text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT knowledge_base_sources_kind_check
+    CHECK (kind IN ('managed-upload', 's3-connect', 'snapshot')),
+  CONSTRAINT knowledge_base_sources_access_status_check
+    CHECK (access_status IN ('pending', 'healthy', 'degraded', 'access_revoked', 'failed')),
+  CONSTRAINT knowledge_base_sources_s3_connect_location_check
+    CHECK (kind <> 's3-connect' OR (bucket IS NOT NULL AND prefix IS NOT NULL))
+);
+
+CREATE INDEX IF NOT EXISTS idx_kb_sources_kb
+  ON public.knowledge_base_sources (knowledge_base_id);
+
+CREATE INDEX IF NOT EXISTS idx_kb_sources_tenant
+  ON public.knowledge_base_sources (tenant_id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_kb_sources_managed_upload
+  ON public.knowledge_base_sources (knowledge_base_id)
+  WHERE kind = 'managed-upload';
+
+ALTER TABLE public.knowledge_base_documents
+  ADD COLUMN IF NOT EXISTS source_id uuid
+    REFERENCES public.knowledge_base_sources(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_source
+  ON public.knowledge_base_documents (source_id);
+
+-- Backfill source #0: one managed-upload row per existing KB, carrying the
+-- KB's implied upload prefix and its current Bedrock data-source identity.
+-- Backfilled sources are the platform's own bucket — access is 'healthy'.
+INSERT INTO public.knowledge_base_sources
+  (tenant_id, knowledge_base_id, kind, prefix, aws_data_source_id,
+   access_status, last_sync_at, last_sync_status, document_count)
+SELECT
+  kb.tenant_id,
+  kb.id,
+  'managed-upload',
+  'tenants/' || t.slug || '/knowledge-bases/' || kb.slug || '/documents/',
+  kb.aws_data_source_id,
+  'healthy',
+  kb.last_sync_at,
+  kb.last_sync_status,
+  kb.document_count
+FROM public.knowledge_bases kb
+JOIN public.tenants t ON t.id = kb.tenant_id
+WHERE NOT EXISTS (
+  SELECT 1 FROM public.knowledge_base_sources s
+  WHERE s.knowledge_base_id = kb.id AND s.kind = 'managed-upload'
+);
+
+-- Attribute existing manifest rows to their KB's managed-upload source.
+UPDATE public.knowledge_base_documents d
+SET source_id = s.id
+FROM public.knowledge_base_sources s
+WHERE d.source_id IS NULL
+  AND s.knowledge_base_id = d.knowledge_base_id
+  AND s.kind = 'managed-upload';
+
+COMMIT;

package/dist/drizzle/0278_kb_page_transcription.sql

@@ -0,0 +1,55 @@
+-- KB page transcription U1: image-bearing source documents are transcribed
+-- page-by-page before ingestion, so the manifest has to record what the
+-- preprocessor produced.
+--
+-- Background: Bedrock's default parser "only parses text in text files" and
+-- the platform never sends a parsingConfiguration, so scanned pages and
+-- embedded screenshots index as nothing. 71 of McPherson's 80 CX SOP PDFs
+-- (89%) keep most of their substance inside images. The fix is a preprocessor
+-- that splits each PDF page and transcribes it with a Claude vision model,
+-- then ingests one IN_LINE document per page under id '<key>#p=<n>'.
+--
+-- Contents:
+--   * knowledge_base_sources.parsing_strategy CHECK widened from the implicit
+--     'DEFAULT' to ('DEFAULT','TRANSCRIBE'). The column already exists and
+--     defaults to 'DEFAULT'; it was previously wired to nothing.
+--   * knowledge_base_documents gains the preprocessor result: derived_prefix
+--     (workspace-bucket location of pages/<n>.md + report.json), page_count,
+--     preprocessor_version (joins the change-detection predicate so a
+--     pipeline bump forces reprocessing), page_report (per-page route, model
+--     used, flags) and needs_review (any page the preprocessor flagged as
+--     low-signal — indexed with a warning, never silently dropped).
+--
+-- Manifest identity is unchanged: ONE row per source document. Page documents
+-- are an ingestion-level fan-out; their Bedrock statuses fold back up to the
+-- base document_key.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0278_kb_page_transcription.sql
+-- creates-column: public.knowledge_base_documents.derived_prefix
+-- creates-column: public.knowledge_base_documents.page_count
+-- creates-column: public.knowledge_base_documents.preprocessor_version
+-- creates-column: public.knowledge_base_documents.page_report
+-- creates-column: public.knowledge_base_documents.needs_review
+-- creates: public.idx_kb_documents_needs_review
+-- creates-constraint: public.knowledge_base_sources.knowledge_base_sources_parsing_strategy_check
+
+ALTER TABLE public.knowledge_base_documents
+  ADD COLUMN IF NOT EXISTS derived_prefix text,
+  ADD COLUMN IF NOT EXISTS page_count integer,
+  ADD COLUMN IF NOT EXISTS preprocessor_version text,
+  ADD COLUMN IF NOT EXISTS page_report jsonb,
+  ADD COLUMN IF NOT EXISTS needs_review boolean NOT NULL DEFAULT false;
+
+-- Operator surface: "which documents came back with pages the preprocessor
+-- was unsure about". Partial — the overwhelming majority are false.
+CREATE INDEX IF NOT EXISTS idx_kb_documents_needs_review
+  ON public.knowledge_base_documents (knowledge_base_id)
+  WHERE needs_review;
+
+ALTER TABLE public.knowledge_base_sources
+  DROP CONSTRAINT IF EXISTS knowledge_base_sources_parsing_strategy_check;
+
+ALTER TABLE public.knowledge_base_sources
+  ADD CONSTRAINT knowledge_base_sources_parsing_strategy_check
+  CHECK (parsing_strategy IN ('DEFAULT', 'TRANSCRIBE'));

package/dist/drizzle/0279_mcp_servers_off_plugin_provenance.sql

@@ -0,0 +1,93 @@
+-- Hand-rolled — apply manually to each stage via:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0279_mcp_servers_off_plugin_provenance.sql
+--
+-- See docs/solutions/workflow-issues/manually-applied-drizzle-migrations-drift-from-dev-2026-04-21.md
+--
+-- Plugin-system removal. The plugin engine's MCP component handler adopted
+-- surviving MCP servers as management_source='plugin' + plugin_install_id
+-- (migrations 0159/0161). Twenty CRM and n8n keep running after the plugin
+-- system is deleted, so their MCP rows move back to plain 'manual'
+-- registration — the same shape lastmile-dispatch and digital-twin already
+-- use.
+--
+-- data-only-migration
+-- No durable schema objects: this only rewrites provenance columns. The
+-- in-transaction assertions below are the correctness gate, and the
+-- verification queries at the bottom are the post-apply check.
+--
+-- Why this is safe:
+--
+--   * Credentials do not move. packages/api/src/lib/mcp-configs.ts resolves
+--     service_credential from auth_config.secretRef and oauth from
+--     user_mcp_tokens — in the plugin branch and the manual branch alike.
+--     plugin_install_id is used for dispatch *ordering* (plugin rows win a
+--     URL dedupe pass), never for auth.
+--   * Both target shapes are already proven on the manual path:
+--     manual|oauth (lastmile-dispatch, with live per-user tokens) and
+--     manual|service_credential (digital-twin, thinkwork-hindsight,
+--     postgres-dev).
+--   * Nothing re-adopts these rows. The only writers of
+--     management_source='plugin' are lib/plugins/handlers/mcp.ts and
+--     lib/plugins/cutover/deps.ts, both reached only by an explicit plugin
+--     install/activate — and both are deleted with the plugin system.
+--
+-- The CHECK constraint tenant_mcp_servers_managed_application_shape_check_v2
+-- requires manual rows to carry NO ownership key, so managed_application_key
+-- is cleared alongside plugin_install_id. Only dev's twenty--crm still has
+-- one (its pre-plugin identity, retained through the 0161 cutover); the
+-- customer stages already have it NULL.
+--
+-- Per-stage effect at time of writing:
+--   dev        twenty--crm (oauth, 2 tokens), n8n--workflow-management,
+--              company-brain--brain, plane--issues
+--   tei-e2e    twenty--crm (oauth, 3 tokens)
+--   mcpherson  n8n--workflow-management
+--
+-- company-brain--brain and plane--issues are flipped too rather than left
+-- dangling: their plugin_install_id would become a broken reference once the
+-- plugin tables drop. Their own removal is a separate decision.
+
+BEGIN;
+
+UPDATE tenant_mcp_servers
+   SET management_source     = 'manual',
+       plugin_install_id     = NULL,
+       managed_application_key = NULL,
+       updated_at            = now()
+ WHERE management_source = 'plugin';
+
+-- Fail loudly rather than commit a half-migration: no row anywhere may still
+-- claim plugin provenance, and none may violate the manual shape.
+DO $$
+DECLARE
+  leftover integer;
+  malformed integer;
+BEGIN
+  SELECT count(*) INTO leftover
+    FROM tenant_mcp_servers
+   WHERE management_source = 'plugin' OR plugin_install_id IS NOT NULL;
+  IF leftover > 0 THEN
+    RAISE EXCEPTION 'plugin provenance still present on % tenant_mcp_servers row(s)', leftover;
+  END IF;
+
+  SELECT count(*) INTO malformed
+    FROM tenant_mcp_servers
+   WHERE management_source = 'manual' AND managed_application_key IS NOT NULL;
+  IF malformed > 0 THEN
+    RAISE EXCEPTION 'manual rows still carry managed_application_key on % row(s)', malformed;
+  END IF;
+END $$;
+
+COMMIT;
+
+-- Verification (run after applying):
+--
+--   SELECT slug, management_source, auth_type,
+--          (plugin_install_id IS NOT NULL) AS has_plugin
+--     FROM tenant_mcp_servers ORDER BY slug;
+--
+--   -- per-user OAuth tokens must be untouched
+--   SELECT s.slug, count(t.id)
+--     FROM tenant_mcp_servers s
+--     LEFT JOIN user_mcp_tokens t ON t.mcp_server_id = s.id
+--    GROUP BY s.slug ORDER BY s.slug;

package/dist/drizzle/0280_work_item_external_refs_drop_plane_provider.sql

@@ -0,0 +1,46 @@
+-- 0280_work_item_external_refs_drop_plane_provider.sql
+--
+-- Purpose: drop 'plane' from the work_item_external_refs provider allowlist.
+-- Plane is retired — its deployment, DNS, S3 bucket, database, credentials and
+-- MCP registration are all gone, so the provider can never be written again.
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0280_work_item_external_refs_drop_plane_provider.sql
+--
+-- Recreates an existing constraint rather than adding a new object, so the
+-- drift reporter is given the constraint it should find afterwards.
+--
+-- creates-constraint: public.work_item_external_refs.work_item_external_refs_provider_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+-- Fail loudly rather than silently dropping rows the narrowed CHECK would
+-- reject. dev had zero 'plane' rows when this was written; another stage
+-- carrying them is a signal to migrate that data first, not to force through.
+DO $$
+DECLARE
+  offending bigint;
+BEGIN
+  SELECT count(*) INTO offending
+  FROM public.work_item_external_refs
+  WHERE provider = 'plane';
+
+  IF offending > 0 THEN
+    RAISE EXCEPTION
+      'work_item_external_refs still has % row(s) with provider=''plane''; migrate or delete them before narrowing the constraint',
+      offending;
+  END IF;
+END
+$$;
+
+ALTER TABLE public.work_item_external_refs
+  DROP CONSTRAINT IF EXISTS work_item_external_refs_provider_allowed;
+
+ALTER TABLE public.work_item_external_refs
+  ADD CONSTRAINT work_item_external_refs_provider_allowed
+  CHECK (provider IN ('thinkwork', 'lastmile', 'linear', 'twenty'));
+
+COMMIT;

package/dist/drizzle/0281_tenant_mcp_twin_keys_expiry_suffix.sql

@@ -0,0 +1,9 @@
+-- Brain API keys: display suffix + expiry on tenant_mcp_twin_keys.
+-- Hand-rolled (mirrors 0274 convention; not registered in meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0281_tenant_mcp_twin_keys_expiry_suffix.sql
+-- creates-column: public.tenant_mcp_twin_keys.key_suffix
+-- creates-column: public.tenant_mcp_twin_keys.expires_at
+
+ALTER TABLE public.tenant_mcp_twin_keys
+  ADD COLUMN IF NOT EXISTS key_suffix text,
+  ADD COLUMN IF NOT EXISTS expires_at timestamptz;

package/dist/drizzle/0282_tenant_mcp_twin_keys_grants.sql

@@ -0,0 +1,24 @@
+-- Brain API keys: per-key grants (security groups + KB collections) on
+-- tenant_mcp_twin_keys — the write side of key manifest v2
+-- (twin-mcp-keys/v2; reader is company-brain brain-mcp/src/auth.ts).
+-- Hand-rolled (mirrors 0274/0281 convention; not registered in
+-- meta/_journal.json).
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0282_tenant_mcp_twin_keys_grants.sql
+-- creates-column: public.tenant_mcp_twin_keys.security_groups
+-- creates-column: public.tenant_mcp_twin_keys.kb_collections
+
+ALTER TABLE public.tenant_mcp_twin_keys
+  ADD COLUMN IF NOT EXISTS security_groups text[] NOT NULL DEFAULT ARRAY[]::text[],
+  ADD COLUMN IF NOT EXISTS kb_collections text[] NOT NULL DEFAULT ARRAY[]::text[];
+
+-- The platform-provisioned connector key ("default") backs the console
+-- proxy and must never be narrowed by this migration: grandfather every
+-- active one to the wildcard grant that re-provisioning would write
+-- anyway. User-minted keys stay empty = PUBLIC graph only, no KB.
+UPDATE public.tenant_mcp_twin_keys
+   SET security_groups = ARRAY['*']::text[],
+       kb_collections  = ARRAY['*']::text[]
+ WHERE name = 'default'
+   AND revoked_at IS NULL
+   AND security_groups = ARRAY[]::text[]
+   AND kb_collections = ARRAY[]::text[];

package/dist/drizzle/0283_agents_agentcore_runtime_dispatch.sql

@@ -0,0 +1,13 @@
+-- THINK-585 U6 (KTD3): per-agent AgentCore Runtime dispatch flag.
+-- When true AND the stage kill-switch (AGENTCORE_RUNTIME_DISPATCH_ENABLED
+-- runtime-config key) is on, chat turns dispatch through the
+-- agentcore-runtime-dispatch Lambda to the Bedrock AgentCore Runtime with a
+-- per-thread session instead of the Pi Lambda. Additive + default false —
+-- safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0283_agents_agentcore_runtime_dispatch.sql
+-- creates-column: public.agents.agentcore_runtime_dispatch
+
+ALTER TABLE public.agents
+  ADD COLUMN IF NOT EXISTS agentcore_runtime_dispatch boolean NOT NULL DEFAULT false;

package/dist/drizzle/0284_user_brain_claims.sql

@@ -0,0 +1,69 @@
+-- User brain claims (THINK-625): per-(tenant, user) Company Brain
+-- authorization, the write side of the user-claims/v1 manifest published to
+-- `user-claims/<tenantId>/latest.json` in the brain-artifacts bucket.
+--
+-- Ships three things that must land together, because the publisher is
+-- useless without the safety interlock and the audit row cannot be written
+-- without the widened event-type constraint:
+--   1. the user_brain_claims table,
+--   2. tenant_settings.brain_user_claims_enabled (default false),
+--   3. the tenant_policy_events event_type CHECK widened to accept
+--      'user_brain_claims' (renamed to _v2 so drift is detectable).
+--
+-- Hand-rolled (partial-index-free but with a NULL-vs-empty array column the
+-- generator flattens; mirrors the 0274/0281/0282 convention). Not registered
+-- in meta/_journal.json.
+-- Apply via: psql "$DATABASE_URL" -f drizzle/0284_user_brain_claims.sql
+-- creates: public.user_brain_claims
+-- creates: public.uq_user_brain_claims_tenant_user
+-- creates: public.idx_user_brain_claims_tenant
+-- creates-column: public.tenant_settings.brain_user_claims_enabled
+-- creates-constraint: public.tenant_policy_events.tenant_policy_events_event_type_allowed_v2
+
+CREATE TABLE IF NOT EXISTS public.user_brain_claims (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+  -- '[]' = PUBLIC graph only; ARRAY['*'] = every group.
+  security_groups text[] NOT NULL DEFAULT ARRAY[]::text[],
+  -- KB is grant-only: '[]' = no KB at all; ARRAY['*'] = every collection.
+  kb_collections text[] NOT NULL DEFAULT ARRAY[]::text[],
+  kb_bundles jsonb NOT NULL DEFAULT '{}'::jsonb,
+  default_kb_bundle text,
+  -- NULL is DISTINCT from '{}': NULL = the Brain surface default applies,
+  -- '{}' = no tools at all. Never coalesce one into the other.
+  tool_allowlist text[],
+  is_operator boolean NOT NULL DEFAULT false,
+  kb_trace boolean NOT NULL DEFAULT false,
+  -- false still publishes an entry (disabled: true) so the Brain fails
+  -- closed rather than falling back to legacy group grants.
+  enabled boolean NOT NULL DEFAULT true,
+  notes text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by_user_id uuid
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_user_brain_claims_tenant_user
+  ON public.user_brain_claims (tenant_id, user_id);
+
+CREATE INDEX IF NOT EXISTS idx_user_brain_claims_tenant
+  ON public.user_brain_claims (tenant_id);
+
+-- Per-tenant enable flag. Default false everywhere: claims rows are
+-- editable with no publish until an operator flips this on.
+ALTER TABLE public.tenant_settings
+  ADD COLUMN IF NOT EXISTS brain_user_claims_enabled boolean NOT NULL DEFAULT false;
+
+-- Widen the audited event types. The old constraint is dropped and a
+-- freshly-named one created so `pnpm db:migrate-manual` can prove the
+-- widened version is actually present in the target database.
+ALTER TABLE public.tenant_policy_events
+  DROP CONSTRAINT IF EXISTS tenant_policy_events_event_type_allowed;
+
+ALTER TABLE public.tenant_policy_events
+  DROP CONSTRAINT IF EXISTS tenant_policy_events_event_type_allowed_v2;
+
+ALTER TABLE public.tenant_policy_events
+  ADD CONSTRAINT tenant_policy_events_event_type_allowed_v2
+  CHECK (event_type IN ('sandbox_enabled','compliance_tier','user_brain_claims'));