Extend Postgres target contract for durable identity

Author: Gini

HANDOVER.md

@@ -1,7 +1,7 @@
 # ONEVibe — Agent Handover Document
 
 > **Date**: 2026-07-17
-> **Status**: Local phases 1–3 are implemented and the professional UI has crossed the Zustand and ordinary-collection TanStack Query boundaries. Governed MCP declarations, bounded MCP health probing, a tested opt-in MCP capability facade, truthful demo skill status, a GitHub-catalog skill marketplace with protected Claude/LiteLLM materialization evidence, feature-gated Better Auth, authenticated owner scoping, a local organization-membership scaffold, and a reviewed Drizzle/Postgres import proof (including organization/member staging) are present. LiteLLM-only enforcement remains mandatory for every harness and every environment: data sovereignty, centralized routing, cost control, and model optimization are product requirements. The running application is still SQLite-backed; production auth, the Postgres repository/runtime switch, deployment, cloud sandbox attestation, MCP secret brokering, and external MCP health/attestation remain open.
+> **Status**: Local phases 1–3 are implemented and the professional UI has crossed the Zustand and ordinary-collection TanStack Query boundaries. Governed MCP declarations, bounded MCP health probing, a tested opt-in MCP capability facade, truthful demo skill status, a GitHub-catalog skill marketplace with protected Claude/LiteLLM materialization evidence, feature-gated Better Auth, authenticated owner scoping, a local organization-membership scaffold, and a reviewed Drizzle/Postgres import proof (including organization/member staging) are present. The target schema now also records durable conversation identity, fork lineage, provider message IDs, MCP configuration history, lease idempotency keys, and legacy-import provenance. LiteLLM-only enforcement remains mandatory for every harness and every environment: data sovereignty, centralized routing, cost control, and model optimization are product requirements. The running application is still SQLite-backed; production auth, the Postgres repository/runtime switch, deployment, cloud sandbox attestation, MCP secret brokering, and external MCP health/attestation remain open.
 > **For**: The next agent (or human) picking this up cold.
 > **Read this entire document before touching any code.**
 
@@ -50,7 +50,7 @@ The abstraction that enforces this: `server/runtime-adapter.ts` — the `Runtime
 
 1. **No governed runtime configured** — the local fallback is explicitly labelled Simulation and makes no model call; when the protected LiteLLM route is configured, the registry selects a compatible governed runtime instead
 2. **Auth is feature-gated** — Better Auth Email OTP, session middleware, login UI, and local user ownership are implemented, but production enablement remains blocked on Postgres/org scope, real delivery, and full route acceptance
-3. **The running app is not Postgres-backed** — local user/org scoping is proven, and the Drizzle schema/import/restart proof now stages organization/member records as well; the TaskStore repository adapter, idempotent application-level proof, and `DATABASE_URL` runtime switch remain Phase 4 work
+3. **The running app is not Postgres-backed** — local user/org scoping is proven, and the Drizzle schema/import/restart proof now stages organization/member records as well; migration `0004` brings conversation identity, fork lineage, provider message IDs, MCP config history, lease idempotency uniqueness, and legacy-import provenance into the target contract. The TaskStore repository adapter, importer writes for the new provenance tables, idempotent application-level proof, and `DATABASE_URL` runtime switch remain Phase 4 work
 4. **No managed deploy path** — a non-root Docker image and local Compose smoke path now exist, but Railway/Fly configuration, secrets, auth, and production operations remain open
 5. **No production sandbox attestation** — local host and development-provider paths must not be described as microVM isolation or default-deny egress
 6. **Organization membership is not yet a data-plane grant** — local authenticated owners can create organizations and owners can add/remove members, but task/project/runtime access remains owner-scoped until the Postgres-backed organization policy and repository switch are accepted

TODO.md

@@ -66,7 +66,7 @@ Reference: `plan/03-runtime-routing.md`
 Reference: `plan/04-cloud-infrastructure.md`
 
 - [ ] **P4-01** Add auth — feature-gated Better Auth + hashed email-OTP foundation, real delivery webhook, session middleware, login UI, hardcoded-identity removal, and expanded local cross-user route negative coverage are implemented; keep open until production delivery and Postgres-backed ownership are complete
-- [ ] **P4-02** Migrate database — Drizzle/PostgreSQL schema contract, four migrations, owner-required importer, organization/member staging, cross-owner relationship validation, disposable live import/restart proof, a disposable PostgreSQL migration smoke proof, and a fail-closed persistence-driver guard are now present; keep open until the TaskStore repository adapter, production legacy import, application-level idempotency proof, and a controlled `DATABASE_URL` runtime switch are complete
+- [ ] **P4-02** Migrate database — Drizzle/PostgreSQL schema contract, five migrations, explicit conversation/task-lineage/provider-message/MCP-history/legacy-provenance tables, owner-required importer, organization/member staging, cross-owner relationship validation, disposable live import/restart proof, a disposable PostgreSQL migration smoke proof, and a fail-closed persistence-driver guard are now present; keep open until the TaskStore repository adapter, production legacy import including provenance writes, application-level idempotency proof, and a controlled `DATABASE_URL` runtime switch are complete
 - [ ] **P4-03** Containerise — current non-root multi-stage `Dockerfile`, hardened SQLite-volume `docker-compose.yml`, `.env.example`, and a GitHub Actions build/non-root/read-only smoke gate are implemented; keep open until the P4-02 Postgres contract is wired into the image/Compose path rather than shipping an unused database service
 - [ ] **P4-04** Deploy to Railway or Fly.io — `railway.toml` or `fly.toml`; deploy instructions in `plan/04-cloud-infrastructure.md#deploy`
 - [ ] **P4-05** Add cloud sandbox — integrate **e2b.dev** (`@e2b/code-interpreter`) as the default `sandboxed` execution backend; surface sandbox preview URL in workspace iframe; `E2bRuntimeAdapter` wraps e2b and implements the full `RuntimeAdapter` interface

docs/AUTH-POSTGRES-ADR.md

@@ -22,7 +22,7 @@ Reference implementation guidance:
 
 ## Migration sequence
 
-1. Define Drizzle schemas for Better Auth tables plus `projects`, `tasks`, `turns`, `messages`, `runtime_events`, `native_events`, `schedules`, `workspace_versions`, and `org_members`. Add non-null `owner_user_id` to new rows; retain a nullable legacy migration column only during import.
+1. Define Drizzle schemas for Better Auth tables plus `conversations`, `projects`, `tasks`, `turns`, `messages`, `runtime_events`, `native_events`, `schedules`, `workspace_versions`, `org_members`, runtime MCP configuration events, and legacy-import provenance. Add non-null `owner_user_id` to new rows; retain a nullable legacy migration column only during import.
 2. Build a repository interface that preserves the current TaskStore contracts. Implement a SQLite test adapter first, then a Postgres adapter with the same transaction boundaries. No route should branch on database vendor.
 3. Add a one-time migration/import command that maps existing local records to an explicit bootstrap owner. It must emit counts and hashes, refuse ambiguous ownership, and never silently assign production data to a default user.
 4. Add Better Auth email-OTP endpoints and a session client. Protect API routes in one middleware boundary, then update every store query to receive an authorized owner/org scope.
@@ -52,6 +52,8 @@ The local authenticated data plane now scopes newly created tasks, projects, sch
 
 ## Postgres/Drizzle contract slice
 
-`server/db/schema.ts` and `server/db/migrations/0000_onevibe_initial_contract.sql` define the target relational contract. It includes Better Auth's `user`, `session`, `account`, and `verification` tables; `org`/`org_member`; owner- and org-scoped projects, tasks, schedules, MCP declarations, and idempotency; durable turns/messages; hashed runtime/native event projections; runtime leases; and workspace versions. `drizzle.config.ts` plus `npm run db:check`/`npm run db:generate` make the schema reviewable and migration generation reproducible.
+`server/db/schema.ts` and `server/db/migrations/0000_onevibe_initial_contract.sql` through `0004_majestic_multiple_man.sql` define the target relational contract. The fifth migration adds an explicit conversation identity, task fork lineage, turn failure storage, provider message IDs, runtime lease idempotency uniqueness, append-only MCP configuration events, and source-keyed legacy-import provenance. It includes Better Auth's `user`, `session`, `account`, and `verification` tables; `org`/`org_member`; owner- and org-scoped projects, tasks, schedules, MCP declarations, and idempotency; durable turns/messages; hashed runtime/native event projections; runtime leases; and workspace versions. `drizzle.config.ts` plus `npm run db:check`/`npm run db:generate` make the schema reviewable and migration generation reproducible.
+
+The new tables are a target-contract parity slice, not a claim that the application has switched drivers. `conversation` is the future durable product identity; `legacy_imports` records source identity/digest/result without silently overwriting canonical rows; and `runtime_mcp_config_events` preserves configuration history for audit. The current SQLite repositories and filesystem workspace remain authoritative until the transaction-compatible Postgres adapter, importer writes, restart/idempotency proof, and controlled runtime switch are accepted together.
 
 This does not yet switch the application to Postgres. The current `TaskStore` still uses SQLite repositories and JSON task/project/schedule files. `scripts/postgres-import.ts` now provides an explicit owner-required migration path with `--dry-run`; it refuses ownerless records unless an operator supplies an owner, refuses mixed owners in the first migration, requires every Better Auth user referenced by the bootstrap owner or organization membership to already exist, and imports organizations/members, task/project/schedule/MCP state plus durable messages/events/native events/workspace versions transactionally. The importer has been exercised against disposable PostgreSQL 18, including a container restart with row-count recovery. A transaction-compatible runtime repository switch and production idempotency/connection test are still required before `DATABASE_URL` can select the production path.

docs/IMPLEMENTATION-LOG.md

@@ -1,5 +1,11 @@
 # Implementation log
 
+## 2026-07-17 — extend the Postgres target contract for durable identity and audit
+
+- Added Drizzle migration `0004_majestic_multiple_man.sql` and schema parity for a first-class `conversation` identity, task fork lineage, turn error metadata, provider message IDs, runtime-lease allocation/idempotency uniqueness, append-only MCP configuration events, and source-keyed `legacy_imports` provenance.
+- `npm run db:generate`, `npm run db:check`, and `git diff --check` pass. This is intentionally a target-contract slice: the running TaskStore remains SQLite-backed, the importer does not yet write the new provenance tables, and no `DATABASE_URL` runtime switch is enabled.
+- All model traffic remains LiteLLM-only. The schema change does not add provider credentials, direct first-party Anthropic configuration, or a model-routing fallback.
+
 ## 2026-07-17 — fail closed on known first-party model endpoints
 
 - Expanded the shared `isLiteLlmRelayUrl` guard used by the Claude SDK and ONEComputer worker to reject known Anthropic, OpenAI, Bedrock, Gemini, Groq, Mistral, Cohere, xAI, and DeepSeek first-party hosts when they are mislabeled as LiteLLM relays.

docs/LINEAR-BOARD.md

@@ -32,7 +32,7 @@ The first MCP extension slice is tracked in [ONE-252](https://linear.app/onecomp
 
 The cloud identity follow-up is tracked in [ONE-253](https://linear.app/onecomputer/issue/ONE-253/platp0-wire-authenticated-owner-scoped-data-plane). The Better Auth foundation now starts against the existing SQLite handle when explicitly enabled, stores OTPs hashed, requires a real delivery webhook, and scopes new local data by server-derived user ID. The `npm run e2e:auth-owner` harness now proves the real email-OTP route through a loopback delivery fixture, unauthenticated `401`, two-user session creation, owner-only inventories, and cross-user `404` isolation for task, project, project-file, schedule, MCP, conversation, Library, search, and representative task-subroute reads/mutations. A 2026-07-17 audit also propagated actor scope through task project movement and tag mutation, with cross-user store-level negative coverage. Commit `b13b8fb` adds local `organizations`/`organization_members` records and authenticated owner/member routes; the harness proves membership visibility and owner-only administration without widening task access. ONE-253 remains open for Postgres-backed org authorization, production migration/import, and production email acceptance.
 
-The Postgres migration work is tracked in [ONE-254](https://linear.app/onecomputer/issue/ONE-254/platp1-implement-postgres-drizzle-repository-and-migrationimport-proof). The current branch contains the reviewed Drizzle schema, four generated SQL migrations, an explicit owner-required `db:import` seam, organization/member staging with Better Auth-user existence checks, pre-transaction validation that rejects missing or cross-owner task/schedule project references, a disposable PostgreSQL 18 migration/import/restart proof, a CI PostgreSQL migration smoke job, and a fail-closed driver guard that rejects an unavailable Postgres selection or ambiguous `DATABASE_URL`. Migration `0003` gives the native projection offset primary key an explicit non-truncated name while preserving the historical migration ledger. The running TaskStore remains SQLite-backed until transaction-compatible repositories, controlled runtime selection, and production idempotency/connection evidence are complete.
+The Postgres migration work is tracked in [ONE-254](https://linear.app/onecomputer/issue/ONE-254/platp1-implement-postgres-drizzle-repository-and-migrationimport-proof). The current branch contains the reviewed Drizzle schema, five generated SQL migrations, an explicit owner-required `db:import` seam, organization/member staging with Better Auth-user existence checks, explicit conversation/task-lineage/provider-message/MCP-history/legacy-provenance target tables, pre-transaction validation that rejects missing or cross-owner task/schedule project references, a disposable PostgreSQL 18 migration/import/restart proof, a CI PostgreSQL migration smoke job, and a fail-closed driver guard that rejects an unavailable Postgres selection or ambiguous `DATABASE_URL`. Migration `0003` gives the native projection offset primary key an explicit non-truncated name while preserving the historical migration ledger; migration `0004` adds the remaining durable identity and audit contract without switching the runtime driver. The running TaskStore remains SQLite-backed until transaction-compatible repositories, importer writes for the new provenance tables, controlled runtime selection, and production idempotency/connection evidence are complete.
 
 The execution-path visibility slice is tracked in ONE-255: authenticated `/api/diagnostics` and the Computers panel expose bounded LiteLLM, session, persistence, runtime, sandbox, and owner-scoped MCP status/health without secrets or provider payloads. It is Done for local operational diagnostics; Postgres runtime switching, cloud health, and production sandbox attestation remain separate release gates.
 

server/db/migrations/0004_majestic_multiple_man.sql

@@ -0,0 +1,44 @@
+CREATE TABLE "conversation" (
+	"id" text PRIMARY KEY NOT NULL,
+	"title" text,
+	"status" text DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone NOT NULL,
+	"updated_at" timestamp with time zone NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "legacy_imports" (
+	"source_kind" text NOT NULL,
+	"source_id" text NOT NULL,
+	"source_digest" text NOT NULL,
+	"conversation_id" text,
+	"result_json" jsonb NOT NULL,
+	"imported_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "legacy_imports_source_kind_source_id_pk" PRIMARY KEY("source_kind","source_id")
+);
+--> statement-breakpoint
+CREATE TABLE "runtime_mcp_config_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"config_id" text NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"operation" text NOT NULL,
+	"config_json" jsonb NOT NULL,
+	"created_at" timestamp with time zone NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "message" ADD COLUMN "provider_message_id" text;--> statement-breakpoint
+ALTER TABLE "task" ADD COLUMN "parent_task_id" text;--> statement-breakpoint
+ALTER TABLE "task" ADD COLUMN "forked_from_message_id" text;--> statement-breakpoint
+ALTER TABLE "task" ADD COLUMN "forked_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "turn" ADD COLUMN "error_json" jsonb;--> statement-breakpoint
+ALTER TABLE "legacy_imports" ADD CONSTRAINT "legacy_imports_conversation_id_conversation_id_fk" FOREIGN KEY ("conversation_id") REFERENCES "public"."conversation"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "runtime_mcp_config_events" ADD CONSTRAINT "runtime_mcp_config_events_config_id_runtime_mcp_config_id_fk" FOREIGN KEY ("config_id") REFERENCES "public"."runtime_mcp_config"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "runtime_mcp_config_events" ADD CONSTRAINT "runtime_mcp_config_events_owner_user_id_user_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "conversation_status_updated_idx" ON "conversation" USING btree ("status","updated_at");--> statement-breakpoint
+CREATE INDEX "legacy_import_conversation_idx" ON "legacy_imports" USING btree ("conversation_id");--> statement-breakpoint
+CREATE INDEX "legacy_import_digest_idx" ON "legacy_imports" USING btree ("source_digest");--> statement-breakpoint
+CREATE INDEX "runtime_mcp_config_event_owner_idx" ON "runtime_mcp_config_events" USING btree ("owner_user_id","created_at");--> statement-breakpoint
+CREATE INDEX "runtime_mcp_config_event_config_idx" ON "runtime_mcp_config_events" USING btree ("config_id","created_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "message_task_provider_idx" ON "message" USING btree ("task_id","provider_message_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "runtime_lease_allocation_operation_idx" ON "runtime_lease" USING btree ("allocation_operation_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "runtime_lease_provider_idempotency_idx" ON "runtime_lease" USING btree ("provider_name","allocation_idempotency_key");--> statement-breakpoint
+CREATE UNIQUE INDEX "turn_task_ordinal_idx" ON "turn" USING btree ("task_id","ordinal");