feat: establish v0.70 platform milestone

migrations/000040_device_database_credential.down.sql

@@ -0,0 +1,5 @@
+BEGIN;
+
+DROP TABLE IF EXISTS device_credential;
+
+COMMIT;

migrations/000040_device_database_credential.up.sql

@@ -0,0 +1,29 @@
+BEGIN;
+
+CREATE TABLE device_credential (
+    device_id          uuid PRIMARY KEY,
+    tenant_id          uuid NOT NULL,
+    credential_ref     varchar(500) NOT NULL UNIQUE,
+    key_version        bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
+    algorithm          varchar(32) NOT NULL DEFAULT 'HMAC-SHA256'
+                       CHECK (algorithm = 'HMAC-SHA256'),
+    encryption         varchar(32) NOT NULL DEFAULT 'AES-256-GCM'
+                       CHECK (encryption = 'AES-256-GCM'),
+    encrypted_secret   bytea NOT NULL,
+    nonce              bytea NOT NULL CHECK (octet_length(nonce) = 12),
+    status             varchar(24) NOT NULL DEFAULT 'active'
+                       CHECK (status IN ('active', 'revoked')),
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    rotated_at         timestamptz,
+    revoked_at         timestamptz,
+    CONSTRAINT device_credential_device_tenant_fk
+        FOREIGN KEY (device_id, tenant_id) REFERENCES device(id, tenant_id)
+);
+
+CREATE INDEX device_credential_tenant_status_idx
+    ON device_credential (tenant_id, status);
+
+COMMENT ON TABLE device_credential IS
+    'Recoverable device HMAC credentials encrypted with the API credential master key; plaintext is never stored.';
+
+COMMIT;

migrations/000041_memory_tools_and_quality.down.sql

@@ -0,0 +1,8 @@
+BEGIN;
+DROP TABLE IF EXISTS content_review_signal;
+ALTER TABLE IF EXISTS memory_version DROP COLUMN IF EXISTS error_type;
+ALTER TABLE IF EXISTS story_revision DROP COLUMN IF EXISTS error_type;
+DROP TABLE IF EXISTS fact_candidate_revision;
+DROP TABLE IF EXISTS memory_tool_call;
+DROP TABLE IF EXISTS conversation_memory_use;
+COMMIT;

migrations/000041_memory_tools_and_quality.up.sql

@@ -0,0 +1,94 @@
+BEGIN;
+
+CREATE TABLE conversation_memory_use (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    public_id          uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    tenant_id          uuid NOT NULL REFERENCES tenant(id),
+    subject_id         uuid NOT NULL,
+    conversation_id    uuid NOT NULL REFERENCES conversation(id),
+    memory_id          uuid NOT NULL REFERENCES curated_memory(id),
+    memory_version_id  uuid NOT NULL REFERENCES memory_version(id),
+    use_type           varchar(24) NOT NULL CHECK (use_type IN ('context_snapshot', 'in_call_tool', 'provider_native')),
+    relevance          double precision,
+    source_refs        jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(source_refs)='array'),
+    used_at            timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT conversation_memory_use_subject_tenant_fk FOREIGN KEY (subject_id, tenant_id)
+        REFERENCES subject_profile(id, tenant_id),
+    CONSTRAINT conversation_memory_use_key UNIQUE (conversation_id, memory_version_id, use_type)
+);
+CREATE INDEX conversation_memory_use_trace_idx ON conversation_memory_use (tenant_id, subject_id, conversation_id, used_at DESC);
+
+CREATE TABLE memory_tool_call (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    public_id          uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    tenant_id          uuid NOT NULL REFERENCES tenant(id),
+    subject_id         uuid NOT NULL,
+    conversation_id    uuid NOT NULL REFERENCES conversation(id),
+    query_digest       char(64) NOT NULL,
+    result_count       integer NOT NULL DEFAULT 0 CHECK (result_count >= 0),
+    status             varchar(24) NOT NULL CHECK (status IN ('SUCCEEDED', 'EMPTY', 'FAILED')),
+    error_code         varchar(64),
+    latency_ms         integer NOT NULL CHECK (latency_ms >= 0),
+    engine_mode        varchar(24) NOT NULL,
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT memory_tool_call_subject_tenant_fk FOREIGN KEY (subject_id, tenant_id)
+        REFERENCES subject_profile(id, tenant_id)
+);
+CREATE INDEX memory_tool_call_observe_idx ON memory_tool_call (tenant_id, status, created_at DESC);
+
+CREATE TABLE fact_candidate_revision (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    fact_candidate_id  uuid NOT NULL REFERENCES fact_candidate(id),
+    version_no         bigint NOT NULL CHECK (version_no > 0),
+    fact_type          varchar(80) NOT NULL,
+    content            text NOT NULL,
+    sensitivity        varchar(24) NOT NULL CHECK (sensitivity IN ('normal', 'sensitive', 'high')),
+    status             varchar(24) NOT NULL CHECK (status IN ('CANDIDATE', 'CONFIRMED', 'REJECTED', 'SUPERSEDED')),
+    edited_by          uuid REFERENCES user_account(id),
+    edit_reason        varchar(500),
+    error_type         varchar(32) CHECK (error_type IS NULL OR error_type IN (
+        'PERSON_ERROR','TIME_ERROR','PLACE_ERROR','RELATION_ERROR','OVER_INFERENCE',
+        'KEY_POINT_OMISSION','DUPLICATE_CONTENT','UNNATURAL_EXPRESSION','SENSITIVE_INFORMATION'
+    )),
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT fact_candidate_revision_key UNIQUE (fact_candidate_id, version_no)
+);
+CREATE INDEX fact_candidate_revision_quality_idx ON fact_candidate_revision (error_type, created_at DESC) WHERE error_type IS NOT NULL;
+
+ALTER TABLE story_revision ADD COLUMN error_type varchar(32) CHECK (error_type IS NULL OR error_type IN (
+    'PERSON_ERROR','TIME_ERROR','PLACE_ERROR','RELATION_ERROR','OVER_INFERENCE',
+    'KEY_POINT_OMISSION','DUPLICATE_CONTENT','UNNATURAL_EXPRESSION','SENSITIVE_INFORMATION'
+));
+ALTER TABLE memory_version ADD COLUMN error_type varchar(32) CHECK (error_type IS NULL OR error_type IN (
+    'PERSON_ERROR','TIME_ERROR','PLACE_ERROR','RELATION_ERROR','OVER_INFERENCE',
+    'KEY_POINT_OMISSION','DUPLICATE_CONTENT','UNNATURAL_EXPRESSION','SENSITIVE_INFORMATION'
+));
+
+CREATE TABLE content_review_signal (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    public_id          uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    tenant_id          uuid NOT NULL REFERENCES tenant(id),
+    subject_id         uuid NOT NULL,
+    resource_type      varchar(24) NOT NULL CHECK (resource_type IN ('story','fact','memory')),
+    resource_public_id uuid NOT NULL,
+    action             varchar(24) NOT NULL CHECK (action IN ('EDITED','CONFIRMED','REJECTED','DISABLED','DELETED')),
+    error_type         varchar(32) CHECK (error_type IS NULL OR error_type IN (
+        'PERSON_ERROR','TIME_ERROR','PLACE_ERROR','RELATION_ERROR','OVER_INFERENCE',
+        'KEY_POINT_OMISSION','DUPLICATE_CONTENT','UNNATURAL_EXPRESSION','SENSITIVE_INFORMATION'
+    )),
+    reason             varchar(500) NOT NULL,
+    model_ref          varchar(200),
+    prompt_version     varchar(80),
+    generation_version bigint,
+    actor_id           uuid NOT NULL REFERENCES user_account(id),
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT content_review_signal_subject_tenant_fk FOREIGN KEY (subject_id, tenant_id)
+        REFERENCES subject_profile(id, tenant_id)
+);
+CREATE INDEX content_review_signal_version_idx ON content_review_signal (tenant_id, model_ref, prompt_version, created_at DESC);
+CREATE INDEX content_review_signal_error_idx ON content_review_signal (tenant_id, error_type, created_at DESC) WHERE error_type IS NOT NULL;
+
+INSERT INTO fact_candidate_revision(fact_candidate_id,version_no,fact_type,content,sensitivity,status,edited_by,edit_reason,created_at)
+SELECT id,version,fact_type,content,sensitivity,status,reviewed_by,review_reason,created_at FROM fact_candidate;
+
+COMMIT;

migrations/000042_operator_accounts.down.sql

@@ -0,0 +1,5 @@
+BEGIN;
+DROP INDEX IF EXISTS user_account_operator_identity_idx;
+ALTER TABLE user_account DROP CONSTRAINT IF EXISTS user_account_kind_role_check;
+ALTER TABLE user_account DROP COLUMN IF EXISTS account_kind;
+COMMIT;

migrations/000042_operator_accounts.up.sql

@@ -0,0 +1,24 @@
+BEGIN;
+
+ALTER TABLE user_account
+    ADD COLUMN account_kind varchar(24) NOT NULL DEFAULT 'customer'
+    CHECK (account_kind IN ('customer','operator'));
+
+UPDATE user_account
+SET account_kind='operator'
+WHERE platform_role <> 'customer';
+
+ALTER TABLE user_account
+    ADD CONSTRAINT user_account_kind_role_check CHECK (
+        (account_kind='customer' AND platform_role='customer') OR
+        (account_kind='operator' AND platform_role IN ('ops_viewer','ops_operator','ops_approver','ops_admin'))
+    );
+
+CREATE INDEX user_account_operator_identity_idx
+    ON user_account(oidc_issuer,oidc_subject,tenant_id)
+    WHERE account_kind='operator' AND status='active';
+
+COMMENT ON COLUMN user_account.account_kind IS
+    'Hard boundary between household customer identities and dedicated maintenance operator identities.';
+
+COMMIT;