feat(org): model grants, org memory, MCP gateway (v2 phases A1-3..5)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
mjalmoudy94
co-authored by
Claude Sonnet 5.5
Claude Sonnet 5.5
parent
c93b25741e
commit
dee2f72c46
@@ -0,0 +1,51 @@
|
||||
"""MCP gateway: scoped bearer tokens for external AI agents
|
||||
|
||||
Revision ID: a8b9c0d1e2f3
|
||||
Revises: f7a8b9c0d1e2
|
||||
Create Date: 2026-10-14 12:00:00.000000
|
||||
|
||||
Owned by Agent 1 (PLAN-v2 §6). Only the token hash and a display prefix are
|
||||
stored; the raw token is shown once at issue time.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
|
||||
revision: str = "a8b9c0d1e2f3"
|
||||
down_revision: str | None = "f7a8b9c0d1e2"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"mcp_tokens",
|
||||
sa.Column("id", sa.String(length=32), primary_key=True),
|
||||
sa.Column(
|
||||
"organization_id",
|
||||
sa.String(length=32),
|
||||
sa.ForeignKey("organizations.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("name", sa.String(length=120), nullable=False),
|
||||
# ``unique=True`` carries the index (``ix_mcp_tokens_token_hash``), so no
|
||||
# separate create_index is needed — a second one would drift.
|
||||
sa.Column("token_hash", sa.String(length=128), nullable=False, unique=True),
|
||||
sa.Column("prefix", sa.String(length=16), nullable=False),
|
||||
sa.Column("scopes", sa.String(length=255), nullable=False, server_default=""),
|
||||
sa.Column("created_by_user_id", sa.String(length=32), sa.ForeignKey("users.id")),
|
||||
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
op.create_index("ix_mcp_tokens_organization_id", "mcp_tokens", ["organization_id"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_index("ix_mcp_tokens_organization_id", table_name="mcp_tokens")
|
||||
op.drop_table("mcp_tokens")
|
||||
@@ -0,0 +1,62 @@
|
||||
"""owner model grants: default grant set + per-org policy
|
||||
|
||||
Revision ID: e6f7a8b9c0d1
|
||||
Revises: d5e6f7a8b9c0
|
||||
Create Date: 2026-10-14 09:00:00.000000
|
||||
|
||||
Owned by Agent 1 (PLAN-v2 §6). Adds the two owner-side tables of the model-grant
|
||||
workstream: the default set copied into every new organization, and the
|
||||
per-organization policy (employee cap, monthly budget, automation/MCP switches).
|
||||
|
||||
``org_model_grants`` itself is foundation-owned and already exists.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
|
||||
revision: str = "e6f7a8b9c0d1"
|
||||
down_revision: str | None = "d5e6f7a8b9c0"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"default_model_grants",
|
||||
sa.Column("id", sa.String(length=32), primary_key=True),
|
||||
sa.Column(
|
||||
"ai_model_id",
|
||||
sa.String(length=32),
|
||||
sa.ForeignKey("ai_models.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("daily_credit_cap", sa.Float(), nullable=True),
|
||||
sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.true()),
|
||||
sa.Column("created_by_user_id", sa.String(length=32), sa.ForeignKey("users.id")),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.UniqueConstraint("ai_model_id", name="uq_default_model_grant"),
|
||||
)
|
||||
|
||||
op.create_table(
|
||||
"org_policies",
|
||||
sa.Column(
|
||||
"organization_id",
|
||||
sa.String(length=32),
|
||||
sa.ForeignKey("organizations.id", ondelete="CASCADE"),
|
||||
primary_key=True,
|
||||
),
|
||||
sa.Column("max_employees", sa.Integer(), nullable=False, server_default="5"),
|
||||
sa.Column("monthly_credit_budget", sa.Float(), nullable=True),
|
||||
sa.Column("automation_enabled", sa.Boolean(), nullable=False, server_default=sa.true()),
|
||||
sa.Column("mcp_enabled", sa.Boolean(), nullable=False, server_default=sa.true()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_table("org_policies")
|
||||
op.drop_table("default_model_grants")
|
||||
@@ -0,0 +1,69 @@
|
||||
"""org memory: the organization's own long-term knowledge
|
||||
|
||||
Revision ID: f7a8b9c0d1e2
|
||||
Revises: e6f7a8b9c0d1
|
||||
Create Date: 2026-10-14 11:00:00.000000
|
||||
|
||||
Owned by Agent 1 (PLAN-v2 §6). ``org_memories`` holds rules, preferences,
|
||||
lessons, facts and the code map, with a content hash for dedupe and a soft
|
||||
delete so a removed memory stays in the audit story.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
|
||||
revision: str = "f7a8b9c0d1e2"
|
||||
down_revision: str | None = "e6f7a8b9c0d1"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"org_memories",
|
||||
sa.Column("id", sa.String(length=32), primary_key=True),
|
||||
sa.Column(
|
||||
"organization_id",
|
||||
sa.String(length=32),
|
||||
sa.ForeignKey("organizations.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("kind", sa.String(length=16), nullable=False),
|
||||
sa.Column("key", sa.String(length=80), nullable=True),
|
||||
sa.Column("content", sa.String(length=1500), nullable=False),
|
||||
# The dedupe digest the domain defines (sha256 of the normalised
|
||||
# content, truncated to 32 chars).
|
||||
sa.Column("content_hash", sa.String(length=32), nullable=False, server_default=""),
|
||||
sa.Column("source", sa.String(length=16), nullable=False, server_default="user"),
|
||||
sa.Column(
|
||||
"evidence_task_id",
|
||||
sa.String(length=32),
|
||||
sa.ForeignKey("tasks.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
),
|
||||
sa.Column("pinned", sa.Boolean(), nullable=False, server_default=sa.false()),
|
||||
sa.Column("confidence", sa.Float(), nullable=False, server_default="1"),
|
||||
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("hits", sa.Integer(), nullable=False, server_default="0"),
|
||||
sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("created_by_user_id", sa.String(length=32), sa.ForeignKey("users.id")),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
|
||||
)
|
||||
op.create_index("ix_org_memories_organization_id", "org_memories", ["organization_id"])
|
||||
op.create_index(
|
||||
"ix_org_memories_org_kind", "org_memories", ["organization_id", "kind"]
|
||||
)
|
||||
op.create_index("ix_org_memories_org_key", "org_memories", ["organization_id", "key"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_index("ix_org_memories_org_key", table_name="org_memories")
|
||||
op.drop_index("ix_org_memories_org_kind", table_name="org_memories")
|
||||
op.drop_index("ix_org_memories_organization_id", table_name="org_memories")
|
||||
op.drop_table("org_memories")
|
||||
Reference in New Issue
Block a user