feat(storage): partner file metadata + 30-day retention schema (v140)

alembic/versions/20260803_b71d9e4c2a60_v111_runtime_role_grants.py

@@ -577,6 +577,11 @@ def _build_migration_owner_posture() -> str:
     "public.scheduler_seen_items": ("SELECT", "INSERT", "UPDATE", "DELETE"),
     "public.tenant_compliance_status": ("SELECT", "INSERT", "UPDATE"),
     "public.tenant_product_profile": ("SELECT",),
+    # v138 partner-file storage. Hard-delete sweep needs DELETE on the two
+    # soft-delete targets; partner_file_deletion_log stays append-only.
+    "public.partner_files": ("SELECT", "INSERT", "UPDATE", "DELETE"),
+    "public.partner_file_derived": ("SELECT", "INSERT", "UPDATE", "DELETE"),
+    "public.partner_file_deletion_log": ("SELECT", "INSERT"),
 }
 
 # Explicit mutable data-plane inventory for the enabled ingestion/workflow
@@ -655,10 +660,10 @@ def _build_migration_owner_posture() -> str:
     # databases already past v111; this inventory keeps it across cutover.
     "public.tenants": {"SELECT": ("id", "status")},
     # v126 -- POST /api/v1/ingest/csv (#3122) retains each upload verbatim
-    # in the ingest transaction (webhook_compat._open_ingestion_run). INSERT
-    # is limited to the columns that statement writes, so storage_url and
-    # created_at cannot be forged; reads, updates and deletes stay denied
-    # (the disabled remediation surface keeps its contract). The composite
+    # in the ingest transaction (webhook_compat._open_ingestion_run).
+    # v138 extends INSERT with storage_url for partner-uploads pointer rows;
+    # created_at stays ungated so timestamps cannot be forged. Reads, updates
+    # and deletes stay denied (disabled remediation surface). The composite
     # (ingestion_run_id, tenant_id) foreign key pins a blob to its own
     # tenant's run.
     "fsma.manifest_blobs": {
@@ -670,6 +675,7 @@ def _build_migration_owner_posture() -> str:
             "original_filename",
             "content_type",
             "uploaded_by",
+            "storage_url",
         )
     },
     # v126 -- the agent-artifact worker (shared.agent_task_bridge) reads only
@@ -754,6 +760,10 @@ def _build_migration_owner_posture() -> str:
     "public.webauthn_challenges": ("SELECT", "INSERT", "UPDATE", "DELETE"),
     "public.webauthn_credentials": ("SELECT", "INSERT", "UPDATE", "DELETE"),
     "public.webhook_outbox": ("SELECT", "INSERT", "UPDATE"),
+    # v138 partner-file storage — control-plane read only.
+    "public.partner_files": ("SELECT",),
+    "public.partner_file_derived": ("SELECT",),
+    "public.partner_file_deletion_log": ("SELECT",),
 }
 
 REGENGINE_SYSADMIN_COLUMN_GRANTS = {