fix: schema drifts, RLS policies, wiki plugin, agent_loop syntax, test imports, frontend error handling

- Migration 0135: Fix 3 VARCHAR length drifts + 2 missing tables (forgejo_reported_errors, pgp_keys)
- Migration 0136: Fix 8 RLS policies referencing app.tenant_id instead of app.current_tenant_id
- wiki/__init__.py: Import WikiPlugin for discover_builtins()
- wiki/plugin.py: Fix SyntaxError (unterminated triple-quoted string)
- agent_loop.py: Fix SyntaxError (stray n character in dict)
- test_p1_6_dms_streaming.py: Fix import (CHUNK_SIZE removed, use _sanitize_filename only)
- conftest.py: Use create_all only (alembic conflicts with create_all in tests)
- frontend errorTypes.ts: asError() now handles nested detail objects
- AGENTS.md: Sub-agents forbidden in this project
- DAMAGE_REPORT.md + SCHEMA_DRIFTS.md: Complete damage assessment
- scripts/schema_drift_check.py: Schema drift checker tool

Tests: 24/24 Phase J + 12/12 Phase K = 36/36 passed
tsc: 0 errors
Frontend build: successful

alembic/versions/0135_fix_schema_drifts.py

@@ -0,0 +1,58 @@
+"""Fix schema drifts — VARCHAR lengths + missing tables.
+
+Revision ID: 0135
+Revises: 0134
+Create Date: 2026-08-21
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+revision = "0135"
+down_revision = "0134"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # 1. Fix VARCHAR length mismatches (model defines longer than DB)
+    op.execute("ALTER TABLE contacts ALTER COLUMN status TYPE VARCHAR(30);")
+    op.execute("ALTER TABLE notifications ALTER COLUMN type TYPE VARCHAR(100);")
+    op.execute("ALTER TABLE notification_preferences ALTER COLUMN type_key TYPE VARCHAR(100);")
+
+    # 2. Create missing table: forgejo_reported_errors
+    # Model: ReportedError(Base) — NO TenantMixin, Integer id
+    op.create_table(
+        "forgejo_reported_errors",
+        sa.Column("id", sa.Integer, primary_key=True, autoincrement=True),
+        sa.Column("dedup_key", sa.String(64), nullable=False, unique=True, index=True),
+        sa.Column("message", sa.Text, nullable=False),
+        sa.Column("stack", sa.Text, nullable=True),
+        sa.Column("forgejo_issue_number", sa.Integer, nullable=True),
+        sa.Column("reported_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("status", sa.String(20), nullable=False, server_default=sa.text("'reported'")),
+    )
+    # No RLS — model has no tenant_id
+
+    # 3. Create missing table: pgp_keys
+    # Model: PgpKey(Base, TenantMixin) — UUID id, user_id, key_id, encrypted_private_key, public_key_armored
+    op.create_table(
+        "pgp_keys",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), nullable=False),
+        sa.Column("key_id", sa.String(255), nullable=False),
+        sa.Column("encrypted_private_key", sa.Text, nullable=False),
+        sa.Column("public_key_armored", sa.Text, nullable=False),
+    )
+    op.create_index("ix_pgp_keys_user", "pgp_keys", ["user_id"])
+    op.execute("ALTER TABLE pgp_keys ENABLE ROW LEVEL SECURITY;")
+    op.execute("CREATE POLICY pgp_keys_tenant_isolation ON pgp_keys USING (tenant_id::text = current_setting('app.current_tenant_id', true));")
+
+
+def downgrade() -> None:
+    op.drop_table("pgp_keys")
+    op.drop_table("forgejo_reported_errors")
+    op.execute("ALTER TABLE notification_preferences ALTER COLUMN type_key TYPE VARCHAR(20);")
+    op.execute("ALTER TABLE notifications ALTER COLUMN type TYPE VARCHAR(20);")
+    op.execute("ALTER TABLE contacts ALTER COLUMN status TYPE VARCHAR(20);")

alembic/versions/0136_fix_rls_tenant_id.py

@@ -0,0 +1,49 @@
+"""Fix RLS policies — app.tenant_id → app.current_tenant_id.
+
+8 RLS policies in production reference 'app.tenant_id' which doesn't exist
+as a PostgreSQL parameter. The code uses 'app.current_tenant_id'.
+This causes 500 errors on roles, sequences, wiki, approval_requests,
+ai_decision_records, and automation_agent_run_steps.
+
+Revision ID: 0136
+Revises: 0135
+Create Date: 2026-08-21
+"""
+from alembic import op
+
+revision = "0136"
+down_revision = "0135"
+branch_labels = None
+depends_on = None
+
+# All 8 tables with broken RLS policies referencing app.tenant_id
+TABLES_WITH_BAD_RLS = [
+    "ai_decision_records",
+    "approval_requests",
+    "automation_agent_run_steps",
+    "roles",
+    "sequences",
+    "wiki_articles",
+    "wiki_article_versions",
+    "wiki_categories",
+]
+
+
+def upgrade() -> None:
+    for table in TABLES_WITH_BAD_RLS:
+        # Drop old policy with app.tenant_id
+        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
+        # Create new policy with app.current_tenant_id
+        op.execute(
+            f"CREATE POLICY tenant_isolation ON {table} "
+            f"USING (tenant_id::text = current_setting('app.current_tenant_id', true));"
+        )
+
+
+def downgrade() -> None:
+    for table in TABLES_WITH_BAD_RLS:
+        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
+        op.execute(
+            f"CREATE POLICY tenant_isolation ON {table} "
+            f"USING (tenant_id::text = current_setting('app.tenant_id', true));"
+        )