mig: enforce owner-loss latching and atomic agent transfer

[danielkov]

Summary

Adds durable owner-loss latching and atomic human-only transfer and explicit reassignment routes for first-class agents. Owner changes preserve the agent identity and direct agent policy while transactional audit events record owner loss and ownership transitions.

Motivation

Agents must remain blocked after their human owner becomes ineligible, even if that owner later becomes eligible again, and ownership recovery must not create a pending or ownerless state.

Technical details

Authoritative owner-loss transitions

User deletion, membership deletion or inactivation, directory deactivation, explicit member removal, and declarative WorkOS membership reconciliation set the durable latch in the same database transaction as the eligibility mutation. Explicit reassignment is the only operation that clears it. WorkOS reconciliation requires a new membership identity to restore a deleted membership.

Ownership and direct policy

Transfer requires the current owner's authorization; reassignment recovers a latched agent. Both preserve direct policy grants. A latched former owner loses intrinsic policy-management authority even after membership restoration; explicit agent-write authority can still manage policy without clearing the latch.

Prerequisite

The agent-management prerequisite #6047 is merged. This PR targets main and preserves the direct policy-management APIs now merged in #6051.

[linear-code]

AIM-184

[changeset-bot]

🦋 Changeset detected

Latest commit: b58772d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
server	Minor
dashboard	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This adds new public API endpoints for agent transfer/reassignment and durable owner-loss latching, touching core ownership logic across server, API design, and client SDKs — a subtle bug could break agent availability or data integrity.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 14m 6s

All reported issues were addressed across 51 files

Linked issue analysis

Linked issue: AIM-184: feat: enforce owner-loss latching and atomic agent transfer

Status	Acceptance criteria	Notes
✅	Owner deletion, inactivation, or organization-membership loss durably sets both reassignment latch fields in the authoritative mutation.	The PR adds shared owner-loss latching and wires it into user deletion, membership removal, WorkOS reconciliation, and directory deactivation paths.
✅	Owner reactivation or membership restoration does not clear the latch; only explicit reassignment clears it.	The latch is cleared in the explicit reassignment update, while ordinary lifecycle restoration paths do not clear it.
✅	Ordinary transfer and explicit reassignment atomically replace the owner with an eligible same-organization human.	The PR adds separate transfer and reassignment operations, tenant-pinned replacement validation, row updates, and transactional service handling.
✅	Transfers preserve agent identity and direct policy while leaving exactly one current owner.	Owner replacement updates owner_user_id in place, and the added integration test explicitly checks preservation of direct policy.
⚠️	Authorization is limited to validated nonsupport human sessions with the required transfer predicate or evaluated agent:transfer permission.	The diff shows human authorization and the owned-agent transfer predicate, but the provided excerpts do not fully demonstrate every authorization branch or nonsupport-session guard.
✅	Owner-loss, ordinary-transfer, and explicit-reassignment audit events record the relevant ownership transition.	The PR adds dedicated audit actions and ownership audit integration for loss, transfer, and reassignment.
⚠️	Lifecycle, ownership, and concurrency cases are covered by tests, including former-owner authority loss and concurrent changes.	New lifecycle, ownership, and direct-policy tests are present, but the supplied diff does not clearly show complete race coverage or tests for every former-owner predicate.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[github-actions]

atlas migrate lint on server/migrations

Status	Step	Result
	1 new migration file detected	20260908210453_owner_lookup_indexes.sql
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[github-actions]

atlas migrate lint on clickhouse/migrations

Status	Step	Result
	No migration files detected
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[cubic-dev-ai]

All reported issues were addressed across 25 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>