Align dependencies and add completion plan

.github/workflows/ci.yml

@@ -15,16 +15,6 @@ jobs:
         with:
           path: graphql-orm-ai
           fetch-depth: 0
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/graphql-orm
-          ref: 1e145a124e9e3f1b0ffd70165289170b627ecb73
-          path: graphql-orm
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/agql-auth
-          ref: c92dcb441237bbe308499b26525945f60ffa394a
-          path: agql-auth
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -49,16 +39,6 @@ jobs:
         with:
           path: graphql-orm-ai
           fetch-depth: 0
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/graphql-orm
-          ref: 1e145a124e9e3f1b0ffd70165289170b627ecb73
-          path: graphql-orm
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/agql-auth
-          ref: c92dcb441237bbe308499b26525945f60ffa394a
-          path: agql-auth
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run ORM parity against a test-owned disposable PostgreSQL container
@@ -85,24 +65,8 @@ jobs:
         with:
           path: graphql-orm-ai
           fetch-depth: 0
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/graphql-orm
-          ref: 1e145a124e9e3f1b0ffd70165289170b627ecb73
-          path: graphql-orm
-      - uses: actions/checkout@v5
-        with:
-          repository: Dastari/agql-auth
-          ref: c92dcb441237bbe308499b26525945f60ffa394a
-          path: agql-auth
       - name: Create baseline worktree
         run: git -C graphql-orm-ai worktree add ../graphql-orm-ai-baseline "${{ github.event.pull_request.base.sha }}"
-      - name: Reconstruct unpublished baseline dependency universe
-        run: |
-          sed -i 's/version = "0.8.0"/version = "0.10.0"/' graphql-orm-ai-baseline/Cargo.toml
-          sed -i 's/version = "0.6.1"/version = "0.7.0"/' graphql-orm-ai-baseline/Cargo.toml
-          grep -F 'agql-auth = { path = "../agql-auth", version = "0.10.0" }' graphql-orm-ai-baseline/Cargo.toml
-          grep -F 'graphql-orm = { path = "../graphql-orm/crates/graphql-orm", version = "0.7.0", default-features = false }' graphql-orm-ai-baseline/Cargo.toml
       - uses: obi1kenobi/cargo-semver-checks-action@v2
         with:
           manifest-path: graphql-orm-ai/Cargo.toml

AGENTS.md

@@ -24,6 +24,12 @@ These rules apply to every human or automated change in this repository.
   otherwise mutate their worktrees or GitHub branches.
 - Read-only inspection of sibling source, tags, PRs, and dependency metadata is
   allowed when needed to define an integration requirement.
+- Never implement an upstream change from this repository, regardless of its
+  size or urgency. Every required change to `graphql-orm`, `agql-auth`, or any
+  other upstream crate must be expressed as a copy-ready prompt in `.handoffs/`
+  and assigned to a separate owning agent. Until that owner returns a reviewed
+  final merge or release SHA, this repository remains read-only and blocked on
+  that upstream requirement.
 - When a reusable upstream change is required, stage a copy-ready prompt in
   `.handoffs/` for the owning repository agent. That directory is deliberately
   ignored so temporary coordination state is not published with the crate.

CHANGELOG.md

@@ -5,9 +5,10 @@ Semantic Versioning and keeps migration instructions in [MIGRATION.md](MIGRATION
 
 ## [Unreleased]
 
-This development line advances the pre-1.0 crate version to `0.50.0` and AI
-schema module to `0.47.0`. It adds a fortieth private entity for exact,
-content-free OpenAI background-submission bindings.
+This development line advances the pre-1.0 crate version to `0.51.0` while the
+AI schema module remains `0.47.0`. It aligns the reviewed dependency universe
+after adding a fortieth private entity for exact, content-free OpenAI
+background-submission bindings.
 
 ### Added
 
@@ -156,6 +157,25 @@ content-free OpenAI background-submission bindings.
 
 ### Changed
 
+- The exact Git dependency universe now pins `graphql-orm` 0.15.0 at
+  `6beef53633befd90a4d4810887a3e4640dc4ad91` and `agql-auth` 0.12.0 at the
+  peeled `v0.12.0` target
+  `3f3b0c5365adfbe436514a681d977b600991b797`. The ORM update incorporates the
+  reviewed PostgreSQL constraint-index introspection fix, aligns its optional
+  auth bridge to the same auth revision, and fixes exact bounded-mutation and
+  retention-purge sentinels above the public 100-row read cap. No AI entity,
+  GraphQL SDL, or stored-data migration changes.
+- Ordinary CI jobs now resolve the exact upstream revisions from the public
+  manifest instead of checking out unused sibling worktrees. The SemVer job
+  now resolves the reviewed exact Git dependencies recorded independently by
+  the current and baseline manifests; it no longer rewrites a historical
+  baseline to hard-coded local path dependencies.
+- Repository ownership is now explicit and unconditional: every upstream
+  implementation request must be staged as a copy-ready `.handoffs/` prompt
+  for a separate owning agent. Agents working in this repository may inspect
+  upstream state and consume reviewed final SHAs but never mutate an upstream
+  worktree or branch.
+
 - Schema module `0.46.0` adds deterministic receipt/profile/event-kind/time
   bindings to the existing private webhook receipt placeholder and combines
   its deterministic UUID with the existing provider family as private key

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "graphql-orm-ai"
-version = "0.50.0"
+version = "0.51.0"
 edition = "2024"
 authors = ["Toby Martin <toby@dastari.net>"]
 description = "Project-agnostic AI agent runtime for graphql-orm applications"
@@ -31,13 +31,13 @@ graphql-case-pascal = [
 ]
 
 [dependencies]
-agql-auth = { git = "https://github.com/Dastari/agql-auth.git", rev = "c92dcb441237bbe308499b26525945f60ffa394a", version = "0.10.0" }
+agql-auth = { git = "https://github.com/Dastari/agql-auth.git", rev = "3f3b0c5365adfbe436514a681d977b600991b797", version = "0.12.0" }
 async-graphql = { version = "7", features = ["uuid"] }
 async-stream = "0.3"
 async-trait = "0.1"
 base64 = { version = "0.22", optional = true }
 futures = "0.3"
-graphql-orm = { git = "https://github.com/Dastari/graphql-orm.git", rev = "f996cdbe2ef1867dea029ec3ff16e051dbe7566e", version = "0.9.0", default-features = false }
+graphql-orm = { git = "https://github.com/Dastari/graphql-orm.git", rev = "6beef53633befd90a4d4810887a3e4640dc4ad91", version = "0.15.0", default-features = false }
 graphql-orm-storage = { git = "https://github.com/Dastari/graphql-orm-storage.git", rev = "f1a1f06483d5fd3a0b8fd17f013b3ad4dd9849c5", version = "0.5.0", default-features = false }
 hex = "0.4"
 hmac = { version = "0.12", optional = true }