files.getUploadURLExternal, a streamed upload from core storage (no temp
files), files.completeUploadExternal; expired-lease reconcile by title marker
through files.list; files:read scope added to the manifest and design.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven tables (workspace, connection, channel, user group, template, message,
attempt), enums, joins, child lists and Postgres DDL. Owner locks on
connection and message; the host tenant lock on workspace and inherited by
join; token fields PASSWORD, hidden, and DENY-locked for every user session.
Tests: validator, owner isolation, two-tenant isolation, token invisibility.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5