القائمة
Write a correct Drizzle schema change plus migration and Row-Level Security policy for MemOS. Use when adding or altering any table, index, or RLS policy.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Generate realistic, screenshot-ready seed data for MemOS — a believable org with teams, projects, agents, OKRs, briefs, and a rich graph of facts/learnings/artifacts. Use before demos, screenshots, or recording the README Loom.
Run an HLD + LLD design review on a proposed plan BEFORE coding a non-trivial MemOS feature. Use at the start of any feature that touches more than one module, the data model, or a core invariant.
Audit that the MemOS core write-gating invariants (evidence gate, non-obvious gate, provenance thread, tenant isolation) are actually enforced and tested. Run before merging any change to the fact/learning/artifact/workflow write path.
Build a polished MemOS dashboard component to the project design system (Next.js App Router, Tailwind, shadcn/ui, Framer Motion). Use for any new UI piece — OKR tree, activity feed, provenance graph, brief authoring, etc.
Add a new MemOS API intent end-to-end (Zod schema, handler, route registration, test, and API docs) in the consistent project pattern. Use whenever adding or modifying an intent like fact.record, workflow.create, brief.fetch.
Capture an Architecture Decision Record for a real design choice in MemOS. Use whenever a non-trivial decision is made (tech choice, schema modeling, isolation strategy, a tradeoff with alternatives).
| name | db-migration |
| description | Write a correct Drizzle schema change plus migration and Row-Level Security policy for MemOS. Use when adding or altering any table, index, or RLS policy. |
Schema changes are schema-as-code via Drizzle, then a generated SQL migration, then an RLS policy. Multi-tenant isolation is enforced at the DB — every table that holds tenant data MUST have RLS. Never hand-edit the live DB.
packages/api/src/db/schema.tsproject_id (and/or team_id).project_id, bd_id, agent_id, created_at, and embedding via an ivfflat/hnsw index for vector columns).facts, learnings) include embedding vector(1536).npx drizzle-kit generate → review the SQL in infra/migrations/. Read it; never apply blind.
For each tenant-scoped table:
alter table <t> enable row level security;
create policy <t>_tenant_read on <t> for select
using (project_id = any(current_setting('memos.agent_projects', true)::text[]));
create policy <t>_tenant_write on <t> for insert
with check (project_id = any(current_setting('memos.agent_projects', true)::text[]));
The gateway sets memos.agent_projects per request from the authed token's scopes (via set_config). This is the real isolation boundary.
pnpm db:migrate. Then prove isolation with a quick test: an agent scoped to project A cannot select project B's rows.
If this is a non-trivial modeling choice (e.g. one table serving two roles, vector index type), write/append an ADR via the write-adr skill, and update docs/DATA_MODEL.md (ER diagram + the new table's fields/indexes).
select * path that bypasses the project filter.bd_id; workflow_run → target_objective_id).Schema updated, migration reviewed + applied, RLS policy in place and proven, DATA_MODEL.md current. Commit as feat(db): <change>.