fix(guarded): cast hosted tenant id in authority trigger

[andrei-hasna]

Summary

• Fixes KNO-00019 / efe433c2-198e-4ece-9f16-e68876a573fb.
• Preserves historical PG_MIGRATIONS bytes for migration-ledger checksum compatibility.
• Appends a new CREATE OR REPLACE FUNCTION migration for knowledge_guarded_item_authority using a portable textual comparison for hosted UUID knowledge_items.tenant_id versus guarded TEXT claim tenant IDs.
• Adds PGlite regression coverage for fresh TEXT tenant, fresh hosted-style UUID tenant, and existing-ledger upgrade UUID tenant.

Evidence

• RED without tenant cast: focused regression failed with KnowledgeGuardedWriteUncertainError and 0 pass / 1 fail / 4 expect() calls.
• GREEN focused: bun test tests/guarded-writer.test.ts -t "REGRESSION: guarded item authority trigger matches TEXT claims to TEXT and UUID tenant ids" => 1 pass / 0 fail / 12 expect() calls.
• Full suite: bun test => 440 pass / 2 skip / 0 fail / 3408 expect() calls.
• Guarded suite: bun test tests/guarded-writer.test.ts => 14 pass / 0 fail / 102 expect() calls.
• contracts:conformance: ok invalid and valid project-panel fixtures.
• contracts no-cloud-scan . => ok hasna.no_cloud_evidence_pack.v1 .
• bun run build passed.
• node scripts/validate-public-package.mjs passed for hasna-knowledge-0.2.97.tgz.
• bun run verify:generated => 6 generated bundles rebuild byte-identically and carry no stale generated code.
• Staged secret scan: managed pre-commit hook exited 0.
• Pre-push scan: [pre-push] scanning 1 commit(s) for refs/heads/fix/efe433c2-guarded-text-uuid.

Agent: cassianus

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #78 @ 6ffb1ac — lens: correctness+security+gates, reviewer Dalton (1 of 1)

Scope reviewed: exact diff from base bb26b7823bade470eb05297e2d61b73125faf213 to head 6ffb1ac0514f9aa0baf7e7aff5ab17dc198967f4 in read-only worktree /home/hasna/.hasna/repos/worktrees/knowledge/pr78-kno00019-review for Todos KNO-00019.

Diff/semantic review:

• src/db/pg-migrations.ts: preserved the historical guarded-authority trigger migration and appended exactly one replacement CREATE OR REPLACE FUNCTION knowledge_guarded_item_authority() migration.
• Mechanical migration-prefix check: base_entries=118, head_entries=119, prefix_preserved=true, appended_entries=1, appended_contains_cast=true.
• The only semantic trigger authority change I found is claim.tenant_id = NEW.tenant_id::text, making the guarded claim tenant_id TEXT compare portably with knowledge_items.tenant_id when that column is TEXT or UUID. target_id remains claim.target_id = NEW.id, so the target comparison stays TEXT/TEXT.
• PGlite fixture coverage now exercises direct/fresh TEXT tenant, direct/fresh UUID tenant, and existing-ledger upgrade UUID tenant through createMigratedPglite({ knowledgeItemsTenantIdType, migrationMode }).
• Generated dist/index.js, dist/storage.js, and bin/knowledge.js carry the same appended migration content as source.
• Diff literal secret scan: added_lines_scanned=400, credential_literal_hits=0, diff_secret_literal_scan=PASS.

Commands and literal pass/fail evidence:

• git rev-parse HEAD exited 0: 6ffb1ac0514f9aa0baf7e7aff5ab17dc198967f4.
• git diff --stat bb26b7823bade470eb05297e2d61b73125faf213..6ffb1ac0514f9aa0baf7e7aff5ab17dc198967f4 exited 0: 6 files changed, 400 insertions(+), 6 deletions(-).
• Migration preservation parser exited 0: prefix_preserved=true; appended_entries=1; appended_contains_cast=true; appended_mentions_target_text_compare=true.
• bun install --frozen-lockfile exited 0: 156 packages installed.
• Focused guarded-writer/PGlite lane bun test tests/guarded-writer.test.ts --timeout 20000 exited 0: (pass) FCAME-1 guarded Knowledge writer > REGRESSION: guarded item authority trigger matches TEXT claims to TEXT and UUID tenant ids; 14 pass; 0 fail; 102 expect() calls.
• Already-completed broader local suite bun test --timeout 20000 exited 0 before the bounded-status request: 440 pass; 2 skip; 0 fail; 3408 expect() calls; Ran 442 tests across 49 files.
• bunx tsc -p tsconfig.build.json --noEmit exited 0: typecheck rc=0.
• bun test tests/package-release.test.ts exited 0: 6 pass; 0 fail; 80 expect() calls.
• node scripts/validate-public-package.mjs exited 0: Public package validation passed for hasna-knowledge-0.2.97.tgz.
• bun run contracts:conformance exited 0: ok valid hasna.project_panel.v1 fixtures/project-panel.valid.json.
• contracts no-cloud-scan . exited 0: ok hasna.no_cloud_evidence_pack.v1 ..
• bun run verify:generated exited 0: verify-generated-artifacts: 6 generated bundles rebuild byte-identically and carry no stale generated code.
• Final exact-head/CI read gh pr view 78 --repo hasna/knowledge --json number,url,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup exited 0: PR_HEAD: 6ffb1ac0514f9aa0baf7e7aff5ab17dc198967f4; PR_BASE: bb26b7823bade470eb05297e2d61b73125faf213; PR_MERGE_STATE: CLEAN; CI_SUMMARY: success=7 skipped=1 pending=0 failure=0.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.