fix: bind agent sessions to role

hub/prisma/migrations/20260709120000_role_bound_agent_sessions/migration.sql

@@ -0,0 +1,9 @@
+-- ADR-0017 refinement: Hub sessions are provider/role/model-bound.
+-- Existing sessions predate role-aware binding; treat them as draft sessions.
+ALTER TABLE "AgentSession" ADD COLUMN "roleId" TEXT NOT NULL DEFAULT 'draft';
+ALTER TABLE "AgentSession" ALTER COLUMN "roleId" DROP DEFAULT;
+
+CREATE INDEX "AgentSession_provider_roleId_model_idx" ON "AgentSession"("provider", "roleId", "model");
+CREATE INDEX "AgentSession_projectId_provider_roleId_model_archivedAt_idx" ON "AgentSession"("projectId", "provider", "roleId", "model", "archivedAt");
+
+DROP INDEX "AgentSession_provider_model_idx";

hub/prisma/schema.prisma

@@ -190,14 +190,15 @@ model ProjectGroupBinding {
 
 // --- AgentRun, session, lock (ADR-0002, 0017) -----------------------------
 
-/// ADR-0017: session is provider/model-bound. `provider` + `model` capture
-/// the binding; provider-specific runtime cursors live in `metadata`
-/// (e.g. metadata.claudeSessionId). Same provider+model ⇒ reuse across runs
-/// (ADR-0002); a switch ⇒ new Hub session.
+/// ADR-0017: session is provider/role/model-bound. `provider` + `roleId` +
+/// `model` capture the binding; provider-specific runtime cursors live in
+/// `metadata` (e.g. metadata.claudeSessionId). Same provider+role+model ⇒
+/// reuse across runs (ADR-0002); a switch ⇒ new Hub session.
 model AgentSession {
   id         String    @id @default(cuid())
   projectId  String
   provider   String
+  roleId     String
   model      String
   title      String?
   metadata   Json
@@ -210,7 +211,8 @@ model AgentSession {
   messages AgentMessage[] @relation("sessionMessages")
 
   @@index([projectId, archivedAt])
-  @@index([provider, model])
+  @@index([provider, roleId, model])
+  @@index([projectId, provider, roleId, model, archivedAt])
   @@index([updatedAt])
 }