feat: make agent roles and skills dynamic

hub/prisma/schema.prisma

@@ -43,6 +43,8 @@ model Organization {
   externalDirectoryConnections ExternalDirectoryConnection[]
   providerConnections          OrganizationProviderConnection[]
   feishuApplicationConnection  OrganizationFeishuApplicationConnection?
+  agentSkills                  OrganizationAgentSkill[]
+  agentRoles                   OrganizationAgentRole[]
   auditEntries                 AuditEntry[]                    @relation("organizationAudit")
 
   @@index([status])
@@ -78,6 +80,70 @@ enum OrganizationMemberRole {
   MEMBER
 }
 
+/// Organization-scoped, content-addressed Agent skill registration. The DB is
+/// the runtime registry; `contentDigest` selects an immutable directory below
+/// the platform-controlled skill store and is never interpreted as a path.
+model OrganizationAgentSkill {
+  id             String    @id @default(cuid())
+  organizationId String
+  name           String
+  version        String
+  description    String?
+  contentDigest  String
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+  disabledAt     DateTime?
+
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  roleBindings OrganizationAgentRoleSkill[]
+
+  @@unique([organizationId, name])
+  @@unique([organizationId, id])
+  @@index([organizationId, disabledAt])
+  @@index([contentDigest])
+}
+
+/// ADR-0017 runtime role bundle. Roles are Organization-owned data rather than
+/// a code enum: model, system prompt, tool allowlist and skill selection change
+/// without a Hub release or process restart.
+model OrganizationAgentRole {
+  id             String    @id @default(cuid())
+  organizationId String
+  roleId         String
+  label          String
+  defaultModel   String?
+  systemPrompt   String?
+  tools          Json?
+  sortOrder      Int       @default(0)
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+  disabledAt     DateTime?
+
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  skillBindings OrganizationAgentRoleSkill[]
+
+  @@unique([organizationId, roleId])
+  @@unique([organizationId, id])
+  @@index([organizationId, disabledAt, sortOrder])
+}
+
+/// Same-Organization join enforced by both composite foreign keys. `sortOrder`
+/// gives stable skill listing and prompt discovery order for a role bundle.
+model OrganizationAgentRoleSkill {
+  organizationId String
+  agentRoleId     String
+  agentSkillId    String
+  sortOrder       Int      @default(0)
+  createdAt       DateTime @default(now())
+
+  role  OrganizationAgentRole  @relation(fields: [organizationId, agentRoleId], references: [organizationId, id], onDelete: Cascade)
+  skill OrganizationAgentSkill @relation(fields: [organizationId, agentSkillId], references: [organizationId, id], onDelete: Cascade)
+
+  @@id([organizationId, agentRoleId, agentSkillId])
+  @@index([organizationId, agentRoleId, sortOrder])
+  @@index([organizationId, agentSkillId])
+}
+
 /// ADR-0021: org-level project onboarding policy. Ordinary Feishu users can
 /// create projects from unbound chats only when membersCanCreateProjects=true.
 model OrganizationProjectSettings {