feat(mothership): add super-user Plan and knowledge graph settings with benchmark tooling - #8637

Summary

Add private named knowledge graphs, detailed Plan-mode specifications and an organization benchmark console. Plan and knowledge use the same server-side eligibility as Benchmark UI: the existing benchmark deployment opt-in plus platform admin status and enabled Super User Mode. The UI, chat creation/admission, graph settings and worker memory scope enforce that policy; ordinary organization admin status is insufficient.

The branch also adds separately gated desktop computer use, read-only Search integration tooling, catalog credential/scope guidance and client-tool result recovery fixes. Computer use and Search tools retain their separate rollout gates; no production flag is enabled by this PR. A benchmark's selected user must independently qualify for Plan.

Product update

Eligible super users can investigate an organization, author a detailed automation specification as a native Sim Page, and reuse private knowledge across chats and workspaces. Plan and graphs require the existing benchmark deployment opt-in and Super User Mode; computer use and Search integration tools retain independent rollout gates.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other

Testing

Latest review fixes recheck the workspace organization while publishing a fork, reject repeated benchmark answers left outside redaction markers, and preserve workspace-specific authorization errors. Their regressions were shown failing before repair. The Stripe concurrency test now waits until its parking transaction actually holds the locks before starting competitors and releases them in a finally block. Fork route fixtures use table-specific results, and the ledger aggregate unit test pins its clock; assertions and timeouts are unchanged. Existing real-PostgreSQL tests still prove elapsed-time deduction and deadline exhaustion.

• Actual production Next build passes. The CI prerender failure was reproduced before extracting the unchanged trigger builder into a registry-free module; trigger definitions now import that owner directly, and the cycle audit covers the registry loop.

• The existing packaged desktop local-files E2E passes with its real feature-flag provider. Page-exit regressions cover retained capacity and late-ack identity races. Additional review regressions cover unavailable Plan policy, scoped cancellation, benchmark retries/redaction/versioning and null native status; each relevant guard was demonstrated red before its fix.

• Full root bun run test: 410 script tests and all 20 workspace tasks pass; Sim app 37,115 pass, 21 opt-in skips.

• All 26 type/lint tasks, 58 architecture audits, workflow lint, block-registry checks, generated docs, migration safety and schema drift pass.

• Complete migrations apply to fresh local PostgreSQL; 37 real graph/benchmark/access/concurrency cases passed in the preceding round. The latest graph ownership and Stripe regressions pass 49 cases; seven PostgreSQL ledger-budget tests also pass. Coverage includes workspace transfer during chat creation or fork and benchmark target deletion.

• Streaming regressions cover proxy idle periods, rate limits, access denial, cancellation, incomplete streams and split UTF-8. Private query/mutation caches remain isolated across account changes.

• The final combined-tree gate passes all 20 workspace tasks, including 1,127 desktop and 478 CLI tests. Focused handler/unload/format checks pass 142 tests. An existing cancellation test now synchronizes on actual tool entry and completion instead of assuming completion within 10 milliseconds; its assertions are unchanged.

• Client unload delivery and native 16 MiB reply-bound regressions fail against the old behavior and pass with the fixes. The existing benchmark UI fixture now supplies its authenticated session; no assertions or timeouts were weakened.

Staging is integrated with a normal merge. Feature eligibility and Slack scope metadata use narrow imports; all 82 guarded module graphs pass their unchanged baseline. The desktop build retains staging's filesystem modules and compiles the dormant helper without executing it or requesting permissions.

Review fixes preserve acknowledged tool outcomes during page exit, bound native replies without losing dispatch metadata, serialize graph binding with workspace transfers, cascade target-user deletion and keep long benchmark requests alive with heartbeats. Computer-use and Search rollout gates remain separate. No live configuration, deployment, PR merge, paid trial or customer-data read was performed in this validation pass.

Additive migrations 0404–0410 add graph/benchmark storage and bounded-lock NOT VALID constraints. Dev databases retaining an earlier feature migration journal still need the documented reconciliation before redeployment; no live journal was changed.

Preview limitation: account deletion does not yet erase Graphiti records. Hosted offboarding is documented as unimplemented; owner-to-namespace tracking, durable erasure and indexer fencing are required before enabling Graphiti for production users. This PR keeps the existing dev infrastructure and super-user/deployment gates.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced (existing upload-test namespace-import and script-template warnings remain)
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

No new screenshots captured for the eligibility change. Plan and knowledge settings use the existing composer and settings layouts.

Companion PR

Companion: https://github.com/simstudioai/mothership/pull/598