@derwinjs/db 0.9.0 → 0.11.0

package/prisma/migrations/20260501165631_init/migration.sql

@@ -0,0 +1,407 @@
+-- CreateEnum
+CREATE TYPE "ProjectType" AS ENUM ('SAAS', 'ECOMMERCE', 'MARKETING', 'ERP', 'ANALYTICS', 'INFRA', 'CONTENT');
+
+-- CreateEnum
+CREATE TYPE "ProjectMode" AS ENUM ('OBSERVE', 'TICKET_ONLY', 'AUTHOR', 'AUTO');
+
+-- CreateEnum
+CREATE TYPE "RunTrigger" AS ENUM ('CRON', 'OPERATOR_ON_DEMAND', 'WEBHOOK', 'CONTINUOUS');
+
+-- CreateEnum
+CREATE TYPE "RunStatus" AS ENUM ('IN_PROGRESS', 'COMPLETED', 'FAILED', 'CANCELLED');
+
+-- CreateEnum
+CREATE TYPE "SurfaceCategory" AS ENUM ('CODE_HEALTH', 'FUNCTIONAL_CORRECTNESS', 'UI_UX_INTEGRITY', 'PERF_RESILIENCE', 'SECURITY', 'COMPLIANCE_AUDIT', 'MULTI_TENANT_SAFETY', 'OPERATIONAL_HEALTH');
+
+-- CreateEnum
+CREATE TYPE "Severity" AS ENUM ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW');
+
+-- CreateEnum
+CREATE TYPE "RiskTier" AS ENUM ('LOW', 'MEDIUM', 'HIGH', 'NEVER');
+
+-- CreateEnum
+CREATE TYPE "TicketStatus" AS ENUM ('OPEN', 'INVESTIGATING', 'AUTHORING', 'PR_OPEN', 'MERGED', 'REGRESSED_REVERTED', 'CLOSED_WONTFIX', 'CLOSED_RESOLVED', 'ESCALATED');
+
+-- CreateEnum
+CREATE TYPE "ReviewBucket" AS ENUM ('PASS', 'FAIL', 'ESCALATION');
+
+-- CreateEnum
+CREATE TYPE "AttemptStatus" AS ENUM ('AUTHORING', 'PRE_VERIFY_FAILED', 'PRE_VERIFY_PASSED', 'PR_OPENED', 'AUTO_MERGED', 'HUMAN_MERGED', 'REJECTED', 'REGRESSED_REVERTED', 'FAILED');
+
+-- CreateEnum
+CREATE TYPE "ArtifactType" AS ENUM ('SCREENSHOT', 'VIDEO', 'DOM_SNAPSHOT', 'CONSOLE_LOG', 'NETWORK_LOG', 'TELEMETRY_SLICE', 'CODE_SNAPSHOT', 'PROMPT_TEXT', 'DIFF', 'REASONING_TRACE', 'REVIEWER_OUTPUT', 'REPLAY_BUNDLE');
+
+-- CreateEnum
+CREATE TYPE "ArtifactStage" AS ENUM ('DETECTION', 'INVESTIGATION', 'TICKET_CREATION', 'AUTHORING', 'PRE_MERGE_VERIFICATION', 'POST_MERGE_VERIFICATION', 'ARCHIVAL');
+
+-- CreateEnum
+CREATE TYPE "PolicyType" AS ENUM ('RISK_TIER', 'CONCURRENCY', 'TRUST_THRESHOLD', 'ESCALATION');
+
+-- CreateTable
+CREATE TABLE "projects" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "type" "ProjectType" NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "mode" "ProjectMode" NOT NULL DEFAULT 'OBSERVE',
+    "modeChangedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "modeChangedBy" TEXT,
+    "monthlyBudgetCents" INTEGER NOT NULL DEFAULT 10000,
+    "dailyDispatchLimit" INTEGER NOT NULL DEFAULT 50,
+
+    CONSTRAINT "projects_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "project_profiles" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "type" "ProjectType" NOT NULL,
+    "domainOntology" JSONB NOT NULL,
+    "riskProfile" JSONB NOT NULL,
+    "criticalFlows" JSONB NOT NULL,
+    "glossary" JSONB NOT NULL,
+    "dependencies" JSONB NOT NULL,
+    "complianceTags" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "ingestedDocsHash" TEXT NOT NULL,
+    "lastIngestedAt" TIMESTAMP(3) NOT NULL,
+    "lastEvolvedAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "project_profiles_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ingested_docs" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "source" TEXT NOT NULL,
+    "sourcePath" TEXT NOT NULL,
+    "contentHash" TEXT NOT NULL,
+    "contentSize" INTEGER NOT NULL,
+    "ingestedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "ontologyDelta" JSONB,
+
+    CONSTRAINT "ingested_docs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "profile_evolution_log" (
+    "id" TEXT NOT NULL,
+    "profileId" TEXT NOT NULL,
+    "triggerType" TEXT NOT NULL,
+    "delta" JSONB NOT NULL,
+    "rationale" TEXT NOT NULL,
+    "appliedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "appliedBy" TEXT NOT NULL,
+
+    CONSTRAINT "profile_evolution_log_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "qa_runs" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "triggeredBy" TEXT NOT NULL,
+    "triggerType" "RunTrigger" NOT NULL,
+    "scope" JSONB NOT NULL,
+    "startedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "completedAt" TIMESTAMP(3),
+    "status" "RunStatus" NOT NULL DEFAULT 'IN_PROGRESS',
+    "signalsRaised" INTEGER NOT NULL DEFAULT 0,
+    "ticketsCreated" INTEGER NOT NULL DEFAULT 0,
+    "attemptsLaunched" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "qa_runs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "raw_signals" (
+    "id" TEXT NOT NULL,
+    "qaRunId" TEXT NOT NULL,
+    "routeName" TEXT NOT NULL,
+    "signalType" TEXT NOT NULL,
+    "rawData" JSONB NOT NULL,
+    "rawArtifactRefs" JSONB NOT NULL,
+    "qaTicketId" TEXT,
+    "investigatedAt" TIMESTAMP(3),
+    "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "raw_signals_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "qa_tickets" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "qaRunId" TEXT NOT NULL,
+    "externalRef" TEXT,
+    "externalSystem" TEXT,
+    "originatingTicketRef" TEXT,
+    "surface" "SurfaceCategory" NOT NULL,
+    "classification" TEXT NOT NULL,
+    "severity" "Severity" NOT NULL,
+    "riskTier" "RiskTier" NOT NULL,
+    "status" "TicketStatus" NOT NULL DEFAULT 'OPEN',
+    "title" TEXT NOT NULL,
+    "reproSteps" JSONB NOT NULL,
+    "suspectedRootCause" TEXT NOT NULL,
+    "blastRadius" JSONB NOT NULL,
+    "proposedFixApproach" TEXT NOT NULL,
+    "autoMergeEligible" BOOLEAN NOT NULL DEFAULT false,
+    "autoMergeRationale" TEXT,
+    "finalBucket" "ReviewBucket",
+    "bucketReason" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "closedAt" TIMESTAMP(3),
+
+    CONSTRAINT "qa_tickets_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "qa_fix_attempts" (
+    "id" TEXT NOT NULL,
+    "qaTicketId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "attemptNumber" INTEGER NOT NULL,
+    "promptText" TEXT NOT NULL,
+    "diff" TEXT,
+    "diffSizeBytes" INTEGER,
+    "modelName" TEXT,
+    "modelVersion" TEXT,
+    "inputTokens" INTEGER,
+    "outputTokens" INTEGER,
+    "costCents" INTEGER,
+    "preVerifyResult" JSONB,
+    "preVerifyPassed" BOOLEAN,
+    "branchName" TEXT,
+    "prUrl" TEXT,
+    "prNumber" INTEGER,
+    "dispatchStatus" "AttemptStatus" NOT NULL DEFAULT 'AUTHORING',
+    "mergedAt" TIMESTAMP(3),
+    "postVerifyResult" JSONB,
+    "regressionDetected" BOOLEAN NOT NULL DEFAULT false,
+    "autoRevertedAt" TIMESTAMP(3),
+    "humanEditLines" INTEGER,
+    "fixSuccessScore" DOUBLE PRECISION,
+    "attemptedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "closedAt" TIMESTAMP(3),
+
+    CONSTRAINT "qa_fix_attempts_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "classification_trust" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "classification" TEXT NOT NULL,
+    "surface" "SurfaceCategory" NOT NULL,
+    "attemptsLast30d" INTEGER NOT NULL DEFAULT 0,
+    "mergedClean" INTEGER NOT NULL DEFAULT 0,
+    "mergedWithEdits" INTEGER NOT NULL DEFAULT 0,
+    "regressed" INTEGER NOT NULL DEFAULT 0,
+    "reverted" INTEGER NOT NULL DEFAULT 0,
+    "successScore" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "trustPercent" INTEGER NOT NULL DEFAULT 0,
+    "autoMergeEligible" BOOLEAN NOT NULL DEFAULT false,
+    "lastComputedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "classification_trust_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "rag_corpus" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "classification" TEXT NOT NULL,
+    "surface" "SurfaceCategory" NOT NULL,
+    "promptText" TEXT NOT NULL,
+    "diff" TEXT NOT NULL,
+    "embedding" BYTEA,
+    "fixAttemptId" TEXT NOT NULL,
+    "outcomeQuality" DOUBLE PRECISION NOT NULL,
+    "addedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "rag_corpus_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "audit_artifacts" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "qaTicketId" TEXT,
+    "qaFixAttemptId" TEXT,
+    "artifactType" "ArtifactType" NOT NULL,
+    "stage" "ArtifactStage" NOT NULL,
+    "storageBackend" TEXT NOT NULL,
+    "storageKey" TEXT NOT NULL,
+    "contentType" TEXT NOT NULL,
+    "sizeBytes" INTEGER NOT NULL,
+    "contentHash" TEXT NOT NULL,
+    "meta" JSONB NOT NULL,
+    "retentionUntil" TIMESTAMP(3),
+    "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "audit_artifacts_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "policies" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "policyType" "PolicyType" NOT NULL,
+    "pathRules" JSONB NOT NULL,
+    "classificationOverrides" JSONB NOT NULL,
+    "autoMergeTrustThreshold" INTEGER NOT NULL DEFAULT 70,
+    "autoMergeMediumThreshold" INTEGER NOT NULL DEFAULT 85,
+    "dailyDispatchLimit" INTEGER NOT NULL DEFAULT 50,
+    "perTicketAttemptLimit" INTEGER NOT NULL DEFAULT 3,
+    "freezeWindowsCron" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "escalationTriggers" JSONB NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "updatedBy" TEXT NOT NULL,
+
+    CONSTRAINT "policies_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "project_mode_log" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "fromMode" "ProjectMode" NOT NULL,
+    "toMode" "ProjectMode" NOT NULL,
+    "reason" TEXT NOT NULL,
+    "changedBy" TEXT NOT NULL,
+    "changedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "project_mode_log_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "spend_ledger" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "qaFixAttemptId" TEXT,
+    "vendor" TEXT NOT NULL,
+    "eventType" TEXT NOT NULL,
+    "costCents" INTEGER NOT NULL,
+    "meta" JSONB NOT NULL,
+    "occurredAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "spend_ledger_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "projects_slug_key" ON "projects"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "project_profiles_projectId_key" ON "project_profiles"("projectId");
+
+-- CreateIndex
+CREATE INDEX "ingested_docs_projectId_sourcePath_idx" ON "ingested_docs"("projectId", "sourcePath");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ingested_docs_projectId_sourcePath_contentHash_key" ON "ingested_docs"("projectId", "sourcePath", "contentHash");
+
+-- CreateIndex
+CREATE INDEX "profile_evolution_log_profileId_appliedAt_idx" ON "profile_evolution_log"("profileId", "appliedAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "qa_runs_projectId_startedAt_idx" ON "qa_runs"("projectId", "startedAt" DESC);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "raw_signals_qaTicketId_key" ON "raw_signals"("qaTicketId");
+
+-- CreateIndex
+CREATE INDEX "raw_signals_qaRunId_idx" ON "raw_signals"("qaRunId");
+
+-- CreateIndex
+CREATE INDEX "raw_signals_routeName_capturedAt_idx" ON "raw_signals"("routeName", "capturedAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "qa_tickets_projectId_status_idx" ON "qa_tickets"("projectId", "status");
+
+-- CreateIndex
+CREATE INDEX "qa_tickets_projectId_finalBucket_idx" ON "qa_tickets"("projectId", "finalBucket");
+
+-- CreateIndex
+CREATE INDEX "qa_tickets_projectId_createdAt_idx" ON "qa_tickets"("projectId", "createdAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "qa_fix_attempts_qaTicketId_attemptNumber_idx" ON "qa_fix_attempts"("qaTicketId", "attemptNumber");
+
+-- CreateIndex
+CREATE INDEX "qa_fix_attempts_projectId_attemptedAt_idx" ON "qa_fix_attempts"("projectId", "attemptedAt" DESC);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "classification_trust_projectId_classification_surface_key" ON "classification_trust"("projectId", "classification", "surface");
+
+-- CreateIndex
+CREATE INDEX "rag_corpus_projectId_classification_surface_idx" ON "rag_corpus"("projectId", "classification", "surface");
+
+-- CreateIndex
+CREATE INDEX "audit_artifacts_qaTicketId_idx" ON "audit_artifacts"("qaTicketId");
+
+-- CreateIndex
+CREATE INDEX "audit_artifacts_projectId_capturedAt_idx" ON "audit_artifacts"("projectId", "capturedAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "policies_projectId_idx" ON "policies"("projectId");
+
+-- CreateIndex
+CREATE INDEX "project_mode_log_projectId_changedAt_idx" ON "project_mode_log"("projectId", "changedAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "spend_ledger_projectId_occurredAt_idx" ON "spend_ledger"("projectId", "occurredAt" DESC);
+
+-- CreateIndex
+CREATE INDEX "spend_ledger_projectId_vendor_occurredAt_idx" ON "spend_ledger"("projectId", "vendor", "occurredAt");
+
+-- AddForeignKey
+ALTER TABLE "project_profiles" ADD CONSTRAINT "project_profiles_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "profile_evolution_log" ADD CONSTRAINT "profile_evolution_log_profileId_fkey" FOREIGN KEY ("profileId") REFERENCES "project_profiles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "qa_runs" ADD CONSTRAINT "qa_runs_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "raw_signals" ADD CONSTRAINT "raw_signals_qaRunId_fkey" FOREIGN KEY ("qaRunId") REFERENCES "qa_runs"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "raw_signals" ADD CONSTRAINT "raw_signals_qaTicketId_fkey" FOREIGN KEY ("qaTicketId") REFERENCES "qa_tickets"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "qa_tickets" ADD CONSTRAINT "qa_tickets_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "qa_tickets" ADD CONSTRAINT "qa_tickets_qaRunId_fkey" FOREIGN KEY ("qaRunId") REFERENCES "qa_runs"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "qa_fix_attempts" ADD CONSTRAINT "qa_fix_attempts_qaTicketId_fkey" FOREIGN KEY ("qaTicketId") REFERENCES "qa_tickets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "qa_fix_attempts" ADD CONSTRAINT "qa_fix_attempts_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "classification_trust" ADD CONSTRAINT "classification_trust_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_artifacts" ADD CONSTRAINT "audit_artifacts_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_artifacts" ADD CONSTRAINT "audit_artifacts_qaTicketId_fkey" FOREIGN KEY ("qaTicketId") REFERENCES "qa_tickets"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_artifacts" ADD CONSTRAINT "audit_artifacts_qaFixAttemptId_fkey" FOREIGN KEY ("qaFixAttemptId") REFERENCES "qa_fix_attempts"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "policies" ADD CONSTRAINT "policies_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "project_mode_log" ADD CONSTRAINT "project_mode_log_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260503051425_0002_qap018b_qaticket_crosslink_fields/migration.sql

@@ -0,0 +1,6 @@
+-- AlterTable
+ALTER TABLE "policies" ALTER COLUMN "perTicketAttemptLimit" SET DEFAULT 1;
+
+-- AlterTable
+ALTER TABLE "qa_tickets" ADD COLUMN     "crossLinkRefs" JSONB NOT NULL DEFAULT '[]',
+ADD COLUMN     "dashboardUrl" TEXT;

package/prisma/migrations/20260507130000_sprint10_visual_baselines/migration.sql

@@ -0,0 +1,27 @@
+-- Sprint 10 Phase 2 (QAP-105) — Visual regression baselines.
+--
+-- Stores durable baseline screenshots that the visual-regression scanner
+-- pixel-diffs against. One row per (projectId, scopeKey) — operator
+-- approves a new baseline by replacing the bytes via
+-- VisualBaselineStore.setBaseline.
+--
+-- Idempotent (IF NOT EXISTS) — safe to re-run on environments where the
+-- table or index already exists.
+
+CREATE TABLE IF NOT EXISTS "derwin"."visual_baselines" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "scopeKey" TEXT NOT NULL,
+    "bytes" BYTEA NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "visual_baselines_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "visual_baselines_projectId_scopeKey_key"
+    ON "derwin"."visual_baselines"("projectId", "scopeKey");
+
+ALTER TABLE "derwin"."visual_baselines"
+    ADD CONSTRAINT "visual_baselines_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260507130100_sprint10_phase3_contract_baselines/migration.sql

@@ -0,0 +1,32 @@
+-- Sprint 10 Phase 3 (QAP-103) — API contract baselines.
+--
+-- Stores durable baseline spec text (OpenAPI / JSON Schema) that the
+-- contract differ compares candidate specs against. One row per
+-- (projectId, specKey) — operator approves a new baseline by replacing
+-- the spec via ContractBaselineStore.setBaseline. Multiple specKeys
+-- per project are allowed ('main-api', 'webhook-payloads', etc.).
+--
+-- Idempotent (IF NOT EXISTS) — safe to re-run on environments where the
+-- table or index already exists.
+
+CREATE TABLE IF NOT EXISTS "derwin"."contract_baselines" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "specKey" TEXT NOT NULL,
+    "spec" TEXT NOT NULL,
+    "format" TEXT NOT NULL,
+    "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "capturedBy" TEXT NOT NULL,
+    CONSTRAINT "contract_baselines_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "contract_baselines_projectId_specKey_key"
+    ON "derwin"."contract_baselines"("projectId", "specKey");
+
+CREATE INDEX IF NOT EXISTS "contract_baselines_projectId_capturedAt_idx"
+    ON "derwin"."contract_baselines"("projectId", "capturedAt" DESC);
+
+ALTER TABLE "derwin"."contract_baselines"
+    ADD CONSTRAINT "contract_baselines_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260507130200_sprint10_phase4_tenant_fuzz/migration.sql

@@ -0,0 +1,34 @@
+-- Sprint 10 Phase 4 (QAP-104) — Tenant-isolation fuzz configuration.
+--
+-- Stores the operator-curated fuzz configuration consumed by the
+-- cross-tenant probing fuzzer (TenantFuzz). One row per project — the
+-- fuzzer reads `consentToFuzz`, `tenantSafeRoutes` and `probePairs` at
+-- run time. The store-side gate prevents probePairs from being persisted
+-- unless consentToFuzz=true; the fuzzer itself re-checks consent for
+-- defense-in-depth against stale config objects.
+--
+-- `tenantSafeRoutes` and `probePairs` are JSONB columns — the route shape
+-- (method/path/body templates) and pair shape (token/resourceId/label)
+-- are validated at the SDK boundary on every read/write.
+--
+-- Idempotent (IF NOT EXISTS) — safe to re-run on environments where the
+-- table or index already exists.
+
+CREATE TABLE IF NOT EXISTS "derwin"."tenant_fuzz_configs" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "consentToFuzz" BOOLEAN NOT NULL DEFAULT false,
+    "tenantSafeRoutes" JSONB NOT NULL,
+    "probePairs" JSONB NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "updatedBy" TEXT NOT NULL,
+    CONSTRAINT "tenant_fuzz_configs_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "tenant_fuzz_configs_projectId_key"
+    ON "derwin"."tenant_fuzz_configs"("projectId");
+
+ALTER TABLE "derwin"."tenant_fuzz_configs"
+    ADD CONSTRAINT "tenant_fuzz_configs_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260508000100_sprint11_phase3_rum_samples/migration.sql

@@ -0,0 +1,31 @@
+-- Sprint 11 Phase 3 (QAP-113) — RUM / Web Vitals samples.
+--
+-- Stores consumer-pushed Real User Monitoring (RUM) samples emitted by the
+-- consumer app's web-vitals hooks. One row per (projectId, metric, capturedAt)
+-- — there is no uniqueness constraint because the same metric + URL may fire
+-- many times per session. Baseline statistics (p50/p75/p95) are derived on
+-- demand from this row set rather than maintained as a rolling aggregate.
+--
+-- Idempotent (IF NOT EXISTS) — safe to re-run on environments where the
+-- table or index already exists.
+
+CREATE TABLE IF NOT EXISTS "derwin"."rum_samples" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "metric" TEXT NOT NULL,
+    "value" DOUBLE PRECISION NOT NULL,
+    "rating" TEXT NOT NULL,
+    "url" TEXT NOT NULL,
+    "deviceType" TEXT,
+    "sessionId" TEXT,
+    "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "rum_samples_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "rum_samples_projectId_metric_capturedAt_idx"
+    ON "derwin"."rum_samples"("projectId", "metric", "capturedAt" DESC);
+
+ALTER TABLE "derwin"."rum_samples"
+    ADD CONSTRAINT "rum_samples_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260508000200_sprint11_phase5_milestone_events/migration.sql

@@ -0,0 +1,42 @@
+-- Sprint 11 Phase 5 (QAP-115) — MilestoneEvent foundation.
+--
+-- Cross-product tracking timeline data source. Backs the Tracking Timeline
+-- Gantt UI (Phase 6) plus future cross-product coherence features (e.g.,
+-- conflict alerts when a release lands inside another project's freeze
+-- window). The spec's `tenantId?` field is intentionally omitted in v1 —
+-- per the Derwin multi-tenant boundary rule (each consumer = ONE Project
+-- row), milestones are project-scoped only; if a downstream consumer ever
+-- needs intra-project tenant slicing it can be added as an optional column
+-- in a future migration without breaking the existing queries.
+--
+-- `kind` is held as a String column rather than a Prisma enum so consumers
+-- can emit custom kinds (alongside the canonical
+-- release / freeze / demo / launch) without requiring a migration. The
+-- conflict-detection helpers in `@derwinjs/core` validate the value at
+-- runtime where it matters.
+--
+-- Two indexes:
+--   - (projectId, startsAt ASC) supports the per-project chronological
+--     listing the Phase 6 Gantt issues on every read.
+--   - (projectId, kind) supports the swimlane-by-kind grouping the Gantt
+--     uses to lay out releases / freezes / demos / launches.
+
+CREATE TABLE "derwin"."milestone_events" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "startsAt" TIMESTAMP(3) NOT NULL,
+    "endsAt" TIMESTAMP(3),
+    "kind" TEXT NOT NULL,
+    "createdBy" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "milestone_events_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "milestone_events_projectId_startsAt_idx" ON "derwin"."milestone_events"("projectId", "startsAt" ASC);
+
+CREATE INDEX "milestone_events_projectId_kind_idx" ON "derwin"."milestone_events"("projectId", "kind");
+
+ALTER TABLE "derwin"."milestone_events" ADD CONSTRAINT "milestone_events_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "derwin"."projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;