@geraldmaron/construct 1.0.21 → 1.0.24

package/templates/docs/security-audit-report.md

@@ -0,0 +1,48 @@
+# Security Audit Report: {scope-title}
+
+- **Date**: {YYYY-MM-DD}
+- **Auditor**: cx-security (or named human)
+- **Scope**: {repo / module / PR / threat-model version}
+- **Threat model**: {path or "n/a"}
+- **Verdict**: SAFE | ISSUES_FOUND | BLOCKED
+- **Status**: draft | final
+
+<!--
+Think like an attacker — the attack surface the developer didn't know existed. Every claim
+cites a CVE, a code path (file:line), a known attack pattern, or a reproducible repro. A
+suspected risk you can't pinpoint is a question, not a finding.
+-->
+
+## Executive summary
+<!-- 2–4 sentences: what was audited, count of findings by severity, the single most important thing the reader needs to know. -->
+
+## Audit categories covered
+
+- [ ] Secrets (hardcoded API keys, tokens, credentials in source or config)
+- [ ] AuthN / AuthZ (bypass paths, missing checks, JWT validation gaps, privilege escalation)
+- [ ] Injection (SQL, command, LDAP, template, SSTI, prompt)
+- [ ] Data exposure (PII in logs, verbose errors, overbroad permissions)
+- [ ] Input validation (unvalidated user input reaching dangerous sinks)
+- [ ] XSS / CSRF / SSRF
+- [ ] Dependencies (known CVEs in direct dependencies)
+- [ ] Cryptography (weak algorithms, hardcoded keys, insufficient entropy)
+
+<!-- Tick boxes for what was actually examined. A category not ticked is not "passed" — it's "not audited." Say so. -->
+
+## Findings
+
+| Category | Severity | Location | Trigger | Evidence | Recommended Fix |
+|---|---|---|---|---|---|
+| {one of the 8 categories above} | critical / high / medium / low | `path/to/file.ext:NNN` | {how an attacker reaches it} | CVE-NNNN / repro / pattern | {minimum patch} |
+
+## Remediation priority
+<!-- Order the findings by what to fix first. Group critical/high together; medium/low can be backlogged with explicit acceptance. -->
+
+## Out of scope
+<!-- Audit boundaries: what the auditor did not look at, and why. Future audits may need to. -->
+
+## Handoff
+
+- code fix → `next:cx-engineer`
+- platform / infrastructure fix → `next:cx-platform-engineer`
+- review of remediation → `next:cx-reviewer`

package/templates/docs/task-packet.md

@@ -0,0 +1,49 @@
+# Task Packet: {goal}
+
+- **Dispatched**: {YYYY-MM-DD HH:MM}
+- **Source**: Construct
+- **Target specialist**: cx-{role}
+- **Track**: immediate | focused | orchestrated
+- **Status**: dispatched | accepted | done | blocked | needs-main-input
+
+<!--
+The shape emitted by Construct when dispatching to a specialist. Mirrors the
+`construct-to-orchestrator` contract in `specialists/contracts.json`. Required fields below
+are validated by the contract — a packet missing any required field BLOCKED_CONTRACTs at
+handoff. The specialist's response is one terminal state (DONE | BLOCKED | NEEDS_MAIN_INPUT),
+referencing this packet by id.
+-->
+
+## Goal
+<!-- One sentence: what success looks like, in the user's voice. Specific and falsifiable; an outcome the specialist can verify they hit. -->
+
+## Intent
+<!-- One of: research | implementation | investigation | evaluation | fix. The deterministic policy in lib/orchestration-policy.mjs:INTENT_CLASSES is the source of truth; do not invent new classes. -->
+
+## Work category
+<!-- One of: visual | deep | quick | writing | analysis. Drives the model tier. Authority: lib/orchestration-policy.mjs:WORK_CATEGORIES. -->
+
+## Risk flags
+<!-- Subset of: architecture, security, dataIntegrity, ui, docs, ai. Drives whether cx-devil-advocate joins the chain. Authority: lib/orchestration-policy.mjs:detectRiskFlags. -->
+
+## Acceptance criteria
+<!-- The conditions that, when all met, mean DONE. Each criterion is verifiable (a test, a check, an observable). Subjective criteria ("looks good") are not acceptable; restate them as observable behavior. -->
+
+| # | Criterion | Verification |
+|---|---|---|
+| 1 | {restated, falsifiable} | {test name / check / observable} |
+
+## Context
+<!-- The minimum the specialist needs to start: file paths, prior decisions, related bd ids, intake packet id, the user's exact language. Link, don't paraphrase. -->
+
+## Constraints
+<!-- Hard limits the specialist must respect: budget, timeline, contract boundaries, parts of the system that are off-limits, prior decisions that are not being revisited. -->
+
+## Handoff candidates
+<!-- Specialists this packet may legitimately route to next. Defaults read from specialists/role-manifests.json → <role>.handoffCandidates. -->
+
+## Approval gates
+<!-- If the work crosses an approval boundary (commit, push, scope change, irreversible action), name it here. Construct must surface these to the user; the specialist must not bypass. -->
+
+## Verification plan
+<!-- How DONE will be confirmed before the chain closes: test runs, doctor checks, smoke tests, manual review. The specialist proves DONE against this plan, not against a vibe. -->

package/templates/docs/verdict.md

@@ -0,0 +1,40 @@
+# Verdict: {decision-or-question}
+
+- **Date**: {YYYY-MM-DD}
+- **Author**: {specialist or named human}
+- **Trigger**: {what asked for this verdict — bd id, intake packet, dispatch event}
+- **Verdict**: APPROVE | REJECT | CONDITIONAL | INSUFFICIENT_EVIDENCE
+- **Confidence**: high | medium | low
+- **Status**: draft | final
+
+<!--
+A verdict is a structured judgment. Sources first, then assessment, then recommendation —
+in that order, so the recommendation is traceable to the evidence. A verdict without
+counter-evidence is not a verdict; it's a vote.
+-->
+
+## Context
+<!-- What is being judged, and why now. One paragraph. Link to the request (bd id, intake id, PR) and the prior verdicts that bear on it. -->
+
+## Evidence
+
+| Claim | Source | Date | Reliability |
+|---|---|---|---|
+| {one specific, falsifiable statement} | `{path / URL / commit / trace id}` | {YYYY-MM-DD} | A–F × 1–6 (Admiralty) |
+
+<!-- Separate observation from inference. "The CI run failed" is observation; "the failure means X" is inference. Label each row. -->
+
+## Counter-evidence
+<!-- The strongest disconfirming evidence. If you cannot articulate it, the verdict is INSUFFICIENT_EVIDENCE, not APPROVE. -->
+
+## Assessment
+
+- **Severity / impact**: {what is at stake if this is wrong}
+- **Confidence**: high (A1–B1 sources) / medium (B2–C2) / low (≤C3 or contested)
+- **Failure mode the verdict guards against**: {one sentence — the thing this verdict exists to prevent}
+
+## Recommendation
+<!-- The action that follows from the evidence. If CONDITIONAL, name the conditions that flip the verdict. If INSUFFICIENT_EVIDENCE, name the evidence threshold that would change it. -->
+
+## Handoff
+<!-- Where this verdict goes next. Bare `next:cx-<role>` form so it works across hosts. -->

package/db/schema/001_init.sql

@@ -1,40 +0,0 @@
-create extension if not exists vector;
-
-create table if not exists construct_documents (
-  id text primary key,
-  project text not null,
-  kind text not null,
-  title text not null,
-  summary text,
-  body text not null,
-  source_path text,
-  tags jsonb not null default '[]'::jsonb,
-  content_hash text not null,
-  updated_at timestamptz not null default now(),
-  created_at timestamptz not null default now()
-);
-
-create index if not exists construct_documents_project_kind_idx on construct_documents (project, kind);
-create index if not exists construct_documents_content_hash_idx on construct_documents (content_hash);
-
-create table if not exists construct_embeddings (
-  document_id text primary key references construct_documents(id) on delete cascade,
-  model text not null,
-  embedding double precision[] not null,
-  content_hash text not null,
-  updated_at timestamptz not null default now(),
-  created_at timestamptz not null default now()
-);
-
-create index if not exists construct_embeddings_model_idx on construct_embeddings (model);
-
-create table if not exists construct_sync_runs (
-  id bigserial primary key,
-  project text not null,
-  source text not null,
-  documents_synced integer not null default 0,
-  embeddings_synced integer not null default 0,
-  status text not null,
-  note text,
-  created_at timestamptz not null default now()
-);

package/db/schema/002_pgvector.sql

@@ -1,182 +0,0 @@
--- db/schema/002_pgvector.sql
--- Enable pgvector extension and add vector-typed columns for semantic search.
--- This migration is idempotent — safe to run multiple times.
-
--- Enable pgvector extension
-CREATE EXTENSION IF NOT EXISTS vector;
-
--- Add vector column to construct_embeddings if it doesn't exist yet
--- (The original 001_init.sql used double precision[], which we keep for backward compat)
-DO $$
-BEGIN
-  -- Check if embedding column is still array type and needs migration
-  IF EXISTS (
-    SELECT 1 FROM information_schema.columns
-    WHERE table_name = 'construct_embeddings'
-      AND column_name = 'embedding'
-      AND data_type = 'ARRAY'
-  ) THEN
-    -- Add new vector column
-    ALTER TABLE construct_embeddings ADD COLUMN embedding_vec vector(384);
-
-    -- Copy data from old array column to new vector column
-    UPDATE construct_embeddings
-      SET embedding_vec = embedding::vector(384);
-
-    -- Drop old column and rename
-    ALTER TABLE construct_embeddings DROP COLUMN embedding;
-    ALTER TABLE construct_embeddings RENAME COLUMN embedding_vec TO embedding;
-  END IF;
-END $$;
-
--- Ensure embedding column exists as vector type (for fresh installs)
-ALTER TABLE construct_embeddings
-  ALTER COLUMN embedding TYPE vector(384) USING embedding::vector(384);
-
--- Create HNSW index for fast approximate nearest neighbor search
-CREATE INDEX IF NOT EXISTS idx_embeddings_hnsw
-  ON construct_embeddings
-  USING hnsw (embedding vector_cosine_ops)
-  WITH (m = 16, ef_construction = 64);
-
--- Create observations table with vector support
-CREATE TABLE IF NOT EXISTS construct_observations (
-  id text PRIMARY KEY,
-  project text NOT NULL,
-  role text NOT NULL,
-  category text NOT NULL,
-  summary text NOT NULL,
-  content text NOT NULL,
-  tags jsonb NOT NULL DEFAULT '[]'::jsonb,
-  confidence float NOT NULL DEFAULT 0.8,
-  source text,
-  git_sha text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  embedding vector(384)
-);
-
--- Indexes for observations
-CREATE INDEX IF NOT EXISTS idx_observations_project ON construct_observations(project);
-CREATE INDEX IF NOT EXISTS idx_observations_category ON construct_observations(project, category);
-CREATE INDEX IF NOT EXISTS idx_observations_created_at ON construct_observations(project, created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_observations_vector ON construct_observations USING hnsw (embedding vector_cosine_ops);
-
--- Create sessions table with vector support
-CREATE TABLE IF NOT EXISTS construct_sessions (
-  id text PRIMARY KEY,
-  project text NOT NULL,
-  platform text,
-  summary text,
-  decisions jsonb DEFAULT '[]'::jsonb,
-  files_changed jsonb DEFAULT '[]'::jsonb,
-  open_questions jsonb DEFAULT '[]'::jsonb,
-  task_snapshot jsonb DEFAULT '[]'::jsonb,
-  status text DEFAULT 'active',
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  embedding vector(384)
-);
-
-CREATE INDEX IF NOT EXISTS idx_sessions_project ON construct_sessions(project);
-CREATE INDEX IF NOT EXISTS idx_sessions_status ON construct_sessions(project, status);
-CREATE INDEX IF NOT EXISTS idx_sessions_vector ON construct_sessions USING hnsw (embedding vector_cosine_ops);
-
--- Create entities table with vector support
-CREATE TABLE IF NOT EXISTS construct_entities (
-  name text PRIMARY KEY,
-  type text NOT NULL,
-  summary text,
-  project text,
-  observation_ids jsonb DEFAULT '[]'::jsonb,
-  related_entities jsonb DEFAULT '[]'::jsonb,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  last_seen timestamptz,
-  embedding vector(384)
-);
-
-CREATE INDEX IF NOT EXISTS idx_entities_type ON construct_entities(type);
-CREATE INDEX IF NOT EXISTS idx_entities_project ON construct_entities(project);
-CREATE INDEX IF NOT EXISTS idx_entities_vector ON construct_entities USING hnsw (embedding vector_cosine_ops);
-
--- Function for searching documents by embedding
-CREATE OR REPLACE FUNCTION search_documents(
-  project_name text,
-  query_embedding vector(384),
-  match_limit int DEFAULT 10,
-  min_similarity float DEFAULT 0.3
-)
-RETURNS TABLE(
-  id text,
-  title text,
-  summary text,
-  body text,
-  source_path text,
-  tags jsonb,
-  kind text,
-  similarity float
-) AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    d.id,
-    d.title,
-    d.summary,
-    d.body,
-    d.source_path,
-    d.tags,
-    d.kind,
-    1 - (e.embedding <=> query_embedding) AS similarity
-  FROM construct_documents d
-  JOIN construct_embeddings e ON d.id = e.document_id
-  WHERE d.project = project_name
-    AND 1 - (e.embedding <=> query_embedding) > min_similarity
-  ORDER BY e.embedding <=> query_embedding
-  LIMIT match_limit;
-END;
-$$ LANGUAGE plpgsql;
-
--- Function for searching observations by embedding
-CREATE OR REPLACE FUNCTION search_observations(
-  project_name text,
-  query_embedding vector(384),
-  match_limit int DEFAULT 10,
-  min_similarity float DEFAULT 0.3,
-  filter_role text DEFAULT NULL,
-  filter_category text DEFAULT NULL
-)
-RETURNS TABLE(
-  id text,
-  role text,
-  category text,
-  summary text,
-  content text,
-  tags jsonb,
-  confidence float,
-  source text,
-  created_at timestamptz,
-  similarity float
-) AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    o.id,
-    o.role,
-    o.category,
-    o.summary,
-    o.content,
-    o.tags,
-    o.confidence,
-    o.source,
-    o.created_at,
-    1 - (o.embedding <=> query_embedding) AS similarity
-  FROM construct_observations o
-  WHERE o.project = project_name
-    AND 1 - (o.embedding <=> query_embedding) > min_similarity
-    AND (filter_role IS NULL OR o.role = filter_role)
-    AND (filter_category IS NULL OR o.category = filter_category)
-  ORDER BY o.embedding <=> query_embedding
-  LIMIT match_limit;
-END;
-$$ LANGUAGE plpgsql;

package/db/schema/003_intake.sql

@@ -1,47 +0,0 @@
--- 003_intake.sql — R&D intake queue backing table for team and enterprise mode.
--- Solo mode uses the filesystem under .cx/intake/ instead.
---
--- Worker claim algorithm: SELECT ... FROM construct_intake_items
---   WHERE status = 'pending' ORDER BY created_at ASC FOR UPDATE SKIP LOCKED LIMIT 1;
--- then set status = 'claimed', claimed_by, claimed_at in the same transaction.
---
--- payload jsonb carries the rest of the intake packet (intake, triage,
--- suggestion, related, excerpt, query) so the on-disk shape and the
--- in-table shape stay aligned.
-
-create table if not exists construct_intake_items (
-  id text primary key,
-  project text not null,
-  tenant_id text,
-  status text not null default 'pending',
-  intake_type text,
-  rd_stage text,
-  primary_owner text,
-  recommended_action text,
-  risk text,
-  requires_approval boolean not null default false,
-  confidence double precision,
-  payload jsonb not null,
-  created_at timestamptz not null default now(),
-  updated_at timestamptz not null default now(),
-  claimed_by text,
-  claimed_at timestamptz,
-  processed_at timestamptz,
-  processed_by text,
-  notes text,
-  skipped_at timestamptz,
-  skipped_by text,
-  skip_reason text
-);
-
-create index if not exists construct_intake_items_status_idx
-  on construct_intake_items(status, created_at);
-
-create index if not exists construct_intake_items_owner_idx
-  on construct_intake_items(primary_owner, status, created_at);
-
-create index if not exists construct_intake_items_payload_gin_idx
-  on construct_intake_items using gin(payload);
-
-create index if not exists construct_intake_items_project_tenant_idx
-  on construct_intake_items(project, tenant_id, status);

package/db/schema/003_observation_reconciliation.sql

@@ -1,14 +0,0 @@
--- db/schema/003_observation_reconciliation.sql
--- Stamp each observation with the content hash and embedding model that
--- produced its vector. An idempotent reconciliation pass uses (content_hash,
--- model) to find rows whose embedding is missing or stale — content edited, or
--- the embedding model changed — and re-embed only those, rather than relying on
--- the inline write at creation time always succeeding. Mirrors the
--- (content_hash, model) tracking construct_embeddings already carries for
--- documents. Fully idempotent: safe to re-apply.
-
-ALTER TABLE construct_observations ADD COLUMN IF NOT EXISTS content_hash text;
-ALTER TABLE construct_observations ADD COLUMN IF NOT EXISTS model text;
-
-CREATE INDEX IF NOT EXISTS idx_observations_content_hash ON construct_observations (content_hash);
-CREATE INDEX IF NOT EXISTS idx_observations_model ON construct_observations (model);

package/db/schema/004_recommendations.sql

@@ -1,46 +0,0 @@
--- 004_recommendations.sql — Recommendations table for team and enterprise mode.
--- Solo mode uses the JSONL store under .cx/intake/ instead.
---
--- Dedup key is enforced at the (project, dedup_key) level — matches the in-memory
--- dedup contract in lib/embed/recommendation-store.mjs.
--- Active recommendations: dismissed_at IS NULL AND superseded_at IS NULL.
-
-create table if not exists construct_recommendations (
-  id text primary key,
-  project text not null,
-  dedup_key text not null,
-  type text not null,
-  title text not null,
-  reason text,
-  lane text,
-  signal_count int not null default 1,
-  total_signal_count int not null default 1,
-  customer_impact int not null default 0,
-  recency_bonus int not null default 0,
-  strategic_bonus int not null default 0,
-  score float not null default 0,
-  priority text not null default 'P3',
-  source_signal_ids jsonb not null default '[]'::jsonb,
-  first_seen timestamptz not null default now(),
-  last_seen timestamptz not null default now(),
-  dismissed_at timestamptz,
-  dismiss_reason text,
-  superseded_at timestamptz,
-  superseded_by_id text,
-  suppressed_until timestamptz,
-  suppress_reason text,
-  updated_at timestamptz not null default now()
-);
-
-create unique index if not exists construct_recommendations_project_dedup_key_idx
-  on construct_recommendations (project, dedup_key);
-
-create index if not exists construct_recommendations_priority_score_idx
-  on construct_recommendations (project, priority, score desc);
-
-create index if not exists construct_recommendations_last_seen_idx
-  on construct_recommendations (project, last_seen desc);
-
-create index if not exists construct_recommendations_active_idx
-  on construct_recommendations (project, dismissed_at)
-  where dismissed_at is null;

package/db/schema/005_strategy.sql

@@ -1,21 +0,0 @@
--- 005_strategy.sql — Product strategy store for team and enterprise mode.
--- Solo mode uses ~/.cx/strategy.md instead.
---
--- Each row is an immutable version snapshot. The latest version for a project
--- is the row with the highest version number (or max updated_at when equal).
--- Callers insert a new row on each write; old versions are retained for history.
-
-create table if not exists construct_strategy (
-  id bigserial primary key,
-  project text not null,
-  content text not null,
-  version int not null default 1,
-  updated_at timestamptz not null default now(),
-  updated_by text
-);
-
-create unique index if not exists construct_strategy_project_version_idx
-  on construct_strategy (project, version);
-
-create index if not exists construct_strategy_project_updated_at_idx
-  on construct_strategy (project, updated_at desc);

package/db/schema/006_graph.sql

@@ -1,24 +0,0 @@
--- 006_graph.sql. GraphRAG community columns for entities.
---
--- Phase C9 foundations. Adds community_id (label propagation output) and a
--- community summary table so the Pg-backed deployment can query communities
--- without a JSONL scan. Solo-mode JSONL remains the source of truth; this
--- table is the projection.
-
-ALTER TABLE construct_entities
-  ADD COLUMN IF NOT EXISTS community_id text,
-  ADD COLUMN IF NOT EXISTS community_size int;
-
-CREATE INDEX IF NOT EXISTS idx_entities_community ON construct_entities(project, community_id);
-
-CREATE TABLE IF NOT EXISTS construct_entity_communities (
-  community_id text NOT NULL,
-  project text NOT NULL,
-  size int NOT NULL DEFAULT 0,
-  top_members jsonb DEFAULT '[]'::jsonb,
-  summary text,
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (project, community_id)
-);
-
-CREATE INDEX IF NOT EXISTS idx_communities_size ON construct_entity_communities(project, size DESC);

package/db/schema/007_tags.sql

@@ -1,30 +0,0 @@
--- Tag attribution and migration tracking for construct_documents.
--- The construct_documents.tags JSONB column already exists in 001_init.sql.
--- This migration adds GIN indexing, attribution history, and migration audit.
-
-create index if not exists construct_documents_tags_gin_idx
-  on construct_documents using gin (tags jsonb_path_ops);
-
-create table if not exists construct_tag_attribution (
-  document_id text not null references construct_documents(id) on delete cascade,
-  tag text not null,
-  source text not null,  -- 'agent:classifier' | 'user' | 'curator'
-  confidence numeric,
-  applied_at timestamptz not null default now(),
-  migrated_from text,
-  primary key (document_id, tag, source)
-);
-create index if not exists construct_tag_attribution_tag_idx on construct_tag_attribution (tag);
-
-create table if not exists construct_tag_migrations (
-  id text primary key,
-  from_tag text not null,
-  to_tag text,
-  executed_at timestamptz not null default now(),
-  executed_by text not null,
-  reason text not null,
-  doc_count_before integer not null,
-  doc_count_after integer,
-  reversible boolean not null default true,
-  rolled_back_at timestamptz
-);

package/db/schema/008_skill_usage.sql

@@ -1,24 +0,0 @@
--- db/schema/008_skill_usage.sql — Per-skill invocation log.
---
--- Backs `construct skills usage/orphans/hot`.  The local
--- JSONL path (~/.cx/skill-calls.jsonl) is primary in solo mode; this table is
--- primary in team/enterprise mode.  One-time backfill via
--- `construct skills backfill-postgres`.
-
-create table if not exists construct_skill_invocations (
-  id           bigserial    primary key,
-  ts           timestamptz  not null,
-  skill_id     text         not null,
-  source       text         not null,  -- 'mcp' | 'role-preload' | 'prompt-composer' | …
-  agent_id     text,
-  session_id   text,
-  caller_context text,
-  latency_ms   integer,
-  tokens_returned integer
-);
-
-create index if not exists construct_skill_invocations_skill_ts_idx
-  on construct_skill_invocations (skill_id, ts desc);
-
-create index if not exists construct_skill_invocations_session_idx
-  on construct_skill_invocations (session_id);

package/db/schema/009_scheduler.sql

@@ -1,14 +0,0 @@
--- Scheduler job state for team and enterprise deployment modes.
--- Solo mode uses native trigger files instead of this table.
--- The lock_holder column stores a short identifier for the process/host
--- that currently holds the advisory lock for a running job.
-
-create table if not exists construct_scheduled_jobs (
-  id text primary key,
-  schedule text not null,
-  last_run_at timestamptz,
-  last_run_status text,
-  lock_holder text,
-  lock_acquired_at timestamptz,
-  created_at timestamptz not null default now()
-);

package/db/schema/010_cx_scores.sql

@@ -1,51 +0,0 @@
--- db/schema/010_cx_scores.sql — Per-trace quality score log + skill quality correlation view.
---
--- Backs `construct skills correlate-quality`.  Producer: lib/mcp/tools/telemetry.mjs
--- cxScore() writes a row here when CONSTRUCT_DB_URL (or DATABASE_URL) is set.
--- Local JSONL/observation paths remain primary in solo mode; this table is
--- primary in team/enterprise mode where multiple agents share a session
--- timeline and the dashboard reads aggregate correlations.
-
-create table if not exists construct_cx_scores (
-  id           bigserial    primary key,
-  ts           timestamptz  not null,
-  trace_id     text         not null,
-  session_id   text,
-  agent_id     text,
-  name         text         not null default 'quality',
-  value        numeric      not null,
-  comment      text
-);
-
-create index if not exists construct_cx_scores_trace_idx
-  on construct_cx_scores (trace_id);
-
-create index if not exists construct_cx_scores_session_ts_idx
-  on construct_cx_scores (session_id, ts desc);
-
-create index if not exists construct_cx_scores_agent_ts_idx
-  on construct_cx_scores (agent_id, ts desc);
-
--- Skill quality correlation view: joins skill invocations and quality
--- scores by session_id so a reader can ask "for sessions where skill X was
--- invoked, what's the median / mean / p10 quality score?" The view is a
--- simple aggregate over the past 90 days; queries that need a longer
--- window can pull straight from the underlying tables. Materialised view
--- not used here because the correlation surface is small and the freshness
--- expectation is "current session" not "yesterday's batch."
-
-create or replace view construct_skill_quality_correlation as
-select
-  inv.skill_id,
-  count(distinct inv.session_id)                            as sessions,
-  count(distinct sc.id)                                     as score_count,
-  round(avg(sc.value)::numeric, 3)                          as mean_score,
-  round((percentile_cont(0.5) within group (order by sc.value))::numeric, 3)  as median_score,
-  round((percentile_cont(0.10) within group (order by sc.value))::numeric, 3) as p10_score,
-  round((percentile_cont(0.90) within group (order by sc.value))::numeric, 3) as p90_score,
-  max(sc.ts)                                                as last_scored_at
-from construct_skill_invocations inv
-  inner join construct_cx_scores sc on sc.session_id = inv.session_id
-where inv.ts > now() - interval '90 days'
-  and sc.ts  > now() - interval '90 days'
-group by inv.skill_id;