@konneal/engine 0.1.0

package/workers/worker_internal/src/index.ts

@@ -0,0 +1,157 @@
+// worker_internal: federated OIML + ISO/IEC retrieval provider for members.
+// Structural isolation per CLAUDE.md — the PUBLIC worker holds no binding
+// to the internal index; this worker holds both and gates by session.
+// Retrieval-only by design (SSOT): the full serving pipeline — query
+// understanding, fusion, reranking, grading, generation — lives in
+// worker_public; this worker answers /retrieve with ranked passages.
+
+import { sessionFrom } from "../../shared/auth";
+import { embed } from "../../shared/ai";
+import { toHits } from "../../shared/chunk";
+import { matchRoute, type RouteContext, type Route } from "../../shared/router";
+import type { Hit } from "../../shared/chunk";
+
+export type { ChunkMeta, Hit };
+
+export interface Env {
+  AI: any;
+  PUBLIC: any; // idx_oiml_public_v2
+  INTERNAL: any; // idx_iso_internal
+  CACHE: KVNamespace;
+  SESSION_SECRET: string;
+  INDEX_VERSION: string;
+  ADMIN_TOKEN?: string;
+}
+
+const RRF_K = 60;
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "access-control-allow-origin": "*" } });
+
+const err = (status: number, code: string, message: string) =>
+  json({ error: { code, message } }, status);
+
+/** Query both indexes and RRF-fuse the rankings; internal (ISO/IEC) hits
+ *  carry a slight weight so members see them when both corpora match. */
+async function federate(env: Env, query: string, topK = 20): Promise<Hit[]> {
+  const vector = await embed(env.AI, query);
+  const [pubRes, intRes] = await Promise.all([
+    env.PUBLIC.query(vector, { topK, returnMetadata: "all" }),
+    env.INTERNAL.query(vector, { topK: Math.min(topK, 10), returnMetadata: "all" }),
+  ]);
+  const scores = new Map<string, number>();
+  const byId = new Map<string, Hit>();
+  // weighted RRF: the internal corpus outranks the public corpus on
+  // tie (federation emphasis — deliberately NOT the shared unweighted
+  // fuse; this worker's only job is the merged internal-first ranking)
+  const rankings: [Hit[], number][] = [
+    [toHits(pubRes.matches ?? []), 1.0],
+    [toHits(intRes.matches ?? []), 1.2],
+  ];
+  for (const [ranking, weight] of rankings) {
+    ranking.forEach((h, i) => {
+      const s = weight / (RRF_K + i + 1);
+      scores.set(h.id, (scores.get(h.id) ?? 0) + s);
+      byId.set(h.id, h);
+    });
+  }
+  return [...scores.entries()]
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, 15)
+    .map(([id]) => byId.get(id)!)
+    .filter(Boolean);
+}
+
+async function healthRoute(c: RouteContext): Promise<Response> {
+  return json({ ok: true, service: "rag-internal", index_version: c.env.INDEX_VERSION });
+}
+
+// Index sync through the Vectorize/AI bindings — used by the ingest
+// pipeline when no REST API token is provisioned. Guarded by the
+// ADMIN_TOKEN secret; batches stay small enough for one request.
+async function adminSyncRoute(c: RouteContext): Promise<Response> {
+  const { env, req } = c;
+  if (!env.ADMIN_TOKEN || req.headers.get("x-admin-token") !== env.ADMIN_TOKEN) {
+    return err(401, "unauthorized", "admin token required");
+  }
+  let body: any;
+  try {
+    body = await req.json();
+  } catch {
+    return err(400, "invalid_input", "JSON body required");
+  }
+  const out = { upserted: 0, deleted: 0, embedded: 0 };
+  try {
+    if (Array.isArray(body?.upserts)) {
+      for (let i = 0; i < body.upserts.length; i += 100) {
+        const batch = body.upserts.slice(i, i + 100).filter((v: any) => v?.id && Array.isArray(v?.values) && v?.metadata);
+        if (batch.length) await env.PUBLIC.upsert(batch);
+        out.upserted += batch.length;
+      }
+    }
+    if (Array.isArray(body?.embedUpserts)) {
+      const todo = body.embedUpserts.filter((v: any) => v?.id && typeof v?.text === "string" && v?.metadata);
+      for (let i = 0; i < todo.length; i += 16) {
+        const batch = todo.slice(i, i + 16);
+        const vectors = await Promise.all(batch.map((b: any) => embed(env.AI, b.text.slice(0, 6000))));
+        await env.PUBLIC.upsert(batch.map((b: any, j: number) => ({ id: b.id, values: vectors[j], metadata: b.metadata })));
+        out.embedded += batch.length;
+      }
+    }
+    if (Array.isArray(body?.deletes)) {
+      const ids = body.deletes.filter((x: any) => typeof x === "string");
+      for (let i = 0; i < ids.length; i += 100) {
+        await env.PUBLIC.deleteByIds(ids.slice(i, i + 100));
+        out.deleted += Math.min(100, ids.length - i);
+      }
+    }
+    return json(out);
+  } catch (e: any) {
+    return err(502, "sync_failed", e?.message ?? "vectorize operation failed");
+  }
+}
+
+async function retrieveRoute(c: RouteContext): Promise<Response> {
+  const session = await sessionFrom(c.req, c.env as any);
+  if (!session) return err(401, "unauthorized", "Sign in required — this endpoint federates the OIML + ISO/IEC corpora.");
+  let body: any;
+  try {
+    body = await c.req.json();
+  } catch {
+    return err(400, "invalid_input", "JSON body required");
+  }
+  const query = typeof body?.query === "string" ? body.query.trim() : "";
+  if (!query || query.length > 1200) return err(400, "invalid_input", "query (1-1200 chars) required");
+  try {
+    const hits = await federate(c.env, query);
+    return json({
+      hits: hits.map((h) => ({
+        id: h.id,
+        score: h.score,
+        metadata: { ...h.metadata, chunk_text: undefined },
+        text: h.text,
+      })),
+    });
+  } catch {
+    return err(503, "retrieval_unavailable", "Federated retrieval is briefly busy.");
+  }
+}
+
+// the same declarative route table the public worker dispatches through
+// (TODO.impl/31) — one HTTP idiom across workers.
+const ROUTES: Route[] = [
+  { method: "GET", pattern: "/health", handler: healthRoute },
+  { method: "POST", pattern: "/admin/sync", handler: adminSyncRoute },
+  { method: "POST", pattern: "/retrieve", handler: retrieveRoute },
+  { method: "POST", pattern: "/api/retrieve", handler: retrieveRoute },
+];
+
+export default {
+  async fetch(req: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const matched = matchRoute(ROUTES, req.method, new URL(req.url).pathname);
+    if (matched) {
+      return matched.route.handler({ env, req, ctx, url: new URL(req.url), path: new URL(req.url).pathname, params: matched.params });
+    }
+    return err(404, "not_found", "Unknown route");
+  },
+};

package/workers/worker_internal/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "types": ["@cloudflare/workers-types"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*.ts"]
+}

package/workers/worker_internal/wrangler.toml

@@ -0,0 +1,32 @@
+name = "rag-internal"
+main = "src/index.ts"
+compatibility_date = "2024-09-23"
+account_id = "06cad8ae9a017c856ab496c6bca9a9d8"
+
+[observability]
+enabled = true
+
+[[vectorize]]
+binding = "PUBLIC"
+index_name = "idx_oiml_public_v2"
+
+[[vectorize]]
+binding = "INTERNAL"
+index_name = "idx_iso_internal"
+
+[ai]
+binding = "AI"
+
+[[kv_namespaces]]
+id = "0f65d12cc77c41b5b91086de1c04f6da"
+binding = "CACHE"
+
+[vars]
+INDEX_VERSION = "internal-v2-retrieve-only"
+SESSION_SECRET_SET = "true"
+
+# deploy on internal.oimlsmart.org (custom domain)
+routes = [
+  { pattern = "internal.oimlsmart.org", custom_domain = true }
+]
+workers_dev = true

package/workers/worker_mcp/src/index.ts

@@ -0,0 +1,175 @@
+// MCP server (streamable HTTP transport) exposing the OIML public corpus
+// to MCP clients: tools oiml_search and oiml_ask, proxied to the rag-public
+// API. Audience isolation stays enforced in rag-public (this worker holds
+// no index bindings and no secrets beyond an optional API key).
+//
+// Protocol: JSON-RPC 2.0 over POST /mcp (Streamable HTTP). Stateless
+// server — each request is answered in one JSON response; no sessions.
+// https://modelcontextprotocol.io spec (2025-06 streamable HTTP).
+
+export interface Env {
+  RAG_BASE: string;
+  RAG_API_KEY?: string;
+  /** read-only access to the derived documents registry (public OIML
+   *  metadata: editions, active flags, supersession) */
+  DB: D1Database;
+}
+
+const PROTOCOL_VERSION = "2025-06-18";
+
+const json = (body: unknown, status = 200, extra: Record<string, string> = {}) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...extra },
+  });
+
+const rpcResult = (id: unknown, result: unknown) => json({ jsonrpc: "2.0", id, result });
+const rpcError = (id: unknown, code: number, message: string) =>
+  json({ jsonrpc: "2.0", id, error: { code, message } });
+
+const TOOLS = [
+  {
+    name: "oiml_search",
+    description:
+      "Search the OIML publications corpus (legal metrology: Recommendations R, Documents D, Basic publications B, Guides G). Returns ranked passages with publication identifier, edition, clause and snippet.",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        query: { type: "string", description: "Natural-language search query" },
+        top_k: { type: "integer", description: "Number of passages (default 5, max 10)", default: 5 },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "oiml_documents",
+    description:
+      "Look up the publication registry for an OIML family: every edition with its derived status (in-force/superseded), which edition is ACTIVE (terminal of the successor chain), and supersession links. Use for 'current/latest edition' and edition-history questions.",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        family: { type: "string", description: "Family key, e.g. 'R-60' (series letter-number)" },
+      },
+      required: ["family"],
+    },
+  },
+  {
+    name: "oiml_ask",
+    description:
+      "Ask a question about OIML publications and get a grounded, citation-linked answer. Every claim cites the exact publication and clause it comes from.",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        query: { type: "string", description: "The question" },
+        fresh: { type: "boolean", description: "Skip the answer cache and regenerate from the live corpus (default false)" },
+      },
+      required: ["query"],
+    },
+  },
+];
+
+async function rag(env: Env, path: string, body: Record<string, unknown>): Promise<any> {
+  const res = await fetch(`${env.RAG_BASE}${path}`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...(env.RAG_API_KEY ? { authorization: `Bearer ${env.RAG_API_KEY}` } : {}),
+    },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) throw new Error(`rag-public ${path} → ${res.status}`);
+  return res.json();
+}
+
+function searchResultText(r: any): string {
+  const anchor = r.clause_anchor && r.clause_anchor !== "overview" ? ` §${r.clause_anchor}` : "";
+  return `${r.docidentifier ?? r.doc_id}${r.edition ? ":" + r.edition : ""}${anchor}${r.clause_title ? " — " + r.clause_title : ""}\n${r.snippet ?? ""}`;
+}
+
+async function callTool(env: Env, name: string, args: any): Promise<{ content: Array<{ type: string; text: string }> }> {
+  if (name === "oiml_search") {
+    const query = String(args?.query ?? "").slice(0, 2000);
+    if (!query) throw new Error("query is required");
+    const data = await rag(env, "/api/search", { query, top_k: Math.min(10, Math.max(1, Number(args?.top_k) || 5)) });
+    const text = (data.results ?? []).map(searchResultText).join("\n\n") || "No passages matched.";
+    return { content: [{ type: "text", text }] };
+  }
+  if (name === "oiml_documents") {
+    const family = String(args?.family ?? "").trim().slice(0, 20);
+    if (!/^[A-Z]-\d{1,3}$/i.test(family)) throw new Error("family must look like 'R-60'");
+    const rows = await env.DB.prepare(
+      "SELECT d.docidentifier, d.derived_status, d.active, s.docidentifier AS succ FROM documents d LEFT JOIN documents s ON d.superseded_by = s.canonical_id WHERE d.family = ?1 ORDER BY d.part, d.edition",
+    )
+      .bind(family.toUpperCase())
+      .all();
+    const lines = (rows.results ?? []).map(
+      (r: any) => `${r.docidentifier} — ${r.derived_status}${r.active ? " [ACTIVE]" : ""}${r.succ ? ` → superseded by ${r.succ}` : ""}`,
+    );
+    return { content: [{ type: "text", text: lines.join("\n") || `No editions found for ${family}` }] };
+  }
+  if (name === "oiml_ask") {
+    const query = String(args?.query ?? "").slice(0, 2000);
+    if (!query) throw new Error("query is required");
+    const data = await rag(env, "/api/ask", { query, stream: false, ...(args?.fresh ? { fresh: true } : {}) });
+    const cites = (data.citations ?? [])
+      .map((c: any) => `${c.docidentifier}${c.clause_anchor ? " §" + c.clause_anchor : ""}`)
+      .join(", ");
+    const text = `${data.answer ?? ""}${cites ? `\n\nSources: ${cites}` : ""}`;
+    return { content: [{ type: "text", text }] };
+  }
+  throw new Error(`Unknown tool: ${name}`);
+}
+
+export default {
+  async fetch(req: Request, env: Env): Promise<Response> {
+    const url = new URL(req.url);
+
+    if (req.method === "GET" && url.pathname === "/") {
+      return json({
+        server: "rag-mcp",
+        transport: "streamable-http",
+        endpoint: "/mcp",
+        tools: TOOLS.map((t) => t.name),
+      });
+    }
+
+    if (url.pathname !== "/mcp") return json({ error: "not_found" }, 404);
+    if (req.method !== "POST") return json({ error: "method_not_allowed — POST JSON-RPC to /mcp" }, 405);
+
+    let msg: any;
+    try {
+      msg = await req.json();
+    } catch {
+      return rpcError(null, -32700, "Parse error");
+    }
+
+    // notification (no id) — acknowledge with 202, nothing to say
+    if (msg?.id === undefined || msg?.id === null) return new Response(null, { status: 202 });
+
+    try {
+      switch (msg.method) {
+        case "initialize":
+          return rpcResult(msg.id, {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: { tools: {} },
+            serverInfo: { name: "rag-mcp", version: "1.0.0", title: "OIML SMART AI — public corpus" },
+          });
+        case "tools/list":
+          return rpcResult(msg.id, { tools: TOOLS });
+        case "tools/call": {
+          const out = await callTool(env, String(msg.params?.name ?? ""), msg.params?.arguments ?? {});
+          return rpcResult(msg.id, out);
+        }
+        case "ping":
+          return rpcResult(msg.id, {});
+        default:
+          return rpcError(msg.id, -32601, `Method not found: ${msg.method}`);
+      }
+    } catch (e: any) {
+      return rpcResult(msg.id, {
+        content: [{ type: "text", text: `Error: ${String(e?.message ?? e)}` }],
+        isError: true,
+      });
+    }
+  },
+};

package/workers/worker_mcp/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "types": ["@cloudflare/workers-types"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}

package/workers/worker_mcp/wrangler.toml

@@ -0,0 +1,18 @@
+name = "rag-mcp"
+main = "src/index.ts"
+compatibility_date = "2026-08-01"
+workers_dev = true
+
+# MCP server (audience: public). Proxies retrieval/answering to the
+# rag-public worker over the public API — no direct index bindings here,
+# so corpus isolation stays enforced in ONE place.
+[vars]
+RAG_BASE = "https://ai.oimlsmart.org"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "rag-public"
+database_id = "655cd63f-1826-4161-bfd1-90c584add4ce"
+
+[observability]
+enabled = true

package/workers/worker_public/migrations/0002_conversations.sql

@@ -0,0 +1,22 @@
+-- Conversations for signed-in members (TODO.impl/15). Anonymous history
+-- is device-local by design; the server stores member conversations only.
+CREATE TABLE IF NOT EXISTS conversations (
+  id TEXT PRIMARY KEY,
+  sub TEXT NOT NULL,
+  title TEXT NOT NULL DEFAULT '',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_conversations_sub ON conversations(sub, updated_at DESC);
+
+CREATE TABLE IF NOT EXISTS messages (
+  id TEXT PRIMARY KEY,
+  conversation_id TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN ('user','assistant')),
+  content TEXT NOT NULL,
+  citations TEXT,
+  model TEXT,
+  created_at TEXT NOT NULL,
+  FOREIGN KEY (conversation_id) REFERENCES conversations(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_messages_conv ON messages(conversation_id, created_at);

package/workers/worker_public/migrations/0003_shared_conversations.sql

@@ -0,0 +1,9 @@
+-- Public read-only shared conversations (TODO.rag/09)
+CREATE TABLE IF NOT EXISTS shared_conversations (
+  slug TEXT PRIMARY KEY,
+  owner_sub TEXT NOT NULL,
+  title TEXT NOT NULL DEFAULT '',
+  messages TEXT NOT NULL,  -- JSON array of {role, content, citations}
+  created_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_shared_owner ON shared_conversations(owner_sub);

package/workers/worker_public/migrations/0004_graph.sql

@@ -0,0 +1,16 @@
+-- Graph projection (Stage 6 of the SOTA specs): structural edges from
+-- relaton-data-oiml + concept nodes from the Glossarist vocab datasets.
+-- Populated by ingest/graph.py; read by the retrieval graph lane.
+CREATE TABLE IF NOT EXISTS graph_nodes (
+  id TEXT PRIMARY KEY,          -- doc:OIML-R-60-1-2017 | family:R-60 | concept:<id>
+  kind TEXT NOT NULL,           -- doc | family | concept
+  label TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS graph_edges (
+  src TEXT NOT NULL,
+  dst TEXT NOT NULL,
+  kind TEXT NOT NULL,           -- part_of | variant_of | successor | amends | defines
+  PRIMARY KEY (src, dst, kind)
+);
+CREATE INDEX IF NOT EXISTS idx_graph_edges_src ON graph_edges(src);
+CREATE INDEX IF NOT EXISTS idx_graph_edges_dst ON graph_edges(dst);

package/workers/worker_public/migrations/0005_documents.sql

@@ -0,0 +1,19 @@
+-- Document identity registry (Stage 1 of the SOTA specs): the SSOT for
+-- edition status. Status is DERIVED, not copied: relaton's status field
+-- is inconsistent (records claim in-force while carrying successors) —
+-- an edition with a successor is superseded regardless; the ACTIVE
+-- edition of a family+part is the terminal node of its successor chain
+-- (no successor, max edition).
+CREATE TABLE IF NOT EXISTS documents (
+  canonical_id TEXT PRIMARY KEY,   -- doc:OIML-R-60-2021
+  docidentifier TEXT NOT NULL,     -- OIML R 60:2021
+  family TEXT NOT NULL,            -- R-60
+  part TEXT,                       -- 1 | 2 | 3 | A | annexes | sup | NULL
+  edition TEXT NOT NULL,           -- 2021
+  status TEXT NOT NULL,            -- in-force | superseded | withdrawn
+  derived_status TEXT NOT NULL,    -- successor-edge derivation result
+  active INTEGER NOT NULL,         -- 1 = the active edition of family+part
+  superseded_by TEXT,              -- canonical_id of the successor
+  title TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_documents_family ON documents(family, part, active);

package/workers/worker_public/migrations/0006_conversation_entities.sql

@@ -0,0 +1,11 @@
+-- Cross-turn entity memory (G5): resolved entities per conversation so
+-- pronouns/ellipsis in follow-ups resolve O(1) instead of re-deriving
+-- from raw history text every turn.
+CREATE TABLE IF NOT EXISTS conversation_entities (
+  conversation_id TEXT NOT NULL,
+  entity TEXT NOT NULL,          -- display form, e.g. "OIML R 60-1:2021"
+  kind TEXT NOT NULL,            -- document | term
+  ts INTEGER NOT NULL,
+  PRIMARY KEY (conversation_id, entity)
+);
+CREATE INDEX IF NOT EXISTS idx_conv_entities ON conversation_entities(conversation_id);

package/workers/worker_public/migrations/0007_chunks_fts.sql

@@ -0,0 +1,43 @@
+-- G-ETSI-1: full-corpus lexical index for BM25 prefilter (arXiv:2604.09868 §II-B5).
+-- Dense-only Vectorize cannot recover exact-jargon misses; FTS5 is the
+-- corpus-wide sparse stage that feeds RRF alongside dense top-K.
+
+CREATE TABLE IF NOT EXISTS chunks (
+  id TEXT PRIMARY KEY,
+  doc_id TEXT NOT NULL,
+  docidentifier TEXT,
+  doctype TEXT,
+  doc_number TEXT,
+  edition TEXT,
+  language TEXT,
+  clause_anchor TEXT,
+  clause_title TEXT,
+  status TEXT,
+  superseded_by TEXT,
+  corpus TEXT,
+  tier TEXT,
+  -- original body for Hit assembly when dense didn't return this id
+  text TEXT NOT NULL,
+  -- context preamble + body (Anthropic contextual BM25); what FTS indexes
+  fts_text TEXT NOT NULL
+);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS chunks_fts USING fts5(
+  fts_text,
+  content='chunks',
+  content_rowid='rowid',
+  tokenize = 'porter unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS chunks_ai AFTER INSERT ON chunks BEGIN
+  INSERT INTO chunks_fts(rowid, fts_text) VALUES (new.rowid, new.fts_text);
+END;
+CREATE TRIGGER IF NOT EXISTS chunks_ad AFTER DELETE ON chunks BEGIN
+  INSERT INTO chunks_fts(chunks_fts, rowid, fts_text) VALUES ('delete', old.rowid, old.fts_text);
+END;
+CREATE TRIGGER IF NOT EXISTS chunks_au AFTER UPDATE ON chunks BEGIN
+  INSERT INTO chunks_fts(chunks_fts, rowid, fts_text) VALUES ('delete', old.rowid, old.fts_text);
+  INSERT INTO chunks_fts(rowid, fts_text) VALUES (new.rowid, new.fts_text);
+END;
+
+CREATE INDEX IF NOT EXISTS idx_chunks_doc_number ON chunks(doc_number);

package/workers/worker_public/migrations/0008_unit_payloads.sql

@@ -0,0 +1,15 @@
+-- Answer contract v2: typed unit payloads for block rendering.
+-- Served blocks NEVER pass through the LLM — the model emits [[u:<id>]]
+-- references; the worker resolves them here and validates against the
+-- passages actually used (producer payloads, ingest-validated).
+
+CREATE TABLE IF NOT EXISTS unit_payloads (
+  unit_id TEXT PRIMARY KEY,
+  doc_id TEXT NOT NULL,
+  docidentifier TEXT,
+  edition TEXT,
+  clause_anchor TEXT,
+  type TEXT NOT NULL,          -- table | formula | figure | term | requirement
+  payload TEXT NOT NULL        -- the MN 116 typed payload, JSON-encoded
+);
+CREATE INDEX IF NOT EXISTS idx_unit_payloads_doc ON unit_payloads(doc_id);

package/workers/worker_public/migrations/0009_chunks_unit.sql

@@ -0,0 +1,8 @@
+-- Contract v2 over the lexical lane: typed chunks (tables, figures,
+-- formulas, terms) must carry their unit identity through BM25 too —
+-- without these columns, a typed chunk arriving via FTS cannot be
+-- referenced [[u:…]], pinned for doc-scoped queries, or protected by
+-- the retyping check (Vectorize metadata already carries them; D1 did not).
+
+ALTER TABLE chunks ADD COLUMN unit_id TEXT;
+ALTER TABLE chunks ADD COLUMN block TEXT;

package/workers/worker_public/migrations/0009_message_context.sql

@@ -0,0 +1,7 @@
+-- The per-answer context mark (TODO.ai-platform/02): the transcript marks
+-- the context each answer was grounded in (the panel's declared chip as
+-- the service APPLIED it — the context_applied echo), so a resumed
+-- conversation keeps its honest context lines. NULL means the answer
+-- carries no recorded context (pre-chips history included) — the panel
+-- renders no context line for those rather than guessing one.
+ALTER TABLE messages ADD COLUMN context_applied TEXT;

package/workers/worker_public/migrations/0010_model_nodes.sql

@@ -0,0 +1,33 @@
+-- The model plane (TODO.ai-platform/05): the SMART Recommendation MODELS
+-- join the retrieval — the packages' machine content (the requirements'
+-- constraints, the applicability rules, the acceptance criteria, the
+-- conformance tests, the term definitions, the subject constraints, the
+-- characteristics, the state machines) indexed alongside the prose corpus.
+-- The content DERIVES from the primmel packages (the SSOT) via the smart
+-- repo's model-plane bundles (browser/public/data/model-plane/*.json,
+-- byte-clean-guarded there); the per-standard source_hash pins WHAT the
+-- index derived from — a package change moves the hash and the freshness
+-- gate (ingest model-plane --check) refuses to call the index current
+-- until a re-index lands.
+
+CREATE TABLE IF NOT EXISTS model_nodes (
+  standard     TEXT NOT NULL,        -- oiml-r60
+  node_id      TEXT NOT NULL,        -- /req/metrological/mpe
+  kind         TEXT NOT NULL,        -- requirement | conformance_test | term | constraint | characteristic | state_machine | dimension
+  name         TEXT,
+  clause_doc   TEXT,                 -- urn:oiml:pub:r:60-1:2021 (the provenance's document)
+  clause_ref   TEXT,                 -- 5.3.2 (the clause inside it)
+  content      TEXT NOT NULL,        -- the node's JSON (the bundle projection, verbatim)
+  content_hash TEXT NOT NULL,        -- sha256 of content (drift forensics)
+  PRIMARY KEY (standard, node_id)
+);
+CREATE INDEX IF NOT EXISTS idx_model_nodes_kind ON model_nodes(kind);
+
+CREATE TABLE IF NOT EXISTS model_plane_meta (
+  standard    TEXT PRIMARY KEY,
+  package     TEXT NOT NULL,         -- oiml-r60 (the primmel package)
+  plane       TEXT NOT NULL,         -- the bundle shape version (model-plane/1)
+  source_hash TEXT NOT NULL,         -- the package content hash the index derived from
+  node_count  INTEGER NOT NULL,
+  indexed_at  TEXT NOT NULL          -- when the index landed (operational truth)
+);

package/workers/worker_public/migrations/0011_schema_union.sql

@@ -0,0 +1,38 @@
+-- Schema union (TODO.impl/18): the bootstrap-only tables, so the
+-- migrations-only path (fresh env, d1 migrations apply) yields the SAME
+-- database as schema.sql. IF NOT EXISTS — a no-op where schema.sql ran.
+CREATE TABLE IF NOT EXISTS api_keys (
+  id         TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  key_hash   TEXT NOT NULL UNIQUE,
+  day_limit  INTEGER NOT NULL DEFAULT 2000,
+  created_at TEXT NOT NULL,
+  revoked    INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS queries (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts           TEXT NOT NULL,
+  day          TEXT NOT NULL,
+  tier         TEXT NOT NULL,
+  route        TEXT,
+  model        TEXT,
+  ok           INTEGER,
+  answer_chars INTEGER,
+  query_hash   TEXT,
+  lang         TEXT
+);
+
+CREATE TABLE IF NOT EXISTS spend (
+  day      TEXT NOT NULL,
+  tier     TEXT NOT NULL,
+  model    TEXT NOT NULL,
+  requests INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (day, tier, model)
+);
+
+CREATE TABLE IF NOT EXISTS feedback (
+  query_hash TEXT NOT NULL,
+  rating     INTEGER NOT NULL,
+  ts         TEXT NOT NULL
+);

package/workers/worker_public/migrations/0012_memories.sql

@@ -0,0 +1,15 @@
+-- Personalized memory files (#171): per-member context documents the
+-- ask path injects when the user selects them (their own stated facts —
+-- lab setup, preferred units, instrument inventory). Member-scoped;
+-- content is user-authored, never corpus. Selection rides each ask
+-- (body.memories) and salts the answer cache (answercache contract).
+CREATE TABLE IF NOT EXISTS memories (
+  id TEXT PRIMARY KEY,
+  sub TEXT NOT NULL,
+  name TEXT NOT NULL,
+  content TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_memories_sub ON memories(sub, updated_at);