create-safest-tools 0.2.0

package/template/migrations/0001_reports_foundation.sql

@@ -0,0 +1,444 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE installations (
+  id TEXT PRIMARY KEY,
+  display_name TEXT NOT NULL,
+  default_locale TEXT NOT NULL DEFAULT 'en',
+  anonymous_reporting_enabled INTEGER NOT NULL DEFAULT 0 CHECK (anonymous_reporting_enabled IN (0, 1)),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE application_integrations (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  name TEXT NOT NULL,
+  key_id TEXT NOT NULL UNIQUE,
+  allowed_origins_json TEXT NOT NULL DEFAULT '[]',
+  enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE report_form_versions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  form_key TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  title TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  target_types_json TEXT NOT NULL,
+  reasons_json TEXT NOT NULL,
+  fields_json TEXT NOT NULL,
+  consent_notice TEXT NOT NULL,
+  published_at TEXT,
+  retired_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, form_key, version)
+);
+
+CREATE TABLE policy_versions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  policy_key TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  title TEXT NOT NULL,
+  rules_json TEXT NOT NULL,
+  published_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, policy_key, version)
+);
+
+CREATE TABLE queue_definitions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  queue_key TEXT NOT NULL,
+  name TEXT NOT NULL,
+  queue_kind TEXT NOT NULL CHECK (queue_kind IN ('human', 'ai', 'appeal', 'operations')),
+  enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, queue_key)
+);
+
+CREATE TABLE queue_versions (
+  id TEXT PRIMARY KEY,
+  queue_id TEXT NOT NULL REFERENCES queue_definitions(id),
+  version INTEGER NOT NULL CHECK (version > 0),
+  mode TEXT NOT NULL CHECK (mode IN ('off', 'shadow', 'assist', 'autonomous_low_priority')),
+  priority INTEGER NOT NULL DEFAULT 50 CHECK (priority BETWEEN 0 AND 100),
+  response_sla_minutes INTEGER,
+  resolution_sla_minutes INTEGER,
+  claim_ttl_minutes INTEGER NOT NULL DEFAULT 15 CHECK (claim_ttl_minutes BETWEEN 1 AND 1440),
+  fallback_queue_id TEXT REFERENCES queue_definitions(id),
+  configuration_json TEXT NOT NULL DEFAULT '{}',
+  published_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (queue_id, version)
+);
+
+CREATE TABLE routing_rule_versions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  version INTEGER NOT NULL CHECK (version > 0),
+  rules_json TEXT NOT NULL,
+  fixture_results_json TEXT NOT NULL,
+  published_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, version)
+);
+
+CREATE TABLE reports (
+  id TEXT PRIMARY KEY,
+  public_reference TEXT NOT NULL UNIQUE,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  integration_id TEXT NOT NULL REFERENCES application_integrations(id),
+  idempotency_key TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (source IN ('signed_widget', 'public_page', 'server_api')),
+  form_version_id TEXT REFERENCES report_form_versions(id),
+  policy_version_id TEXT REFERENCES policy_versions(id),
+  routing_rule_version_id TEXT REFERENCES routing_rule_versions(id),
+  queue_id TEXT REFERENCES queue_definitions(id),
+  state TEXT NOT NULL CHECK (state IN (
+    'received', 'human_review', 'ai_review', 'awaiting_reporter', 'resolved_by_human',
+    'resolved_by_ai', 'human_review_requested', 'appealed', 'closed'
+  )),
+  priority INTEGER NOT NULL DEFAULT 50 CHECK (priority BETWEEN 0 AND 100),
+  reason_code TEXT NOT NULL,
+  locale TEXT NOT NULL,
+  consent_notice TEXT NOT NULL,
+  consented_at TEXT NOT NULL,
+  submitted_at TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  due_at TEXT,
+  resolved_at TEXT,
+  routing_status TEXT NOT NULL DEFAULT 'pending' CHECK (routing_status IN ('pending', 'enqueued', 'processing', 'complete', 'failed')),
+  routing_attempts INTEGER NOT NULL DEFAULT 0 CHECK (routing_attempts >= 0),
+  routing_error_code TEXT,
+  UNIQUE (integration_id, idempotency_key)
+);
+
+CREATE INDEX reports_queue_state_priority_idx
+  ON reports(queue_id, state, priority DESC, received_at ASC, id ASC);
+CREATE INDEX reports_routing_status_idx
+  ON reports(routing_status, received_at ASC, id ASC);
+CREATE INDEX reports_target_time_idx
+  ON reports(installation_id, received_at DESC, id DESC);
+
+CREATE TABLE report_participants (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
+  reference TEXT,
+  contact_mode TEXT NOT NULL CHECK (contact_mode IN ('portal', 'customer_notification', 'none')),
+  contact_ciphertext TEXT,
+  created_at TEXT NOT NULL,
+  UNIQUE (report_id, audience)
+);
+
+CREATE TABLE report_targets (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  target_type TEXT NOT NULL,
+  target_reference TEXT NOT NULL,
+  owner_reference TEXT,
+  customer_url TEXT,
+  signed_facts_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL,
+  UNIQUE (report_id, target_type, target_reference)
+);
+
+CREATE INDEX report_targets_reference_idx
+  ON report_targets(target_type, target_reference, report_id);
+
+CREATE TABLE report_answers (
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  field_key TEXT NOT NULL,
+  value_json TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (report_id, field_key)
+);
+
+CREATE TABLE evidence_references (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  evidence_kind TEXT NOT NULL CHECK (evidence_kind IN ('allegation', 'signed_fact', 'customer_reference', 'fetched_record', 'snapshot')),
+  reference TEXT NOT NULL,
+  availability TEXT NOT NULL DEFAULT 'available' CHECK (availability IN ('available', 'unavailable', 'deleted', 'changed')),
+  retention_class TEXT NOT NULL DEFAULT 'reference',
+  created_at TEXT NOT NULL,
+  UNIQUE (report_id, evidence_kind, reference)
+);
+
+CREATE TABLE report_state_history (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  background_job_id TEXT UNIQUE REFERENCES background_jobs(id),
+  from_state TEXT,
+  to_state TEXT NOT NULL,
+  reason_code TEXT NOT NULL,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX report_state_history_report_idx
+  ON report_state_history(report_id, created_at ASC, id ASC);
+
+CREATE TABLE portal_sessions (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
+  token_hash TEXT NOT NULL UNIQUE,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL,
+  last_used_at TEXT
+);
+
+CREATE INDEX portal_sessions_report_idx ON portal_sessions(report_id, audience, expires_at);
+
+CREATE TABLE context_token_uses (
+  jti TEXT PRIMARY KEY,
+  integration_id TEXT NOT NULL REFERENCES application_integrations(id),
+  report_id TEXT NOT NULL UNIQUE REFERENCES reports(id) ON DELETE CASCADE,
+  used_at TEXT NOT NULL
+);
+
+CREATE TABLE case_messages (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  audience TEXT NOT NULL CHECK (audience IN ('internal', 'reporter', 'affected_user')),
+  direction TEXT NOT NULL CHECK (direction IN ('inbound', 'outbound', 'internal')),
+  sender_type TEXT NOT NULL CHECK (sender_type IN ('reporter', 'affected_user', 'human', 'ai', 'system')),
+  sender_id TEXT NOT NULL,
+  body TEXT NOT NULL,
+  template_version_id TEXT,
+  automated INTEGER NOT NULL DEFAULT 0 CHECK (automated IN (0, 1)),
+  delivery_state TEXT NOT NULL DEFAULT 'not_required' CHECK (delivery_state IN ('not_required', 'queued', 'delivered', 'failed', 'suppressed')),
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX case_messages_report_audience_idx
+  ON case_messages(report_id, audience, created_at ASC, id ASC);
+
+CREATE TABLE review_claims (
+  report_id TEXT PRIMARY KEY REFERENCES reports(id) ON DELETE CASCADE,
+  reviewer_id TEXT NOT NULL,
+  claimed_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0)
+);
+
+CREATE TABLE decisions (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id),
+  decision_code TEXT NOT NULL,
+  policy_version_id TEXT NOT NULL REFERENCES policy_versions(id),
+  policy_code TEXT NOT NULL,
+  rationale TEXT NOT NULL,
+  evidence_references_json TEXT NOT NULL,
+  maker_type TEXT NOT NULL CHECK (maker_type IN ('human', 'ai')),
+  maker_id TEXT NOT NULL,
+  queue_version_id TEXT REFERENCES queue_versions(id),
+  ai_run_id TEXT,
+  proposed_action_code TEXT,
+  supersedes_decision_id TEXT REFERENCES decisions(id),
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX decisions_report_idx ON decisions(report_id, created_at DESC, id DESC);
+
+CREATE TABLE notices (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id),
+  decision_id TEXT REFERENCES decisions(id),
+  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
+  template_version_id TEXT NOT NULL,
+  rendered_body TEXT NOT NULL,
+  delivery_state TEXT NOT NULL CHECK (delivery_state IN ('queued', 'delivered', 'failed', 'suppressed')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE action_outbox (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id),
+  decision_id TEXT NOT NULL REFERENCES decisions(id),
+  idempotency_key TEXT NOT NULL UNIQUE,
+  action_code TEXT NOT NULL,
+  target_reference TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'delivering', 'accepted', 'rejected', 'already_applied', 'failed')),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at TEXT NOT NULL,
+  last_error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX action_outbox_due_idx ON action_outbox(status, next_attempt_at, id);
+
+CREATE TABLE action_attempts (
+  id TEXT PRIMARY KEY,
+  action_id TEXT NOT NULL REFERENCES action_outbox(id) ON DELETE CASCADE,
+  attempt_number INTEGER NOT NULL CHECK (attempt_number > 0),
+  response_class TEXT NOT NULL,
+  response_status INTEGER,
+  error_code TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT NOT NULL,
+  UNIQUE (action_id, attempt_number)
+);
+
+CREATE TABLE notification_outbox (
+  id TEXT PRIMARY KEY,
+  notice_id TEXT NOT NULL REFERENCES notices(id),
+  idempotency_key TEXT NOT NULL UNIQUE,
+  channel TEXT NOT NULL CHECK (channel IN ('customer_webhook', 'email')),
+  payload_json TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'delivering', 'delivered', 'failed', 'suppressed')),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at TEXT NOT NULL,
+  last_error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX notification_outbox_due_idx ON notification_outbox(status, next_attempt_at, id);
+
+CREATE TABLE notification_attempts (
+  id TEXT PRIMARY KEY,
+  notification_id TEXT NOT NULL REFERENCES notification_outbox(id) ON DELETE CASCADE,
+  attempt_number INTEGER NOT NULL CHECK (attempt_number > 0),
+  response_class TEXT NOT NULL,
+  response_status INTEGER,
+  error_code TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT NOT NULL,
+  UNIQUE (notification_id, attempt_number)
+);
+
+CREATE TABLE appeals (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id),
+  decision_id TEXT NOT NULL REFERENCES decisions(id),
+  appellant_audience TEXT NOT NULL CHECK (appellant_audience IN ('reporter', 'affected_user')),
+  reason TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('submitted', 'human_review', 'upheld', 'modified', 'reversed')),
+  queue_id TEXT NOT NULL REFERENCES queue_definitions(id),
+  submitted_at TEXT NOT NULL,
+  resolved_at TEXT,
+  UNIQUE (decision_id, appellant_audience)
+);
+
+CREATE INDEX appeals_queue_state_idx ON appeals(queue_id, state, submitted_at ASC, id ASC);
+
+CREATE TABLE appeal_decisions (
+  id TEXT PRIMARY KEY,
+  appeal_id TEXT NOT NULL UNIQUE REFERENCES appeals(id),
+  outcome TEXT NOT NULL CHECK (outcome IN ('upheld', 'modified', 'reversed')),
+  rationale TEXT NOT NULL,
+  reviewer_id TEXT NOT NULL,
+  corrective_action_id TEXT REFERENCES action_outbox(id),
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE background_jobs (
+  id TEXT PRIMARY KEY,
+  report_id TEXT REFERENCES reports(id),
+  job_type TEXT NOT NULL CHECK (job_type IN ('route_report', 'deliver_action', 'deliver_notification', 'resume_ai', 'retention')),
+  idempotency_key TEXT NOT NULL UNIQUE,
+  state TEXT NOT NULL CHECK (state IN ('pending', 'enqueued', 'processing', 'complete', 'failed', 'dead_letter')),
+  payload_json TEXT NOT NULL,
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  available_at TEXT NOT NULL,
+  last_error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX background_jobs_reconcile_idx ON background_jobs(state, available_at, id);
+
+CREATE TABLE audit_entries (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  action TEXT NOT NULL,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  details_json TEXT NOT NULL,
+  previous_hash TEXT NOT NULL UNIQUE,
+  entry_hash TEXT NOT NULL UNIQUE,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX audit_entries_target_idx
+  ON audit_entries(target_type, target_id, sequence DESC);
+
+CREATE TABLE daily_aggregates (
+  aggregate_date TEXT NOT NULL,
+  metric_key TEXT NOT NULL,
+  dimension_key TEXT NOT NULL,
+  dimension_value TEXT NOT NULL,
+  value INTEGER NOT NULL DEFAULT 0,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (aggregate_date, metric_key, dimension_key, dimension_value)
+);
+
+INSERT INTO installations (
+  id, display_name, default_locale, anonymous_reporting_enabled, created_at, updated_at
+) VALUES (
+  'default', 'Safest Resolve', 'en', 0, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+
+INSERT INTO application_integrations (
+  id, installation_id, name, key_id, allowed_origins_json, enabled, created_at, updated_at
+) VALUES (
+  'default', 'default', 'Default integration', 'default', '["http://localhost:8787","http://localhost:8788"]', 1,
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+
+INSERT INTO report_form_versions (
+  id, installation_id, form_key, version, title, description, target_types_json, reasons_json,
+  fields_json, consent_notice, published_at, created_by, created_at
+) VALUES (
+  'general-v1', 'default', 'general', 1, 'Report a safety concern',
+  'Tell the service owner about abuse or a safety concern.',
+  '["message","profile","listing","account","file","transaction","service"]',
+  '[{"code":"harassment","label":"Harassment"},{"code":"spam","label":"Spam or scam"},{"code":"threat","label":"Threat or immediate danger"},{"code":"other","label":"Something else"}]',
+  '[{"key":"details","label":"What happened?","type":"long_text","required":true,"max_length":4000}]',
+  'Your report will be shared with authorized safety reviewers and handled according to the service privacy policy.',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+
+INSERT INTO policy_versions (
+  id, installation_id, policy_key, version, title, rules_json, published_at, created_by, created_at
+) VALUES (
+  'general-policy-v1', 'default', 'general', 1, 'General safety policy',
+  '[{"code":"GENERAL-1","title":"Customer review required"}]',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+
+INSERT INTO queue_definitions (id, installation_id, queue_key, name, queue_kind, created_at, updated_at) VALUES
+  ('urgent-human', 'default', 'urgent-human', 'Urgent human', 'human', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('standard-human', 'default', 'standard-human', 'Standard human', 'human', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('low-priority-ai', 'default', 'low-priority-ai', 'Low-priority AI', 'ai', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('appeals', 'default', 'appeals', 'Appeals', 'appeal', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('operations', 'default', 'operations', 'Operations', 'operations', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
+
+INSERT INTO queue_versions (
+  id, queue_id, version, mode, priority, response_sla_minutes, resolution_sla_minutes,
+  claim_ttl_minutes, fallback_queue_id, configuration_json, published_at, created_by, created_at
+) VALUES
+  ('urgent-human-v1', 'urgent-human', 1, 'off', 100, 15, 240, 15, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('standard-human-v1', 'standard-human', 1, 'off', 50, 1440, 10080, 15, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('low-priority-ai-v1', 'low-priority-ai', 1, 'shadow', 20, 1440, 10080, 15, 'standard-human', '{"allowed_outcomes":[],"protected_categories":[],"daily_volume_budget":0}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('appeals-v1', 'appeals', 1, 'off', 60, 1440, 10080, 30, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('operations-v1', 'operations', 1, 'off', 80, 60, 1440, 30, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));

package/template/migrations/0002_human_report_loop.sql

@@ -0,0 +1,65 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE case_messages ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX case_messages_idempotency_idx ON case_messages(report_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE decisions ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX decisions_idempotency_idx ON decisions(report_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE notices ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX notices_idempotency_idx ON notices(report_id, audience, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE appeals ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX appeals_idempotency_idx ON appeals(report_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE message_template_versions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id),
+  template_key TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
+  purpose TEXT NOT NULL CHECK (purpose IN ('follow_up', 'outcome', 'affected_user_notice', 'appeal_outcome')),
+  locale TEXT NOT NULL,
+  body_template TEXT NOT NULL,
+  published_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, template_key, version, locale)
+);
+
+CREATE TABLE appeal_claims (
+  appeal_id TEXT PRIMARY KEY REFERENCES appeals(id) ON DELETE CASCADE,
+  reviewer_id TEXT NOT NULL,
+  claimed_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0)
+);
+
+CREATE TABLE audit_events (
+  id TEXT PRIMARY KEY,
+  idempotency_key TEXT NOT NULL UNIQUE,
+  action TEXT NOT NULL,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  details_json TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  chained_at TEXT,
+  chain_error_code TEXT
+);
+
+CREATE INDEX audit_events_pending_idx ON audit_events(chained_at, created_at, id);
+
+INSERT INTO message_template_versions (
+  id, installation_id, template_key, version, audience, purpose, locale,
+  body_template, published_at, created_by, created_at
+) VALUES
+  ('reporter-follow-up-v1', 'default', 'reporter-follow-up', 1, 'reporter', 'follow_up', 'en',
+   '{{message}}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('reporter-outcome-v1', 'default', 'reporter-outcome', 1, 'reporter', 'outcome', 'en',
+   '{{message}}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('affected-user-notice-v1', 'default', 'affected-user-notice', 1, 'affected_user', 'affected_user_notice', 'en',
+   '{{message}}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ('appeal-outcome-v1', 'default', 'appeal-outcome', 1, 'affected_user', 'appeal_outcome', 'en',
+   '{{message}}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));

package/template/migrations/0003_delivery_reliability.sql

@@ -0,0 +1,18 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE notices ADD COLUMN message_id TEXT REFERENCES case_messages(id);
+
+ALTER TABLE appeal_decisions ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX appeal_decisions_idempotency_idx
+  ON appeal_decisions(appeal_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE action_outbox ADD COLUMN lease_expires_at TEXT;
+ALTER TABLE action_outbox ADD COLUMN terminal INTEGER NOT NULL DEFAULT 0 CHECK (terminal IN (0, 1));
+
+ALTER TABLE notification_outbox ADD COLUMN lease_expires_at TEXT;
+ALTER TABLE notification_outbox ADD COLUMN terminal INTEGER NOT NULL DEFAULT 0 CHECK (terminal IN (0, 1));
+
+CREATE INDEX action_outbox_reconcile_idx
+  ON action_outbox(terminal, status, next_attempt_at, lease_expires_at, id);
+CREATE INDEX notification_outbox_reconcile_idx
+  ON notification_outbox(terminal, status, next_attempt_at, lease_expires_at, id);

package/template/migrations/0004_public_intake.sql

@@ -0,0 +1,14 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE intake_rate_limits (
+  bucket_key TEXT NOT NULL,
+  window_start TEXT NOT NULL,
+  request_count INTEGER NOT NULL DEFAULT 0 CHECK (request_count >= 0),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (bucket_key, window_start)
+);
+
+CREATE INDEX intake_rate_limits_expiry_idx ON intake_rate_limits(window_start, updated_at);
+
+UPDATE installations SET anonymous_reporting_enabled = 1, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE id = 'default';

package/template/migrations/0005_operations_visibility.sql

@@ -0,0 +1,24 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE dead_letter_items (
+  id TEXT PRIMARY KEY,
+  fingerprint TEXT NOT NULL UNIQUE,
+  source_queue TEXT NOT NULL,
+  source_message_id TEXT NOT NULL,
+  job_type TEXT NOT NULL CHECK (job_type IN ('route_report', 'deliver_action', 'deliver_notification', 'invalid')),
+  job_id TEXT,
+  report_id TEXT REFERENCES reports(id),
+  outbox_id TEXT,
+  state TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'acknowledged', 'resolved')),
+  error_code TEXT NOT NULL,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count > 0),
+  details_json TEXT NOT NULL DEFAULT '{}',
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  resolved_at TEXT
+);
+
+CREATE INDEX dead_letter_items_state_idx
+  ON dead_letter_items(state, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_report_idx
+  ON dead_letter_items(report_id, last_seen_at DESC, id DESC);