spine-framework 0.3.114 → 0.3.115

package/.framework/functions/_shared/agent-runner.ts

@@ -70,7 +70,7 @@ export interface AgentConfig {
  * Structured result from a single LLM inference call.
  *
  * @outputSpec content: string — agent response text
- * @outputSpec confidence: number — 0-1 score; derived from logprobs or 0.85 default
+ * @outputSpec confidence: number — 0-1 score; derived from logprobs or 0.70 default
  * @outputSpec tool_calls: ToolCall[] | undefined — tools the model wants to call
  * @outputSpec metadata: { model, usage, finish_reason } | undefined
  */
@@ -372,10 +372,14 @@ async function executeAgentInference(
 
     if (!inferenceResult.tool_calls || inferenceResult.tool_calls.length === 0) {
       // Composite confidence: 60% LLM logprobs + 40% retrieval similarity
+      // When logprobs are absent, be conservative: default 0.70 instead of 0.85
       // If mean retrieval similarity < 0.40, cap composite at 0.60
-      const llmConf = inferenceResult.confidence ?? 0.85
+      // If mean retrieval similarity < 0.25, cap composite at 0.45 (very poor retrieval)
+      const llmConf = inferenceResult.confidence ?? 0.70
       let compositeConf: number
-      if (meanSimilarity < 0.40 && meanSimilarity > 0) {
+      if (meanSimilarity < 0.25 && meanSimilarity > 0) {
+        compositeConf = Math.min(llmConf * 0.6 + meanSimilarity * 0.4, 0.45)
+      } else if (meanSimilarity < 0.40 && meanSimilarity > 0) {
         compositeConf = Math.min(llmConf * 0.6 + meanSimilarity * 0.4, 0.60)
       } else {
         compositeConf = llmConf * 0.6 + Math.min(meanSimilarity, 1) * 0.4
@@ -799,9 +803,11 @@ async function callInference(
   const message = result.choices?.[0]?.message
 
   // Extract confidence from logprobs if available, otherwise estimate
+  // Default is conservative (0.70) when logprobs are absent — retrieval quality
+  // should drive the final composite confidence, not an arbitrary high default.
   const confidence = result.choices?.[0]?.logprobs?.content?.[0]?.logprob 
     ? Math.exp(result.choices[0].logprobs.content[0].logprob)
-    : 0.85 // Default confidence when not provided
+    : 0.70
 
   return {
     content: message?.content || '',
@@ -1195,6 +1201,34 @@ async function handleEscalation(
     })
     .eq('id', threadId)
 
+  // If the thread targets an item (e.g., a support ticket), mark that item as
+  // human-assigned so it shows up in the human queue and stops AI responses.
+  const { data: thread } = await adminDb
+    .from('threads')
+    .select('target_type, target_id')
+    .eq('id', threadId)
+    .single()
+  if (thread?.target_type === 'items' && thread?.target_id) {
+    const { data: item } = await adminDb
+      .from('items')
+      .select('status, data')
+      .eq('id', thread.target_id)
+      .single()
+    if (item && item.status !== 'human_assigned' && item.status !== 'resolved') {
+      await adminDb
+        .from('items')
+        .update({
+          status: 'human_assigned',
+          data: {
+            ...(item.data || {}),
+            aim_escalation_reason: 'low_confidence'
+          },
+          updated_at: new Date().toISOString()
+        })
+        .eq('id', thread.target_id)
+    }
+  }
+
   // Fire trigger event
   await emitAudit(ctx, 'agent.inference.low_confidence', {
     type: 'thread',

package/.framework/functions/_shared/permissions.ts

@@ -1,3 +1,4 @@
+// ─── CHUNK_START: PERMISSIONS_OVERVIEW ──────────────────────────────────────────────
 /**
  * @module permissions
  * @audience both
@@ -32,12 +33,13 @@
  * @seeAlso index.ts (stable export surface for custom code)
  */
 
+// ─── CHUNK_END: PERMISSIONS_OVERVIEW ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_TYPES ──────────────────────────────────────────────
 import { adminDb } from './db'
 import { Principal } from './principal'
 import { CoreContext } from './middleware'
 
-// ─── TYPES ────────────────────────────────────────────────────────────────────
-
 /**
  * Result of a permission resolution for a principal + record + action combination.
  *
@@ -66,9 +68,9 @@ export interface PermissionResult {
 }
 
 type RequestContext = CoreContext
+// ─── CHUNK_END: PERMISSIONS_TYPES ────────────────────────────────────────────────
 
-// ─── ENGINE CLASS ────────────────────────────────────────────────────────────
-
+// ─── CHUNK_START: PERMISSIONS_ENGINE_CLASS ──────────────────────────────────────────────
 /**
  * The single permission engine for all authorization in Spine.
  *
@@ -87,11 +89,12 @@ type RequestContext = CoreContext
  * @testUnit tests/unit/permissions.test.ts
  * @testIntegration tests/integration/isolation.test.ts, admin-data-accounts.test.ts
  */
+// ─── CHUNK_END: PERMISSIONS_ENGINE_CLASS ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_SURFACE_CLASSIFICATION ──────────────────────────────────────────────
 class _PermissionEngineInternal {
   private static instance: _PermissionEngineInternal
 
-  // ─── SURFACE CLASSIFICATION ───────────────────────────────────────────────
-
   // Surface classification tables
   private readonly SECOND_SURFACE_TABLES = new Set([
     'apps', 'app', 'pipelines', 'triggers', 'ai_agents', 'embeddings', 
@@ -189,7 +192,9 @@ class _PermissionEngineInternal {
     return _PermissionEngineInternal.instance
   }
 
-  // ─── FIRST SURFACE — RUNTIME DATA ──────────────────────────────────────────
+// ─── CHUNK_END: PERMISSIONS_SURFACE_CLASSIFICATION ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_FIRST_SURFACE_RESOLVE ──────────────────────────────────────────────
 
   /**
    * Resolves record-level and field-level permissions for a human principal
@@ -334,7 +339,9 @@ class _PermissionEngineInternal {
     }
   }
 
-  // ─── SECOND SURFACE — CONFIG OBJECTS ────────────────────────────────────────
+// ─── CHUNK_END: PERMISSIONS_FIRST_SURFACE_RESOLVE ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_SECOND_SURFACE_CONFIG_OBJECTS ──────────────────────────────────────────────
 
   /**
    * Checks whether the principal in `ctx` may perform `action` on a second-surface
@@ -465,7 +472,9 @@ class _PermissionEngineInternal {
     return { valid: false, error: 'Insufficient permissions for this operation' }
   }
 
-  // ─── THIRD SURFACE — SYSTEM METADATA ────────────────────────────────────────
+// ─── CHUNK_END: PERMISSIONS_SECOND_SURFACE_CONFIG_OBJECTS ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_THIRD_SURFACE_SYSTEM_METADATA ──────────────────────────────────────────────
 
   /**
    * Checks whether the principal may access a third-surface system metadata record
@@ -584,7 +593,9 @@ class _PermissionEngineInternal {
     return { valid: false, error: 'Insufficient permissions for this operation' }
   }
 
-  // ─── SHARED HELPERS ──────────────────────────────────────────────────────────
+// ─── CHUNK_END: PERMISSIONS_THIRD_SURFACE_SYSTEM_METADATA ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_SHARED_HELPERS ──────────────────────────────────────────────
 
   /**
    * Returns true if the principal in `ctx` holds the `system_admin` role.
@@ -608,7 +619,9 @@ class _PermissionEngineInternal {
     return ctx.principal?.roles?.includes('system_admin') || false
   }
 
-  // ─── PUBLIC SURFACE ROUTER METHODS ──────────────────────────────────────────
+// ─── CHUNK_END: PERMISSIONS_SHARED_HELPERS ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_CAN_ACCESS_RECORD ──────────────────────────────────────────────
 
   /**
    * Checks whether the principal in `ctx` may perform `action` on `record`.
@@ -776,6 +789,9 @@ class _PermissionEngineInternal {
    * const safe = await sanitizeRecordData(ctx, rawRecord, 'ticket')
    * ```
    */
+// ─── CHUNK_END: PERMISSIONS_CAN_ACCESS_RECORD ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_SANITIZE_RECORD_DATA ──────────────────────────────────────────────
   async sanitizeRecordData(
     ctx: RequestContext,
     record: any,
@@ -803,7 +819,9 @@ class _PermissionEngineInternal {
         return this.sanitizeFirstSurfaceRecordData(ctx, record, typeSlug || '')
     }
   }
+// ─── CHUNK_END: PERMISSIONS_SANITIZE_RECORD_DATA ────────────────────────────────────────────────
 
+// ─── CHUNK_START: PERMISSIONS_SANITIZE_FIRST_SURFACE ──────────────────────────────────────────────
   /**
    * Field-level filter and formatter for first-surface (runtime data) records.
    *
@@ -924,7 +942,9 @@ class _PermissionEngineInternal {
 
     return sanitized
   }
+// ─── CHUNK_END: PERMISSIONS_SANITIZE_FIRST_SURFACE ────────────────────────────────────────────────
 
+// ─── CHUNK_START: PERMISSIONS_VALIDATE_UPDATE ──────────────────────────────────────────────
   /**
    * Validates that the principal has write permission for every field in `updateData`,
    * and sanitizes the data using the validation schema before returning it.
@@ -992,7 +1012,9 @@ class _PermissionEngineInternal {
         return this.validateFirstSurfaceUpdatePermissions(ctx, updateData, existingRecord, typeSlug || '')
     }
   }
+// ─── CHUNK_END: PERMISSIONS_VALIDATE_UPDATE ────────────────────────────────────────────────
 
+// ─── CHUNK_START: PERMISSIONS_VALIDATE_FIRST_SURFACE ──────────────────────────────────────────────
   /**
    * Field-level write validation and sanitization for first-surface update payloads.
    *
@@ -1103,8 +1125,9 @@ class _PermissionEngineInternal {
 
     return { valid: true, sanitizedData }
   }
+// ─── CHUNK_END: PERMISSIONS_VALIDATE_FIRST_SURFACE ────────────────────────────────────────────────
 
-  // ─── UNIFIED PRINCIPAL METHODS ───────────────────────────────────────────────
+// ─── CHUNK_START: PERMISSIONS_CAN_PRINCIPAL_ACCESS_RECORD ──────────────────────────────────────────────
 
   /**
    * Unified permission check for all principal types (human, machine, cron, trigger).
@@ -1180,7 +1203,9 @@ class _PermissionEngineInternal {
     
     return false
   }
-  
+// ─── CHUNK_END: PERMISSIONS_CAN_PRINCIPAL_ACCESS_RECORD ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_MACHINE_SCOPE ──────────────────────────────────────────────
   /**
    * Evaluates whether a machine principal's scopes permit the requested action.
    *
@@ -1227,7 +1252,9 @@ class _PermissionEngineInternal {
     
     return false
   }
-  
+// ─── CHUNK_END: PERMISSIONS_MACHINE_SCOPE ────────────────────────────────────────────────
+
+// ─── CHUNK_START: PERMISSIONS_PERMISSION_SUMMARY ──────────────────────────────────────────────
   /**
    * Returns a structured summary of a principal's permission posture for use
    * in audit log entries.
@@ -1274,7 +1301,9 @@ class _PermissionEngineInternal {
     return { type: 'unknown' }
   }
 }
+// ─── CHUNK_END: PERMISSIONS_PERMISSION_SUMMARY ────────────────────────────────────────────────
 
+// ─── CHUNK_START: PERMISSIONS_SINGLETON_AND_EXPORTS ──────────────────────────────────────────────
 // ─── SINGLETON EXPORT ────────────────────────────────────────────────────────
 
 /**
@@ -1317,3 +1346,4 @@ export const isSystemAdmin = PermissionEngine.isSystemAdmin.bind(PermissionEngin
 export const canAccessRecord = PermissionEngine.canAccessRecord.bind(PermissionEngine)
 export const sanitizeRecordData = PermissionEngine.sanitizeRecordData.bind(PermissionEngine)
 export const validateUpdatePermissions = PermissionEngine.validateUpdatePermissions.bind(PermissionEngine)
+// ─── CHUNK_END: PERMISSIONS_SINGLETON_AND_EXPORTS ────────────────────────────────────────────────

package/.framework/migrations/030_messages_updated_by.sql

@@ -0,0 +1,6 @@
+-- Migration 030: Add missing updated_by column to messages table
+-- The messages table was created without updated_by, causing PATCH requests
+-- via admin-data to fail when the audit stamp tries to set that field.
+
+ALTER TABLE public.messages
+  ADD COLUMN IF NOT EXISTS updated_by uuid REFERENCES public.people(id) ON DELETE SET NULL;

package/.framework/migrations/031_cil_vector_types.sql

@@ -0,0 +1,60 @@
+-- Migration 031: CIL vector types — patch cil_chunk type design_schema
+--
+-- The seed file (custom/apps/cortex/seed/types.json) defines cil_chunk with
+-- no vector_types because the generate() function in embeddings.ts reads
+-- vector_types from the type's design_schema at runtime.
+--
+-- This migration patches in the three CIL vector types for cil_chunk so that
+-- calls to generate() produce semantic, structural, and contract vectors.
+--
+-- Also adds vector_types for cil_config (semantic only) and cil_project (semantic).
+--
+-- Safe to re-run: uses jsonb_set which is idempotent on the same value.
+--
+-- NOTE: This only patches rows where the type already exists. The seed must
+-- have been applied (via spine install-app) before this migration runs.
+
+-- ── cil_chunk: semantic + structural + contract ───────────────────────────────
+UPDATE public.types
+SET design_schema = jsonb_set(
+  design_schema,
+  '{vector_types}',
+  '["semantic", "structural", "contract"]'::jsonb,
+  true  -- create if missing
+)
+WHERE kind = 'item'
+  AND slug = 'cil_chunk';
+
+-- ── cil_project: semantic only (project descriptions) ─────────────────────────
+UPDATE public.types
+SET design_schema = jsonb_set(
+  design_schema,
+  '{vector_types}',
+  '["semantic"]'::jsonb,
+  true
+)
+WHERE kind = 'item'
+  AND slug = 'cil_project';
+
+-- ── cil_config: semantic (config field descriptions) ──────────────────────────
+UPDATE public.types
+SET design_schema = jsonb_set(
+  design_schema,
+  '{vector_types}',
+  '["semantic"]'::jsonb,
+  true
+)
+WHERE kind = 'item'
+  AND slug = 'cil_config';
+
+-- ── embedding_fields for cil_chunk structural vector ─────────────────────────
+-- structural vector uses these fields from item.data for its JSON snapshot
+UPDATE public.types
+SET design_schema = jsonb_set(
+  design_schema,
+  '{embedding_fields,structural}',
+  '["chunk_type","file_path","stability","is_dead_code","boundary_confidence","doc_confidence","review_status"]'::jsonb,
+  true
+)
+WHERE kind = 'item'
+  AND slug = 'cil_chunk';

package/.framework/migrations/032_cil_agent_config.sql

@@ -0,0 +1,122 @@
+-- Migration 032: CIL AI Agent + Prompt Config
+--
+-- Seeds the Code Intelligence Layer conversational agent so it can answer
+-- questions about the codebase using cil_chunk embeddings as RAG context.
+--
+-- The agent is scoped to the Cortex app (is_system = false so it can be
+-- overridden per-tenant). A second system-level prompt config with
+-- retrieval_policy.item_types = ["cil_chunk"] ensures the agent only pulls
+-- code chunk embeddings rather than KB articles.
+--
+-- Safe to re-run: uses INSERT ... ON CONFLICT DO NOTHING on (app_id, name)
+-- and ON CONFLICT (slug) DO NOTHING for prompt_configs.
+
+-- ── CIL Conversational Agent ─────────────────────────────────────────────────
+INSERT INTO public.ai_agents (
+  id,
+  app_id,
+  name,
+  description,
+  agent_type,
+  system_prompt,
+  model_config,
+  ownership,
+  is_system,
+  is_active,
+  created_at,
+  updated_at
+)
+SELECT
+  gen_random_uuid(),
+  (SELECT id FROM public.apps WHERE slug = 'cortex'),
+  'CIL Codebase Assistant',
+  'Conversational agent that answers questions about the codebase using the Code Intelligence Layer. Retrieves chunk contracts, call graphs, and documentation via semantic search.',
+  'rag',
+  'You are a Code Intelligence Layer assistant. Your job is to answer questions about this codebase accurately and concisely.
+
+You have access to a semantic index of every named chunk in the codebase. Each chunk record contains:
+- chunk_name: the function / class / component name
+- macro: one-sentence purpose statement
+- micro: implementation detail
+- input_spec: parameter names, types, constraints
+- output_spec: return type and shape
+- side_effects: DB writes, API calls, file I/O
+- stability: stable | internal | experimental
+- file_path: source file location
+
+When answering:
+1. Ground your answer in the retrieved chunk contracts — do not invent APIs.
+2. Always cite the chunk_name and file_path when referencing a specific function.
+3. If you cannot find a relevant chunk, say so explicitly — do not guess.
+4. For refactoring questions, always mention callers / blast radius if known.
+5. Keep answers concise. Use markdown code blocks for code examples.
+6. If asked "is X safe to change?", check if stability = stable before confirming.
+
+Avoid hallucinating parameter names, return types, or side effects that are not in the retrieved contracts.',
+  '{"model": "gpt-4o-mini", "temperature": 0.2, "max_tokens": 1500}',
+  'platform',
+  false,
+  true,
+  now(),
+  now()
+WHERE NOT EXISTS (
+  SELECT 1 FROM public.ai_agents
+  WHERE app_id = (SELECT id FROM public.apps WHERE slug = 'cortex')
+    AND name = 'CIL Codebase Assistant'
+);
+
+-- ── CIL Agent Prompt Config ───────────────────────────────────────────────────
+INSERT INTO public.prompt_configs (
+  id,
+  app_id,
+  slug,
+  name,
+  context_template,
+  model,
+  temperature,
+  max_tokens,
+  is_multi_turn,
+  max_history_messages,
+  confidence_threshold,
+  output_mode,
+  knowledge_sources,
+  available_tools,
+  metadata,
+  ownership,
+  is_system,
+  is_active,
+  created_at,
+  updated_at
+)
+SELECT
+  gen_random_uuid(),
+  (SELECT id FROM public.apps WHERE slug = 'cortex'),
+  'cil_codebase_assistant',
+  'CIL Codebase Assistant',
+  'Answer the user''s question about the codebase using the retrieved chunk contracts above.
+If the answer involves a specific function, always include: chunk_name, file_path, and what it does.',
+  'gpt-4o-mini',
+  0.2,
+  1500,
+  true,
+  10,
+  0.3,
+  'text',
+  '[]'::jsonb,
+  '[]'::jsonb,
+  jsonb_build_object(
+    'retrieval_policy', jsonb_build_object(
+      'item_types',       jsonb_build_array('cil_chunk'),
+      'vector_types',     jsonb_build_array('semantic', 'contract'),
+      'max_security_level', 'internal',
+      'require_approved', true
+    )
+  ),
+  'platform',
+  false,
+  true,
+  now(),
+  now()
+WHERE NOT EXISTS (
+  SELECT 1 FROM public.prompt_configs WHERE slug = 'cil_codebase_assistant'
+);

package/.framework/migrations/033_cil_chunk_schema_fields.sql

@@ -0,0 +1,75 @@
+-- Migration 033: Add missing fields to CIL item type design_schemas
+--
+-- Adds fields that are written by the backend functions but were absent from
+-- the design_schema definitions in types.json:
+--
+--   cil_chunk:
+--     - hash_updated_at   written by custom_cil-validate ?action=update_hash
+--     - kb_type           written by custom_cil-ingest pass2 (discriminator field)
+--
+--   cil_file:
+--     - line_count                      written by custom_cil-ingest pass1
+--     - existing_marker_names           written by custom_cil-ingest pass1
+--     - existing_marker_count           written by custom_cil-ingest pass1
+--     - kb_type                         discriminator field
+--
+-- Safe to re-run: uses jsonb || operator (merge) so existing schema fields are
+-- preserved. Only adds new keys — does not overwrite existing ones.
+
+-- ── cil_chunk — add hash_updated_at + kb_type ───────────────────────────────
+UPDATE public.types
+SET design_schema = design_schema || jsonb_build_object(
+  'fields', (design_schema->'fields') || jsonb_build_object(
+    'hash_updated_at', jsonb_build_object(
+      'label', 'Hash Updated At',
+      'data_type', 'text'
+    ),
+    'kb_type', jsonb_build_object(
+      'label', 'KB Type',
+      'data_type', 'text'
+    )
+  )
+)
+WHERE slug = 'cil_chunk'
+  AND kind = 'item'
+  AND NOT (design_schema->'fields' ? 'hash_updated_at');
+
+-- ── cil_file — add line_count, existing_marker_names, existing_marker_count, kb_type ─
+UPDATE public.types
+SET design_schema = design_schema || jsonb_build_object(
+  'fields', (design_schema->'fields') || jsonb_build_object(
+    'line_count', jsonb_build_object(
+      'label', 'Line Count',
+      'data_type', 'number'
+    ),
+    'existing_marker_names', jsonb_build_object(
+      'label', 'Existing Marker Names',
+      'data_type', 'text'
+    ),
+    'existing_marker_count', jsonb_build_object(
+      'label', 'Existing Marker Count',
+      'data_type', 'number'
+    ),
+    'kb_type', jsonb_build_object(
+      'label', 'KB Type',
+      'data_type', 'text'
+    )
+  )
+)
+WHERE slug = 'cil_file'
+  AND kind = 'item'
+  AND NOT (design_schema->'fields' ? 'kb_type');
+
+-- ── cil_project — add kb_type ────────────────────────────────────────────────
+UPDATE public.types
+SET design_schema = design_schema || jsonb_build_object(
+  'fields', (design_schema->'fields') || jsonb_build_object(
+    'kb_type', jsonb_build_object(
+      'label', 'KB Type',
+      'data_type', 'text'
+    )
+  )
+)
+WHERE slug = 'cil_project'
+  AND kind = 'item'
+  AND NOT (design_schema->'fields' ? 'kb_type');

package/.framework/migrations/034_cil_self_seed.sql

@@ -0,0 +1,116 @@
+-- Migration 034: CIL Self-Seed — register spine-ia as a CIL project
+--
+-- Seeds the spine-ia repository itself as a `cil_project` item so that
+-- Pass 1–5 of the Code Intelligence Layer pipeline can be run against it
+-- immediately after install, without needing to create the project via the UI.
+--
+-- The repo_path defaults to the standard CascadeProjects location. Operators
+-- running the app on a different machine should update the repo_path via:
+--   PATCH /api/custom_cil-project?action=update&id=<SPINE_IA_PROJECT_ID>
+--   body: { data: { repo_path: "/path/to/your/spine-ia" } }
+--
+-- Safe to re-run: the INSERT is guarded by WHERE NOT EXISTS on the title.
+-- The hard-coded UUID allows other migrations to reference this project.
+
+-- Known stable UUID for the spine-ia CIL project (update if your DB uses a different value)
+DO $$
+DECLARE
+  v_cil_project_type_id  uuid;
+  v_spine_account_id     uuid;
+  v_cortex_app_id        uuid;
+  v_existing_id          uuid;
+BEGIN
+  -- Resolve the cil_project type
+  SELECT id INTO v_cil_project_type_id
+    FROM public.types
+   WHERE slug = 'cil_project' AND kind = 'item'
+   LIMIT 1;
+
+  IF v_cil_project_type_id IS NULL THEN
+    RAISE NOTICE 'cil_project type not found — skipping CIL self-seed. Run install-app cortex first.';
+    RETURN;
+  END IF;
+
+  -- Resolve the system account (spine-system or the first account if not found)
+  SELECT id INTO v_spine_account_id
+    FROM public.accounts
+   WHERE slug = 'spine-system'
+   LIMIT 1;
+
+  IF v_spine_account_id IS NULL THEN
+    SELECT id INTO v_spine_account_id FROM public.accounts ORDER BY created_at LIMIT 1;
+  END IF;
+
+  IF v_spine_account_id IS NULL THEN
+    RAISE NOTICE 'No account found — skipping CIL self-seed.';
+    RETURN;
+  END IF;
+
+  -- Resolve the cortex app
+  SELECT id INTO v_cortex_app_id
+    FROM public.apps
+   WHERE slug = 'cortex'
+   LIMIT 1;
+
+  -- Check if the project already exists
+  SELECT id INTO v_existing_id
+    FROM public.items
+   WHERE title = 'spine-ia'
+     AND type_id = v_cil_project_type_id
+     AND account_id = v_spine_account_id
+   LIMIT 1;
+
+  IF v_existing_id IS NOT NULL THEN
+    RAISE NOTICE 'spine-ia CIL project already seeded (id: %). Skipping.', v_existing_id;
+    RETURN;
+  END IF;
+
+  -- Insert the project item
+  INSERT INTO public.items (
+    id,
+    type_id,
+    account_id,
+    app_id,
+    title,
+    description,
+    status,
+    is_active,
+    data,
+    created_at,
+    updated_at
+  ) VALUES (
+    -- Fixed UUID so other tooling can reference it; change if collision occurs
+    '00000001-c11a-4a1e-0000-00000000001a',
+    v_cil_project_type_id,
+    v_spine_account_id,
+    v_cortex_app_id,
+    'spine-ia',
+    'The spine-ia monorepo — Spine framework core + Cortex CIL app',
+    'active',
+    true,
+    jsonb_build_object(
+      'kb_type',           'cil_project',
+      'project_id',        '00000001-c11a-4a1e-0000-00000000001a',
+      'repo_path',         '/Users/thistle/CascadeProjects/spine-ia',
+      'language_mix',      'TypeScript, SQL',
+      'description',       'The spine-ia monorepo — Spine framework core + Cortex CIL app',
+      'ingestion_status',  'not_started',
+      'file_count',        0,
+      'chunk_count',       0,
+      'last_ingested_at',  NULL,
+      'globs',             jsonb_build_array(
+        'custom/**/*.ts', 'custom/**/*.tsx',
+        '.framework/functions/**/*.ts',
+        '.framework/migrations/**/*.sql'
+      ),
+      'exclude_globs',     jsonb_build_array(
+        'node_modules/**', '.assembled/**', 'dist/**', 'build/**',
+        '**/*.test.ts', '**/*.spec.ts', '**/*.d.ts'
+      )
+    ),
+    now(),
+    now()
+  );
+
+  RAISE NOTICE 'spine-ia CIL project seeded successfully (id: 00000001-c11a-4a1e-0000-00000000001a)';
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.114",
+  "version": "0.3.115",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {
@@ -36,6 +36,11 @@
     ".framework/migrations/027_embedding_lifecycle.sql",
     ".framework/migrations/028_fix_message_data_permissions.sql",
     ".framework/migrations/029_tighten_support_triage_prompt.sql",
+    ".framework/migrations/030_messages_updated_by.sql",
+    ".framework/migrations/031_cil_vector_types.sql",
+    ".framework/migrations/032_cil_agent_config.sql",
+    ".framework/migrations/033_cil_chunk_schema_fields.sql",
+    ".framework/migrations/034_cil_self_seed.sql",
     ".framework/public/",
     ".framework/scripts/",
     ".framework/seeds/",
@@ -92,7 +97,8 @@
     "test:core": "vitest run .framework/tests/unit/core-isolation.test.ts",
     "test:integration": "vitest run .framework/tests/integration",
     "test:boundary": "bash scripts/boundary-check.sh",
-    "docs": "typedoc --entryPoints .framework/functions/_shared/index.ts --out docs/generated"
+    "docs": "typedoc --entryPoints .framework/functions/_shared/index.ts --out docs/generated",
+    "mcp": "tsx custom/apps/cortex/mcp/index.ts"
   },
   "dependencies": {
     "@base-ui/react": "^1.4.1",
@@ -174,6 +180,7 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@netlify/functions": "^2.8.2",
     "@supabase/supabase-js": "^2.49.1",
     "@tailwindcss/typography": "^0.5.19",