spine-framework 0.3.145 → 0.4.0

package/.framework/migrations/006_security_hardening_rls.sql

@@ -1,3 +1,11 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/006_security_hardening_rls.sql:security_hardening_rls:file" type="file" identity="security_hardening_rls" parent="~/.framework/migrations/006_security_hardening_rls.sql"]
+-- CIL[DOC-MACRO purpose="Apply migration 006 to close RLS bypasses for unauthenticated PostgREST requests and replace over-permissive types/watchers policies."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Update Row Level Security policies on integrations, api_keys, api_key_usage_logs, webhook_handlers, webhook_deliveries, items, types, and watchers to require authenticated or service-role access."]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/006_security_hardening_rls.sql"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="Recreated RLS policies for integrations, api_keys, api_key_usage_logs, webhook_handlers, webhook_deliveries, items, types, and watchers" errors="SQL errors if referenced helper functions or tables are missing" side_effects="Drops and recreates RLS policies on public tables, affecting PostgREST access control."]
+-- CIL[DOC-MICRO logic_summary="Removes OR auth.uid() IS NULL / OR public.current_actor_id() IS NULL / OR true clauses from existing policies, then creates account-scoped policies using public.get_accessible_accounts and public.person_is_system_admin; types is split into a public read policy and admin-only write policies, while watchers is scoped to accessible accounts." notable_decisions="types: split SELECT for everyone from INSERT/UPDATE/DELETE for system-admins; watchers: remove always-true OR clause and scope to accessible accounts"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Security hardening: close RLS bypasses that allowed unauthenticated
 -- (no-JWT / anon-key-only) requests to read and write sensitive tables
 -- directly via PostgREST, and remove `OR true` policies that made
@@ -95,3 +103,10 @@ CREATE POLICY watchers_access ON public.watchers FOR ALL
 
 DROP POLICY IF EXISTS watchers_service_role ON public.watchers;
 CREATE POLICY watchers_service_role ON public.watchers FOR ALL TO service_role USING (true) WITH CHECK (true);
+-- CIL[DOC-VECTOR type="context" content="purpose='Apply migration 006 to close RLS bypasses for unauthenticated PostgREST requests and replace over-permissive types/watchers policies.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/006_security_hardening_rls.sql:security_hardening_rls:file"]

package/.framework/migrations/007_kb_article_list.sql

@@ -1,3 +1,12 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/007_kb_article_list.sql:kb_article_list:file" type="file" identity="kb_article_list" parent="~/.framework/migrations/007_kb_article_list.sql"]
+-- CIL[DOC-MACRO purpose="Creates the kb-article-list type, rebuild cache function, cache trigger, and seeds cache records for existing accounts."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Installs and maintains the cached ordered KB article tree for each account by rebuilding on structural item changes."]
+-- CIL[DOC-CONTEXT module="knowledge-base" layer="migrations" related_files=".framework/migrations/007_kb_article_list.sql"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="public.types row for kb-article-list, public.rebuild_kb_cache function, public.trg_rebuild_kb_article_list trigger, seeded cache records" errors="none expected; slug conflicts upserted; trigger ignores non-KB types and cache record recursion" side_effects="Inserts or updates public.items cache rows, recalculates article trees on structural changes"]
+-- CIL[DOC-MICRO logic_summary="Upserts the kb-article-list type with design and validation schemas, defines a function that aggregates ordered article trees by scope into a jsonb trees field, attaches an AFTER INSERT/UPDATE/DELETE trigger on public.items to rebuild when parent, order, title, status, or type change, and seeds global and account caches for existing data." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[DOC-NOTE type="caution" content="cil_validate_file reports perpetual drift_detected on whole-file .sql chunks (32-char stored vs ~16-char computed hash) — also true of untouched 008/009 migrations. Pre-existing hash-format quirk for SQL file chunks, not real drift."]
 -- KB article list cache: a single row per scope/account that stores the
 -- pre-built ordered tree of KB articles. Updated by trigger on structural
 -- changes (parent, order, title, status, type) but NOT on content edits.
@@ -50,7 +59,7 @@ VALUES (
     },
     "record_permissions": {
       "all": ["read"],
-      "system-admin": ["create", "read", "update", "delete"],
+      "system_admin": ["create", "read", "update", "delete"],
       "admin": ["create", "read", "update", "delete"],
       "member": ["read"]
     },
@@ -235,3 +244,10 @@ BEGIN
     PERFORM public.rebuild_kb_cache(acc_id, 'account');
   END LOOP;
 END $$;
+-- CIL[DOC-VECTOR type="context" content="purpose='Creates the kb-article-list type, rebuild cache function, cache trigger, and seeds cache records for existing accounts.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/007_kb_article_list.sql:kb_article_list:file"]

package/.framework/migrations/008_items_target.sql

@@ -1,3 +1,11 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/008_items_target.sql:items_target:file" type="file" identity="items_target" parent="~/.framework/migrations/008_items_target.sql"]
+-- CIL[DOC-MACRO purpose="Add target scoping columns to public.items so any item can be explicitly scoped to a person or account."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Apply schema migration that introduces target_type and target_id columns and an index for target-based lookups."]
+-- CIL[DOC-CONTEXT module="schema" layer="migration" related_files=".framework/migrations/008_items_target.sql"]
+-- CIL[DOC-CONTRACT inputs="Existing public.items table." outputs="public.items with target_type and target_id columns and idx_items_target index." errors="Fails if public.items does not exist or if the executing role lacks ALTER/CREATE INDEX privileges." side_effects="Modifies public.items table schema and creates a new index."]
+-- CIL[DOC-MICRO logic_summary="Use IF NOT EXISTS clauses to idempotently add target_type text and target_id uuid columns, then create a composite index on (target_type, target_id)." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Add target scoping columns to public.items to align with threads, links, and watchers.
 -- This lets any item (note, ticket, deal, etc.) be explicitly scoped to a person or account.
 
@@ -6,3 +14,10 @@ ALTER TABLE public.items
   ADD COLUMN IF NOT EXISTS target_id uuid;
 
 CREATE INDEX IF NOT EXISTS idx_items_target ON public.items (target_type, target_id);
+-- CIL[DOC-VECTOR type="context" content="purpose='Add target scoping columns to public.items so any item can be explicitly scoped to a person or account.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/008_items_target.sql:items_target:file"]

package/.framework/migrations/009_roles_slug_unique.sql

@@ -1,3 +1,11 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/009_roles_slug_unique.sql:roles_slug_unique:file" type="file" identity="roles_slug_unique" parent="~/.framework/migrations/009_roles_slug_unique.sql"]
+-- CIL[DOC-MACRO purpose="Ensure the public.roles slug column has a unique index, dropping any prior app_id+slug constraints."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Apply a one-time, idempotent schema change to enforce slug uniqueness across roles."]
+-- CIL[DOC-CONTEXT module="roles" layer="migrations" related_files=".framework/migrations/009_roles_slug_unique.sql"]
+-- CIL[DOC-CONTRACT inputs="public.roles table with slug column" outputs="Unique index roles_slug_key on public.roles(slug)" errors="Constraint-violation if duplicate slugs exist" side_effects="Drops roles_app_id_slug_key constraint and index if present"]
+-- CIL[DOC-MICRO logic_summary="Drops the old constraint and index, then creates a unique index on slug" notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Idempotent: safe for fresh (001 already has this) and existing DBs.
 -- If duplicates exist, the DBA must dedupe before running; this migration
 -- will fail with a clear constraint-violation error until they do.
@@ -9,3 +17,10 @@ DROP INDEX IF EXISTS roles_app_id_slug_key;
 
 CREATE UNIQUE INDEX IF NOT EXISTS roles_slug_key
   ON public.roles (slug);
+-- CIL[DOC-VECTOR type="context" content="purpose='Ensure the public.roles slug column has a unique index, dropping any prior app_id+slug constraints.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/009_roles_slug_unique.sql:roles_slug_unique:file"]

package/.framework/migrations/010_auth_user_trigger.sql

@@ -1,3 +1,11 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/010_auth_user_trigger.sql:auth_user_trigger:file" type="file" identity="auth_user_trigger" parent="~/.framework/migrations/010_auth_user_trigger.sql"]
+-- CIL[DOC-MACRO purpose="PostgreSQL trigger function and trigger that synchronizes newly created auth.users records into public.people, linking existing stubs and promoting the first user to system admin."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Keep the public.people table in sync with auth.users on insert, resolve pending or invited person stubs, and assign the first registered user the system_admin role."]
+-- CIL[DOC-CONTEXT module="auth" layer="migrations" related_files=".framework/migrations/010_auth_user_trigger.sql"]
+-- CIL[DOC-CONTRACT inputs="NEW auth.users row with id, email, raw_user_meta_data" outputs="Unchanged NEW row; public.people row inserted or updated" errors="No raised errors; warnings emitted if spine-system account or person type is missing" side_effects="Inserts or updates public.people and installs an AFTER INSERT trigger on auth.users"]
+-- CIL[DOC-MICRO logic_summary="Resolve the spine-system account and person type, then either link an existing pending/invited people stub by email or insert a new people record, assigning the system_admin role to the first registered user. Finally, drop and recreate the trigger." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Create trigger function to sync new auth users to people records
 CREATE OR REPLACE FUNCTION public.handle_new_auth_user()
 RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
@@ -80,3 +88,10 @@ DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
 CREATE TRIGGER on_auth_user_created
   AFTER INSERT ON auth.users
   FOR EACH ROW EXECUTE FUNCTION public.handle_new_auth_user();
+-- CIL[DOC-VECTOR type="context" content="purpose='PostgreSQL trigger function and trigger that synchronizes newly created auth.users records into public.people, linking existing stubs and promoting the first user to system admin.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/010_auth_user_trigger.sql:auth_user_trigger:file"]

package/.framework/migrations/011_spine_system_account.sql

@@ -1,3 +1,12 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/011_spine_system_account.sql:spine_system_account:file" type="file" identity="spine_system_account" parent="~/.framework/migrations/011_spine_system_account.sql"]
+-- CIL[DOC-MACRO purpose="Seed the account type and spine-system master account"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Ensure the runtime account type and master account exist for auth and registration flows"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/migrations/011_spine_system_account.sql"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="public.types row for account; public.accounts row for spine-system" errors="none" side_effects="Inserts rows into public.types and public.accounts when missing"]
+-- CIL[DOC-MICRO logic_summary="Inserts the account type into public.types with a full design schema if absent, then inserts the spine-system master account using that type if it does not already exist." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+
 -- Seed the account type and Spine system master account required by the auth trigger and existing-account registration flow
 
 -- Ensure the runtime account type exists
@@ -60,3 +69,10 @@ SELECT
 FROM public.types t
 WHERE t.kind = 'account' AND t.slug = 'account'
   AND NOT EXISTS (SELECT 1 FROM public.accounts a WHERE a.slug = 'spine-system');
+-- CIL[DOC-VECTOR type="context" content="purpose='Seed the account type and spine-system master account'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/011_spine_system_account.sql:spine_system_account:file"]

package/.framework/migrations/012_service_role_grants.sql

@@ -1,3 +1,12 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/012_service_role_grants.sql:service_role_grants:file" type="file" identity="service_role_grants" parent="~/.framework/migrations/012_service_role_grants.sql"]
+-- CIL[DOC-MACRO purpose="Define core schema privileges for Supabase auth roles to enable first-user registration and auth lookups."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Grant usage, select, and CRUD privileges on the public schema to anon, authenticated, and service_role, and set default privileges for future objects."]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/012_service_role_grants.sql"]
+-- CIL[DOC-CONTRACT inputs="SQL execution context in a Supabase migration" outputs="Granted privileges on public schema and default privileges for auth roles" errors="Migration failure if roles or schema public are missing" side_effects="Modifies database grants and default privileges for future objects"]
+-- CIL[DOC-MICRO logic_summary="Grant USAGE on schema public to anon, authenticated, and service_role; grant SELECT on all tables and sequences to authenticated; grant full CRUD on tables and sequences to service_role; configure default privileges for future objects." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+
 -- Spine v2: core schema privileges for Supabase auth roles
 --
 -- Without these grants, a fresh Supabase project denies "schema public"
@@ -20,3 +29,10 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO authenticate
 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO authenticated;
 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO service_role;
+-- CIL[DOC-VECTOR type="context" content="purpose='Define core schema privileges for Supabase auth roles to enable first-user registration and auth lookups.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/012_service_role_grants.sql:service_role_grants:file"]

package/.framework/migrations/013_get_account_apps_role_filter.sql

@@ -1,3 +1,11 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/013_get_account_apps_role_filter.sql:get_account_apps_role_filter:file" type="file" identity="get_account_apps_role_filter" parent="~/.framework/migrations/013_get_account_apps_role_filter.sql"]
+-- CIL[DOC-MACRO purpose="Adds role-based filtering to the public.get_account_apps function so non-system-admin users only see apps allowed by their assigned role slugs."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Define the security-definer get_account_apps SQL function, including overload cleanup and role-aware access filtering."]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/013_get_account_apps_role_filter.sql"]
+-- CIL[DOC-CONTRACT inputs="uuid account_id, boolean include_system=true, boolean include_inactive=false, text[] user_role_slugs=null, boolean is_system_admin=false" outputs="TABLE of app columns filtered by ownership, active state, and role requirements" errors="none" side_effects="Drops and recreates get_account_apps function overloads in the public schema."]
+-- CIL[DOC-MICRO logic_summary="Drops overloaded get_account_apps signatures, then creates a security-definer function returning app rows. Filters combine active/owner/system rules with optional role checks: when user_role_slugs is provided and the caller is not a system admin, only apps with matching required_roles or min_role are returned." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Update get_account_apps to support role-based filtering.
 -- This signature matches the .rpc call in .framework/functions/apps.ts,
 -- which passes user_role_slugs and is_system_admin.
@@ -98,3 +106,10 @@ BEGIN
     a.name;
 END;
 $$;
+-- CIL[DOC-VECTOR type="context" content="purpose='Adds role-based filtering to the public.get_account_apps function so non-system-admin users only see apps allowed by their assigned role slugs.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/013_get_account_apps_role_filter.sql:get_account_apps_role_filter:file"]

package/.framework/migrations/014_apps_required_roles.sql

@@ -1,3 +1,12 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/014_apps_required_roles.sql:apps_required_roles:file" type="file" identity="apps_required_roles" parent="~/.framework/migrations/014_apps_required_roles.sql"]
+-- CIL[DOC-MACRO purpose="Adds and backfills a required_roles jsonb column on the public.apps table so that app records can carry a list of roles needed for access."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Schema migration: add required_roles column to public.apps and backfill from min_role."]
+-- CIL[DOC-CONTEXT module="framework" layer="migrations" related_files=".framework/migrations/014_apps_required_roles.sql"]
+-- CIL[DOC-CONTRACT inputs="public.apps table with existing min_role column" outputs="public.apps table with required_roles jsonb column populated for rows having min_role" errors="SQL execution errors, jsonb cast issues" side_effects="Adds column if missing; updates existing rows."]
+-- CIL[DOC-MICRO logic_summary="Add required_roles jsonb defaulting to empty array; then set it to a jsonb array containing the existing min_role for rows with min_role and empty/null required_roles." notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+
 -- Add required_roles jsonb column to apps table for get_account_apps filtering.
 ALTER TABLE public.apps
   ADD COLUMN IF NOT EXISTS required_roles jsonb DEFAULT '[]'::jsonb;
@@ -7,3 +16,10 @@ UPDATE public.apps
 SET required_roles = jsonb_build_array(min_role)
 WHERE min_role IS NOT NULL
   AND (required_roles = '[]'::jsonb OR required_roles IS NULL);
+-- CIL[DOC-VECTOR type="context" content="purpose='Adds and backfills a required_roles jsonb column on the public.apps table so that app records can carry a list of roles needed for access.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/014_apps_required_roles.sql:apps_required_roles:file"]

package/.framework/migrations/015_types_kind_slug_unique.sql

@@ -1,5 +1,20 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/015_types_kind_slug_unique.sql:types_kind_slug_unique:file" type="file" identity="types_kind_slug_unique" parent="~/.framework/migrations/015_types_kind_slug_unique.sql"]
+-- CIL[DOC-MACRO purpose="Enforce global uniqueness of type slugs across all apps"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Ensure deterministic resolveTypeId and resolveTypeRecord single lookups for shared kind/slug values"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/migrations/015_types_kind_slug_unique.sql"]
+-- CIL[DOC-CONTRACT inputs="public.types table with kind and slug columns" outputs="types_kind_slug_unique unique index on public.types(kind, slug)" errors="Duplicate (kind, slug) values cause uniqueness violation" side_effects="Creates a database index that enforces uniqueness on public.types writes"]
+-- CIL[DOC-MICRO logic_summary="Create a unique composite index IF NOT EXISTS on public.types(kind, slug)" notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
 -- Enforce global uniqueness of type slugs across all apps.
 -- This lets multiple apps share the same kind/slug (e.g. funnel_signal, support_ticket)
 -- and makes resolveTypeId/resolveTypeRecord .single() lookups deterministic.
 CREATE UNIQUE INDEX IF NOT EXISTS types_kind_slug_unique
   ON public.types (kind, slug);
+-- CIL[DOC-VECTOR type="context" content="purpose='Enforce global uniqueness of type slugs across all apps'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/015_types_kind_slug_unique.sql:types_kind_slug_unique:file"]

package/.framework/migrations/016_cil_types.sql

@@ -0,0 +1,281 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/016_cil_types.sql:cil_types:file" type="file" identity="cil_types" parent="~/.framework/migrations/016_cil_types.sql"]
+-- CIL[DOC-MACRO purpose="Upsert core CIL runtime types and link relation types for spine-core"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Ensure public.types and public.link_types contain the CIL account, project, file, chunk, proposal, config, learning, version, suggestion, and link-type rows needed by the CIL pipeline"]
+-- CIL[DOC-CONTEXT module="migrations" layer="framework" related_files=".framework/migrations/016_cil_types.sql"]
+-- CIL[DOC-CONTRACT inputs="Existing public.apps row with slug 'spine-core'" outputs="Active type and link_type rows for all CIL kinds" errors="NULL app_id selected if spine-core app missing" side_effects="Inserts or updates rows in public.types and public.link_types"]
+-- CIL[DOC-MICRO logic_summary="Resolves the spine-core app id, then loops through UPSERT statements for each CIL item type and each CIL link type using ON CONFLICT (kind, slug) / (app_id, slug)" notable_decisions="[]"]
+-- CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL types: move to core, add version/suggestion types, align permissions and stable-ID fields.
+-- This migration upserts types on (kind, slug) so existing CIL records keep their type_id.
+DO $$
+DECLARE
+  v_spine_core_app_id uuid;
+BEGIN
+  SELECT id INTO v_spine_core_app_id FROM public.apps WHERE slug = 'spine-core' LIMIT 1;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_project',
+  'CIL Project',
+  'A codebase registered in the Code Intelligence Layer for graph ingestion and analysis',
+  'folder-git-2',
+  '#6366F1',
+  $DESIGN${"scope":"account","fields":{"repo_path":{"label":"Repository Path","data_type":"text","required":false},"language_mix":{"label":"Languages","data_type":"text","required":false},"file_count":{"label":"File Count","data_type":"number","required":false},"chunk_count":{"label":"Chunk Count","data_type":"number","required":false},"ingestion_status":{"label":"Ingestion Status","data_type":"select","options":[{"label":"Not Started","value":"not_started"},{"label":"In Progress","value":"in_progress"},{"label":"Complete","value":"complete"}],"required":false},"total_ingestion_cost_usd":{"label":"Total Ingestion Cost (USD)","data_type":"number","required":false},"last_ingested_at":{"label":"Last Ingested At","data_type":"text","required":false},"kb_type":{"label":"KB Type","data_type":"text","required":false},"npm_name":{"data_type":"text","label":"NPM Package Name","required":true},"canonical_root":{"data_type":"text","label":"Canonical Root","required":false},"active_version_id":{"data_type":"text","label":"Active Version ID","required":false},"default_version_id":{"data_type":"text","label":"Default Version ID","required":false},"dependencies":{"data_type":"json","label":"Dependencies","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null,"vector_types":["semantic"]}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_file',
+  'CIL File',
+  'A source file within a CIL project — tracks ingestion pass, hash, and dead code status',
+  'file-code-2',
+  '#8B5CF6',
+  $DESIGN${"scope":"account","fields":{"file_path":{"label":"File Path","data_type":"text","required":false},"language":{"label":"Language","data_type":"text","required":false},"project_id":{"label":"Project ID","data_type":"text","required":false},"stored_hash":{"label":"Stored Hash","data_type":"text","required":false},"ingestion_pass":{"label":"Ingestion Pass","data_type":"number","required":false},"chunk_count":{"label":"Chunk Count","data_type":"number","required":false},"has_existing_markers":{"label":"Had Existing Markers","data_type":"boolean","required":false},"is_dead_code":{"label":"Dead Code","data_type":"boolean","required":false},"git_last_commit":{"label":"Git Last Commit","data_type":"text","required":false},"existing_marker_agreement_count":{"label":"Marker Agreement Count","data_type":"number","required":false},"existing_marker_disagreement_count":{"label":"Marker Disagreement Count","data_type":"number","required":false},"line_count":{"label":"Line Count","data_type":"number","required":false},"existing_marker_names":{"label":"Existing Marker Names","data_type":"text","required":false},"existing_marker_count":{"label":"Existing Marker Count","data_type":"number","required":false},"kb_type":{"label":"KB Type","data_type":"text","required":false},"stable_id":{"data_type":"text","label":"Stable ID","required":true},"version_id":{"data_type":"text","label":"Version ID","required":true},"file_hash":{"data_type":"text","label":"File Hash","required":false},"content_hash":{"data_type":"text","label":"Content Hash","required":false},"dead_reason":{"data_type":"text","label":"Dead Reason","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_chunk',
+  'CIL Chunk',
+  'A semantically meaningful chunk within a CIL file — carries inline contract, hash, and graph edges',
+  'code-2',
+  '#10B981',
+  $DESIGN${"scope":"account","fields":{"chunk_name":{"label":"Chunk Name","data_type":"text","required":false},"file_id":{"label":"File ID","data_type":"text","required":false},"project_id":{"label":"Project ID","data_type":"text","required":false},"file_path":{"label":"File Path","data_type":"text","required":false},"line_start":{"label":"Line Start","data_type":"number","required":false},"line_end":{"label":"Line End","data_type":"number","required":false},"chunk_type":{"label":"Chunk Type","data_type":"select","options":[{"label":"Function","value":"function"},{"label":"Class","value":"class"},{"label":"Interface","value":"interface"},{"label":"Type","value":"type"},{"label":"Component","value":"component"},{"label":"Hook","value":"hook"},{"label":"Route","value":"route"},{"label":"Config","value":"config"}],"required":false},"stored_hash":{"label":"Stored Hash","data_type":"text","required":false},"boundary_confidence":{"label":"Boundary Confidence","data_type":"select","options":[{"label":"High","value":"high"},{"label":"Low","value":"low"},{"label":"Human Verified","value":"human_verified"}],"required":false},"boundary_source":{"label":"Boundary Source","data_type":"select","options":[{"label":"AST Auto","value":"ast_auto"},{"label":"AST Approved","value":"ast_approved"},{"label":"Human Override","value":"human_override"}],"required":false},"review_status":{"label":"Review Status","data_type":"select","options":[{"label":"Pending Review","value":"pending_review"},{"label":"Approved","value":"approved"},{"label":"Rejected","value":"rejected"}],"required":false},"doc_confidence":{"label":"Doc Confidence","data_type":"select","options":[{"label":"AI Generated","value":"ai_generated"},{"label":"Human Verified","value":"human_verified"},{"label":"Unverified Legacy","value":"unverified_legacy"}],"required":false},"is_dead_code":{"label":"Dead Code","data_type":"boolean","required":false},"description":{"label":"Description","data_type":"textarea","required":false},"macro":{"label":"Macro (Purpose)","data_type":"text","required":false},"micro":{"label":"Micro (Detail)","data_type":"text","required":false},"input_spec":{"label":"Input Spec","data_type":"textarea","required":false},"output_spec":{"label":"Output Spec","data_type":"text","required":false},"throws":{"label":"Throws","data_type":"text","required":false},"side_effects":{"label":"Side Effects","data_type":"text","required":false},"calls":{"label":"Calls","data_type":"text","required":false},"called_by":{"label":"Called By","data_type":"text","required":false},"error_handling":{"label":"Error Handling","data_type":"text","required":false},"tags":{"label":"Tags","data_type":"text","required":false},"complexity":{"label":"Complexity","data_type":"select","options":[{"label":"Simple","value":"simple"},{"label":"Moderate","value":"moderate"},{"label":"Complex","value":"complex"}],"required":false},"stability":{"label":"Stability","data_type":"select","options":[{"label":"Stable","value":"stable"},{"label":"Internal","value":"internal"},{"label":"Experimental","value":"experimental"},{"label":"Deprecated","value":"deprecated"}],"required":false},"module":{"label":"Module Name","data_type":"text","required":false},"audience":{"label":"Audience","data_type":"select","options":[{"label":"Internal","value":"internal"},{"label":"External","value":"external"},{"label":"Both","value":"both"}],"required":false},"layer":{"label":"Layer","data_type":"select","options":[{"label":"Shared Core","value":"shared-core"},{"label":"App Specific","value":"app-specific"},{"label":"Infrastructure","value":"infrastructure"},{"label":"Test","value":"test"}],"required":false},"see_also":{"label":"See Also","data_type":"textarea","required":false},"doc_validation_errors":{"label":"Doc Validation Errors","data_type":"text","required":false},"test_unit_path":{"label":"Unit Test Path","data_type":"text","required":false},"test_e2e_path":{"label":"E2E Test Path","data_type":"text","required":false},"token_count":{"label":"Token Count","data_type":"number","required":false},"existing_marker_agreement":{"label":"Existing Marker Agreement","data_type":"select","options":[{"label":"None (no prior marker)","value":"none"},{"label":"Agreed","value":"agreed"},{"label":"Disagreed","value":"disagreed"}],"required":false},"code_content":{"label":"Code Content","data_type":"textarea","required":false},"hash_updated_at":{"label":"Hash Updated At","data_type":"text","required":false},"kb_type":{"label":"KB Type","data_type":"text","required":false},"stable_id":{"data_type":"text","label":"Stable ID","required":true},"version_id":{"data_type":"text","label":"Version ID","required":true},"parent_stable_id":{"data_type":"text","label":"Parent Stable ID","required":false},"content_hash":{"data_type":"text","label":"Content Hash","required":false},"file_hash":{"data_type":"text","label":"File Hash","required":false},"legacy_chunk_id":{"data_type":"text","label":"Legacy Chunk ID","required":false},"embedding_types":{"data_type":"json","label":"Embedding Types","required":false},"embedding_ids":{"data_type":"json","label":"Embedding IDs","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null,"vector_types":["semantic","structural","contract"],"embedding_fields":{"structural":["chunk_type","file_path","stability","is_dead_code","boundary_confidence","doc_confidence","review_status"]}}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_chunk_proposal',
+  'CIL Chunk Proposal',
+  'Staged low-confidence chunk boundary proposal awaiting human or Devin review before being written to source file',
+  'git-pull-request',
+  '#F59E0B',
+  $DESIGN${"scope":"account","fields":{"file_id":{"label":"File ID","data_type":"text","required":false},"project_id":{"label":"Project ID","data_type":"text","required":false},"file_path":{"label":"File Path","data_type":"text","required":false},"proposed_name":{"label":"Proposed Chunk Name","data_type":"text","required":false},"line_start":{"label":"Line Start","data_type":"number","required":false},"line_end":{"label":"Line End","data_type":"number","required":false},"chunk_type":{"label":"Chunk Type","data_type":"text","required":false},"confidence_score":{"label":"Confidence Score","data_type":"number","required":false},"confidence_reasons":{"label":"Confidence Reasons","data_type":"text","required":false},"existing_marker_match":{"label":"Matches Existing Marker","data_type":"boolean","required":false},"existing_marker_name":{"label":"Existing Marker Name","data_type":"text","required":false},"review_status":{"label":"Review Status","data_type":"select","options":[{"label":"Pending Review","value":"pending_review"},{"label":"Approved","value":"approved"},{"label":"Rejected","value":"rejected"},{"label":"Merged","value":"merged"}],"required":false},"reviewed_by":{"label":"Reviewed By","data_type":"text","required":false},"reviewed_at":{"label":"Reviewed At","data_type":"text","required":false},"adjusted_line_start":{"label":"Adjusted Line Start","data_type":"number","required":false},"adjusted_line_end":{"label":"Adjusted Line End","data_type":"number","required":false},"token_count":{"label":"Token Count","data_type":"number","required":false},"code_preview":{"label":"Code Preview","data_type":"text","required":false},"stable_id":{"data_type":"text","label":"Stable ID","required":false},"version_id":{"data_type":"text","label":"Version ID","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_config',
+  'CIL Config',
+  'Config field contract — what a setting means, what each value drives downstream, and how to query the current value',
+  'settings-2',
+  '#EF4444',
+  $DESIGN${"scope":"account","fields":{"config_table":{"label":"Config Table","data_type":"text","required":false},"record_slug":{"label":"Record Slug","data_type":"text","required":false},"field_name":{"label":"Field Name","data_type":"text","required":false},"field_type":{"label":"Field Type","data_type":"text","required":false},"allowed_range":{"label":"Allowed Range","data_type":"text","required":false},"default_value":{"label":"Default Value","data_type":"text","required":false},"description":{"label":"Description","data_type":"text","required":false},"settings":{"label":"Settings (JSON)","data_type":"text","required":false},"current_value_query":{"label":"Current Value Query","data_type":"text","required":false},"current_value_query_type":{"label":"Query Type","data_type":"select","options":[{"label":"SQL","value":"sql"},{"label":"JSON Path","value":"json_path"},{"label":"Env Var","value":"env"}],"required":false},"code_edge_chunk_ids":{"label":"Code Edge Chunk IDs","data_type":"text","required":false},"project_id":{"label":"Project ID","data_type":"text","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null,"vector_types":["semantic"]}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_learning_proposal',
+  'CIL Learning Proposal',
+  'Developer-review queue entry for CIL learning extracted from a support case',
+  'git-pull-request',
+  '#10B981',
+  $DESIGN${"scope":"account","fields":{"ticket_id":{"label":"Ticket ID","data_type":"text","required":false},"thread_id":{"label":"Thread ID","data_type":"text","required":false},"ai_message_id":{"label":"AI Message ID","data_type":"text","required":false},"proposed_summary":{"label":"Proposed Summary","data_type":"textarea","required":true},"source_message_ids":{"label":"Source Message IDs","data_type":"json","required":false},"source_chunk_ids":{"label":"Source Chunk IDs","data_type":"json","required":false},"proposed_tags":{"label":"Proposed Tags","data_type":"json","required":false},"status":{"label":"Status","data_type":"select","required":true,"options":[{"label":"Draft","value":"draft"},{"label":"Submitted for Developer Review","value":"submitted_for_developer_review"},{"label":"In Review","value":"in_review"},{"label":"Approved","value":"approved"},{"label":"Applied","value":"applied"},{"label":"Rejected","value":"rejected"}]},"submitted_at":{"label":"Submitted At","data_type":"text","required":false},"reviewed_by":{"label":"Reviewed By","data_type":"text","required":false},"review_notes":{"label":"Developer Review Notes","data_type":"textarea","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'system',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_version',
+  'CIL Version',
+  'A published or iteration version of a CIL project, aligned to npm semver.',
+  'tag',
+  '#6366F1',
+  $DESIGN${"scope":"account","fields":{"project_id":{"data_type":"text","label":"Project ID","required":true},"version":{"data_type":"text","label":"Version","required":true},"base_version":{"data_type":"text","label":"Base Version","required":false},"status":{"data_type":"select","label":"Status","required":true,"options":[{"label":"Active","value":"active"},{"label":"Inactive","value":"inactive"},{"label":"Archived","value":"archived"}]},"is_iteration":{"data_type":"boolean","label":"Is Iteration","required":true},"published_version_id":{"data_type":"text","label":"Published Version ID","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+INSERT INTO public.types (id, app_id, kind, slug, name, description, icon, color, design_schema, validation_schema, ownership, is_active)
+VALUES (
+  gen_random_uuid(),
+  v_spine_core_app_id,
+  'item',
+  'cil_suggestion',
+  'CIL Suggestion',
+  'Pending AI or human suggestion for a CIL learning, note, or KB link awaiting review.',
+  'lightbulb',
+  '#F59E0B',
+  $DESIGN${"scope":"account","fields":{"project_id":{"data_type":"text","label":"Project ID","required":true},"version_id":{"data_type":"text","label":"Version ID","required":false},"target_stable_id":{"data_type":"text","label":"Target Stable ID","required":false},"suggestion_type":{"data_type":"select","label":"Suggestion Type","required":true,"options":[{"label":"Learning","value":"learning"},{"label":"Note","value":"note"},{"label":"KB Link","value":"kb_link"}]},"content":{"data_type":"textarea","label":"Content","required":true},"source":{"data_type":"text","label":"Source","required":false},"confidence":{"data_type":"number","label":"Confidence","required":false},"status":{"data_type":"select","label":"Status","required":true,"options":[{"label":"Pending","value":"pending"},{"label":"Accepted","value":"accepted"},{"label":"Rejected","value":"rejected"},{"label":"Escalated","value":"escalated"}]},"proposed_by":{"data_type":"select","label":"Proposed By","required":false,"options":[{"label":"AI","value":"ai"},{"label":"Human","value":"human"},{"label":"System","value":"system"}]},"reviewed_by":{"data_type":"text","label":"Reviewed By","required":false},"reviewed_at":{"data_type":"text","label":"Reviewed At","required":false}},"record_permissions":{"system_admin":["create","read","update","delete"],"engineering_admin":["create","read","update","delete"],"engineering":["create","read","update"],"devops":["create","read","update"],"product":["create","read","update"],"docs":["create","read","update"],"qa":["create","read","update"],"management":["create","read","update"],"support_admin":["create","read","update"],"support":["read"],"csm":["read"],"tam":["read"],"sales":["read"],"member_admin":["read","update"],"member":["read"]},"functionality":null}$DESIGN$::jsonb,
+  '{}'::jsonb,
+  'tenant',
+  true
+)
+ON CONFLICT (kind, slug) DO UPDATE SET
+  app_id = EXCLUDED.app_id,
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  icon = EXCLUDED.icon,
+  color = EXCLUDED.color,
+  design_schema = EXCLUDED.design_schema,
+  validation_schema = EXCLUDED.validation_schema,
+  ownership = EXCLUDED.ownership,
+  is_active = EXCLUDED.is_active;
+
+END $$;
+
+-- CIL link types
+DO $$
+DECLARE v_spine_core_app_id uuid;
+BEGIN
+  SELECT id INTO v_spine_core_app_id FROM public.apps WHERE slug = 'spine-core' LIMIT 1;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_calls', 'CIL Calls', 'Source chunk calls target chunk', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_imports', 'CIL Imports', 'Source file imports target file or chunk', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_parent_child', 'CIL Parent/Child', 'Source chunk contains or defines target child', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_configures', 'CIL Configures', 'Source chunk reads or writes target config', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_tests', 'CIL Tests', 'Source chunk tests target chunk', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_kb_reference', 'CIL KB Reference', 'Source chunk references a KB article', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+INSERT INTO public.link_types (id, app_id, slug, name, description, is_active)
+VALUES (gen_random_uuid(), v_spine_core_app_id, 'cil_suggestion_target', 'CIL Suggestion Target', 'Suggestion targets a specific CIL chunk', true)
+ON CONFLICT (app_id, slug) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  is_active = EXCLUDED.is_active;
+END $$;
+-- CIL[DOC-VECTOR type="context" content="purpose='Upsert core CIL runtime types and link relation types for spine-core'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+-- CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+-- CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+-- CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+-- CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+-- CIL[END stable_id="~/.framework/migrations/016_cil_types.sql:cil_types:file"]