spine-framework 0.3.145 → 0.4.0

package/.framework/migrations/042_registration_hierarchy.sql

@@ -0,0 +1,309 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/042_registration_hierarchy.sql:registration_hierarchy:file" type="file" identity="registration_hierarchy" parent="~/.framework/migrations/042_registration_hierarchy.sql"]
+-- CIL[DOC-MACRO purpose="Make spine-system a staff-only root: null-account signups, people self-read, and uniform actor resolution across all account-scoped RLS policies."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Stop routing generic signups into spine-system, let people read their own row pre-assignment, replace auth.uid() with public.current_actor_id() in every account-scoped policy, parent existing root accounts under spine-system, and retire demo account expiry markers."]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/002_core_rls_and_functions.sql,.framework/migrations/010_auth_user_trigger.sql,.framework/migrations/006_security_hardening_rls.sql,.framework/functions/invites.ts"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="Updated trigger, RLS policies, and account rows" errors="SQL errors if referenced objects are missing" side_effects="Alters people.account_id nullability; replaces handle_new_auth_user; drops and recreates RLS policies; updates accounts.parent_id and accounts.data; updates apps.config.registration for known slugs"]
+-- CIL[DOC-MICRO logic_summary="people.account_id becomes nullable so non-invited signups carry no account until completeRegistration assigns one; people_access gains self-read; all policies that resolved the actor through auth.uid() now use current_actor_id() so invited users (people.id != auth.users.id) see threads/messages/links/attachments/embeddings consistently; non-system root accounts are re-parented to spine-system and expires_at/demo_expired markers are cleared." notable_decisions="spine-system is reserved for the first user (system_admin) and invited staff; hierarchy visibility flows parent->child via get_accessible_accounts"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- Registration + account hierarchy hardening.
+--
+-- Background:
+--   * handle_new_auth_user() (010) placed EVERY signup in spine-system, which
+--     becomes unsafe once customer accounts are children of spine-system —
+--     any stray member would gain descendant visibility.
+--   * Policies created in 002/004/006 resolved the actor via auth.uid(),
+--     which only equals people.id for self-signups. Invited users have a
+--     stub-generated people.id, so they could not read threads/messages/etc.
+--   * Customer accounts were created as roots (no parent_id), so
+--     get_accessible_accounts() never reached them for staff users.
+--   * accounts.data.expires_at drove the demo expiry sweep; demo signups are
+--     real support-portal customers now, so expiry markers are removed.
+
+-- ============================================
+-- 1. people.account_id becomes nullable.
+--    Non-invited signups start unassigned; completeRegistration assigns them.
+-- ============================================
+ALTER TABLE public.people ALTER COLUMN account_id DROP NOT NULL;
+
+-- ============================================
+-- 2. Signup trigger: only the first user (system_admin) and invited/pending
+--    stubs are attached to an account. Everyone else starts with
+--    account_id = NULL until they complete registration.
+-- ============================================
+CREATE OR REPLACE FUNCTION public.handle_new_auth_user()
+RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
+DECLARE
+  v_account_id         uuid;
+  v_type_id            uuid;
+  v_role_id            uuid;
+  v_is_first           boolean;
+  v_design_schema      jsonb;
+  v_validation_schema  jsonb;
+  v_stub_id            uuid;
+  v_stub_status        text;
+BEGIN
+  SELECT id, design_schema, validation_schema
+    INTO v_type_id, v_design_schema, v_validation_schema
+  FROM public.types WHERE kind = 'person' AND slug = 'person' LIMIT 1;
+
+  IF v_type_id IS NULL THEN
+    RAISE WARNING 'handle_new_auth_user: person type not found — skipping';
+    RETURN NEW;
+  END IF;
+
+  SELECT id, status
+    INTO v_stub_id, v_stub_status
+  FROM public.people
+  WHERE email = NEW.email
+    AND status IN ('invited', 'pending')
+    AND auth_uid IS NULL
+  LIMIT 1;
+
+  IF v_stub_id IS NOT NULL THEN
+    UPDATE public.people SET
+      auth_uid   = NEW.id,
+      full_name  = COALESCE(NEW.raw_user_meta_data->>'full_name', full_name, split_part(NEW.email, '@', 1)),
+      status     = CASE WHEN v_stub_status = 'invited' THEN 'active' ELSE 'pending' END,
+      updated_at = now()
+    WHERE id = v_stub_id;
+
+    RETURN NEW;
+  END IF;
+
+  SELECT NOT EXISTS (SELECT 1 FROM public.people LIMIT 1) INTO v_is_first;
+  IF v_is_first THEN
+    SELECT id INTO v_role_id FROM public.roles WHERE slug = 'system_admin' LIMIT 1;
+    SELECT id INTO v_account_id FROM public.accounts WHERE slug = 'spine-system' LIMIT 1;
+  END IF;
+
+  -- Non-first, non-invited users get no account and no role here.
+  -- completeRegistration assigns both from the app's installed config.
+  INSERT INTO public.people (
+    id,
+    auth_uid,
+    email,
+    full_name,
+    account_id,
+    type_id,
+    role_id,
+    status,
+    is_active,
+    design_schema,
+    validation_schema
+  ) VALUES (
+    NEW.id,
+    NEW.id,
+    NEW.email,
+    COALESCE(NEW.raw_user_meta_data->>'full_name', split_part(NEW.email, '@', 1)),
+    v_account_id,
+    v_type_id,
+    v_role_id,
+    'active',
+    true,
+    v_design_schema,
+    COALESCE(v_validation_schema, '{}'::jsonb)
+  )
+  ON CONFLICT (id) DO NOTHING;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.handle_new_auth_user();
+
+-- ============================================
+-- 3. people: a person can always read their own row, even before they have
+--    an account. Without this, null-account users cannot resolve their
+--    principal or /api/auth context to finish registration.
+-- ============================================
+DROP POLICY IF EXISTS people_access ON public.people;
+CREATE POLICY people_access ON public.people FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
+         OR id = public.current_actor_id());
+
+-- ============================================
+-- 4. Normalize actor resolution: auth.uid() -> public.current_actor_id().
+--    get_accessible_accounts expects a people.id; auth.uid() only coincides
+--    with it for self-signups, so invited members were invisible to these
+--    policies. This is what makes account access cover tickets AND their
+--    threads/messages/links/attachments/watchers/embeddings uniformly.
+-- ============================================
+
+DROP POLICY IF EXISTS threads_access ON public.threads;
+CREATE POLICY threads_access ON public.threads FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS messages_access ON public.messages;
+CREATE POLICY messages_access ON public.messages FOR ALL
+  USING (EXISTS (SELECT 1 FROM public.threads t
+                 WHERE t.id = messages.thread_id
+                 AND t.account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))));
+
+DROP POLICY IF EXISTS links_access ON public.links;
+CREATE POLICY links_access ON public.links FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS attachments_access ON public.attachments;
+CREATE POLICY attachments_access ON public.attachments FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS watchers_access ON public.watchers;
+CREATE POLICY watchers_access ON public.watchers FOR ALL
+  USING (account_id IS NULL
+         OR account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS link_types_access ON public.link_types;
+CREATE POLICY link_types_access ON public.link_types FOR ALL
+  USING (app_id IS NULL
+         OR EXISTS (SELECT 1 FROM public.apps a WHERE a.id = link_types.app_id
+                    AND a.owner_account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))));
+
+DROP POLICY IF EXISTS pipelines_access ON public.pipelines;
+CREATE POLICY pipelines_access ON public.pipelines FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS pe_access ON public.pipeline_executions;
+CREATE POLICY pe_access ON public.pipeline_executions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS triggers_access ON public.triggers;
+CREATE POLICY triggers_access ON public.triggers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS te_access ON public.trigger_executions;
+CREATE POLICY te_access ON public.trigger_executions FOR ALL
+  USING (EXISTS (SELECT 1 FROM public.triggers t
+                 WHERE t.id = trigger_executions.trigger_id
+                 AND t.account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))));
+
+DROP POLICY IF EXISTS timers_access ON public.timers;
+CREATE POLICY timers_access ON public.timers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS ai_agents_access ON public.ai_agents;
+CREATE POLICY ai_agents_access ON public.ai_agents FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS embeddings_access ON public.embeddings;
+CREATE POLICY embeddings_access ON public.embeddings FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS integrations_access ON public.integrations;
+CREATE POLICY integrations_access ON public.integrations FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS api_keys_access ON public.api_keys;
+CREATE POLICY api_keys_access ON public.api_keys FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS akul_access ON public.api_key_usage_logs;
+CREATE POLICY akul_access ON public.api_key_usage_logs FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS webhook_handlers_access ON public.webhook_handlers;
+CREATE POLICY webhook_handlers_access ON public.webhook_handlers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS webhook_deliveries_access ON public.webhook_deliveries;
+CREATE POLICY webhook_deliveries_access ON public.webhook_deliveries FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS logs_access ON public.logs;
+CREATE POLICY logs_access ON public.logs FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS apps_access ON public.apps;
+CREATE POLICY apps_access ON public.apps FOR ALL
+  USING (is_system = true OR owner_account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS prompt_configs_access ON public.prompt_configs;
+CREATE POLICY prompt_configs_access ON public.prompt_configs FOR ALL
+  USING ((app_id IS NULL OR EXISTS (SELECT 1 FROM public.apps a
+          WHERE a.id = prompt_configs.app_id
+          AND (a.is_system = true
+               OR a.owner_account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))))));
+
+-- ============================================
+-- 5. Backfill: existing customer/demo root accounts become children of
+--    spine-system so staff get hierarchical read access. The
+--    update_account_paths trigger maintains the closure table on UPDATE.
+-- ============================================
+UPDATE public.accounts a
+SET parent_id = s.id, updated_at = now()
+FROM public.accounts s
+WHERE s.slug = 'spine-system'
+  AND a.parent_id IS NULL
+  AND a.id <> s.id;
+
+-- ============================================
+-- 6. Demo accounts are real support-portal customers — no expiry sweep.
+--    Clear legacy lifecycle markers (is_demo itself stays for funnel
+--    tagging and the demo rate-limit policy).
+-- ============================================
+UPDATE public.accounts
+SET data = data - 'expires_at' - 'demo_expired' - 'expired_at',
+    updated_at = now()
+WHERE data ?| ARRAY['expires_at', 'demo_expired', 'expired_at'];
+
+-- ============================================
+-- 7. Mirror each installed app's resolved registration policy onto
+--    apps.config.registration so completeRegistration can resolve
+--    strategy/role/target/parent server-side without trusting the client.
+--    Values match spine.config.json registration.apps.
+-- ============================================
+UPDATE public.apps SET config = COALESCE(config, '{}'::jsonb) || '{
+  "registration": {
+    "roles": ["member", "member_admin", "support", "support_admin", "sales", "csm", "tam", "engineering", "engineering_admin", "product", "docs", "qa", "devops", "management"],
+    "default_role": "member_admin",
+    "path": "/portal",
+    "enabled": true,
+    "account_strategy": "new",
+    "parent_account": "spine-system"
+  }
+}'::jsonb
+WHERE slug = 'portal';
+
+UPDATE public.apps SET config = COALESCE(config, '{}'::jsonb) || '{
+  "registration": {
+    "roles": ["member", "member_admin"],
+    "default_role": "member_admin",
+    "path": "/demo",
+    "enabled": true,
+    "account_strategy": "new",
+    "parent_account": "spine-system"
+  }
+}'::jsonb
+WHERE slug = 'demo';
+
+UPDATE public.apps SET config = COALESCE(config, '{}'::jsonb) || '{
+  "registration": {
+    "roles": ["support", "support_admin", "sales", "csm", "tam", "engineering", "engineering_admin", "product", "docs", "qa", "devops", "management"],
+    "default_role": "support",
+    "path": "/cortex",
+    "enabled": true,
+    "account_strategy": "existing",
+    "target_account": "spine-system"
+  }
+}'::jsonb
+WHERE slug = 'cortex';
+
+UPDATE public.apps SET config = COALESCE(config, '{}'::jsonb) || '{
+  "registration": {
+    "roles": ["engineering", "engineering_admin", "product", "docs", "qa", "devops", "management", "support", "support_admin", "sales", "csm", "tam"],
+    "default_role": "engineering",
+    "path": "/workbench",
+    "enabled": true,
+    "account_strategy": "existing",
+    "target_account": "spine-system"
+  }
+}'::jsonb
+WHERE slug = 'workbench';
+-- CIL[DOC-VECTOR type="context" content="purpose='Make spine-system a staff-only root: null-account signups, people self-read, and uniform actor resolution across all account-scoped RLS policies.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="Affects every account-scoped RLS policy; invited users gain correct access; anonymous signups lose spine-system placement" status="ready"]
+-- CIL[DOC-VECTOR type="configuration" content="Depends on public.get_accessible_accounts, public.current_actor_id, account_paths trigger from 002" status="ready"]
+-- CIL[DOC-VECTOR type="constraint" content="current_actor_id() requires is_active=true; deactivated people lose self-read" status="ready"]
+-- CIL[END stable_id="~/.framework/migrations/042_registration_hierarchy.sql:registration_hierarchy:file"]

package/.framework/migrations/043_policy_actor_cleanup.sql

@@ -0,0 +1,39 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/043_policy_actor_cleanup.sql:policy_actor_cleanup:file" type="file" identity="policy_actor_cleanup" parent="~/.framework/migrations/043_policy_actor_cleanup.sql"]
+-- CIL[DOC-MACRO purpose="Finish actor-resolution normalization: fix the auth.uid() policies missed by 042 and close remaining anonymous-access bypasses."]
+-- CIL[DOC-RESPONSIBILITY responsibility="Replace auth.uid() with public.current_actor_id() in actions/item_progress/schedules/schedule_executions policies, drop their OR auth.uid() IS NULL bypasses, and replace the webhook_handlers system-admin check that trusted user-editable raw_user_meta_data."]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/042_registration_hierarchy.sql,.framework/migrations/006_security_hardening_rls.sql"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="Recreated RLS policies" errors="SQL errors if referenced objects are missing" side_effects="Drops and recreates five RLS policies"]
+-- CIL[DOC-MICRO logic_summary="actions, item_progress, schedules, and schedule_executions get the standard accessible-accounts predicate via current_actor_id(); webhook_handlers_system_admin switches from auth.users.raw_user_meta_data->>'role' (client-controllable at signup) to person_is_system_admin(current_actor_id())." notable_decisions="OR auth.uid() IS NULL removed for parity with the 006 hardening pattern"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- Follow-up to 042: these four account-scoped tables still resolved the actor
+-- via auth.uid() AND retained the `OR auth.uid() IS NULL` anonymous bypass
+-- that 006 removed everywhere else. webhook_handlers_system_admin trusted
+-- raw_user_meta_data.role, which a user can set at signup — replace it with
+-- the people/roles-backed person_is_system_admin() check.
+
+DROP POLICY IF EXISTS actions_access ON public.actions;
+CREATE POLICY actions_access ON public.actions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS item_progress_access ON public.item_progress;
+CREATE POLICY item_progress_access ON public.item_progress FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS schedules_access ON public.schedules;
+CREATE POLICY schedules_access ON public.schedules FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS se_access ON public.schedule_executions;
+CREATE POLICY se_access ON public.schedule_executions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+DROP POLICY IF EXISTS webhook_handlers_system_admin ON public.webhook_handlers;
+CREATE POLICY webhook_handlers_system_admin ON public.webhook_handlers FOR ALL
+  USING (public.person_is_system_admin(public.current_actor_id()))
+  WITH CHECK (public.person_is_system_admin(public.current_actor_id()));
+-- CIL[DOC-VECTOR type="context" content="purpose='Finish actor-resolution normalization and close anonymous/user-metadata access bypasses.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="Anonymous PostgREST access to actions/item_progress/schedules/schedule_executions is revoked; webhook_handlers admin check now uses role table" status="ready"]
+-- CIL[DOC-VECTOR type="configuration" content="Depends on public.current_actor_id and public.person_is_system_admin from 002" status="ready"]
+-- CIL[DOC-VECTOR type="constraint" content="Any flow relying on unauthenticated access to these tables must authenticate; service_role is unaffected" status="ready"]
+-- CIL[END stable_id="~/.framework/migrations/043_policy_actor_cleanup.sql:policy_actor_cleanup:file"]

package/.framework/migrations/044_match_embeddings_filtered_knn.sql

@@ -0,0 +1,151 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/044_match_embeddings_filtered_knn.sql:match_embeddings_filtered_knn:file" type="file" identity="match_embeddings_filtered_knn" parent="~/.framework/migrations/044_match_embeddings_filtered_knn.sql"]
+-- CIL[DOC-MACRO purpose="Fix match_embeddings crowding-out for small tenants by routing selective searches to an exact filtered scan"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Replace the match_embeddings RPC so account-filtered semantic search returns correct results even when the candidate set is a tiny fraction of the embeddings table"]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/034_match_embeddings_knn.sql,.framework/functions/_shared/agent-runner.ts,.framework/functions/_shared/kb.ts"]
+-- CIL[DOC-CONTRACT inputs="existing public.match_embeddings function and embeddings table" outputs="replaced function with same signature and result shape" errors="requires pgvector >= 0.8 for hnsw.iterative_scan" side_effects="adds one indexed candidate-count query per non-document-targeted search"]
+-- CIL[DOC-MICRO logic_summary="The 034 oversample takes the global top-100 KNN rows and then applies account/type filters; in a table dominated by CIL chunks a small account's rows never reach the candidate window, so selective searches return empty. Now: count rows matching the selective filters via embeddings_active_idx; when the candidate set is <= 5000 run an exact filter-first scan (bounded and correct); otherwise keep the global oversample (dense candidate sets always fill the top-N window)" notable_decisions="candidate_count threshold 5000 keeps the KNN fast path for the ~19k-row platform corpus while restoring correctness for small tenants; document-targeted branch unchanged"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.9" flags="none"]
+-- CIL[DOC-STABILITY stability="experimental"]
+-- CIL[DOC-LEARNING topic="filtered_knn" content="KNN-first oversampling is only safe when the filtered candidate set is dense enough to occupy the oversample window; a 10-embedding account in a 19k-row table returns zero rows because the top-100 global neighbours contain no account rows. Exact filter-first scan is cheap precisely when crowding-out is a risk, so route by candidate count"]
+-- CIL[DOC-VECTOR type="context" content="purpose='Fix match_embeddings crowding-out for small tenants by routing selective searches to an exact filtered scan'; callers: agent-runner retrieveKnowledge, kb.ts search, cil-embeddings, embeddings.ts, eval-harness, custom_kb-embeddings"]
+-- CIL[DOC-VECTOR type="blast_radius" content="Same signature and result shape as 034; all match_embeddings callers get correct selective-filter results; small-account searches change from empty to populated"]
+-- CIL[DOC-VECTOR type="configuration" content="Requires pgvector 0.8+; function statement_timeout stays 25s; candidate-count query uses embeddings_active_idx (account_id, document_id WHERE approved_and_not_revoked)"]
+-- CIL[DOC-VECTOR type="constraint" content="Result shape and parameter signature unchanged; filter_document_ids branch unchanged; CANDIDATE_SCAN_LIMIT (5000) bounds the exact-scan path"]
+
+-- match_embeddings (034) oversamples the global KNN index (top 100+) and then
+-- applies account/vector_type/item_type filters. When the table is dominated
+-- by platform/CIL rows, a small tenant's embeddings never enter the
+-- oversample window — the account filter sees an empty candidate set and the
+-- search returns zero rows even for perfect matches.
+--
+-- The original filter-first form was removed in 034 because the planner
+-- mis-estimates large accounts and picks a btree scan + heapsort. Keep that
+-- fast path for dense candidate sets, but count candidates first (indexed by
+-- embeddings_active_idx): when the set is small, an exact filtered scan is
+-- both correct and cheap, so crowding-out cannot silently empty results.
+
+CREATE OR REPLACE FUNCTION public.match_embeddings(
+  query_embedding      vector(1536),
+  match_count          int            DEFAULT 10,
+  filter_account_ids   uuid[]         DEFAULT NULL,
+  filter_vector_type   text           DEFAULT NULL,
+  similarity_threshold float          DEFAULT 0.15,
+  filter_item_types    text[]         DEFAULT NULL,
+  filter_document_ids  text[]         DEFAULT NULL
+)
+RETURNS TABLE (
+  id              uuid,
+  document_id     text,
+  content         text,
+  metadata        jsonb,
+  account_id      uuid,
+  similarity      float
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+SET statement_timeout = '25s'
+AS $$
+DECLARE
+  candidate_count bigint;
+BEGIN
+  -- Document-targeted lookups stay filter-first: a global KNN oversample
+  -- would crowd out the requested documents before they can be scored.
+  IF filter_document_ids IS NOT NULL THEN
+    RETURN QUERY
+    SELECT
+      e.id,
+      e.document_id,
+      e.content,
+      e.metadata,
+      e.account_id,
+      1 - (e.embedding <=> query_embedding) AS similarity
+    FROM public.embeddings e
+    WHERE
+      (filter_account_ids IS NULL OR e.account_id = ANY(filter_account_ids))
+      AND (filter_vector_type IS NULL OR e.metadata->>'vector_type' = filter_vector_type)
+      AND (filter_item_types IS NULL OR e.metadata->>'item_type' = ANY(filter_item_types))
+      AND e.document_id = ANY(filter_document_ids)
+      AND e.approved_at IS NOT NULL
+      AND e.revoked_at IS NULL
+      AND (1 - (e.embedding <=> query_embedding)) >= similarity_threshold
+    ORDER BY e.embedding <=> query_embedding
+    LIMIT match_count;
+    RETURN;
+  END IF;
+
+  PERFORM set_config('hnsw.iterative_scan', 'strict_order', true);
+
+  -- Route by candidate density: a small filtered set would be crowded out of
+  -- the global oversample, but is cheap to scan exactly via the account index.
+  SELECT count(*) INTO candidate_count
+  FROM public.embeddings e
+  WHERE
+    (filter_account_ids IS NULL OR e.account_id = ANY(filter_account_ids))
+    AND (filter_vector_type IS NULL OR e.metadata->>'vector_type' = filter_vector_type)
+    AND (filter_item_types IS NULL OR e.metadata->>'item_type' = ANY(filter_item_types))
+    AND e.approved_at IS NOT NULL
+    AND e.revoked_at IS NULL;
+
+  IF candidate_count <= 5000 THEN
+    RETURN QUERY
+    SELECT
+      e.id,
+      e.document_id,
+      e.content,
+      e.metadata,
+      e.account_id,
+      1 - (e.embedding <=> query_embedding) AS similarity
+    FROM public.embeddings e
+    WHERE
+      (filter_account_ids IS NULL OR e.account_id = ANY(filter_account_ids))
+      AND (filter_vector_type IS NULL OR e.metadata->>'vector_type' = filter_vector_type)
+      AND (filter_item_types IS NULL OR e.metadata->>'item_type' = ANY(filter_item_types))
+      AND e.approved_at IS NOT NULL
+      AND e.revoked_at IS NULL
+      AND (1 - (e.embedding <=> query_embedding)) >= similarity_threshold
+    ORDER BY e.embedding <=> query_embedding
+    LIMIT match_count;
+    RETURN;
+  END IF;
+
+  -- Dense candidate set: the global KNN oversample is safe — the top-100
+  -- window will contain enough matching rows for the post-filters.
+  RETURN QUERY
+  SELECT
+    t.id,
+    t.document_id,
+    t.content,
+    t.metadata,
+    t.account_id,
+    t.similarity
+  FROM (
+    SELECT
+      e.id,
+      e.document_id,
+      e.content,
+      e.metadata,
+      e.account_id,
+      e.approved_at,
+      e.revoked_at,
+      1 - (e.embedding <=> query_embedding) AS similarity
+    FROM public.embeddings e
+    ORDER BY e.embedding <=> query_embedding
+    LIMIT GREATEST(match_count * 10, 100)
+  ) t
+  WHERE
+    (filter_account_ids IS NULL OR t.account_id = ANY(filter_account_ids))
+    AND (filter_vector_type IS NULL OR t.metadata->>'vector_type' = filter_vector_type)
+    AND (filter_item_types IS NULL OR t.metadata->>'item_type' = ANY(filter_item_types))
+    AND t.approved_at IS NOT NULL
+    AND t.revoked_at IS NULL
+    AND t.similarity >= similarity_threshold
+  ORDER BY t.similarity DESC
+  LIMIT match_count;
+END
+$$;
+
+GRANT EXECUTE ON FUNCTION public.match_embeddings(
+  vector(1536), int, uuid[], text, float, text[], text[]
+) TO authenticated, service_role;
+-- CIL[END stable_id="~/.framework/migrations/044_match_embeddings_filtered_knn.sql:match_embeddings_filtered_knn:file"]

package/.framework/migrations/045_security_critical_rls.sql

@@ -0,0 +1,139 @@
+-- CIL[BEGIN stable_id="~/.framework/migrations/045_security_critical_rls.sql:security_critical_rls:file" type="file" identity="security_critical_rls" parent="~/.framework/migrations/045_security_critical_rls.sql"]
+-- CIL[DOC-MACRO purpose="Close the remaining anonymous-access bypasses and the member self-write path on security-critical tables"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Drop OR current_actor_id() IS NULL from system_settings/accounts/roles, require authentication for system_settings reads, restrict all role writes to system admins, and split people_access so members can read themselves but cannot self-write role_id/account_id via PostgREST"]
+-- CIL[DOC-CONTEXT module="migrations" layer="database" related_files=".framework/migrations/006_security_hardening_rls.sql,.framework/migrations/043_policy_actor_cleanup.sql,.framework/migrations/042_registration_hierarchy.sql"]
+-- CIL[DOC-CONTRACT inputs="none" outputs="Recreated RLS policies" errors="SQL errors if referenced objects are missing" side_effects="Drops and recreates six RLS policies"]
+-- CIL[DOC-MICRO logic_summary="system_settings gets system-admin write + authenticated read; accounts loses its anonymous read branch; roles_modify becomes system-admin-only for both system and non-system roles; people_access splits into people_read (accessible accounts OR self) and people_write (accessible accounts only — no self-write bypass)" notable_decisions="roles_modify no longer allows any authenticated user to write non-system roles — role metadata is a trust anchor; people write policy has no self branch because admin-data performs record writes via adminDb after field-level permission checks, so no legitimate flow needs direct PostgREST self-update"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+
+-- system_settings: anonymous write (OR current_actor_id() IS NULL) allowed any
+-- anon-key PostgREST caller to INSERT/UPDATE/DELETE global config. The read
+-- policy is also USING (true); settings are only consumed server-side via
+-- adminDb (logging.ts), so reads now require an authenticated actor.
+DROP POLICY IF EXISTS system_settings_modify ON public.system_settings;
+CREATE POLICY system_settings_modify ON public.system_settings FOR ALL
+  USING (public.person_is_system_admin(public.current_actor_id()))
+  WITH CHECK (public.person_is_system_admin(public.current_actor_id()));
+
+DROP POLICY IF EXISTS system_settings_read ON public.system_settings;
+CREATE POLICY system_settings_read ON public.system_settings FOR SELECT
+  USING (public.current_actor_id() IS NOT NULL);
+
+-- accounts: anonymous read exposed the full customer list via the anon key.
+-- All public/invite flows resolve records through adminDb (service role
+-- bypasses RLS), so removing the bypass changes nothing legitimate.
+DROP POLICY IF EXISTS accounts_access ON public.accounts;
+CREATE POLICY accounts_access ON public.accounts FOR ALL
+  USING (id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+-- roles: the previous policy let unauthenticated callers write everything and
+-- let any authenticated user create or modify non-system roles. Role metadata
+-- feeds the permission engine — all writes are now system-admin only.
+-- roles_read (USING (true)) is untouched: slug lookup stays public.
+DROP POLICY IF EXISTS roles_modify ON public.roles;
+CREATE POLICY roles_modify ON public.roles FOR ALL
+  USING (public.person_is_system_admin(public.current_actor_id()))
+  WITH CHECK (public.person_is_system_admin(public.current_actor_id()));
+
+-- people: the single FOR ALL policy's OR (id = current_actor_id()) branch let a
+-- member PATCH their own role_id and account_id directly through PostgREST,
+-- bypassing admin-data's field-level permission checks. Split the policy:
+-- reads keep self-access, writes require the row to sit in an accessible
+-- account. No production flow writes people through the user-scoped client —
+-- admin-data reads via ctx.db but writes via adminDb.
+DROP POLICY IF EXISTS people_access ON public.people;
+
+CREATE POLICY people_read ON public.people FOR SELECT
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
+    OR id = public.current_actor_id()
+  );
+
+CREATE POLICY people_insert ON public.people FOR INSERT
+  WITH CHECK (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+CREATE POLICY people_update ON public.people FOR UPDATE
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())))
+  WITH CHECK (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+CREATE POLICY people_delete ON public.people FOR DELETE
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id())));
+
+-- RLS is row-level only — it cannot stop a member from writing privileged
+-- columns (role_id, account_id, is_active, schema stamps, identity anchors)
+-- on their own row or a teammate's row inside the same accessible account.
+-- This trigger supplies the missing column-level enforcement:
+--   * service_role/adminDb writes have no actor → skipped
+--   * system_admin → allowed
+--   * self-update of privileged columns → denied
+--   * privileged changes on other rows → admin-capable roles only
+-- Profile fields (names, avatar, phone, status, data) remain self-editable.
+CREATE OR REPLACE FUNCTION public.people_guard_privileged_fields()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  actor uuid := public.current_actor_id();
+  privileged_changed boolean;
+  actor_is_admin boolean;
+BEGIN
+  IF actor IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  privileged_changed :=
+       NEW.role_id           IS DISTINCT FROM OLD.role_id
+    OR NEW.account_id        IS DISTINCT FROM OLD.account_id
+    OR NEW.is_active         IS DISTINCT FROM OLD.is_active
+    OR NEW.auth_uid          IS DISTINCT FROM OLD.auth_uid
+    OR NEW.app_id            IS DISTINCT FROM OLD.app_id
+    OR NEW.type_id           IS DISTINCT FROM OLD.type_id
+    OR NEW.design_schema     IS DISTINCT FROM OLD.design_schema
+    OR NEW.validation_schema IS DISTINCT FROM OLD.validation_schema
+    OR NEW.created_by        IS DISTINCT FROM OLD.created_by;
+
+  IF NOT privileged_changed THEN
+    RETURN NEW;
+  END IF;
+
+  IF public.person_is_system_admin(actor) THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.id = actor THEN
+    RAISE EXCEPTION 'Cannot modify privileged fields on your own record';
+  END IF;
+
+  -- Only system admins may assign system roles (system_admin, csm, ...) —
+  -- otherwise a member_admin could mint a system admin by setting role_id.
+  IF NEW.role_id IS DISTINCT FROM OLD.role_id
+     AND EXISTS (SELECT 1 FROM public.roles r WHERE r.id = NEW.role_id AND r.is_system) THEN
+    RAISE EXCEPTION 'Only system admins may assign system roles';
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1
+    FROM public.people p
+    JOIN public.roles r ON r.id = p.role_id
+    WHERE p.id = actor
+      AND r.slug IN ('support_admin', 'member_admin')
+  ) INTO actor_is_admin;
+
+  IF NOT actor_is_admin THEN
+    RAISE EXCEPTION 'Insufficient role to modify privileged people fields';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS people_privileged_fields_guard ON public.people;
+CREATE TRIGGER people_privileged_fields_guard
+  BEFORE UPDATE ON public.people
+  FOR EACH ROW EXECUTE FUNCTION public.people_guard_privileged_fields();
+-- CIL[DOC-VECTOR type="context" content="purpose='Close anonymous-access bypasses on system_settings/accounts/roles and the member self-write path on people.'; No verified external callers; imports: none"]
+-- CIL[DOC-VECTOR type="blast_radius" content="Anonymous PostgREST access to system_settings/accounts/roles is revoked; non-system role writes restricted to system_admin; members can no longer PATCH their own people row directly — admin-data flows unaffected because writes go through adminDb" status="ready"]
+-- CIL[DOC-VECTOR type="configuration" content="Depends on public.current_actor_id, public.person_is_system_admin, and public.get_accessible_accounts" status="ready"]
+-- CIL[DOC-VECTOR type="constraint" content="Any flow relying on unauthenticated or direct-PostgREST self-writes must authenticate via a privileged path; service_role is unaffected" status="ready"]
+-- CIL[END stable_id="~/.framework/migrations/045_security_critical_rls.sql:security_critical_rls:file"]