spine-framework 0.3.145 → 0.4.0

package/.framework/migrations/055_type_id_drift_reconciliation.sql

@@ -0,0 +1,33 @@
+-- 055_type_id_drift_reconciliation.sql
+-- CIL[BEGIN stable_id="~/.framework/migrations/055_type_id_drift_reconciliation.sql:type_id_drift_reconciliation:file" type="file" identity="type_id_drift_reconciliation" parent="~/.framework/migrations"]
+-- CIL[DOC-MACRO purpose="Reconcile archive-era databases with the consolidated baseline's type_id columns/indexes on meta tables"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Add nullable type_id columns and matching indexes to triggers, timers, prompt_configs, integrations, test_runs, ai_agents, and api_keys where absent"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/migrations/001_core_schema.sql"]
+-- CIL[DOC-CONTRACT inputs="tables predating consolidated 001" outputs="type_id columns + idx_*_type_id indexes present" errors="none" side_effects="ADD COLUMN IF NOT EXISTS / CREATE INDEX IF NOT EXISTS only; nullable columns leave existing rows null — matches baseline where type_id is optional on these tables"]
+-- CIL[DOC-MICRO logic_summary="The consolidated baseline declares type_id on meta config tables; archive-era databases never received it, which made replaying 001 fail at CREATE INDEX ... (type_id). Nothing in the runtime writes these columns today — they exist for baseline convergence" notable_decisions="columns added nullable rather than NOT NULL to avoid backfill semantics on tables the baseline leaves optional"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[END stable_id="~/.framework/migrations/055_type_id_drift_reconciliation.sql:type_id_drift_reconciliation:file"]
+-- Reconciles pre-consolidation databases that were built from the archive-era
+-- migration set (tracked in _spine_migrations under the old filenames) with the
+-- consolidated baseline in 001_core_schema.sql. The baseline declares a nullable
+-- type_id column plus an index on these tables; archive-era databases never
+-- received them, which makes replaying 001 fail on
+--   CREATE INDEX ... (type_id) -> "column type_id does not exist".
+-- All statements are additive and idempotent: no-op on fresh installs where the
+-- consolidated baseline already created the columns and indexes.
+
+ALTER TABLE public.triggers            ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.timers              ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.prompt_configs      ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.integrations        ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.test_runs           ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.ai_agents           ADD COLUMN IF NOT EXISTS type_id uuid;
+ALTER TABLE public.api_keys            ADD COLUMN IF NOT EXISTS type_id uuid;
+
+CREATE INDEX IF NOT EXISTS idx_triggers_type_id            ON public.triggers(type_id);
+CREATE INDEX IF NOT EXISTS idx_timers_type_id              ON public.timers(type_id);
+CREATE INDEX IF NOT EXISTS idx_prompt_configs_type_id      ON public.prompt_configs(type_id);
+CREATE INDEX IF NOT EXISTS idx_integrations_type_id        ON public.integrations(type_id);
+CREATE INDEX IF NOT EXISTS idx_test_runs_type_id           ON public.test_runs(type_id);
+CREATE INDEX IF NOT EXISTS idx_ai_agents_type_id           ON public.ai_agents(type_id);
+CREATE INDEX IF NOT EXISTS idx_api_keys_type_id            ON public.api_keys(type_id);

package/.framework/migrations/056_slug_column_reconciliation.sql

@@ -0,0 +1,38 @@
+-- 056_slug_column_reconciliation.sql
+-- CIL[BEGIN stable_id="~/.framework/migrations/056_slug_column_reconciliation.sql:slug_column_reconciliation:file" type="file" identity="slug_column_reconciliation" parent="~/.framework/migrations"]
+-- CIL[DOC-MACRO purpose="Add baseline slug identity columns to archive-era config tables so manifest seed upserts resolve"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Add slug to triggers/timers/test_runs/ai_agents/item_progress, add missing app_id to test_runs, backfill slug from name, and create UNIQUE(app_id, slug) indexes"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/migrations/001_core_schema.sql,.framework/cli/commands/install-app.ts"]
+-- CIL[DOC-CONTRACT inputs="archive-era table shapes" outputs="slug columns present, backfilled, uniquely indexed per app" errors="unique-index creation fails if name-derived slugs collide per app (checked: 17 triggers + 13 agents produce no collisions)" side_effects="Existing rows gain deterministic slug = lower(name) with non-alphanumerics folded to underscores — matches demo seed slugs so upserts update in place instead of duplicating"]
+-- CIL[DOC-MICRO logic_summary="Demo ai_agents seeds upsert on slug; live rows existed name-only from pre-E1 seeding — regex backfill makes 'Demo Triage Agent' → 'demo_triage_agent' exactly matching the seed. slug left nullable (unlike baseline NOT NULL) to avoid breaking legacy inserts that omit it; uniqueness enforced by index" notable_decisions="test_runs also lacked app_id — added nullable since the identity index requires it"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[END stable_id="~/.framework/migrations/056_slug_column_reconciliation.sql:slug_column_reconciliation:file"]
+-- Adds the consolidated-baseline `slug` identity column to config tables that
+-- predate it on archive-era databases, backfills existing rows from `name`,
+-- and adds the baseline UNIQUE(app_id, slug) index so seed upserts resolve.
+-- All statements are additive and idempotent — no-op on fresh installs where
+-- 001_core_schema.sql already created the columns.
+
+ALTER TABLE public.triggers      ADD COLUMN IF NOT EXISTS slug text;
+ALTER TABLE public.timers        ADD COLUMN IF NOT EXISTS slug text;
+ALTER TABLE public.test_runs     ADD COLUMN IF NOT EXISTS slug text;
+ALTER TABLE public.ai_agents     ADD COLUMN IF NOT EXISTS slug text;
+ALTER TABLE public.item_progress ADD COLUMN IF NOT EXISTS slug text;
+
+-- Archive-era test_runs also predates app_id, which the (app_id, slug)
+-- identity index requires.
+ALTER TABLE public.test_runs     ADD COLUMN IF NOT EXISTS app_id uuid;
+
+UPDATE public.triggers
+SET slug = regexp_replace(lower(name), '[^a-z0-9]+', '_', 'g')
+WHERE slug IS NULL;
+
+UPDATE public.ai_agents
+SET slug = regexp_replace(lower(name), '[^a-z0-9]+', '_', 'g')
+WHERE slug IS NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS triggers_app_slug_key      ON public.triggers(app_id, slug);
+CREATE UNIQUE INDEX IF NOT EXISTS timers_app_slug_key        ON public.timers(app_id, slug);
+CREATE UNIQUE INDEX IF NOT EXISTS test_runs_app_slug_key     ON public.test_runs(app_id, slug);
+CREATE UNIQUE INDEX IF NOT EXISTS ai_agents_app_slug_key     ON public.ai_agents(app_id, slug);
+CREATE UNIQUE INDEX IF NOT EXISTS item_progress_app_slug_key ON public.item_progress(app_id, slug);

package/.framework/migrations/057_pipelines_slug_identity.sql

@@ -0,0 +1,14 @@
+-- 057_pipelines_slug_identity.sql
+-- CIL[BEGIN stable_id="~/.framework/migrations/057_pipelines_slug_identity.sql:pipelines_slug_identity:file" type="file" identity="pipelines_slug_identity" parent="~/.framework/migrations"]
+-- CIL[DOC-MACRO purpose="Add the baseline UNIQUE(app_id, slug) identity to pipelines on archive-era databases"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Create pipelines_app_slug_key unique index so manifest seed upserts with conflict 'app_id,slug' resolve"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/migrations/001_core_schema.sql,.framework/migrations/056_slug_column_reconciliation.sql"]
+-- CIL[DOC-CONTRACT inputs="pipelines table with app_id + slug columns (both already present)" outputs="unique index exists" errors="fails if duplicate (app_id,slug) pairs exist (verified none: 5 rows, 5 unique)" side_effects="none — index only"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[END stable_id="~/.framework/migrations/057_pipelines_slug_identity.sql:pipelines_slug_identity:file"]
+-- Archive-era databases lack the baseline UNIQUE(app_id, slug) identity on
+-- pipelines, so manifest seed upserts with conflict "app_id,slug" fail with
+-- "no unique or exclusion constraint matching the ON CONFLICT specification".
+-- Idempotent — no-op where the constraint already exists.
+
+CREATE UNIQUE INDEX IF NOT EXISTS pipelines_app_slug_key ON public.pipelines(app_id, slug);

package/.framework/migrations/058_account_data_field_declarations.sql

@@ -0,0 +1,53 @@
+-- 058_account_data_field_declarations.sql
+-- CIL[BEGIN stable_id="~/.framework/migrations/058_account_data_field_declarations.sql:account_data_field_declarations:file" type="file" identity="account_data_field_declarations" parent="~/.framework/migrations"]
+-- CIL[DOC-MACRO purpose="Declare the account.data extension fields that runtime code already writes"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Merge is_demo, demo_provisioned_at, geo_country, rate_limits, lifecycle_stage, segment, temperature into the account type design_schema.fields and re-stamp existing accounts"]
+-- CIL[DOC-CONTEXT module="migrations" layer="data" related_files=".framework/functions/admin-data.ts,.framework/functions/_shared/permissions.ts,custom/apps/demo/functions/custom_demo-journey.ts,.framework/migrations/037_kb_types_canonical.sql"]
+-- CIL[DOC-CONTRACT inputs="types row kind='account' slug='account'; accounts rows with stamped design_schema" outputs="declared fields present on type schema and every account stamp" errors="none — merges are idempotent" side_effects="member/member_admin can now adminDataUpdate these account.data keys"]
+-- CIL[DOC-MICRO logic_summary="admin-data field gate requires every key in an update's data object to be declared in the record's stamped design_schema.fields; these keys were historically written via raw adminDb so they were never declared. jsonb merge adds declarations without touching existing fields or record_permissions — declared fields inherit the record-level update grant." notable_decisions="no field-level permissions — member/member_admin already hold record-level update; no validation_schema regeneration needed (baseline is '{}' and sanitization is optional per-field); legacy demo_run_id/expires_at/demo_expired/expired_at deliberately NOT re-declared — provisioning scrubs them"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[END stable_id="~/.framework/migrations/058_account_data_field_declarations.sql:account_data_field_declarations:file"]
+-- Account data fields historically written through raw adminDb were never
+-- declared on the account type. admin-data's field gate (permissions.ts)
+-- denies writes to undeclared fields, so provisioning a demo workspace as
+-- member_admin 403s on accounts.data.is_demo. Declaring the fields is the
+-- schema-correct fix: record_permissions already grant member/member_admin
+-- update, and declared fields inherit it. Follows the 037 jsonb merge pattern.
+
+-- 1. Declare the fields on the account type (covers accounts created later,
+--    since account creation stamps the type's design_schema).
+UPDATE public.types
+SET design_schema = jsonb_set(
+      design_schema,
+      '{fields}',
+      COALESCE(design_schema->'fields', '{}'::jsonb) || $F${
+        "is_demo":             { "data_type": "boolean",  "label": "Demo Account",        "required": false },
+        "demo_provisioned_at": { "data_type": "datetime", "label": "Demo Provisioned At", "required": false },
+        "geo_country":         { "data_type": "text",     "label": "Geo Country",         "required": false },
+        "rate_limits":         { "data_type": "json",     "label": "Rate Limits",         "required": false },
+        "lifecycle_stage":     { "data_type": "text",     "label": "Lifecycle Stage",     "required": false },
+        "segment":             { "data_type": "text",     "label": "Segment",             "required": false },
+        "temperature":         { "data_type": "text",     "label": "Temperature",         "required": false }
+      }$F$::jsonb,
+      true
+    )
+WHERE kind = 'account' AND slug = 'account';
+
+-- 2. Re-stamp existing accounts — the field gate reads the schema stamped on
+--    the record at creation, so the types update alone only helps new rows.
+UPDATE public.accounts
+SET design_schema = jsonb_set(
+      design_schema,
+      '{fields}',
+      COALESCE(design_schema->'fields', '{}'::jsonb) || $F${
+        "is_demo":             { "data_type": "boolean",  "label": "Demo Account",        "required": false },
+        "demo_provisioned_at": { "data_type": "datetime", "label": "Demo Provisioned At", "required": false },
+        "geo_country":         { "data_type": "text",     "label": "Geo Country",         "required": false },
+        "rate_limits":         { "data_type": "json",     "label": "Rate Limits",         "required": false },
+        "lifecycle_stage":     { "data_type": "text",     "label": "Lifecycle Stage",     "required": false },
+        "segment":             { "data_type": "text",     "label": "Segment",             "required": false },
+        "temperature":         { "data_type": "text",     "label": "Temperature",         "required": false }
+      }$F$::jsonb,
+      true
+    )
+WHERE design_schema IS NOT NULL;

package/.framework/migrations/059_registration_placement_fixes.sql

@@ -0,0 +1,269 @@
+-- Migration 059: complete_registration_placement — stamp account schema + fix slug
+-- CIL[DOC-RESPONSIBILITY responsibility="Fix two defects in complete_registration_placement's new_account path discovered by fresh standalone install: (1) the accounts INSERT never stamped design_schema/validation_schema, so every registered account hit admin-data's 'No permissions defined on this record type' gate; (2) slug generation ran regexp_replace before lower(), stripping capitals ('Test Company' -> 'est-ompany-*')"]
+-- CIL[DOC-MICRO logic_summary="Recreates the RPC identical to 052 except: the new_account branch loads the ACCOUNT type's design/validation schemas alongside account type_id and stamps them into the new accounts row; slug base lowercases the name BEFORE the non-alphanumeric replace, matching generateAccountSlug. Repair of already-broken account stamps is handled by 060's blanket restamp." notable_decisions="CREATE OR REPLACE preserves signature and grants; dev DB never showed this because its accounts predate 052 (older creation paths stamped schemas)"]
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.complete_registration_placement(
+  p_person_id uuid,
+  p_app_slug text,
+  p_path text,
+  p_account_name text
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_person           public.people%ROWTYPE;
+  v_app_reg          jsonb;
+  v_role_slug        text;
+  v_role             public.roles%ROWTYPE;
+  v_account_id       uuid;
+  v_account_slug     text;
+  v_account_type_id  uuid;
+  v_account_design_schema    jsonb;
+  v_account_validation_schema jsonb;
+  v_parent_id        uuid;
+  v_type_id          uuid;
+  v_design_schema    jsonb;
+  v_validation_schema jsonb;
+  v_base             text;
+  v_domain           text;
+  v_status           text;
+  v_target           record;
+  v_personal_domains text[] := ARRAY[
+    'gmail.com', 'yahoo.com', 'hotmail.com', 'outlook.com', 'icloud.com',
+    'aol.com', 'protonmail.com', 'me.com', 'mac.com', 'live.com',
+    'msn.com', 'ymail.com', 'googlemail.com', 'fastmail.com'
+  ];
+BEGIN
+  IF p_person_id IS NULL OR p_app_slug IS NULL OR p_path IS NULL THEN
+    RAISE EXCEPTION 'person, app, and path are required';
+  END IF;
+
+  -- Per-person lock serializes concurrent/duplicate placement calls.
+  PERFORM pg_advisory_xact_lock(hashtext('spine.placement.' || p_person_id::text));
+
+  SELECT * INTO v_person FROM public.people WHERE id = p_person_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Person not found';
+  END IF;
+
+  -- Idempotent: a retry after a lost response returns the placement that
+  -- already committed instead of creating a second account or failing.
+  IF v_person.account_id IS NOT NULL AND v_person.role_id IS NOT NULL THEN
+    RETURN (
+      SELECT jsonb_build_object(
+        'status', v_person.status,
+        'account_slug', a.slug,
+        'role_slug', r.slug
+      )
+      FROM public.accounts a, public.roles r
+      WHERE a.id = v_person.account_id AND r.id = v_person.role_id
+    );
+  END IF;
+
+  -- Resolve the installed registration policy server-side.
+  SELECT config->'registration' INTO v_app_reg
+  FROM public.apps
+  WHERE slug = p_app_slug AND is_active = true
+  LIMIT 1;
+
+  IF v_app_reg IS NULL THEN
+    RAISE EXCEPTION 'Unknown or uninstalled app ''%'' or no registration policy configured', p_app_slug;
+  END IF;
+  IF COALESCE((v_app_reg->>'enabled')::boolean, false) = false THEN
+    RAISE EXCEPTION 'Registration is not enabled for app ''%''', p_app_slug;
+  END IF;
+
+  -- Role comes from the app's installed config — NEVER the request.
+  -- join_request defaults to 'member' when the app permits it.
+  v_role_slug := CASE
+    WHEN p_path = 'join_request' AND (v_app_reg->'roles' ? 'member') THEN 'member'
+    ELSE v_app_reg->>'default_role'
+  END;
+
+  IF v_role_slug IS NULL THEN
+    RAISE EXCEPTION 'App ''%'' registration has no default_role configured', p_app_slug;
+  END IF;
+  IF v_app_reg->'roles' IS NOT NULL AND NOT (v_app_reg->'roles' ? v_role_slug) THEN
+    RAISE EXCEPTION 'Role ''%'' is not permitted in this context', v_role_slug;
+  END IF;
+  IF v_role_slug = 'system_admin' THEN
+    RAISE EXCEPTION 'Role ''system_admin'' cannot be assigned through registration';
+  END IF;
+
+  SELECT * INTO v_role FROM public.roles WHERE slug = v_role_slug LIMIT 1;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Role ''%'' not found', v_role_slug;
+  END IF;
+  IF v_role.is_system = true THEN
+    RAISE EXCEPTION 'Role ''%'' is not permitted in this context', v_role_slug;
+  END IF;
+
+  -- Post-lock precondition: another writer already assigned a role. Return
+  -- the existing placement rather than overwrite (lost-response resume).
+  IF v_person.role_id IS NOT NULL THEN
+    RETURN (
+      SELECT jsonb_build_object(
+        'status', v_person.status,
+        'account_slug', a.slug,
+        'role_slug', r.slug
+      )
+      FROM public.roles r
+      LEFT JOIN public.accounts a ON a.id = v_person.account_id
+      WHERE r.id = v_person.role_id
+    );
+  END IF;
+
+  SELECT id, design_schema, validation_schema
+    INTO v_type_id, v_design_schema, v_validation_schema
+  FROM public.types WHERE kind = 'person' AND slug = 'person' LIMIT 1;
+  IF v_type_id IS NULL THEN
+    RAISE EXCEPTION 'Person type (kind=person, slug=person) not found — run framework type seeds';
+  END IF;
+
+  IF p_path = 'new_account' THEN
+    IF p_account_name IS NULL OR btrim(p_account_name) = '' THEN
+      RAISE EXCEPTION 'account_name is required for new_account path';
+    END IF;
+
+    v_parent_id := NULL;
+    IF v_app_reg->>'parent_account' IS NOT NULL THEN
+      SELECT id INTO v_parent_id FROM public.accounts
+      WHERE slug = v_app_reg->>'parent_account' LIMIT 1;
+      IF v_parent_id IS NULL THEN
+        RAISE EXCEPTION 'Parent account ''%'' not found', v_app_reg->>'parent_account';
+      END IF;
+    END IF;
+
+    SELECT id, design_schema, validation_schema
+      INTO v_account_type_id, v_account_design_schema, v_account_validation_schema
+    FROM public.types
+    WHERE kind = 'account' AND slug = 'account' LIMIT 1;
+    IF v_account_type_id IS NULL THEN
+      RAISE EXCEPTION 'Account type (kind=account, slug=account) not found — run framework type seeds';
+    END IF;
+
+    -- Slug pattern matches generateAccountSlug: lower FIRST so capitals are
+    -- preserved, non-alphanumeric runs -> '-', trimmed, 40-char base,
+    -- '-xxxxxx' random suffix, retried on collision until unique.
+    v_base := left(btrim(regexp_replace(lower(p_account_name), '[^a-z0-9]+', '-', 'g'), '-'), 40);
+    IF v_base = '' THEN v_base := 'account'; END IF;
+    LOOP
+      v_account_slug := v_base || '-' || substr(md5(random()::text), 1, 6);
+      EXIT WHEN NOT EXISTS (SELECT 1 FROM public.accounts WHERE slug = v_account_slug);
+    END LOOP;
+
+    INSERT INTO public.accounts (
+      slug, display_name, type_id, parent_id, is_active,
+      design_schema, validation_schema
+    )
+    VALUES (
+      v_account_slug, btrim(p_account_name), v_account_type_id, v_parent_id, true,
+      v_account_design_schema, COALESCE(v_account_validation_schema, '{}'::jsonb)
+    )
+    RETURNING id INTO v_account_id;
+
+    v_status := 'active';
+
+    UPDATE public.people SET
+      account_id        = v_account_id,
+      role_id           = v_role.id,
+      status            = 'active',
+      type_id           = v_type_id,
+      design_schema     = v_design_schema,
+      validation_schema = COALESCE(v_validation_schema, '{}'::jsonb),
+      updated_at        = now()
+    WHERE id = v_person.id
+      AND role_id IS NULL;
+
+  ELSIF p_path = 'existing_account' THEN
+    IF COALESCE(v_app_reg->>'account_strategy', '') <> 'existing' THEN
+      RAISE EXCEPTION 'App ''%'' does not support joining an existing account', p_app_slug;
+    END IF;
+    IF v_app_reg->>'target_account' IS NULL THEN
+      RAISE EXCEPTION 'No target_account configured for this app registration';
+    END IF;
+
+    SELECT id, slug INTO v_target FROM public.accounts
+    WHERE slug = v_app_reg->>'target_account' LIMIT 1;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'Target account ''%'' not found', v_app_reg->>'target_account';
+    END IF;
+    v_account_id   := v_target.id;
+    v_account_slug := v_target.slug;
+    v_status       := 'active';
+
+    UPDATE public.people SET
+      account_id        = v_account_id,
+      role_id           = v_role.id,
+      status            = 'active',
+      type_id           = v_type_id,
+      design_schema     = v_design_schema,
+      validation_schema = COALESCE(v_validation_schema, '{}'::jsonb),
+      data              = '{}'::jsonb,
+      updated_at        = now()
+    WHERE id = v_person.id
+      AND role_id IS NULL;
+
+  ELSIF p_path = 'join_request' THEN
+    -- Opt-in only: apps must declare allow_domain_join. The target account
+    -- is derived server-side from the person's email domain — the client
+    -- never supplies target_account_id.
+    IF COALESCE((v_app_reg->>'allow_domain_join')::boolean, false) = false THEN
+      RAISE EXCEPTION 'App ''%'' does not allow domain-based join requests', p_app_slug;
+    END IF;
+
+    v_domain := lower(split_part(v_person.email, '@', 2));
+    IF v_domain IS NULL OR v_domain = '' OR v_domain = ANY(v_personal_domains) THEN
+      RAISE EXCEPTION 'No account found for this email domain';
+    END IF;
+
+    SELECT p2.account_id INTO v_account_id
+    FROM public.people p2
+    WHERE lower(split_part(p2.email, '@', 2)) = v_domain
+      AND p2.status = 'active'
+      AND p2.account_id IS NOT NULL
+    ORDER BY p2.created_at
+    LIMIT 1;
+
+    IF v_account_id IS NULL THEN
+      RAISE EXCEPTION 'No account found for this email domain';
+    END IF;
+    SELECT slug INTO v_account_slug FROM public.accounts WHERE id = v_account_id;
+
+    v_status := 'pending';
+
+    UPDATE public.people SET
+      account_id        = v_account_id,
+      role_id           = v_role.id,
+      status            = 'pending',
+      type_id           = v_type_id,
+      design_schema     = v_design_schema,
+      validation_schema = COALESCE(v_validation_schema, '{}'::jsonb),
+      data              = COALESCE(data, '{}'::jsonb) || jsonb_build_object(
+                            'invite_kind', 'access_request',
+                            'invite_invited_by', null,
+                            'invite_token', null),
+      updated_at        = now()
+    WHERE id = v_person.id
+      AND role_id IS NULL;
+
+  ELSE
+    RAISE EXCEPTION 'Unknown registration path: %', p_path;
+  END IF;
+
+  RETURN jsonb_build_object(
+    'status', v_status,
+    'account_slug', v_account_slug,
+    'role_slug', v_role.slug
+  );
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.complete_registration_placement(uuid, text, text, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.complete_registration_placement(uuid, text, text, text) FROM anon;
+REVOKE ALL ON FUNCTION public.complete_registration_placement(uuid, text, text, text) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.complete_registration_placement(uuid, text, text, text) TO service_role;

package/.framework/migrations/060_account_person_record_permissions.sql

@@ -0,0 +1,38 @@
+-- Migration 060: account + person type record_permissions convergence
+-- CIL[DOC-RESPONSIBILITY responsibility="Grant member/member_admin record-level CRU on the account and person types. The 003 seed grants system_admin only; member_admin provisioning (account data writes via admin-data) and team management (people record updates) fail the record-level gate without these grants. Also restamps every accounts/people row so stamped schemas carry the new grants."]
+-- CIL[DOC-MICRO logic_summary="jsonb_set replaces design_schema.record_permissions on the two type rows, then blanket restamps accounts and people from their type rows — covering records stamped with the old schema AND accounts left unstamped (design_schema='{}') by the pre-059 placement RPC." notable_decisions="Grant set = least privilege proven by the standalone demo install (system_admin CRUD, member_admin/member CRU) — deliberately narrower than the dev DB's drifted superset (support/support_admin/engineering_admin/sales/csm/tam); widen with a follow-up migration if another app declares a need"]
+-- ============================================
+
+UPDATE public.types
+SET design_schema = jsonb_set(
+  design_schema,
+  '{record_permissions}',
+  '{
+    "system_admin": ["create","read","update","delete"],
+    "member_admin": ["create","read","update"],
+    "member":       ["create","read","update"]
+  }'::jsonb
+)
+WHERE (kind = 'account' AND slug = 'account')
+   OR (kind = 'person'  AND slug = 'person');
+
+-- Restamp all account rows with the updated type schema (also repairs
+-- accounts stamped '{}' by the pre-059 registration RPC).
+UPDATE public.accounts a
+SET type_id           = t.id,
+    design_schema     = t.design_schema,
+    validation_schema = COALESCE(t.validation_schema, '{}'::jsonb),
+    updated_at        = now()
+FROM public.types t
+WHERE t.kind = 'account' AND t.slug = 'account'
+  AND (a.type_id = t.id OR a.type_id IS NULL);
+
+-- Restamp all people rows with the updated type schema.
+UPDATE public.people p
+SET type_id           = t.id,
+    design_schema     = t.design_schema,
+    validation_schema = COALESCE(t.validation_schema, '{}'::jsonb),
+    updated_at        = now()
+FROM public.types t
+WHERE t.kind = 'person' AND t.slug = 'person'
+  AND (p.type_id = t.id OR p.type_id IS NULL);

package/.framework/migrations/061_fk_dedup.sql

@@ -0,0 +1,32 @@
+-- Migration 061: drop duplicate and non-canonical foreign keys
+-- CIL[DOC-RESPONSIBILITY responsibility="Remove 26 auto-named *_fkey foreign key constraints that shadow identically-scoped fk_* named constraints (001's inline REFERENCES clauses created them; 002/004/018 re-added the same FKs under fk_* names with DROP CONSTRAINT IF EXISTS fk_* which never matched the auto names). Also drop both roles.created_by->people FKs so people<->roles has a single relationship path."]
+-- CIL[DOC-MICRO logic_summary="PostgREST counts every FK between two tables as a candidate relationship for embeds — the duplicates made every unhinted select on these pairs ambiguous ('more than one relationship was found'). Named fk_* constraints are kept as canonical; roles loses BOTH created_by FKs (dev DB has neither; a roles->people path would keep people<->roles ambiguous for role embeds). Legitimate multi-column pairs (items.created_by/updated_by, apps.owner_account_id/account_id) are preserved — queries on those still require !fkey hints." notable_decisions="IF EXISTS everywhere makes this a no-op on schemas that lack any listed constraint; verified against a fresh migration replay on a standalone-export database"]
+-- ============================================
+
+ALTER TABLE public.accounts            DROP CONSTRAINT IF EXISTS accounts_app_id_fkey;
+ALTER TABLE public.accounts            DROP CONSTRAINT IF EXISTS accounts_type_id_fkey;
+ALTER TABLE public.ai_agents           DROP CONSTRAINT IF EXISTS ai_agents_created_by_fkey;
+ALTER TABLE public.api_keys            DROP CONSTRAINT IF EXISTS api_keys_created_by_fkey;
+ALTER TABLE public.apps                DROP CONSTRAINT IF EXISTS apps_account_id_fkey;
+ALTER TABLE public.apps                DROP CONSTRAINT IF EXISTS apps_owner_account_id_fkey;
+ALTER TABLE public.integrations        DROP CONSTRAINT IF EXISTS integrations_created_by_fkey;
+ALTER TABLE public.invites             DROP CONSTRAINT IF EXISTS invites_created_by_fkey;
+ALTER TABLE public.item_progress       DROP CONSTRAINT IF EXISTS item_progress_created_by_fkey;
+ALTER TABLE public.items               DROP CONSTRAINT IF EXISTS items_created_by_fkey;
+ALTER TABLE public.items               DROP CONSTRAINT IF EXISTS items_updated_by_fkey;
+ALTER TABLE public.logs                DROP CONSTRAINT IF EXISTS logs_created_by_fkey;
+ALTER TABLE public.messages            DROP CONSTRAINT IF EXISTS messages_account_id_fkey;
+ALTER TABLE public.messages            DROP CONSTRAINT IF EXISTS messages_created_by_fkey;
+ALTER TABLE public.observability       DROP CONSTRAINT IF EXISTS observability_created_by_fkey;
+ALTER TABLE public.pipeline_executions DROP CONSTRAINT IF EXISTS pipeline_executions_created_by_fkey;
+ALTER TABLE public.pipelines           DROP CONSTRAINT IF EXISTS pipelines_created_by_fkey;
+ALTER TABLE public.prompt_configs      DROP CONSTRAINT IF EXISTS prompt_configs_created_by_fkey;
+ALTER TABLE public.prompt_configs      DROP CONSTRAINT IF EXISTS prompt_configs_updated_by_fkey;
+ALTER TABLE public.roles               DROP CONSTRAINT IF EXISTS roles_created_by_fkey;
+ALTER TABLE public.roles               DROP CONSTRAINT IF EXISTS fk_roles_created_by;
+ALTER TABLE public.test_runs           DROP CONSTRAINT IF EXISTS test_runs_created_by_fkey;
+ALTER TABLE public.threads             DROP CONSTRAINT IF EXISTS threads_created_by_fkey;
+ALTER TABLE public.threads             DROP CONSTRAINT IF EXISTS threads_updated_by_fkey;
+ALTER TABLE public.timers              DROP CONSTRAINT IF EXISTS timers_created_by_fkey;
+ALTER TABLE public.triggers            DROP CONSTRAINT IF EXISTS triggers_created_by_fkey;
+ALTER TABLE public.types               DROP CONSTRAINT IF EXISTS types_app_id_fkey;

package/.framework/public/spine-logo.svg

@@ -1,3 +1,10 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
-  <rect width="32" height="32" rx="5" fill="#1e2a4a"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 210" role="img" aria-label="Spine">
+  <rect x="10" y="20" width="130" height="40" rx="6" fill="#0071e3"/>
+  <rect x="150" y="30" width="40" height="20" rx="3" fill="#0071e3"/>
+
+  <rect x="0" y="95" width="40" height="20" rx="3" fill="#0071e3"/>
+  <rect x="60" y="85" width="130" height="40" rx="6" fill="#0071e3"/>
+
+  <rect x="10" y="150" width="130" height="40" rx="6" fill="#0071e3"/>
+  <rect x="150" y="160" width="40" height="20" rx="3" fill="#0071e3"/>
+</svg>