spine-framework 0.4.4 → 0.5.0-rc.4

package/.framework/functions/triggers.ts

@@ -248,7 +248,8 @@ export const getExecutions = createHandler(async (ctx, body) => {
     throw new Error('Account context required')
   }
 
-  const { data, error: err } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+  const { data, error: err } = await db
     .from('trigger_executions')
     .select('*')
     .eq('trigger_id', trigger_id)
@@ -275,7 +276,7 @@ export const getExecutions = createHandler(async (ctx, body) => {
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
 export const create = createHandler(async (ctx, body) => {
-  const { app_id, name, description, event_type, pipeline_id, config, metadata } = body
+  const { app_id, name, description, event_type, trigger_type, pipeline_id, config, metadata } = body
 
   if (!name || !event_type || !pipeline_id) {
     throw new Error('name, event_type, and pipeline_id are required')
@@ -305,7 +306,8 @@ export const create = createHandler(async (ctx, body) => {
     }
   }
 
-  const { data, error: err } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+  const { data, error: err } = await db
     .from('triggers')
     .insert({
       app_id: app_id || null,
@@ -316,7 +318,8 @@ export const create = createHandler(async (ctx, body) => {
       pipeline_id,
       config: config || {},
       metadata: metadata || {},
-      created_by: ctx.principal.id
+      trigger_type: trigger_type || 'event',
+      created_by: ctx.principal.type === 'human' ? ctx.principal.id : null
     })
     .select()
     .single()
@@ -353,13 +356,14 @@ export const update = createHandler(async (ctx, body) => {
     throw new Error('Trigger ID is required')
   }
 
-  const allowed = ['name', 'description', 'config', 'pipeline_id', 'metadata', 'is_active', 'event_type', 'app_id']
+  const allowed = ['name', 'description', 'config', 'pipeline_id', 'metadata', 'is_active', 'event_type', 'trigger_type', 'app_id']
   const updateData: Record<string, any> = { updated_at: new Date().toISOString() }
   for (const key of allowed) {
     if (updates[key] !== undefined) updateData[key] = updates[key]
   }
 
-  const { data, error: err } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+  const { data, error: err } = await db
     .from('triggers')
     .update(updateData)
     .eq('id', id)
@@ -397,7 +401,8 @@ export const remove = createHandler(async (ctx, body) => {
     throw new Error('Trigger ID is required')
   }
 
-  const { data: existing } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+  const { data: existing } = await db
     .from('triggers')
     .select('name, event_type')
     .eq('id', id)
@@ -407,9 +412,9 @@ export const remove = createHandler(async (ctx, body) => {
     throw new Error('Trigger not found')
   }
 
-  const { error: err } = await ctx.db
+  const { error: err } = await db
     .from('triggers')
-    .update({ 
+    .update({
       is_active: false,
       updated_at: new Date().toISOString()
     })
@@ -446,7 +451,8 @@ export const toggle = createHandler(async (ctx, body) => {
     throw new Error('Trigger ID is required')
   }
 
-  const { data: existing } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+  const { data: existing } = await db
     .from('triggers')
     .select('is_active, name')
     .eq('id', id)
@@ -458,9 +464,9 @@ export const toggle = createHandler(async (ctx, body) => {
 
   const newStatus = !existing.is_active
 
-  const { data, error: err } = await ctx.db
+  const { data, error: err } = await db
     .from('triggers')
-    .update({ 
+    .update({
       is_active: newStatus,
       updated_at: new Date().toISOString()
     })
@@ -497,7 +503,16 @@ export const toggle = createHandler(async (ctx, body) => {
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
 export const handler = createHandler(async (ctx, body) => {
-  const { action } = ctx.query || {}
+  const { action, id } = ctx.query || {}
+  const method = ctx.query?.method || 'GET'
+
+  if (!action) {
+    if (method === 'GET') return id ? await get(ctx, body) : await list(ctx, body)
+    if (method === 'POST') return await create(ctx, body)
+    if (method === 'PATCH') return await update(ctx, body)
+    if (method === 'DELETE') return await remove(ctx, body)
+    throw new Error(`Unsupported method: ${method}`)
+  }
 
   switch (action) {
     case 'list':

package/.framework/functions/types.ts

@@ -42,22 +42,27 @@ const permissions = PermissionEngine as any
 // CIL[DOC-MACRO purpose="List active type definitions with optional filters and pagination"]
 // CIL[DOC-RESPONSIBILITY responsibility="Query the public.types table and sanitize records based on the caller principal"]
 // CIL[DOC-CONTEXT module="types function" layer="framework/functions" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/schema-utils.ts,.framework/functions/types.ts"]
-// CIL[DOC-CONTRACT inputs="kind, app_id, ownership, limit, offset, include_schema query parameters" outputs="array of sanitized type rows" errors="Database query errors" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Builds a filtered, paginated Supabase query against the types table and returns sanitized results" notable_decisions="Returns minimal fields for unauthenticated callers; includes schema only when requested"]
+// CIL[DOC-CONTRACT inputs="kind, app_id, ownership, active, limit, offset, include_schema query parameters" outputs="array of sanitized type rows" errors="Database query errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Builds a filtered, paginated Supabase query against the types table and returns sanitized results" notable_decisions="Returns minimal fields for unauthenticated callers; includes schema only when requested; active defaults to true, 'all' lists active and inactive, 'false' lists inactive only"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
 export const list = createHandler(async (ctx, body) => {
-  const { kind, app_id, ownership, limit = '50', offset = '0', include_schema } = ctx.query || {}
+  const { kind, app_id, ownership, active, limit = '50', offset = '0', include_schema } = ctx.query || {}
 
   const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
 
   let query = db
     .from('types')
     .select('*')
-    .eq('is_active', true)
     .order('kind')
     .order('name')
 
+  if (active === 'false') {
+    query = query.eq('is_active', false)
+  } else if (active !== 'all') {
+    query = query.eq('is_active', true)
+  }
+
   if (kind) {
     query = query.eq('kind', kind)
   }
@@ -132,7 +137,6 @@ export const get = createHandler(async (ctx, body) => {
     .from('types')
     .select('*')
     .eq('id', id)
-    .eq('is_active', true)
     .single()
 
   if (err) throw err
@@ -237,7 +241,6 @@ export const create = createHandler(async (ctx, body) => {
     app_id = null,
     design_schema = {},
     validation_schema = null,
-    view_config = {},
     description = null,
     icon = null,
     color = null
@@ -272,7 +275,6 @@ export const create = createHandler(async (ctx, body) => {
       app_id,
       design_schema,
       validation_schema: validation,
-      view_config,
       description,
       icon,
       color,
@@ -325,7 +327,6 @@ export const update = createHandler(async (ctx, body) => {
     .from('types')
     .select('*')
     .eq('id', id)
-    .eq('is_active', true)
     .single()
 
   if (!existing) {
@@ -340,7 +341,6 @@ export const update = createHandler(async (ctx, body) => {
     name,
     slug,
     design_schema,
-    view_config,
     description,
     icon,
     color,
@@ -354,7 +354,6 @@ export const update = createHandler(async (ctx, body) => {
 
   if (name !== undefined) updates.name = name
   if (slug !== undefined) updates.slug = slug
-  if (view_config !== undefined) updates.view_config = view_config
   if (description !== undefined) updates.description = description
   if (icon !== undefined) updates.icon = icon
   if (color !== undefined) updates.color = color
@@ -368,6 +367,10 @@ export const update = createHandler(async (ctx, body) => {
     updates.validation_schema = generateValidationSchema(design_schema)
   }
 
+  if (Object.keys(updates).length === 0) {
+    return existing
+  }
+
   const { data, error } = await adminDb
     .from('types')
     .update(updates)

package/.framework/migrations/069_log_stats_window.sql

@@ -0,0 +1,54 @@
+CREATE OR REPLACE FUNCTION public.get_log_stats(
+  p_account_id uuid,
+  p_level text DEFAULT NULL::text,
+  p_source text DEFAULT NULL::text,
+  p_source_type text DEFAULT NULL::text,
+  p_source_id text DEFAULT NULL::text,
+  p_person_id text DEFAULT NULL::text,
+  p_query text DEFAULT NULL::text,
+  p_date_from timestamp with time zone DEFAULT NULL::timestamp with time zone,
+  p_date_to timestamp with time zone DEFAULT NULL::timestamp with time zone
+)
+RETURNS TABLE(total bigint, error_count bigint, user_action_count bigint, event_type_count bigint, levels text[], sources text[], source_types text[])
+LANGUAGE plpgsql
+AS $function$
+DECLARE
+  v_from timestamptz := COALESCE(p_date_from, now() - interval '7 days');
+  v_total bigint;
+  v_error_count bigint;
+  v_user_action_count bigint;
+  v_event_type_count bigint;
+  v_levels text[];
+  v_sources text[];
+  v_source_types text[];
+BEGIN
+  SELECT
+    count(*),
+    count(*) FILTER (WHERE level ILIKE '%error%'),
+    count(*) FILTER (WHERE person_id IS NOT NULL),
+    count(DISTINCT level)
+  INTO v_total, v_error_count, v_user_action_count, v_event_type_count
+  FROM public.logs
+  WHERE account_id = p_account_id
+    AND created_at >= v_from
+    AND (p_level IS NULL OR level = p_level)
+    AND (p_source IS NULL OR source = p_source)
+    AND (p_source_type IS NULL OR source_type = p_source_type)
+    AND (p_source_id IS NULL OR source_id = p_source_id::uuid)
+    AND (p_person_id IS NULL OR person_id = p_person_id::uuid)
+    AND (p_query IS NULL OR message ILIKE '%' || p_query || '%')
+    AND (p_date_to IS NULL OR created_at <= p_date_to);
+
+  SELECT
+    coalesce(array_agg(DISTINCT level ORDER BY level) FILTER (WHERE level IS NOT NULL), ARRAY[]::text[]),
+    coalesce(array_agg(DISTINCT source ORDER BY source) FILTER (WHERE source IS NOT NULL), ARRAY[]::text[]),
+    coalesce(array_agg(DISTINCT source_type ORDER BY source_type) FILTER (WHERE source_type IS NOT NULL), ARRAY[]::text[])
+  INTO v_levels, v_sources, v_source_types
+  FROM public.logs
+  WHERE account_id = p_account_id
+    AND created_at >= v_from
+    AND (p_date_to IS NULL OR created_at <= p_date_to);
+
+  RETURN QUERY SELECT v_total, v_error_count, v_user_action_count, v_event_type_count, v_levels, v_sources, v_source_types;
+END;
+$function$;

package/.framework/migrations/070_app_type_schema_rpcs.sql

@@ -0,0 +1,166 @@
+-- Migration 070: bootstrap the RPCs the types/apps handlers expect
+--
+-- types.ts getSchema (?action=schema) and apps.ts getSchema /
+-- checkAvailability / updateVersion (?action=schema|available|version)
+-- call four Postgres functions that existed in the pre-consolidation v2
+-- schema (v2-core/migrations/010_apps.sql, 004_types.sql +
+-- 049_schema_driven_permissions.sql) but were never ported into
+-- .framework/migrations — each action fails at runtime on a stock
+-- install with "Could not find the function public.<name>(...) in the
+-- schema cache". This migration recreates them against the public
+-- schema.
+--
+-- Semantics are ported from the recovered v2 definitions:
+--   * get_type_schema returns the matching active type's design_schema
+--     ('{}' when none). An app_id argument prefers that app's row and
+--     falls back to the global (app_id IS NULL) type — the documented
+--     "app-specific fallback to system" behavior.
+--   * get_app_schema returns a jsonb projection of the active app row
+--     ('{}' when none), extended with the required_roles / route_prefix /
+--     renderer columns added since v2.
+--   * is_app_available returns true when an active app with the slug is
+--     available to the account under the same ownership rule
+--     get_account_apps uses (is_system OR owner_account_id IS NULL OR
+--     owner_account_id = account_id).
+--   * update_app_version bumps apps.version + updated_at and returns
+--     void — the handler only checks for an error.
+--
+-- All four run as SECURITY INVOKER (the v2 default): callers go through
+-- ctx.db, so human callers keep RLS scoping (types are world-readable via
+-- types_read; apps via apps_access) and machine principals bypass RLS as
+-- service_role. GRANTs match the sibling RPC convention in
+-- 004_core_rpc_and_broker.sql.
+
+-- CIL[BEGIN stable_id="~/.framework/migrations/070_app_type_schema_rpcs.sql:module:migration" type="migration" identity="app-type-schema-rpcs" parent="~/.framework/migrations/070_app_type_schema_rpcs.sql"]
+-- CIL[DOC-MACRO purpose="Create the four Postgres RPCs the types and apps Netlify handlers invoke: get_type_schema, get_app_schema, is_app_available, update_app_version"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Provide schema lookup, app-schema projection, account-scoped app availability, and app version bump functions missing since the v2-to-public consolidation"]
+-- CIL[DOC-CONTEXT module="functions" layer="schema" related_files=".framework/functions/types.ts,.framework/functions/apps.ts,.framework/migrations/013_get_account_apps_role_filter.sql"]
+-- CIL[DOC-CONTRACT inputs="text/uuid params matching the .rpc named args in types.ts and apps.ts" outputs="jsonb scalars, boolean, void matching the shapes the handlers read" errors="none — SECURITY INVOKER relies on caller RLS" side_effects="update_app_version mutates public.apps version and updated_at"]
+-- CIL[DOC-MICRO logic_summary="Ports the recovered v2-core function bodies to the public schema; get_type_schema reads design_schema with app-specific fallback to the global type; is_app_available reuses the get_account_apps ownership rule including NULL-owner apps" notable_decisions="SECURITY INVOKER rather than DEFINER so human callers keep RLS scoping and no caller-supplied privilege claims are trusted"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.9" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[DOC-AUDIENCE audience="framework_developers"]
+-- CIL[END stable_id="~/.framework/migrations/070_app_type_schema_rpcs.sql:module:migration"]
+
+-- ── types ─────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.get_type_schema(
+  kind   text,
+  slug   text,
+  app_id uuid DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+STABLE
+AS $$
+DECLARE
+  type_schema jsonb;
+BEGIN
+  SELECT t.design_schema INTO type_schema
+  FROM public.types t
+  WHERE t.kind = get_type_schema.kind
+    AND t.slug = get_type_schema.slug
+    AND t.is_active = true
+    AND (t.app_id = get_type_schema.app_id OR t.app_id IS NULL)
+  ORDER BY t.app_id NULLS LAST -- prefer app-specific types over global
+  LIMIT 1;
+
+  RETURN COALESCE(type_schema, '{}'::jsonb);
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.get_type_schema(text, text, uuid) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.get_type_schema(text, text, uuid) TO service_role;
+
+COMMENT ON FUNCTION public.get_type_schema(text, text, uuid) IS 'Get type design_schema by kind+slug, app-specific with fallback to global';
+
+-- ── apps ──────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.get_app_schema(app_slug text)
+RETURNS jsonb
+LANGUAGE plpgsql
+STABLE
+AS $$
+DECLARE
+  app_schema jsonb;
+BEGIN
+  SELECT jsonb_build_object(
+    'id', a.id,
+    'slug', a.slug,
+    'name', a.name,
+    'description', a.description,
+    'icon', a.icon,
+    'color', a.color,
+    'version', a.version,
+    'app_type', a.app_type,
+    'source', a.source,
+    'config', a.config,
+    'nav_items', a.nav_items,
+    'min_role', a.min_role,
+    'required_roles', a.required_roles,
+    'integration_deps', a.integration_deps,
+    'metadata', a.metadata,
+    'route_prefix', a.route_prefix,
+    'renderer', a.renderer
+  ) INTO app_schema
+  FROM public.apps a
+  WHERE a.slug = get_app_schema.app_slug
+    AND a.is_active = true;
+
+  RETURN COALESCE(app_schema, '{}'::jsonb);
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.get_app_schema(text) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.get_app_schema(text) TO service_role;
+
+COMMENT ON FUNCTION public.get_app_schema(text) IS 'Get full app schema by slug';
+
+CREATE OR REPLACE FUNCTION public.is_app_available(
+  app_slug   text,
+  account_id uuid
+)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+AS $$
+BEGIN
+  RETURN EXISTS (
+    SELECT 1
+    FROM public.apps a
+    WHERE a.slug = is_app_available.app_slug
+      AND a.is_active = true
+      AND (
+        a.is_system = true
+        OR a.owner_account_id IS NULL
+        OR a.owner_account_id = is_app_available.account_id
+      )
+  );
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.is_app_available(text, uuid) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.is_app_available(text, uuid) TO service_role;
+
+COMMENT ON FUNCTION public.is_app_available(text, uuid) IS 'Check if app is available to account';
+
+CREATE OR REPLACE FUNCTION public.update_app_version(
+  app_id      uuid,
+  new_version text
+)
+RETURNS void
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  UPDATE public.apps
+  SET
+    version = update_app_version.new_version,
+    updated_at = now()
+  WHERE id = update_app_version.app_id;
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.update_app_version(uuid, text) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.update_app_version(uuid, text) TO service_role;
+
+COMMENT ON FUNCTION public.update_app_version(uuid, text) IS 'Update app version';

package/.framework/migrations/071_timer_interval_keys.sql

@@ -0,0 +1,96 @@
+-- Migration 071: F-056 — make timers created via the API/admin UI fire.
+--
+-- Two halves of the fix:
+--   1. timers.ts now writes next_execution server-side on
+--      create/update/activate (068's get_due_timers gates on
+--      next_execution IS NOT NULL and nothing else ever set it).
+--   2. This file: update_timer_after_run previously rescheduled only
+--      from config->>'interval_minutes', but TimerDetailPage seeded
+--      config.interval_seconds — UI-created timers would fire once (if
+--      armed) and never reschedule. The RPC now accepts both keys with
+--      the same precedence the TS handler uses: interval_minutes
+--      (minutes) first, then interval_seconds (seconds / 60).
+--      Existing rows keep working under either key.
+--
+-- A backfill at the bottom arms existing active timers that have a
+-- computable interval but next_execution IS NULL — rows created before
+-- the API could write the column could never fire.
+
+-- CIL[BEGIN stable_id="~/.framework/migrations/071_timer_interval_keys.sql:module:migration" type="migration" identity="timer-interval-keys" parent="~/.framework/migrations/071_timer_interval_keys.sql"]
+-- CIL[DOC-MACRO purpose="Teach update_timer_after_run the interval_seconds config key and backfill next_execution for dormant armed-by-interval timers"]
+-- CIL[DOC-RESPONSIBILITY responsibility="Replace update_timer_after_run with a dual-key interval resolver; arm existing active timers whose next_execution is NULL"]
+-- CIL[DOC-CONTEXT module="system-cron" layer="schema" related_files=".framework/functions/system-cron.ts, .framework/functions/timers.ts, .framework/migrations/068_cron_schedule_timer_rpcs.sql"]
+-- CIL[DOC-CONTRACT inputs="p_timer_id uuid, p_success boolean, p_error_message text" outputs="void" errors="none — SECURITY DEFINER" side_effects="mutates timers bookkeeping columns; backfill sets next_execution on dormant interval timers"]
+-- CIL[DOC-MICRO logic_summary="Interval precedence: config->>'interval_minutes' (minutes) then config->>'interval_seconds' (seconds/60); non-positive or absent => next_execution NULL one-shot stop. Backfill UPDATE arms is_active + next_execution IS NULL + positive-interval rows to now()+interval" notable_decisions="Both keys kept forever so rows seeded with the old UI default (interval_seconds) and the canonical key (interval_minutes) both reschedule; 'once'/cron timers still dead-end to NULL since no cron evaluator exists in the DB"]
+-- CIL[DOC-CONFIDENCE pass="first" score="0.9" flags="none"]
+-- CIL[DOC-STABILITY stability="stable"]
+-- CIL[DOC-AUDIENCE audience="system-admin"]
+-- CIL[END stable_id="~/.framework/migrations/071_timer_interval_keys.sql:module:migration"]
+
+CREATE OR REPLACE FUNCTION public.update_timer_after_run(
+  p_timer_id uuid,
+  p_success boolean,
+  p_error_message text
+)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_config jsonb;
+  v_interval numeric; -- resolved interval in MINUTES
+BEGIN
+  SELECT config INTO v_config FROM public.timers WHERE id = p_timer_id;
+
+  -- interval_minutes (canonical) wins; interval_seconds is the legacy UI
+  -- default and is converted seconds -> minutes.
+  v_interval := CASE
+    WHEN v_config->>'interval_minutes' ~ '^\d+(\.\d+)?$'
+      THEN (v_config->>'interval_minutes')::numeric
+    WHEN v_config->>'interval_seconds' ~ '^\d+(\.\d+)?$'
+      THEN (v_config->>'interval_seconds')::numeric / 60
+    ELSE NULL
+  END;
+
+  UPDATE public.timers
+  SET
+    last_execution = now(),
+    execution_count = COALESCE(execution_count, 0) + 1,
+    success_count = COALESCE(success_count, 0) + CASE WHEN p_success THEN 1 ELSE 0 END,
+    failure_count = COALESCE(failure_count, 0) + CASE WHEN p_success THEN 0 ELSE 1 END,
+    next_execution = CASE
+      WHEN v_interval IS NOT NULL AND v_interval > 0
+        THEN now() + (v_interval * interval '1 minute')
+      ELSE NULL
+    END,
+    updated_at = now()
+  WHERE id = p_timer_id;
+END;
+$$;
+
+-- Arm timers that are active and have a resolvable interval but were
+-- created while next_execution was unwritable (pre-F-056 API). One-shot
+-- and unparseable configs stay NULL — a NULL next_execution is a safe
+-- never-fire state, matching update_timer_after_run's stop semantics.
+UPDATE public.timers t
+SET
+  next_execution = now() + (v.mins * interval '1 minute'),
+  updated_at = now()
+FROM (
+  SELECT
+    id,
+    CASE
+      WHEN config->>'interval_minutes' ~ '^\d+(\.\d+)?$'
+        THEN (config->>'interval_minutes')::numeric
+      WHEN config->>'interval_seconds' ~ '^\d+(\.\d+)?$'
+        THEN (config->>'interval_seconds')::numeric / 60
+      ELSE NULL
+    END AS mins
+  FROM public.timers
+) v
+WHERE t.id = v.id
+  AND t.is_active
+  AND t.next_execution IS NULL
+  AND v.mins IS NOT NULL
+  AND v.mins > 0;

package/.framework/migrations/072_slug_autofill.sql

@@ -0,0 +1,77 @@
+-- 072_slug_autofill.sql
+-- Fill slug from name on insert when the caller omits it.
+-- Fresh-install schema (001) declares slug NOT NULL on these tables, but the
+-- create handlers for triggers/timers/pipelines/ai_agents/test_runs/
+-- item_progress/invites never write slug — inserts fail on fresh chains.
+-- The trigger is a no-op whenever the caller supplies a slug.
+
+CREATE OR REPLACE FUNCTION public.spine_fill_slug()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  base text;
+  candidate text;
+  clash boolean;
+  i int := 2;
+BEGIN
+  IF NEW.slug IS NOT NULL AND NEW.slug <> '' THEN
+    RETURN NEW;
+  END IF;
+
+  base := trim(both '_' from regexp_replace(lower(coalesce(NEW.name, '')), '[^a-z0-9]+', '_', 'g'));
+  IF base = '' THEN
+    base := 'row';
+  END IF;
+  candidate := base;
+
+  LOOP
+    EXECUTE format(
+      'SELECT EXISTS (SELECT 1 FROM %I.%I WHERE app_id IS NOT DISTINCT FROM $1 AND slug = $2)',
+      TG_TABLE_SCHEMA, TG_TABLE_NAME
+    ) INTO clash USING NEW.app_id, candidate;
+    EXIT WHEN NOT clash;
+    candidate := base || '_' || i;
+    i := i + 1;
+    IF i > 100 THEN
+      candidate := base || '_' || substr(replace(gen_random_uuid()::text, '-', ''), 1, 6);
+      EXECUTE format(
+        'SELECT EXISTS (SELECT 1 FROM %I.%I WHERE app_id IS NOT DISTINCT FROM $1 AND slug = $2)',
+        TG_TABLE_SCHEMA, TG_TABLE_NAME
+      ) INTO clash USING NEW.app_id, candidate;
+      EXIT WHEN NOT clash;
+    END IF;
+  END LOOP;
+
+  NEW.slug := candidate;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.triggers;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.triggers
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.timers;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.timers
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.pipelines;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.pipelines
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.ai_agents;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.ai_agents
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.test_runs;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.test_runs
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.item_progress;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.item_progress
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();
+
+DROP TRIGGER IF EXISTS spine_fill_slug_trg ON public.invites;
+CREATE TRIGGER spine_fill_slug_trg BEFORE INSERT ON public.invites
+  FOR EACH ROW EXECUTE FUNCTION public.spine_fill_slug();

package/.framework/migrations/073_seed_member_roles.sql

@@ -0,0 +1,26 @@
+-- 073_seed_member_roles.sql
+-- Seed the member and member_admin end-user roles.
+--
+-- F-066: 003_core_system_data.sql seeds system_admin plus the department
+-- roles but never member/member_admin, even though the platform assumes
+-- they exist:
+--   * 003's own thread/message types grant record_permissions to both
+--   * 060 grants them CRU on account/person; 051/007 grant member reads
+--   * the registration RPCs (052/059) default join_request to 'member'
+--   * RegisterPage falls back to 'member'; the admin UI defaults app
+--     min_role to 'member'; create-app defaults --role member
+-- With no roles row the slug never resolves, so every member grant was a
+-- dead key (guaranteed-deny) and apps scaffolded with the default --role
+-- wrote a min_role no person could satisfy.
+--
+-- is_system stays false: invites.ts resolveRoleId and the invite-accept
+-- path reject is_system role slugs, and these are the self-service
+-- end-user roles (same shape the app seed/roles.json files carry).
+-- App installs upsert the same slugs (conflict 'slug'), so ON CONFLICT
+-- DO NOTHING keeps this a no-op wherever an app already claimed them.
+
+INSERT INTO public.roles (id, slug, name, description, permissions, is_system, is_active, is_protected, app_id, account_id)
+VALUES
+  (gen_random_uuid(), 'member',       'Member',       'Standard account member — end-user access to account-scoped apps',                 '["*"]'::jsonb, false, true, false, NULL, NULL),
+  (gen_random_uuid(), 'member_admin', 'Member Admin', 'Member administrator — same access as member plus invite and member management', '["*"]'::jsonb, false, true, false, NULL, NULL)
+ON CONFLICT (slug) DO NOTHING;