spine-framework 0.4.4 → 0.5.0-rc.4

package/.framework/docs/audit-results.md

@@ -1,590 +0,0 @@
-# Spine v2 — Two-Pass Codebase Audit Results
-
-Generated: 2026-04-26  
-Auditor: Cascade (automated trace + sweep)
-
----
-
-## Summary
-
-- **Live frontend files:** 78 (all files in `v2-core/src/`)
-- **Live function files:** 18 handlers + 6 shared files
-- **Orphaned / dead files:** 11 identified
-- **Legacy candidates:** 8 identified
-- **Tables required by live code:** 21 distinct tables
-- **RPC functions required:** 8 distinct RPCs
-- **Hardcoded values found:** 0 in source (schema targets `v2` — see note)
-- **Duplicate migration prefix:** 1 (`047`)
-- **Critical note:** ALL code targets the `v2` schema, NOT `public`. Day-zero migrations must use `v2` schema OR code must be updated to use `public`.
-
----
-
-## Live Set
-
-### Frontend Entry Chain (`v2-core/src/`)
-
-**Entry:** `main.tsx` → `App.tsx`
-
-#### Core files (always live)
-- `main.tsx`
-- `App.tsx`
-- `index.css`
-- `contexts/AuthContext.tsx`
-- `types/types.ts`
-- `types/auth.ts`
-- `lib/` (all files)
-
-#### Layout
-- `components/layout/Layout.tsx`
-- `components/layout/Header.tsx`
-- `components/layout/Sidebar.tsx`
-
-#### Auth
-- `components/auth/ProtectedRoute.tsx`
-- `pages/auth/LoginPage.tsx`
-
-#### Pages
-- `pages/DashboardPage.tsx`
-- `pages/NotFoundPage.tsx`
-- `pages/admin/TypesPage.tsx`
-- `pages/admin/TypeDetailPage.tsx`
-- `pages/admin/AppsPage.tsx`
-- `pages/admin/AppDetailPage.tsx`
-- `pages/admin/PipelinesPage.tsx`
-- `pages/admin/PipelineDetailPage.tsx`
-- `pages/admin/TriggersPage.tsx`
-- `pages/admin/TriggerDetailPage.tsx`
-- `pages/admin/AIAgentsPage.tsx`
-- `pages/admin/AIAgentDetailPage.tsx`
-- `pages/admin/EmbeddingsPage.tsx`
-- `pages/admin/EmbeddingDetailPage.tsx`
-- `pages/admin/TimersPage.tsx`
-- `pages/admin/TimerDetailPage.tsx`
-- `pages/admin/IntegrationsPage.tsx`
-- `pages/admin/IntegrationDetailPage.tsx`
-- `pages/admin/AccountTypesPage.tsx`
-- `pages/admin/AccountTypeDetailPage.tsx`
-- `pages/admin/PersonTypesPage.tsx`
-- `pages/admin/PersonTypeDetailPage.tsx`
-- `pages/admin/RolesPage.tsx`
-- `pages/admin/RoleDetailPage.tsx`
-- `pages/admin/ThreadTypesPage.tsx`
-- `pages/admin/MessageTypesPage.tsx`
-- `pages/admin/AttachmentTypesPage.tsx`
-- `pages/admin/PromptConfigsPage.tsx`
-- `pages/admin/PromptConfigDetailPage.tsx`
-- `pages/admin/APIKeysPage.tsx`
-- `pages/admin/APIKeyDetailPage.tsx`
-- `pages/admin/PipelineExecutionsPage.tsx`
-- `pages/admin/LogsPage.tsx`
-
-#### Runtime components (live — routed via `DataListPage` / `DataDetailPage`)
-- `components/runtime/DataListPage.tsx`
-- `components/runtime/DataDetailPage.tsx`
-- `components/runtime/DataTable.tsx`
-- `components/runtime/DataStats.tsx`
-- `components/runtime/DataFilters.tsx`
-- `components/runtime/DataHeader.tsx`
-- `components/runtime/DataDetailHeader.tsx`
-- `components/runtime/SchemaDetailForm.tsx`
-- `components/runtime/index.ts`
-
-#### Shared components
-- `components/shared/FieldRenderer.tsx`
-- `components/shared/SchemaFields.tsx`
-
-#### Admin components
-- `components/admin/AdminListPage.tsx`
-- `components/admin/AdminStatsCard.tsx`
-- `components/admin/SortableTableHeader.tsx`
-
-#### Hooks
-- `hooks/useApi.ts`
-- `hooks/useEntityList.ts`
-- `hooks/useEntityRecord.ts`
-- `hooks/useForm.ts`
-- `hooks/useListSchema.ts`
-- `hooks/useSchemaRecord.ts`
-
-### Live Functions (`v2-core/functions/`)
-
-All 18 handlers are reachable from `netlify.toml [functions] directory = "v2-core/functions"`:
-
-| Handler | Tables accessed |
-|---|---|
-| `admin-data.ts` | accounts, people, items, threads, messages, links, attachments, watchers, types |
-| `types.ts` | types, accounts, apps |
-| `roles.ts` | roles, apps |
-| `apps.ts` | apps, accounts |
-| `auth.ts` | people, accounts, roles |
-| `pipelines.ts` | pipelines, pipeline_executions, apps, people |
-| `pipeline-executions.ts` | pipeline_executions, pipelines, people |
-| `triggers.ts` | triggers, trigger_executions, apps, people |
-| `timers.ts` | timers, apps, people |
-| `ai-agents.ts` | ai_agents, apps, people |
-| `embeddings.ts` | embeddings |
-| `integrations.ts` | integrations, apps, people |
-| `logs.ts` | logs |
-| `prompt-configs.ts` | prompt_configs, apps, people |
-| `api-keys.ts` | api_keys, api_key_usage_logs, integrations, people |
-| `account-nodes.ts` | accounts, types |
-| `debug-auth.ts` | (no DB — JWT debug only) |
-| `system-cron.ts` | actions, api_keys, schedule_executions (via `adminDb.rpc`) |
-
-### Live `_shared/` Files
-
-All 6 are imported by live handlers:
-- `_shared/db.ts` — Supabase clients, `joins` constants
-- `_shared/middleware.ts` — `createHandler`, `RequestContext`
-- `_shared/permissions.ts` — `PermissionEngine`, `sanitizeRecordData`
-- `_shared/principal.ts` — `resolvePrincipal`, `getPrincipalDb`
-- `_shared/audit.ts` — `emitLog`, `emitAudit`
-- `_shared/schema-utils.ts` — `generateValidationSchema` (used by `types.ts`)
-
-### Live Scripts
-
-| Script | Status | Called by |
-|---|---|---|
-| `scripts/netlify-dev-wrapper.sh` | ✅ Live | `netlify.toml [dev].command` |
-| `scripts/assemble-v2.sh` | ✅ Live | `package.json` prebuild |
-| `scripts/assemble-v2-functions.sh` | ✅ Live | `assemble-v2.sh` |
-| `scripts/assemble-v2-frontend.sh` | ✅ Live | `assemble-v2.sh` |
-| `scripts/assemble-v2-custom.sh` | ✅ Live | `assemble-v2.sh` |
-| `scripts/build-manifest.sh` | ✅ Live | `package.json` prebuild |
-| `scripts/verify-integrity.sh` | ✅ Live | `package.json` prebuild |
-
----
-
-## Orphaned Files
-
-These files exist but nothing in the live code path imports or routes to them:
-
-| File | Reason |
-|---|---|
-| `v2-core/src/pages/admin/AccountDetailPage.tsx.new` | Zero-byte file with `.new` extension — artifact |
-| `v2-core/x-netlify-functions/` (entire dir, 40 files) | Legacy function snapshot — no live code imports from here; superseded by `v2-core/functions/` |
-| `v2-core/functions/schema-utils.ts` *(if exists at root)* | Confirm — `schema-utils` lives in `_shared/`; any root-level copy is orphaned |
-| `scripts/assemble-apps.sh` | Not called by any live script |
-| `scripts/assemble-apps-simple.sh` | Not called by any live script |
-| `scripts/assemble-frontend.sh` | v1-era script, superseded by `assemble-v2-frontend.sh` |
-| `scripts/assemble-functions.sh` | v1-era script, superseded by `assemble-v2-functions.sh` |
-| `scripts/quarantine-legacy.sh` | One-time-use script, no longer needed |
-| `scripts/app-install-cli.ts` | Not called by any live script or route |
-| `scripts/load-test-app-install.ts` | Test/dev script, not part of any build chain |
-| `_quarantine/` (entire dir) | All contents are retired artifacts — no imports anywhere |
-
----
-
-## Legacy Candidates
-
-Files that contain references to old patterns, deleted tables, or v1-era architecture:
-
-| File | Issue |
-|---|---|
-| `v2-core/migrations/047_provisioning.sql` | Duplicate `047_` prefix — conflicts with `047_simplify_auth_model.sql`; migration order is ambiguous on fresh install |
-| `v2-core/migrations/047_simplify_auth_model.sql` | Same duplicate prefix issue |
-| `v2-core/src/App.tsx` lines 376–390 | Legacy redirect routes (`/admin/data/:entity` → `/admin/runtime/:entity`) — safe to keep short-term but dead routes |
-| `v2-core/docs/` (various .md files) | Contains stale audit reports, gap-remediation notes referencing old state — not harmful, but stale |
-| `v2-core/fix-functions.sh` | One-off fix script at `v2-core/` root — purpose served, should be deleted |
-| `v2-core/.windsurf/` | Unknown contents — confirm empty or remove |
-| `v2-core/.vscode/` | Editor config — OK to keep, but confirm not containing hardcoded values |
-| `v2-core/README.md` | May reference old architecture — needs refresh for clean install |
-
----
-
-## DB: Code→Table Map
-
-> **CRITICAL:** `db.ts` connects to schema `v2` (not `public`). Day-zero migrations must either:  
-> (a) Create tables in the `v2` schema, OR  
-> (b) Update `db.ts` to use `schema: 'public'`  
-> This decision must be made before writing migration files.
-
----
-
-### Table: `accounts`
-```
-columns used:  id, slug, display_name, is_active, parent_id, type_id, owner_account_id
-FKs:           parent_id → accounts.id
-               type_id → types.id
-               owner_account_id → accounts.id
-joins:         type:types!type_id, parent:accounts!parent_id, owner_account:accounts!owner_account_id
-accessed by:   admin-data.ts (ctx.db + adminDb), auth.ts (ctx.db), types.ts (adminDb), account-nodes.ts (ctx.db)
-RLS required:  yes (account hierarchy filtering)
-RPCs:          get_account_hierarchy(parent_account_id), get_account_ancestors(account_id),
-               get_account_descendants(account_id), get_account_apps(account_id, include_system, include_inactive)
-```
-
-### Table: `people`
-```
-columns used:  id, email, full_name, avatar_url, account_id, role_id, is_active
-FKs:           account_id → accounts.id
-               role_id → roles.id
-joins:         account:accounts!people_account_id_fkey, role:roles
-accessed by:   auth.ts (ctx.db), admin-data.ts (ctx.db), pipeline-executions.ts (join),
-               prompt-configs.ts (join), api-keys.ts (join), ai-agents.ts (join),
-               triggers.ts (join), timers.ts (join), pipelines.ts (join), integrations.ts (join)
-RLS required:  yes
-```
-
-### Table: `types`
-```
-columns used:  id, slug, name, kind, description, icon, color, app_id, is_active,
-               design_schema, validation_schema, ownership
-FKs:           app_id → apps.id
-joins:         app:apps!app_id
-accessed by:   types.ts (ctx.db + adminDb), admin-data.ts (adminDb — type lookup for items),
-               account-nodes.ts (join on accounts)
-RLS required:  yes
-RPCs:          get_type_schema(kind, slug, app_id)
-```
-
-### Table: `apps`
-```
-columns used:  id, slug, name, description, icon, color, version, app_type, source,
-               owner_account_id, config, nav_items, min_role, integration_deps, metadata,
-               is_active, is_system
-FKs:           owner_account_id → accounts.id
-joins:         owner_account:accounts!owner_account_id
-accessed by:   apps.ts (ctx.db), types.ts (adminDb), roles.ts (ctx.db),
-               pipelines.ts (join), triggers.ts (join), timers.ts (join),
-               ai-agents.ts (join), integrations.ts (join), prompt-configs.ts (join)
-RLS required:  yes
-RPCs:          get_account_apps(account_id, include_system, include_inactive),
-               get_app_schema(app_slug),
-               is_app_available(app_slug, account_id),
-               update_app_version(app_id, new_version)
-```
-
-### Table: `roles`
-```
-columns used:  id, slug, name, description, permissions, is_system, is_active, app_id
-FKs:           app_id → apps.id
-joins:         app:apps!app_id
-accessed by:   roles.ts (ctx.db + adminDb), auth.ts (join on people)
-RLS required:  yes
-```
-
-### Table: `items`
-```
-columns used:  id, item_type_id, title, is_active, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           item_type_id → types.id
-               account_id → accounts.id
-               created_by → people.id
-accessed by:   admin-data.ts (ctx.db — full CRUD via VALID_ENTITIES)
-search field:  title
-soft delete:   yes (is_active)
-RLS required:  yes
-```
-
-### Table: `threads`
-```
-columns used:  id, title, is_active, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           account_id → accounts.id
-accessed by:   admin-data.ts (ctx.db — VALID_ENTITIES)
-search field:  title
-soft delete:   yes (is_active)
-RLS required:  yes
-```
-
-### Table: `messages`
-```
-columns used:  id, content, is_active, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           account_id → accounts.id
-accessed by:   admin-data.ts (ctx.db — VALID_ENTITIES)
-search field:  content
-soft delete:   yes (is_active)
-RLS required:  yes
-```
-
-### Table: `links`
-```
-columns used:  id, link_type, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           account_id → accounts.id
-accessed by:   admin-data.ts (ctx.db — VALID_ENTITIES)
-search field:  link_type
-soft delete:   no (hard delete)
-RLS required:  yes
-```
-
-### Table: `attachments`
-```
-columns used:  id, filename, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           account_id → accounts.id
-accessed by:   admin-data.ts (ctx.db — VALID_ENTITIES)
-search field:  filename
-soft delete:   no
-RLS required:  yes
-```
-
-### Table: `watchers`
-```
-columns used:  id, watch_type, is_active, design_schema, validation_schema,
-               account_id, type_id, created_by, created_at, updated_at, updated_by
-FKs:           account_id → accounts.id
-accessed by:   admin-data.ts (ctx.db — VALID_ENTITIES)
-search field:  watch_type
-soft delete:   yes (is_active)
-RLS required:  yes
-```
-
-### Table: `pipelines`
-```
-columns used:  id, name, description, trigger_type, config, stages, metadata, is_active,
-               app_id, account_id, created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-joins:         app:apps!app_id, created_by_person:people!created_by
-accessed by:   pipelines.ts (ctx.db), pipeline-executions.ts (join)
-RLS required:  yes
-```
-
-### Table: `pipeline_executions`
-```
-columns used:  id, pipeline_id, status, trigger_data, result, error_message,
-               started_at, completed_at, duration_ms, created_by, account_id, created_at
-FKs:           pipeline_id → pipelines.id
-               created_by → people.id
-               account_id → accounts.id
-joins:         pipeline:pipelines!pipeline_id, triggered_by_person:people!pipeline_executions_created_by_fkey
-accessed by:   pipeline-executions.ts (ctx.db), pipelines.ts (ctx.db — getExecutions)
-RLS required:  yes
-```
-
-### Table: `triggers`
-```
-columns used:  id, name, description, trigger_type, event_type, config, pipeline_id,
-               metadata, is_active, app_id, account_id, created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-               pipeline_id → pipelines.id
-joins:         app:apps!app_id, created_by_person:people!created_by
-accessed by:   triggers.ts (ctx.db)
-RLS required:  yes
-```
-
-### Table: `trigger_executions`
-```
-columns used:  id, trigger_id, triggered_at, status (implicit via ordering)
-FKs:           trigger_id → triggers.id
-accessed by:   triggers.ts (ctx.db — getExecutions)
-RLS required:  yes
-```
-
-### Table: `timers`
-```
-columns used:  id, name, description, timer_type, config, pipeline_id, metadata, is_active,
-               app_id, account_id, created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-               pipeline_id → pipelines.id
-joins:         app:apps!app_id, created_by_person:people!created_by
-accessed by:   timers.ts (ctx.db)
-RLS required:  yes
-```
-
-### Table: `ai_agents`
-```
-columns used:  id, name, description, agent_type, model_config, system_prompt, tools,
-               capabilities, constraints, metadata, is_active, app_id, account_id,
-               created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-joins:         app:apps!app_id, created_by_person:people!created_by
-accessed by:   ai-agents.ts (ctx.db)
-RLS required:  yes
-```
-
-### Table: `embeddings`
-```
-columns used:  id, model_id, document_id, chunk_index, content, metadata,
-               account_id, created_at
-FKs:           account_id → accounts.id
-accessed by:   embeddings.ts (ctx.db)
-RLS required:  yes
-```
-
-### Table: `integrations`
-```
-columns used:  id, name, description, integration_type, provider, version, config,
-               credentials, metadata, is_active, is_configured, app_id, account_id,
-               created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-joins:         app:apps!app_id, created_by_person:people!created_by
-accessed by:   integrations.ts (ctx.db), api-keys.ts (join)
-RLS required:  yes
-```
-
-### Table: `logs`
-```
-columns used:  id, level, message, context, source, source_type, source_id,
-               person_id, account_id, metadata, created_at
-FKs:           account_id → accounts.id
-               person_id → people.id (nullable)
-accessed by:   logs.ts (ctx.db), audit.ts (ctx.db or adminDb — all functions via emitLog/emitAudit)
-RLS required:  yes (scoped to account_id)
-```
-
-### Table: `prompt_configs`
-```
-columns used:  id, name, slug, system_prompt, context_template, model, temperature,
-               max_tokens, is_multi_turn, max_history_messages, confidence_threshold,
-               escalation_action, escalation_target, output_mode, output_field,
-               requires_review, knowledge_sources, available_tools, tool_constraints,
-               metadata, is_active, app_id, account_id, created_by, created_at, updated_at
-FKs:           app_id → apps.id
-               account_id → accounts.id
-               created_by → people.id
-joins:         app:apps!app_id, created_by_person:people!prompt_configs_created_by_fkey
-accessed by:   prompt-configs.ts (ctx.db)
-RLS required:  yes
-```
-
-### Table: `api_keys`
-```
-columns used:  id, integration_id, name, key_type, key_prefix, permissions, rate_limit,
-               expires_at, metadata, is_active, account_id, created_by, created_at, updated_at
-               machine_type, is_internal, scopes (read by system-cron.ts)
-FKs:           integration_id → integrations.id (nullable)
-               account_id → accounts.id
-               created_by → people.id
-joins:         integration:integrations, created_by_person:people
-accessed by:   api-keys.ts (ctx.db), system-cron.ts (adminDb — machine principal lookup)
-RLS required:  yes
-RPCs:          create_api_key(...), validate_api_key(key_value, required_permissions)
-```
-
-### Table: `api_key_usage_logs`
-```
-columns used:  id, api_key_id, response_status, success, created_at
-FKs:           api_key_id → api_keys.id
-joins:         api_key:api_keys
-accessed by:   api-keys.ts (ctx.db — listUsageLogs)
-RLS required:  yes
-```
-
-### Table: `actions` *(system-cron only)*
-```
-columns used:  id, handler, handler_module, config, required_scopes
-FKs:           (none explicit in code)
-accessed by:   system-cron.ts (adminDb)
-RLS required:  no (adminDb only)
-```
-
-### Table: `schedule_executions` *(system-cron only)*
-```
-columns used:  schedule_id, account_id, machine_principal_id, status,
-               input_params, output_result, error_message, duration_ms
-FKs:           schedule_id → schedules (implied), account_id → accounts.id
-accessed by:   system-cron.ts (adminDb)
-RLS required:  no (adminDb only)
-```
-
----
-
-## Tables: `select *` (columns not fully enumerated in code)
-
-These tables are queried with `select('*')` — full column set must be verified against DB schema:
-
-| Table | Location |
-|---|---|
-| `accounts` | `admin-data.ts`, `types.ts`, `account-nodes.ts` |
-| `people` | `admin-data.ts` |
-| `items` | `admin-data.ts` |
-| `threads` | `admin-data.ts` |
-| `messages` | `admin-data.ts` |
-| `links` | `admin-data.ts` |
-| `attachments` | `admin-data.ts` |
-| `watchers` | `admin-data.ts` |
-| `types` | `types.ts` (full record), `admin-data.ts` (type lookup) |
-| `roles` | `roles.ts` |
-| `pipelines` | `pipelines.ts` |
-| `triggers` | `triggers.ts` |
-| `timers` | `timers.ts` |
-| `ai_agents` | `ai-agents.ts` |
-| `integrations` | `integrations.ts` |
-| `prompt_configs` | `prompt-configs.ts` |
-| `api_keys` | `api-keys.ts` |
-
----
-
-## RPC Functions Required
-
-| RPC name | Called by | Purpose |
-|---|---|---|
-| `get_account_hierarchy(parent_account_id)` | `auth.ts` | Get all accessible child accounts |
-| `get_account_ancestors(account_id)` | `account-nodes.ts` | Ancestor chain for breadcrumb |
-| `get_account_descendants(account_id)` | `account-nodes.ts` | Subtree for tree view |
-| `get_account_apps(account_id, include_system, include_inactive)` | `apps.ts` | Apps visible to account |
-| `get_type_schema(kind, slug, app_id)` | `types.ts` | Resolve design_schema for a type |
-| `get_app_schema(app_slug)` | `apps.ts` | App schema lookup |
-| `is_app_available(app_slug, account_id)` | `apps.ts` | Marketplace availability check |
-| `update_app_version(app_id, new_version)` | `apps.ts` | Version bump |
-| `create_api_key(...)` | `api-keys.ts` | Secure key generation |
-| `validate_api_key(key_value, required_permissions)` | `api-keys.ts` | Key validation |
-| `get_due_schedules(p_now)` | `system-cron.ts` | Cron schedule polling |
-| `validate_schedule_creator(p_schedule_id)` | `system-cron.ts` | Cron safety check |
-| `update_schedule_after_run(p_schedule_id, p_success, p_error_message)` | `system-cron.ts` | Cron state update |
-
----
-
-## Hardcoded Values Found
-
-| File | Type | Value |
-|---|---|---|
-| `functions/_shared/db.ts` | Schema target | `schema: 'v2'` — hardcoded in both `adminDb` and `getUserDb`. **Must change to `'public'` for day-zero migration** |
-| `vite.config.ts` | (check) | Confirm `VITE_DB_SCHEMA` env var path |
-
-No hardcoded tenant IDs, account UUIDs, or emails found in `v2-core/functions/` or `v2-core/src/`.
-
----
-
-## Migration Chain Issues
-
-| Issue | Detail |
-|---|---|
-| **Duplicate prefix `047`** | `047_provisioning.sql` AND `047_simplify_auth_model.sql` both exist — ambiguous execution order on fresh install |
-| **65 migrations total** | Chain is long; many migrations are incremental patches to the current hodgepodge schema — NOT suitable as a clean day-zero chain |
-| **Schema target mismatch** | All migrations use `v2` schema; day-zero plan must decide: keep `v2` schema or migrate to `public` and update `db.ts` |
-| **`x-netlify-functions/`** | Contains `_shared/` with `db.ts` likely targeting a different/older schema — confirm and delete |
-
----
-
-## Recommended Deletion List (Pending Your Sign-off)
-
-| Path | Action | Risk |
-|---|---|---|
-| `v2-core/x-netlify-functions/` | Delete entire directory | Low — nothing imports from here |
-| `v2-core/src/pages/admin/AccountDetailPage.tsx.new` | Delete | None — zero bytes |
-| `scripts/assemble-apps.sh` | Delete | Low — not in any build chain |
-| `scripts/assemble-apps-simple.sh` | Delete | Low — not in any build chain |
-| `scripts/assemble-frontend.sh` | Delete | Low — v1-era, superseded |
-| `scripts/assemble-functions.sh` | Delete | Low — v1-era, superseded |
-| `scripts/quarantine-legacy.sh` | Delete | Low — one-time use done |
-| `scripts/app-install-cli.ts` | Delete | Medium — confirm no external tooling depends on it |
-| `scripts/load-test-app-install.ts` | Delete | Medium — confirm not used in CI |
-| `_quarantine/` | Delete entire directory | Low — all contents are retired artifacts |
-| `v2-core/fix-functions.sh` | Delete | Low — one-off fix script |
-| `v2-core/migrations/` | Do NOT delete yet — keep as reference for day-zero spec | — |
-
----
-
-## Key Decisions Required Before Day-Zero Migration
-
-1. **Schema: `v2` or `public`?** — `db.ts` hardcodes `schema: 'v2'`. Day-zero plan must pick one. Changing to `public` requires a one-line edit in `db.ts`; keeping `v2` requires `CREATE SCHEMA v2` in migration 001.
-
-2. **RPC functions** — 13 RPCs are called by live code. Each needs a `CREATE FUNCTION` in the day-zero migrations. These are currently buried across the 65-migration chain.
-
-3. **`system-cron` tables** — `actions`, `schedule_executions`, `schedules` are only accessed by `system-cron.ts` via `adminDb` with no RLS. These need their own migration section.
-
-4. **`api_key_usage_logs`** — Small table, only read by `api-keys.ts`. Needs creation in day-zero chain.

package/.framework/docs/db-api-inventory.md

@@ -1,95 +0,0 @@
-# DB-First API Inventory (v2 Schema)
-
-## Core Entity Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `accounts` | accounts.ts | admin-data | complete | Full CRUD with account scoping |
-| `people` | people.ts | admin-data | complete | Full CRUD with account scoping |
-| `items` | items.ts | admin-data | complete | Full CRUD with type validation |
-| `types` | types.ts | admin-configs | complete | Unified for item/account/person types |
-| `apps` | apps.ts | admin-configs | complete | App definitions with nav items |
-| `roles` | roles.ts | admin-configs | complete | Role definitions and permissions |
-| `links` | links.ts | runtime | complete | Polymorphic entity relationships |
-| `link_types` | link_types.ts | admin-configs | complete | Link type definitions |
-
-## Workflow & Automation Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `pipelines` | pipelines.ts | admin-configs | complete | Workflow automation pipelines |
-| `pipeline_executions` | pipeline-executions.ts | runtime | complete | Pipeline execution history |
-| `triggers` | triggers.ts | admin-configs | complete | Trigger definitions |
-| `trigger_executions` | trigger_executions | runtime | RPC-only | Accessed via triggers.ts |
-| `timers` | timers.ts | admin-configs | complete | Scheduled/delayed timers |
-
-## Collaboration & Communication Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `threads` | threads.ts | runtime | complete | Conversation threads |
-| `messages` | messages.ts | runtime | complete | Thread messages |
-| `attachments` | attachments.ts | runtime | complete | File attachments |
-| `watchers` | watchers.ts | runtime | complete | Entity watching/subscriptions |
-
-## Integration & AI Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `integrations` | integrations.ts | admin-configs | complete | Integration instances |
-| `embeddings` | embeddings.ts | admin-configs | complete | Embedding vectors |
-| `ai_agents` | ai-agents.ts | admin-configs | complete | AI agent definitions |
-| `prompt_configs` | prompt-configs.ts | admin-configs | complete | AI prompt configurations |
-
-## Access Control Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `people_accounts` | people-accounts.ts | runtime | complete | People-Accounts junction |
-| `people_roles` | people-roles.ts | runtime | complete | People-Roles junction |
-| `account_paths` | account-nodes.ts | internal | RPC-only | Account hierarchy traversal |
-
-## System & Logging Tables
-
-| Table | Endpoint | Domain | Status | Notes |
-|-------|----------|--------|--------|-------|
-| `logs` | logs.ts | internal | complete | System and application logs |
-
-## v2-Incompatible Endpoints (Require Remediation)
-
-| Endpoint | Referenced Tables | Domain | Status | Action Required |
-|----------|------------------|--------|--------|-----------------|
-| ai-orchestrator.ts | `ai_orchestrator` | internal | v2-incompatible | Table does not exist in v2 schema |
-| pending-actions.ts | `pending_actions` | internal | v2-incompatible | Table does not exist in v2 schema |
-| apps-accounts.ts | `apps_accounts` | internal | v2-incompatible | Table does not exist in v2 schema |
-| apps-integrations.ts | `apps_integrations` | internal | v2-incompatible | Table does not exist in v2 schema |
-| impersonation.ts | `impersonation_sessions`, `impersonation_policies`, `impersonation_logs` | internal | v2-incompatible | Tables do not exist in v2 schema |
-| integration-health.ts | `integration_sync_logs`, `oauth_connections`, `api_keys`, `api_key_usage_logs` | internal | v2-incompatible | Tables do not exist in v2 schema |
-| thread-participants.ts | `thread_participants` | runtime | v2-incompatible | Table does not exist in v2 schema |
-| outbox.ts | `outbox` | internal | v2-incompatible | Table does not exist in v2 schema |
-| webhooks.ts | `webhooks` | internal | v2-incompatible | Table does not exist in v2 schema |
-
-## Summary
-
-### Complete Coverage: 18 tables
-- All core entity tables have proper endpoints
-- All workflow/automation tables are covered
-- All collaboration tables are covered
-- All integration/AI tables are covered
-- Access control tables are covered
-- System logging is covered
-
-### v2-Incompatible: 9 endpoints
-- These endpoints reference tables that don't exist in v2 schema
-- Must be either rewritten to use existing v2 tables or quarantined
-- Priority: High - these will cause runtime errors if called
-
-### Missing Endpoints: 0 tables
-- All v2 schema tables have corresponding endpoints
-- Some tables are accessed via RPC rather than direct queries (trigger_executions, account_paths)
-
-### Recommendations
-1. Quarantine v2-incompatible endpoints immediately
-2. Rewrite or remove incompatible endpoints
-3. Consider if missing functionality should be implemented with existing v2 tables
-4. Update any UI that might be calling incompatible endpoints