PR #33 — Kuan Central Estratégica do Guardião

[NomosLudens]

Motivation

• Base SHA usado como referência: aea896809fd1f4d6e4f050468742cc264e04d870 (checkout local sem remote origin).
• Corrigir regressão de segurança introduzida no PR PR #32 — Security Boundaries & Database Canon #32 antes de adicionar o domínio estratégico do produto.
• Entregar uma superfície real e persistente para o Guardião: plano estratégico (direção, decisões, cronograma, ciclos e coach), integrando UI, RLS e server functions sem mocks.

Description

• Segurança: nova migration compensatória supabase/migrations/20260712001000_repair_pr32_security_boundaries.sql que revoga grants globais inseguros e restabelece policies/grants coerentes para threads públicas e mensagens (ownership via auth.uid()), sem editar a migration histórica do PR PR #32 — Security Boundaries & Database Canon #32.
• Banco: migration supabase/migrations/20260712002000_create_kuanyin_strategic_plan.sql criando as tabelas kuanyin_business_plans, kuanyin_plan_decisions, kuanyin_plan_milestones, kuanyin_plan_review_cycles, kuanyin_plan_reviews e kuanyin_plan_links com constraints, índices, triggers updated_at e RLS baseada em kuanyin_guardians.user_id = auth.uid().
• Server: adicionadas server functions em src/lib/kuan-plan.functions.ts (workspace, upsert plan, propose/transition/supersede decisions, milestones, review cycles, reviews, link/unlink entities) e helper de ownership; regras de transição e validações em src/lib/kuan-plan.transitions.ts.
• UI / Routes: nova rota real /kuan/plano via src/routes/_authenticated/kuan.plano.tsx e implementação da página em src/features/kuan-plan/KuanPlanPage.tsx com componentes auxiliares PlanDecisionCard e PlanDialogs e entrada no APP_REGISTRY e CTA no cabeçalho de /kuan.
• Chat integration: injeção controlada do contexto compacto do plano no chat privado (src/lib/kuan/plan-context.server.ts) e inclusão condicional em src/routes/api/chat.ts somente para audience === guardian_private usando guardianId/businessContextId confiáveis.
• Ações estruturadas: ampliado KuanyinActionSchema e KuanyinActionCard para suportar kuanyin.plan.direction.propose, kuanyin.plan.decision.propose e kuanyin.plan.milestone.propose, todas com preview/ confirmação manual antes de persistir.
• Tests & QA: adicionados testes unitários de transições e contexto (src/lib/kuan-plan.transitions.test.ts, src/lib/kuan-plan-context.test.ts) e extensão dos testes de extração de ações (src/lib/kuanyin-action.test.ts), e checklist de QA manual em docs/qa/PR33_KUAN_CENTRAL_ESTRATEGICA.md.

Testing

• bun run test — all tests passed: 242 tests (22 files) — ✅
• bun run typecheck (tsc --noEmit) — succeeded — ✅
• bun run lint — succeeded after formatting fixes (warnings for any remain as non-blocking lints) — ✅
• bun run build — production build completed successfully — ✅
• bun run format:check — failed due to unrelated legacy docs (docs/qa/KUAN_CALENDAR_PRIVACY_RUNTIME_CHECKLIST.md and docs/qa/KUAN_COMMERCIAL_CONTEXT_INTERPRETER_CHECKLIST.md) outside this diff — ⚠️
• bun run start — failed in this environment because serve.mjs expected /workspace/kuan/server.js while build emits dist/server/server.js; runtime startup issue detected (environment/serve script mismatch), treated as an environment limitation — ⚠️

Notes: security migration was committed as the first isolated change; QA with a real Supabase instance is required before final approval (checklist added in docs).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	kuan	5a547ae	Jul 12 2026, 03:05 AM