Add Kuan strategic plan: DB, server functions, UI, routes, RLS and tests

[NomosLudens]

Motivation

• Introduce a private strategic plan workspace for a Guardian to capture plan direction, decisions, milestones, review cycles and links (clients, appointments, etc.).
• Let the Kuan-Yin chat propose structured plan actions (direction, decision, milestone) as non-authoritative cards that require human confirmation before persisting.
• Enforce row-level security and safe RPC usage for atomic supersede operations and plan ownership checks in Supabase.
• Provide QA artifacts and an isolation script to validate cross-guardian boundaries against a real Supabase project before approving the feature.

Description

• New backend server functions in src/lib/kuan-plan.functions.ts implement workspace loading, upsert plan, propose/transition/supersede decisions, milestone flows, review cycles, reviews, and linking/unlinking entities with logging and ownership checks.
• Database migrations add plan-related tables and constraints plus RLS helpers and an atomic kuanyin_supersede_plan_decision RPC guarded with proper privilege hardening under supabase/migrations/20260712002000_create_kuanyin_strategic_plan.sql and 20260712003000_harden_kuan_plan_rpc_privileges.sql, and a repair migration to adjust earlier chat policy changes.
• Client changes add a full plan UI and route (/kuan/plano), route registrations, KuanPlanPage, decision cards, dialogs, action-card support for three new action types, plan-context rendering and injection into the chat prompt, and minor server adapter path fixes (serve.mjs).
• Tests and QA: unit tests for transitions, context rendering and SQL/contracts were added, a QA manual doc docs/qa/PR33_KUAN_CENTRAL_ESTRATEGICA.md and a reproducible isolation script scripts/qa/pr33-real-isolation.ts to validate RLS across two Guardians.

Testing

• Added Vitest unit tests and ran the test suite with vitest; the new tests include src/lib/kuan-plan.transitions.test.ts, src/lib/kuan-plan-context.test.ts, src/lib/kuan-plan.sql-contract.test.ts and updated src/lib/kuanyin-action.test.ts, and the suite passed locally under vitest.
• Per-PR QA steps are documented in docs/qa/PR33_KUAN_CENTRAL_ESTRATEGICA.md and the real-isolation script scripts/qa/pr33-real-isolation.ts is provided for validation against a real Supabase project; real Supabase QA was not executed in this environment due to missing credentials.
• Database migrations were inspected by the SQL contract tests to ensure the RPC is SECURITY INVOKER and privilege hardening is applied; those checks are covered by the added contract test and passed in the test run.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	kuan	1f13655	Jul 12 2026, 05:10 AM