Bugfix/upload

.agents/skills/minimal-sufficient-work/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: minimal-sufficient-work
+description: "Use when MSW is invoked or work risks expanding beyond the requested scope."
+---
+
+# Minimal Sufficient Work (MSW)
+
+Use the MSW kernel to complete the requested outcome without speculative work, extra process, or proof beyond what the outcome requires.
+
+## Program
+
+```
+contract ← the requested outcome + the smallest criteria that prove it
+
+while ∃ claim c : deleting c leaves contract unmet ∨ unproven
+      do c ; prove c
+
+halt ; report
+```
+
+## Definitions
+
+### Contract
+
+Establish the requested outcome and the smallest set of acceptance criteria that would prove it before doing work. Treat the contract as both the floor and the ceiling.
+
+When the request is ambiguous:
+
+- In attended work, ask only when the answer would materially change the contract.
+- In unattended work, bind the smallest reading consistent with the stated intent and record the assumption.
+
+Do not silently expand the contract with inferred improvements, generic best practices, or unrelated cleanup.
+
+### Claim
+
+Treat anything petitioning to become work as a claim, including:
+
+- a plan step or implementation change
+- a test, check, investigation, or proof step
+- a new file, abstraction, dependency, artifact, or process
+- a review finding or discovered edge case
+- a migration, rollout control, monitoring change, or cleanup task
+- an instinct that another pass would be useful
+
+A claim is a proposal, not a verdict. Its source or stated severity does not make it necessary.
+
+### Deletion Rule
+
+For every claim `c`, ask:
+
+> If `c` is deleted, does the contract remain met and proven for the task's actual inputs, environment, and applicable constraints?
+
+- If yes, reject the claim. Do not implement, investigate, defer, or create follow-up work for it.
+- If no, accept the claim and perform the smallest reliable act that closes the specific gap.
+
+A claim passes only when deleting it leaves the contract unmet or unproven. Useful, thorough, conventional, and possible are not synonyms for necessary. Derive severity from impact on the contract, not from the person or tool that raised the claim.
+
+### Do and Prove
+
+For each accepted claim:
+
+1. Perform the smallest reliable act that closes the gap.
+2. Produce evidence sized to that claim.
+3. Close the claim when the evidence proves it.
+
+An unproven act leaves its claim open. Re-proving a closed claim is a new claim and must pass the deletion rule.
+
+Use evidence appropriate to the gap, such as a focused test, command output, direct inspection, reproduced behavior, type check, build result, or authoritative documentation. Do not add a broader test or review pass unless deleting it would leave the contract unproven.
+
+### Halt
+
+Stop when the contract is proven and no remaining claim passes the deletion rule. Reviewer silence and exhausted imagination are not stopping conditions. Continuing after the fixed point is as incorrect as stopping before it.
+
+## Fuses
+
+Use these fuses when claim evaluation fails to converge:
+
+```text
+rounds = 3 -> halt and report open items; do not chase them
+claim born in round n+1 that was visible in round n -> reject
+```
+
+A round is one complete evaluation, action, and proof pass over the claims then visible. The three-round limit is defined by this skill, not inferred from task size.
+
+## No Unauthoritative Limits
+
+Never invent a cap, threshold, quota, budget, timeout, retry count, round count, file count, line count, acceptance-criterion count, agent count, or similar limit.
+
+A limit is admissible only when its exact value is:
+
+- explicitly required by the requester
+- imposed by an applicable technical or platform contract
+- defined by authoritative project policy
+- derived from measured evidence necessary to meet or prove the contract
+
+State the authority or derivation whenever proposing or applying a limit. If no authority exists, omit the limit and apply the deletion rule. Metrics may be evidence, but must not become gates, defaults, targets, or recommendations through agent intuition. Examples and representative proportions do not become defaults.
+
+If a necessary limit requires an unresolved owner choice, ask rather than manufacture a value. The fuse above is already authorized by this skill.
+
+## Report
+
+Report only:
+
+1. the outcome against the contract
+2. the evidence that proves it
+3. necessary open items remaining because a fuse fired or the work is blocked
+4. rejected claims worth the user's attention, at most one line each
+
+Do not turn rejected claims into recommendations, investigations, or deferred tasks.
+
+## Quality Gate
+
+Before reporting, confirm:
+
+- the requested outcome and proof criteria formed the contract
+- every performed action passed the deletion rule
+- every accepted claim has evidence or remains explicitly open
+- no invented limit shaped the work
+- no closed claim was re-proven without necessity
+- work stopped at the fixed point or an authorized fuse

.env.example

@@ -1,5 +1,5 @@
 # Postgres
-DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm?schema=public"
+DATABASE_URL="postgresql://crm:crm@localhost:5432/crm?schema=public"
 
 # A direct, unpooled connection to that same database, used by
 # `prisma migrate deploy` when the API is built on Vercel. Set it only if
@@ -11,7 +11,12 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm?schema=public"
 # and refuses to run without this — these are real integration tests, they write
 # and delete rows, and the pre-push hook runs them. The name has to end in
 # `_test`. `bun run db:test` creates it and applies the migrations.
-TEST_DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm_test?schema=public"
+TEST_DATABASE_URL="postgresql://crm:crm@localhost:5432/crm_test?schema=public"
+
+# Postgres connection for a BYPASSRLS role. Only the database migration
+# rehearsal uses this role to audit every tenant. Normal app processes must
+# never use this value.
+AUDIT_DATABASE_URL=""
 
 # Generate your own:  openssl rand -base64 32
 BETTER_AUTH_SECRET=""
@@ -53,7 +58,7 @@ GOOGLE_CLIENT_SECRET=""
 # MICROSOFT_CLIENT_SECRET=""
 
 # Optional. Enables Slack account linking on Settings > Connections.
-# Add APP_URL + /api/auth/oauth2/callback/slack as the Slack OAuth redirect URL.
+# Add API_URL + /api/auth/callback/slack as the Slack OAuth redirect URL.
 # SLACK_CLIENT_ID=""
 # SLACK_CLIENT_SECRET=""
 
@@ -112,6 +117,41 @@ GOOGLE_CLIENT_SECRET=""
 # schedule.
 # AGENT_BRIDGE_SECRET=""
 
+# Optional XMPP agent gateway. Set XMPP_COMPONENT_ENABLED to 1 and provide the
+# component identity, component secret, and owning organization together. The
+# gateway exposes only operations from apps/agent/src/exports. Task state is
+# retained in PostgreSQL for 24 hours after admission.
+# XMPP_COMPONENT_ENABLED="1"
+# XMPP_COMPONENT_JID="gateway.agents.example.com"
+# XMPP_COMPONENT_SECRET=""
+# XMPP_ORGANIZATION_ID=""
+# XMPP_COMPONENT_SERVICE="xmpp://127.0.0.1:5275"
+# XMPP_DEFAULT_AGENT_JID="assistant@agents.example.com"
+# XMPP_AGENT_DOMAIN="agents.example.com"
+# XMPP_SERVER_DOMAIN="example.com"
+# XMPP_GATEWAY_ID="gw-1"
+# XMPP_AGENT_VERSION="1.0.0"
+
+# Comma-separated domains that can discover and invoke the endpoint. The
+# server and agent domains are used when this value is absent.
+# XMPP_ALLOWED_CALLER_DOMAINS="example.com,agents.example.com"
+
+# Comma-separated bare JIDs that can invoke destructive exports. Destructive
+# exports remain visible but return forbidden when this value is absent.
+# XMPP_ALLOW_DESTRUCTIVE_CALLERS="trusted-agent@agents.example.com"
+
+# Optional transport tuning. The copied gateway supplies safe defaults.
+# XMPP_XML_LANG="en"
+# XMPP_RECEIPT_TIMEOUT_MS="30000"
+# XMPP_RECEIPT_MAX_RESENDS="0"
+# XMPP_RECEIPT_SWEEP_MS="10000"
+# XMPP_RECONNECT_INITIAL_MS="1000"
+# XMPP_RECONNECT_MAX_MS="60000"
+# XMPP_PING_INTERVAL_MS="60000"
+# XMPP_PING_TIMEOUT_MS="10000"
+# XMPP_PING_FAILURE_THRESHOLD="2"
+# XMPP_MAX_PENDING_IQ_REQUESTS="256"
+
 # PORT="3001"
 
 
@@ -152,6 +192,14 @@ GOOGLE_CLIENT_SECRET=""
 # https://vercel.com/docs/ai-gateway
 # AI_GATEWAY_API_KEY=""
 
+# Cloudflare R2 storage. Leave all four values empty to disable asset uploads.
+# Create an R2 API token with object read and write access for the private bucket.
+# The API signs direct browser and mobile transfers. It does not expose these keys.
+# R2_ACCOUNT_ID=""
+# R2_ACCESS_KEY_ID=""
+# R2_SECRET_ACCESS_KEY=""
+# R2_BUCKET=""
+
 
 # ── Optional: operations ─────────────────────────────────────────────────────
 

.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
   push:
-    branches: [main, release]
+    branches: [master]
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -20,12 +20,12 @@ env:
 jobs:
   check:
     name: check-types, lint, test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
 
     services:
       postgres:
-        image: postgres:17-alpine
+        image: postgres:18-alpine
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -39,8 +39,8 @@ jobs:
           --health-retries 20
 
     env:
-      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/crm_test?schema=public
-      TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/crm_test?schema=public
+      DATABASE_URL: postgresql://crm:crm@localhost:5432/crm_test?schema=public
+      TEST_DATABASE_URL: postgresql://crm:crm@localhost:5432/crm_test?schema=public
       ALLOWED_SIGN_IN: example.com
       BETTER_AUTH_SECRET: ci-only-secret-regenerate-for-any-real-deployment
       API_URL: http://localhost:3001
@@ -50,13 +50,30 @@ jobs:
 
     steps:
       - uses: actions/checkout@v5
+        with:
+          submodules: recursive
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
 
+      - name: Create runtime database role
+        env:
+          PGPASSWORD: postgres
+        run: |
+          psql -h localhost -U postgres -d postgres -v ON_ERROR_STOP=1 -c "CREATE ROLE crm WITH LOGIN PASSWORD 'crm' NOSUPERUSER CREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS"
+          psql -h localhost -U postgres -d postgres -v ON_ERROR_STOP=1 -c "ALTER DATABASE crm_test OWNER TO crm"
+
       - run: bun install --frozen-lockfile
 
+      - name: Install kaneo dependencies
+        run: cd vendor/kaneo && bun install
+
+      - name: Build kaneo packages
+        run: |
+          cd vendor/kaneo/packages/email && bun run build
+          cd ../permissions && bun run build
+
       - name: Apply migrations
         run: bun run db:deploy