Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/api/test/activities.test.ts

@@ -0,0 +1,167 @@
+/**
+ * The write that used to bypass everything.
+ *
+ * `POST /api/activities` lived inline in app.ts with no capability check at
+ * all: any member, and any write-scoped API key, could insert an activity
+ * against an arbitrary `accountId` and move that account's `lastActivityAt`.
+ * These pin the three things that stopped it, not the SQL that carries them
+ * out.
+ */
+import { strict as assert } from 'node:assert';
+import { describe, it } from 'node:test';
+import type { Database } from '@pig/db';
+import { AuthError } from '../src/lib/auth';
+import { executeMutation } from '../src/lib/mutation';
+import { createActivityMutationDefinition, type LoggedActivity } from '../src/routes/activities';
+import { onTeam, principal } from './helpers/principal';
+
+interface Recorded {
+  events: string[];
+  inserted: unknown[];
+  updated: unknown[];
+}
+
+/** A transaction whose account lookup answers with a chosen side. */
+function database(accountSide: string | null): { db: Database; log: Recorded } {
+  const log: Recorded = { events: [], inserted: [], updated: [] };
+  const accountRows = accountSide ? [{ side: accountSide }] : [];
+
+  const tx = {
+    select: () => {
+      log.events.push('select');
+      return { from: () => ({ where: () => ({ limit: async () => accountRows }) }) };
+    },
+    insert: () => ({
+      values: (row: unknown) => {
+        log.events.push('insert');
+        log.inserted.push(row);
+        return { onConflictDoNothing: () => ({ returning: async () => [row] }) };
+      },
+    }),
+    update: () => ({
+      set: (values: unknown) => ({
+        where: async () => {
+          log.events.push('touch-account');
+          log.updated.push(values);
+        },
+      }),
+    }),
+  };
+
+  return {
+    db: {
+      transaction: async (work: (t: unknown) => Promise<unknown>) => {
+        log.events.push('transaction');
+        return work(tx);
+      },
+    } as unknown as Database,
+    log,
+  };
+}
+
+const body = {
+  type: 'call' as const,
+  subject: 'Spoke to the CTO',
+  accountId: '00000000-0000-4000-8000-0000000000ff',
+};
+
+function log(db: Database, actor = principal()) {
+  return executeMutation(
+    db,
+    actor,
+    async () => body,
+    createActivityMutationDefinition(),
+  ) as Promise<LoggedActivity>;
+}
+
+describe('logging an activity', () => {
+  it('refuses a principal with no activity:write anywhere, before reading the body', async () => {
+    const { db, log: recorded } = database('demand');
+    let bodyWasRead = false;
+
+    await assert.rejects(
+      executeMutation(
+        db,
+        principal(onTeam('demand', 'viewer')),
+        async () => {
+          bodyWasRead = true;
+          return body;
+        },
+        createActivityMutationDefinition(),
+      ),
+      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_permission',
+    );
+    assert.equal(bodyWasRead, false);
+    assert.deepEqual(recorded.events, []);
+  });
+
+  /**
+   * The escalation the old handler allowed: a research member logging a call
+   * against a demand account they have no relationship with, and pushing it to
+   * the top of somebody else's account list.
+   */
+  it('refuses a research member writing against a demand account', async () => {
+    const { db, log: recorded } = database('demand');
+
+    await assert.rejects(
+      log(db, principal(onTeam('research', 'admin'))),
+      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_permission',
+    );
+    assert.equal(recorded.inserted.length, 0);
+    assert.equal(recorded.updated.length, 0);
+  });
+
+  it('admits a demand member against a dual-sided account', async () => {
+    const { db, log: recorded } = database('both');
+
+    const result = await log(db);
+
+    assert.equal(result.deduplicated, false);
+    assert.deepEqual(recorded.events, ['transaction', 'select', 'insert', 'touch-account']);
+  });
+
+  it('writes one row, not two — the activity is its own audit event', async () => {
+    const { db, log: recorded } = database('demand');
+
+    await log(db);
+
+    assert.equal(
+      recorded.inserted.length,
+      1,
+      'an audit row alongside the activity would double every synced call in the feed',
+    );
+  });
+
+  it('attributes an API key to the agent, not silently to the person', async () => {
+    const { db, log: recorded } = database('demand');
+
+    await log(db, principal({ via: 'api_key', apiKeyId: 'key-1' }));
+
+    assert.deepEqual(
+      recorded.inserted[0] as Record<string, unknown>,
+      {
+        ...(recorded.inserted[0] as Record<string, unknown>),
+        actorAgent: 'agent',
+        source: 'agent',
+      },
+    );
+  });
+
+  it('keeps the caller\'s timestamp, because sync backfills', async () => {
+    const { db, log: recorded } = database('demand');
+    const when = '2026-01-05T09:30:00.000Z';
+
+    await executeMutation(
+      db,
+      principal(),
+      async () => ({ ...body, occurredAt: when }),
+      createActivityMutationDefinition(),
+    );
+
+    const row = recorded.inserted[0] as { occurredAt: Date };
+    assert.equal(row.occurredAt.toISOString(), when);
+    // And the account stamp follows the event, not the clock, or a backfilled
+    // call from March would jump the account to the top of the list today.
+    assert.deepEqual(recorded.updated, [{ lastActivityAt: new Date(when) }]);
+  });
+});