Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/db/migrations/0010_calendar_entries.sql

@@ -0,0 +1,26 @@
+CREATE TABLE "calendar_entries" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"title" text NOT NULL,
+	"description" text,
+	"kind" text DEFAULT 'meeting' NOT NULL,
+	"starts_at" timestamp with time zone NOT NULL,
+	"ends_at" timestamp with time zone,
+	"all_day" boolean DEFAULT false NOT NULL,
+	"owner_user_id" uuid,
+	"account_id" uuid,
+	"demand_deal_id" uuid,
+	"supply_deal_id" uuid,
+	"completed_at" timestamp with time zone,
+	"created_by_user_id" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "calendar_entries" ADD CONSTRAINT "calendar_entries_owner_user_id_users_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "calendar_entries" ADD CONSTRAINT "calendar_entries_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "calendar_entries" ADD CONSTRAINT "calendar_entries_demand_deal_id_demand_deals_id_fk" FOREIGN KEY ("demand_deal_id") REFERENCES "public"."demand_deals"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "calendar_entries" ADD CONSTRAINT "calendar_entries_supply_deal_id_supply_deals_id_fk" FOREIGN KEY ("supply_deal_id") REFERENCES "public"."supply_deals"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "calendar_entries" ADD CONSTRAINT "calendar_entries_created_by_user_id_users_id_fk" FOREIGN KEY ("created_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "calendar_entries_starts_idx" ON "calendar_entries" USING btree ("starts_at");--> statement-breakpoint
+CREATE INDEX "calendar_entries_owner_idx" ON "calendar_entries" USING btree ("owner_user_id");--> statement-breakpoint
+CREATE INDEX "calendar_entries_account_idx" ON "calendar_entries" USING btree ("account_id");

packages/db/migrations/0011_learn_resources.sql

@@ -0,0 +1,29 @@
+CREATE TABLE "learn_resources" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"track" text NOT NULL,
+	"title" text NOT NULL,
+	"summary" text,
+	"url" text NOT NULL,
+	"provider" text NOT NULL,
+	"external_id" text NOT NULL,
+	"visibility" text DEFAULT 'members' NOT NULL,
+	"duration_seconds" integer,
+	"sort_order" integer DEFAULT 100 NOT NULL,
+	"published_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"added_by_user_id" uuid,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "learn_resources_track_provider_external_key" UNIQUE("track","provider","external_id"),
+	CONSTRAINT "learn_resources_track_check" CHECK ("learn_resources"."track" IN ('supply', 'demand', 'platform')),
+	CONSTRAINT "learn_resources_visibility_check" CHECK ("learn_resources"."visibility" IN ('members', 'code')),
+	CONSTRAINT "learn_resources_provider_check" CHECK ("learn_resources"."provider" IN ('cap', 'loom', 'youtube_nocookie')),
+	CONSTRAINT "learn_resources_code_is_platform_only_check" CHECK ("learn_resources"."visibility" <> 'code' OR "learn_resources"."track" = 'platform'),
+	CONSTRAINT "learn_resources_duration_check" CHECK ("learn_resources"."duration_seconds" IS NULL OR "learn_resources"."duration_seconds" > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "platform_settings" ADD COLUMN "learn_access_code" text DEFAULT 'carlthefog' NOT NULL;--> statement-breakpoint
+ALTER TABLE "platform_settings" ADD COLUMN "learn_access_code_updated_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "learn_resources" ADD CONSTRAINT "learn_resources_added_by_user_id_users_id_fk" FOREIGN KEY ("added_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "learn_resources_track_order_idx" ON "learn_resources" USING btree ("track","sort_order");--> statement-breakpoint
+CREATE INDEX "learn_resources_visibility_idx" ON "learn_resources" USING btree ("visibility","track");

packages/db/migrations/0012_viewer_team_role.sql

@@ -0,0 +1,16 @@
+-- Hand-written, like 0005, because drizzle-kit cannot express this safely.
+--
+-- Two traps live in these three lines.
+--
+-- First, `ALTER TYPE ... ADD VALUE` could not run inside a transaction block
+-- before Postgres 12, and the drizzle migrator wraps every migration in one.
+-- PIG targets Postgres 16, where it is permitted; what remains forbidden even
+-- on 16 is *using* the new value in the same transaction, so nothing here may
+-- reference 'viewer' — no backfill, no default change, no CHECK. Adding one
+-- later means its own migration.
+--
+-- Second, `BEFORE 'member'` is not cosmetic. `viewer` outranks nobody, and the
+-- enum's sort order is what `ORDER BY role` and any future comparison would
+-- use. Appending it to the end would silently make the least privileged role
+-- sort as the most senior.
+ALTER TYPE "public"."pig_team_role" ADD VALUE IF NOT EXISTS 'viewer' BEFORE 'member';

packages/db/migrations/meta/_journal.json

@@ -71,6 +71,27 @@
       "when": 1786612000000,
       "tag": "0009_warm_metal_master",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1786651559230,
+      "tag": "0010_calendar_entries",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1786655711401,
+      "tag": "0011_learn_resources",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1786655800000,
+      "tag": "0012_viewer_team_role",
+      "breakpoints": true
     }
   ]
-}
+}