feat(related-persons): регистърни доказателства за връзките (#279)

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@
 
 ## Чеклист
 
-- [ ] Комитите следват [conventional commits](https://www.conventionalcommits.org) и **нямат** `Co-Authored-By:` trailer
+- [ ] Комитите следват [conventional commits](https://www.conventionalcommits.org) и **нямат** `Co-Authored-By:` trailer, който сочи към агент (Claude Code, Codex, Cursor, Copilot). Трейлъри с **хора** са наред и не се махат — те са начинът заслугата на сътрудника да оцелее при squash
 - [ ] PR-ът е с **един логически обхват** и е от форк към `midt-bg/sigma:main`
 - [ ] `pnpm typecheck` минава
 - [ ] `pnpm test` (поне за засегнатите пакети) минава

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     container:
       image: semgrep/semgrep:1.170.0@sha256:c98f8829eea377274ee4b10656458b078b88232469b2ff913f091c2317347c9d
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Static analysis (semgrep)
         run: semgrep scan --config p/security-audit --config p/secrets --config p/typescript --metrics=off --error
 
@@ -55,7 +55,7 @@ jobs:
           tar -xzf "$RUNNER_TEMP/gitleaks.tar.gz" -C "$RUNNER_TEMP" gitleaks
           "$RUNNER_TEMP/gitleaks" dir . --redact --no-banner
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22

.github/workflows/deploy.yml

@@ -83,7 +83,7 @@ jobs:
       SIGMA_VECTORIZE_NAME: ${{ vars.SIGMA_VECTORIZE_NAME }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
@@ -145,6 +145,26 @@ jobs:
           pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
             --config wrangler.deploy.jsonc --remote --yes \
             --file ../../packages/db/migrations/0003_related_persons_foundation.sql
+          # 0009 attaches the Trade Register evidence seal (#279, ADR-0033). Both migrations are
+          # applied by name here because wrangler's migration ledger is empty on this D1 (the base
+          # schema was created out-of-band), so `d1 migrations apply` would collide on 0000.
+          pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+            --config wrangler.deploy.jsonc --remote --yes \
+            --file ../../packages/db/migrations/0009_interest_link_evidence.sql
+          # 0010 owns the publishing-gate enforcement for EVERY database (#279 §2) — fresh and already
+          # deployed alike. It is deliberately NOT declared in 0003: that migration is already applied
+          # everywhere, `CREATE TABLE IF NOT EXISTS` never revisits an existing table, and the ship step
+          # wipes ROWS, not definitions — so an in-place CHECK would exist only on databases built after
+          # the edit, and be absent on exactly the database that serves the site. Enforced with BEFORE
+          # INSERT/UPDATE triggers, NOT a table rebuild: the create-copy-drop-rename route would expose
+          # the foreign keys and strip every evidence seal, emptying the public surface until the next
+          # monthly run (see the migration header). `control_hash` stays NULLABLE by design — the register
+          # omits it on some declarations; the natural-key index folds those with COALESCE instead.
+          # Idempotent: every statement is `IF NOT EXISTS` over a converging definition, so re-applying it
+          # on each deploy is a no-op. Verified by three consecutive applications, gate still enforcing.
+          pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+            --config wrangler.deploy.jsonc --remote --yes \
+            --file ../../packages/db/migrations/0010_publishing_gate_constraints.sql
       # The base schema was created out-of-band with `d1 execute --file`, so wrangler's migration
       # ledger is empty and `d1 migrations apply` would collide on 0000. Probe the actual table
       # instead. SQLite has no `ADD COLUMN IF NOT EXISTS`; a completion-marker table is created only
@@ -214,6 +234,78 @@ jobs:
               ;;
           esac
 
+      # #305 additive columns (migrations 0006/0007) must exist BEFORE the Worker serves: the contract-page
+      # query reads amendments.value_restated/value_suspect, and promote-amendments/refresh-slice also INSERT
+      # value_treatment — so all three must be present or the read AND the ETL write fail. Same rationale as
+      # the currency step above: the migration ledger is empty, so `d1 migrations apply` would collide on
+      # 0000. Probe the actual table and ALTER only the missing columns (SQLite has no ADD COLUMN IF NOT
+      # EXISTS). These are pure additions with safe defaults (INTEGER NOT NULL DEFAULT 0 / nullable TEXT), so
+      # no backfill or completion marker is needed — an ALTER populates every existing row. Malformed
+      # responses are fatal. This also makes 0006/0007 replay-safe when they were applied out-of-ledger.
+      # #306 folds in here rather than adding a second step of its own (as PR #308's own note asked):
+      # refresh-slice.sql and promote-amendments.sql write contract_number_raw + link_method into served
+      # `amendments`, so the first cron after release would crash on the missing columns. One probe, one
+      # mechanism — a second hand-written step is another chance for the alias bug #310 had to fix.
+      - name: Apply amendment restated/suspect + provenance columns
+        if: steps.guard.outputs.ok == 'true'
+        run: |
+          node scripts/wrangler-render.mjs apps/web/wrangler.jsonc
+          # Each alias below MUST be the column name itself: read_flag looks the row up by the very string
+          # ensure_column is called with. An alias that merely describes the column (has_restated) makes
+          # `Object.hasOwn(row, key)` false for every column, which the probe treats as an unreadable answer
+          # and turns into a hard failure — so the step could never succeed, on any database.
+          schema_json="$(pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+            --config wrangler.deploy.jsonc --remote --yes --json \
+            --command "SELECT
+              (SELECT COUNT(*) FROM pragma_table_info('amendments') WHERE name = 'value_restated') AS value_restated,
+              (SELECT COUNT(*) FROM pragma_table_info('amendments') WHERE name = 'value_treatment') AS value_treatment,
+              (SELECT COUNT(*) FROM pragma_table_info('amendments') WHERE name = 'value_suspect') AS value_suspect,
+              (SELECT COUNT(*) FROM pragma_table_info('amendments') WHERE name = 'contract_number_raw') AS contract_number_raw,
+              (SELECT COUNT(*) FROM pragma_table_info('amendments') WHERE name = 'link_method') AS link_method")"
+
+          read_flag() {
+            printf '%s' "$schema_json" | node -e '
+              const fs = require("fs");
+              let payload;
+              try {
+                payload = JSON.parse(fs.readFileSync(0, "utf8"));
+              } catch {
+                process.exit(2);
+              }
+              const result = Array.isArray(payload) ? payload[0] : payload;
+              const row = result && Array.isArray(result.results) ? result.results[0] : null;
+              const key = process.argv[1];
+              if (!row || !Object.hasOwn(row, key)) process.exit(2);
+              process.exit(Number(row[key]) === 1 ? 0 : 1);
+            ' "$1"
+          }
+
+          add_column() {
+            echo "amendments.$1 missing; adding it."
+            pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+              --config wrangler.deploy.jsonc --remote --yes \
+              --command "ALTER TABLE amendments ADD COLUMN $2"
+          }
+
+          ensure_column() {
+            set +e
+            read_flag "$1"
+            status="$?"
+            set -e
+            case "$status" in
+              0) echo "amendments.$1 already exists." ;;
+              1) add_column "$1" "$2" ;;
+              *) echo "::error::Could not determine whether amendments.$1 exists."; exit 1 ;;
+            esac
+          }
+
+          ensure_column value_restated  "value_restated INTEGER NOT NULL DEFAULT 0"
+          ensure_column value_treatment "value_treatment TEXT"
+          ensure_column value_suspect   "value_suspect INTEGER NOT NULL DEFAULT 0"
+          # #306 provenance: NULL on both = the row linked by contract_number directly (or is unlinked).
+          ensure_column contract_number_raw "contract_number_raw TEXT"
+          ensure_column link_method         "link_method TEXT"
+
       # `run deploy`, not `deploy` — bare `pnpm deploy` is a pnpm built-in, not our package script.
       - name: Deploy explorer (sigma)
         if: steps.guard.outputs.ok == 'true'