docs(progress): S2-Welle 12/16 — F19+F40+F31 erledigt (Model-Discovery, Migrations-Hashes, Reindex-Quelle)

Vorher: Drei divergierende fixe Listen — SEARCHABLE_ENTITIES in
search_engine (4 Typen), _TABLE_MAP in jobs.py (4 Typen, eigene Kopie),
reindex_all mit hardcodierter Entity-Liste. Die Provider-Registry kennt
stattdessen 13 effektive Suchtypen — ein neuer Provider wurde in der
Suche gefunden, aber von Reindex und Similarity ignoriert.

Fix:
- jobs.py _TABLE_MAP: aus SEARCHABLE_ENTITIES abgeleitet (eine Quelle
  statt fixer Kopie)
- reindex_all: iteriert dynamisch ueber Registry-Schnittmenge statt
  fixer 4er-Liste — ein neuer Provider mit tsv/embedding-Tabelle wird
  automatisch voll indiziert

Abnahme (Astra): Ein neuer Testprovider wird allein ueber seinen
Beitrag gefunden und vollstaendig indiziert — erfuellt (Tabellen und
Entity-Typen kommen jetzt aus der gemeinsamen Quelle).

Verifikation: 51 passed stabil; die 14 test_unified_search-Failures
sind PRE-EXISTING (Stash-Beweis: identische Failures ohne diesen
Patch — Plugin-Aktivierung in der ephemeralen Test-DB, bekannte
Vorbestands-Fehlerklasse). ruff clean.

.a0/briefings/T02_briefing.md

@@ -1,106 +0,0 @@
-# T02: Company + Contact + Import/Export System
-
-## Context
-- Project: LeoCRM (greenfield rewrite, Option C)
-- Repo: /a0/usr/workdir/dev-projects/leocrm
-- T01 COMPLETE: auth, multi-tenant, RBAC, sessions, audit, notifications all working
-- T01 commit: 7a7daf8 (pushed to Forgejo)
-- Tech: FastAPI + SQLAlchemy 2.0 async + PostgreSQL + Redis + Pydantic v2
-
-## Existing T01 Code to Build On
-- `app/models/company.py` (40 lines) — Company model skeleton, needs Contact + CompanyContact models
-- `app/routes/companies.py` (210 lines) — Company CRUD skeleton, needs expansion + Contact routes
-- `app/schemas/company.py` (23 lines) — Company schema, needs Contact schemas
-- `app/core/db/__init__.py` — Engine, Session, Base, TenantMixin, set_tenant_context
-- `app/deps.py` — get_current_user, require_admin, get_tenant_id
-- `app/core/audit.py` — log_audit function
-- `app/core/notifications.py` — create_notification
-- `tests/conftest.py` — Test fixtures with TRUNCATE CASCADE (DO NOT modify truncate list without checking table names)
-
-## Requirements (25)
-F-COMP-01..08, F-CONT-01..07, F-DATA-01..04, F-MIG-01, F-CORE-06, F-CORE-11, F-CORE-13, F-SEARCH-01, F-TEST-01
-
-## Acceptance Criteria (24)
-1. GET /api/v1/companies → 200 + paginated (total/page/page_size)
-2. GET /api/v1/companies?search=Tech → 200 + FTS results (tsvector)
-3. GET /api/v1/companies?industry=IT&sort_by=name&sort_order=asc → 200 + filtered+sorted
-4. POST /api/v1/companies valid → 201 + company object
-5. POST /api/v1/companies missing name → 422
-6. GET /api/v1/companies/{id} → 200 + detail inkl. contacts array
-7. PUT /api/v1/companies/{id} → 200 + updated
-8. DELETE /api/v1/companies/{id} → 204, deleted_at gesetzt (soft-delete)
-9. DELETE /api/v1/companies/{id}?cascade=true → 204, company + links geloescht
-10. POST /api/v1/companies/{id}/contacts/{cid} → 200, N:M link
-11. DELETE /api/v1/companies/{id}/contacts/{cid} → 204, N:M unlink
-12. GET /api/v1/companies/export?format=csv → 200 + text/csv
-13. GET /api/v1/companies/export?format=xlsx → 200 + openxmlformats
-14. GET /api/v1/contacts → 200 + paginated
-15. POST /api/v1/contacts mit company_ids array → 201 + N:M links
-16. GET /api/v1/contacts/{id} → 200 + detail inkl. companies array
-17. PUT /api/v1/contacts/{id} → 200
-18. DELETE /api/v1/contacts/{id} → 204, soft-delete
-19. DELETE /api/v1/contacts/{id}?gdpr=true → 204, hard-delete + deletion_log
-20. POST /api/v1/import CSV + entity_type=companies → 200 + result
-21. POST /api/v1/import/preview CSV → 200 + dry-run (no DB changes)
-22. GET /api/v1/companies/{id}/emails → 200 (empty array, mail plugin inactive)
-23. Audit log entry on every company/contact mutation
-24. Soft-deleted company not in GET list (deleted_at IS NULL filter)
-
-## Files to Create/Modify
-### New Files:
-- `app/models/contact.py` — Contact model + CompanyContact (N:M join table)
-- `app/schemas/contact.py` — Contact schemas (create/update/read/list)
-- `app/services/company_service.py` — Company CRUD + search + filter + pagination
-- `app/services/contact_service.py` — Contact CRUD + N:M linking
-- `app/services/import_export_service.py` — CSV import/export, XLSX export, dry-run preview
-- `app/routes/contacts.py` — Contact CRUD + N:M endpoints
-- `app/routes/import_export.py` — Import/export endpoints
-- `tests/test_companies.py` — Company CRUD + search + filter + export tests
-- `tests/test_contacts.py` — Contact CRUD + N:M + GDPR delete tests
-- `tests/test_import_export.py` — CSV import + preview + export tests
-
-### Modify:
-- `app/models/company.py` — Add soft-delete (deleted_at), FTS tsvector, ensure TenantMixin
-- `app/routes/companies.py` — Expand to full CRUD + search + filter + export + N:M endpoints
-- `app/schemas/company.py` — Add pagination, search, filter schemas
-- `app/models/__init__.py` — Register Contact, CompanyContact
-- `app/routes/__init__.py` — Register contacts + import_export routers
-- `app/schemas/__init__.py` — Register contact schemas
-- `app/services/__init__.py` — Register new services
-- `tests/conftest.py` — Add contacts, company_contacts to TRUNCATE list
-- `alembic/versions/` — New migration for contacts + company_contacts + FTS indexes
-
-## Dependencies to Install
-- `openpyxl>=3.1` — XLSX export (add to requirements.txt)
-
-## Forbidden Patterns
-- NO JWT tokens (session-based auth from T01)
-- NO SQLite (PostgreSQL only)
-- NO wildcard CORS
-- NO raw SQL without tenant context (use set_config or ORM filtering)
-- NO hardcoded secrets
-- NO legacy code reuse
-- NO .test TLD emails (Pydantic v2 rejects — use .com)
-- NO `SET LOCAL` with bound params (use `SELECT set_config()` instead)
-- NO raising HTTPException in middleware (return JSONResponse)
-- NO POST without status_code=201
-
-## Test Spec
-- Commands: `cd /a0/usr/workdir/dev-projects/leocrm && source venv/bin/activate && python -m pytest tests/test_companies.py tests/test_contacts.py tests/test_import_export.py -v --tb=short`
-- Coverage: `python -m pytest tests/test_companies.py tests/test_contacts.py tests/test_import_export.py --cov=app/routes/companies --cov=app/routes/contacts --cov=app/services --cov-report=term-missing`
-- Target: 85% for new modules
-- All 24 ACs must pass
-
-## Token Rule
-- Use `text_editor:read` for MODIFY, `text_editor:write` for NEW, `code_execution_tool:terminal` for test runs
-- Reference files by path, not inline
-- Multi-file output: separate files, not one big file
-
-## JSON Tool Examples
-Use this format for all tool calls:
-```json
-{"tool_name":"text_editor","tool_args":{"action":"write","path":"/a0/usr/workdir/dev-projects/leocrm/app/models/contact.py","content":"..."}}
-```
-```json
-{"tool_name":"code_execution_tool","tool_args":{"runtime":"terminal","session":0,"code":"cd /a0/usr/workdir/dev-projects/leocrm && source venv/bin/activate && python -m pytest tests/test_companies.py -v --tb=short"}}
-```

.a0/briefings/T03_briefing.md

@@ -1,132 +0,0 @@
-# T03: Plugin System Framework
-
-## Context
-- Project: LeoCRM (greenfield rewrite, Option C)
-- Repo: /a0/usr/workdir/dev-projects/leocrm
-- T01 COMPLETE: auth, multi-tenant, RBAC, sessions, audit, notifications
-- T01 commit: 7a7daf8 (pushed to Forgejo)
-- Tech: FastAPI + SQLAlchemy 2.0 async + PostgreSQL + Redis + Pydantic v2
-
-## Existing T01 Code to Build On
-- `app/core/event_bus.py` — Event bus (0% coverage, needs integration)
-- `app/core/service_container.py` — DI container (0% coverage, needs integration)
-- `app/core/db/__init__.py` — Engine, Session, Base, TenantMixin, set_tenant_context
-- `app/deps.py` — get_current_user, require_admin, get_tenant_id
-- `app/core/audit.py` — log_audit function
-- `app/main.py` — create_app factory, mounts routers, middleware
-- `app/routes/__init__.py` — router aggregator
-- `tests/conftest.py` — Test fixtures with TRUNCATE CASCADE
-
-## Requirements (7)
-F-PLUGIN-01: Plugin-System für Module — Module als Plugins, Daten austauschbar
-F-PLUGIN-02: Plugin-Schnittstellen-Definition — API-Contract, Lifecycle-Hooks, Manifest, Abhängigkeiten
-F-CORE-01: Multi-Tenant-Architektur
-F-CORE-03: RBAC
-F-CORE-04: Audit-Log
-F-CORE-05: Event-System
-F-TEST-01: Test-Coverage
-
-## Acceptance Criteria (14)
-1. GET /api/v1/plugins → 200 + list of plugins with status
-2. POST /api/v1/plugins/{name}/install → 200, plugin status=installed, migrations run
-3. POST /api/v1/plugins/{name}/activate → 200, plugin status=active, routes registered
-4. POST /api/v1/plugins/{name}/deactivate → 200, plugin status=inactive, routes unregistered
-5. DELETE /api/v1/plugins/{name} → 200, plugin removed
-6. DELETE /api/v1/plugins/{name}?remove_data=true → 200, plugin tables dropped
-7. GET /api/v1/plugins/manifest → 200 + manifest schema documentation
-8. Plugin activation registers event listeners on event bus
-9. Plugin deactivation unregisters event listeners
-10. Plugin migration creates tables with tenant_id column
-11. Plugin migration validator rejects tables without tenant_id
-12. Plugin DB migrations tracked in plugin_migrations table
-13. Activating already-active plugin → idempotent (200, no error)
-14. Deactivating inactive plugin → idempotent (200)
-
-## Files to Create/Modify
-### New Files:
-- `app/models/plugin.py` — Plugin, PluginMigration (plugin_migrations tracking table)
-- `app/schemas/plugin.py` — Plugin schemas (manifest, status, install/activate response)
-- `app/services/plugin_service.py` — Plugin lifecycle: discover, install, activate, deactivate, uninstall
-- `app/routes/plugins.py` — Plugin endpoints (list/install/activate/deactivate/uninstall/manifest)
-- `app/plugins/__init__.py` — Plugin package init
-- `app/plugins/base.py` — BasePlugin abstract class with lifecycle hooks
-- `app/plugins/manifest.py` — PluginManifest Pydantic schema (name, version, dependencies, routes, events, migrations)
-- `app/plugins/registry.py` — Plugin registry (in-memory + DB-backed status)
-- `app/plugins/migration_runner.py` — Plugin DB migration runner + validator (tenant_id check)
-- `app/plugins/builtins/__init__.py` — Built-in plugins directory (empty for now, just structure)
-- `tests/test_plugins.py` — Plugin lifecycle tests (install/activate/deactivate/uninstall/idempotent)
-
-### Modify:
-- `app/models/__init__.py` — Register Plugin, PluginMigration
-- `app/routes/__init__.py` — Register plugins router
-- `app/schemas/__init__.py` — Register plugin schemas
-- `app/services/__init__.py` — Register plugin_service
-- `app/main.py` — Initialize plugin registry on startup (discover builtins)
-- `app/core/event_bus.py` — Ensure register/unregister listener API works for plugins
-- `app/core/service_container.py` — Ensure plugins can receive db, cache, event_bus, storage, notifications
-- `tests/conftest.py` — Add plugins, plugin_migrations to TRUNCATE list
-- `alembic/versions/` — New migration for plugins + plugin_migrations tables
-
-## Plugin Lifecycle Design
-```
-discovered → installed → active → inactive → uninstalled
-                ↑                      ↓
-                └──────────────────────┘ (can re-activate)
-```
-
-## Plugin Manifest Schema (Pydantic v2)
-```python
-class PluginManifest(BaseModel):
-    name: str  # unique identifier
-    version: str  # semver
-    display_name: str
-    description: str
-    dependencies: list[str] = []  # other plugin names required
-    routes: list[dict] = []  # route definitions
-    events: list[str] = []  # event names to listen
-    migrations: list[str] = []  # migration file names
-    permissions: list[str] = []  # required permissions
-```
-
-## BasePlugin Abstract Class
-```python
-class BasePlugin(ABC):
-    manifest: PluginManifest
-    
-    async def on_install(self, db, service_container): ...
-    async def on_activate(self, db, service_container, event_bus): ...
-    async def on_deactivate(self, db, service_container, event_bus): ...
-    async def on_uninstall(self, db, service_container): ...
-    def get_routes(self) -> list[APIRouter]: ...
-```
-
-## Forbidden Patterns
-- NO JWT tokens (session-based auth from T01)
-- NO SQLite (PostgreSQL only)
-- NO wildcard CORS
-- NO raw SQL without tenant context
-- NO hardcoded secrets
-- NO .test TLD emails (use .com)
-- NO `SET LOCAL` with bound params (use `SELECT set_config()`)
-- NO raising HTTPException in middleware (return JSONResponse)
-- NO POST without status_code=201 (where applicable)
-- NO plugin tables without tenant_id column (validator enforces)
-
-## Test Spec
-- Commands: `cd /a0/usr/workdir/dev-projects/leocrm && source venv/bin/activate && python -m pytest tests/test_plugins.py -v --tb=short`
-- Coverage: `python -m pytest tests/test_plugins.py --cov=app/plugins --cov-report=term-missing`
-- Target: 85% for plugin modules
-- All 14 ACs must pass
-
-## Token Rule
-- Use `text_editor:read` for MODIFY, `text_editor:write` for NEW, `code_execution_tool:terminal` for test runs
-- Reference files by path, not inline
-- Multi-file output: separate files, not one big file
-
-## JSON Tool Examples
-```json
-{"tool_name":"text_editor","tool_args":{"action":"write","path":"/a0/usr/workdir/dev-projects/leocrm/app/plugins/base.py","content":"..."}}
-```
-```json
-{"tool_name":"code_execution_tool","tool_args":{"runtime":"terminal","session":0,"code":"cd /a0/usr/workdir/dev-projects/leocrm && source venv/bin/activate && python -m pytest tests/test_plugins.py -v --tb=short"}}
-```

.a0/briefings/T04_briefing.md

@@ -1,227 +0,0 @@
-# T04 — DMS Plugin Backend (Folders, Files, Preview, OnlyOffice, Share Links)
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Context Files (READ FIRST)
-- `app/plugins/base.py` — BasePlugin abstract class
-- `app/plugins/manifest.py` — PluginManifest, PluginRouteDef
-- `app/plugins/builtins/tags/` — Reference plugin (subdirectory pattern)
-- `app/plugins/builtins/permissions/` — Already has share links + file permissions
-- `app/plugins/builtins/entity_links/` — Links files to companies/contacts
-- `app/core/db.py` — Base, TenantMixin, TimestampMixin
-- `app/models/company.py` — Model pattern reference
-- `app/routes/companies.py` — Route pattern reference
-- `app/schemas/company.py` — Schema pattern reference
-- `architecture.md` — Architecture decisions
-- `requirements.md` — F-DMS-*, F-FILE-*, F-FILEUI-* requirements
-
-## Overview
-Implement DMS (Document Management System) plugin as `app/plugins/builtins/dms/`.
-
-## Plugin Structure
-```
-app/plugins/builtins/dms/
-├── __init__.py          # Export DmsPlugin
-├── plugin.py            # DmsPlugin(BasePlugin) with manifest
-├── models.py            # Folder, File models
-├── schemas.py           # Pydantic schemas for all endpoints
-├── routes.py            # FastAPI APIRouter with all endpoints
-└── migrations/
-    └── 0001_initial.sql # Create folders + files tables
-```
-
-## Models
-
-### Folder
-- id (UUID, PK)
-- name (str, not null)
-- parent_id (UUID, FK to folders.id, nullable — null = root)
-- tenant_id (UUID, not null)
-- created_by (UUID, not null)
-- deleted_at (datetime, nullable — soft delete)
-- created_at, updated_at (TimestampMixin)
-- **Unique constraint**: (name, parent_id, tenant_id) where deleted_at IS NULL
-
-### File
-- id (UUID, PK)
-- name (str, not null)
-- folder_id (UUID, FK to folders.id, nullable — null = root)
-- tenant_id (UUID, not null)
-- uploaded_by (UUID, not null)
-- mime_type (str, not null)
-- size_bytes (int, not null)
-- storage_path (str, not null — relative path on disk)
-- deleted_at (datetime, nullable — soft delete)
-- created_at, updated_at (TimestampMixin)
-
-## File Storage
-- Store files at: `/data/dms/{tenant_id}/{file_uuid}` (configurable via plugin config)
-- Use `shutil.copyfileobj` for upload streaming
-- Generate UUID for filename on disk, keep original name in DB
-- Create directory with `os.makedirs(path, exist_ok=True)`
-
-## Endpoints (19 ACs)
-
-### Folders
-1. `GET /api/v1/dms/folders` → 200, folder tree (recursive tree structure)
-   - Query param `parent_id` (optional, null = root level)
-   - Returns list of folders with children nested
-2. `POST /api/v1/dms/folders` → 201, create folder
-   - Body: `{name, parent_id?}`
-   - Returns created folder with full path
-3. `PATCH /api/v1/dms/folders/{id}` → 200, rename/move folder
-   - Body: `{name?, parent_id?}`
-4. `DELETE /api/v1/dms/folders/{id}` → 204, soft-delete (set deleted_at)
-   - Cascade: soft-delete all child folders and files
-
-### Files
-5. `POST /api/v1/dms/files/upload` → 201, multipart upload
-   - Form fields: `file` (UploadFile), `folder_id?` (optional)
-   - Store file on disk, create metadata record
-   - Max file size: 100MB (configurable)
-6. `GET /api/v1/dms/files/{id}` → 200, file metadata
-7. `PATCH /api/v1/dms/files/{id}` → 200, rename/move
-   - Body: `{name?, folder_id?}`
-8. `DELETE /api/v1/dms/files/{id}` → 204, soft-delete
-9. `POST /api/v1/dms/files/{id}/restore` → 200, restore from trash
-
-### Preview & Edit
-10. `GET /api/v1/dms/files/{id}/preview` → 200, PDF stream
-    - Only for PDF files (mime_type == application/pdf)
-    - Return `StreamingResponse` with `media_type='application/pdf'`
-    - Non-PDF files: return 400
-11. `POST /api/v1/dms/files/{id}/edit-session` → 200, OnlyOffice config
-    - Return JSON config for OnlyOffice editor:
-      ```json
-      {
-        "document": {"fileType": "docx", "key": "<uuid>", "title": "<filename>", "url": "<download_url>"},
-        "editorConfig": {"mode": "edit", "callbackUrl": "<callback_url>", "user": {"id": "<user_id>", "name": "<user_name>"}}
-      }
-      ```
-    - Only for Office files (docx, xlsx, pptx)
-    - Non-Office files: return 400
-
-### Sharing (INTERNAL — different from T11 permissions plugin)
-**NOTE**: T11 permissions plugin already handles:
-- `POST /api/v1/dms/files/{id}/share-link` — public share links with token
-- `GET /api/public/share/{token}` — public access
-- `POST /api/v1/dms/files/{id}/permissions` — grant permissions
-
-T04 DMS plugin handles INTERNAL sharing (different endpoints):
-12. `POST /api/v1/dms/files/{id}/share` → 200, internal share
-    - Body: `{user_ids?: [uuid], group_ids?: [uuid], access_level: 'read'|'write'}`
-    - Creates permission records (reuse permissions plugin Permission model OR DMS-specific)
-13. `DELETE /api/v1/dms/files/{id}/share` → 204, remove share
-    - Body: `{user_id?: uuid, group_id?: uuid}`
-
-**IMPORTANT**: For `GET /api/public/share/{token}` (AC14, AC15) — T11 permissions plugin ALREADY implements this endpoint. Do NOT create a duplicate. If T11's endpoint already handles password-protected links (401 without password), then AC14 and AC15 are already satisfied. Verify by reading `app/plugins/builtins/permissions/routes.py`.
-
-### Search & Bulk
-14. `GET /api/v1/dms/search?q=text` → 200, matching files
-    - Case-insensitive filename search with ILIKE
-    - Search across all files in tenant (not deleted)
-15. `GET /api/v1/dms/shared-with-me` → 200, shared files list
-    - Files where user has been granted permission (via permissions plugin)
-16. `POST /api/v1/dms/files/bulk-move` → 200
-    - Body: `{file_ids: [uuid], target_folder_id: uuid?}`
-17. `POST /api/v1/dms/files/bulk-delete` → 200
-    - Body: `{file_ids: [uuid]}` — soft-delete all
-
-## Migration SQL
-```sql
-CREATE TABLE IF NOT EXISTS folders (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    name VARCHAR(255) NOT NULL,
-    parent_id UUID REFERENCES folders(id) ON DELETE CASCADE,
-    tenant_id UUID NOT NULL,
-    created_by UUID NOT NULL,
-    deleted_at TIMESTAMP WITH TIME ZONE,
-    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-);
-CREATE INDEX idx_folders_parent ON folders(parent_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_folders_tenant ON folders(tenant_id) WHERE deleted_at IS NULL;
-
-CREATE TABLE IF NOT EXISTS files (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    name VARCHAR(255) NOT NULL,
-    folder_id UUID REFERENCES folders(id) ON DELETE SET NULL,
-    tenant_id UUID NOT NULL,
-    uploaded_by UUID NOT NULL,
-    mime_type VARCHAR(255) NOT NULL,
-    size_bytes BIGINT NOT NULL,
-    storage_path VARCHAR(1024) NOT NULL,
-    deleted_at TIMESTAMP WITH TIME ZONE,
-    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-);
-CREATE INDEX idx_files_folder ON files(folder_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_files_tenant ON files(tenant_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_files_name ON files USING gin (to_tsvector('simple', name));
-```
-
-## Register Plugin
-Add to `app/plugins/builtins/__init__.py`:
-```python
-from app.plugins.builtins.dms import DmsPlugin
-__all__.append("DmsPlugin")
-```
-
-## Test File
-Create `tests/test_dms.py` with tests for ALL 19 ACs.
-
-### Test Patterns
-- Follow existing test patterns in `tests/test_tags.py`, `tests/test_permissions.py`
-- Use async test client via `httpx.AsyncClient` with `ASGITransport`
-- Use existing fixtures from `tests/conftest.py`
-- For file upload tests: use `httpx.AsyncClient.post` with `files={'file': ('test.pdf', b'%PDF-1.4...', 'application/pdf')}`
-- For preview tests: verify response status 200 + content-type application/pdf
-- For OnlyOffice: verify config structure returned
-- For bulk operations: create multiple files, then bulk-move/bulk-delete
-
-## Verification Commands
-```bash
-cd /a0/usr/workdir/dev-projects/leocrm
-python -m pytest tests/test_dms.py -v --tb=short
-python -m pytest tests/test_dms.py --cov=app/plugins/builtins/dms --cov-report=term-missing
-```
-
-## Acceptance Criteria (19 — ALL must pass)
-1. GET /api/v1/dms/folders → 200 + folder tree
-2. POST /api/v1/dms/folders → 201, folder created with path
-3. PATCH /api/v1/dms/folders/{id} → 200, folder renamed/moved
-4. DELETE /api/v1/dms/folders/{id} → 204, soft-delete
-5. POST /api/v1/dms/files/upload (multipart) → 201, file stored + metadata
-6. GET /api/v1/dms/files/{id} → 200 + file metadata
-7. PATCH /api/v1/dms/files/{id} → 200, renamed/moved
-8. DELETE /api/v1/dms/files/{id} → 204, soft-delete
-9. POST /api/v1/dms/files/{id}/restore → 200, restored from trash
-10. GET /api/v1/dms/files/{id}/preview → 200 + PDF stream
-11. POST /api/v1/dms/files/{id}/edit-session → 200 + OnlyOffice config
-12. POST /api/v1/dms/files/{id}/share → 200, internal share created
-13. DELETE /api/v1/dms/files/{id}/share → 204, share removed
-14. GET /api/public/share/{token} → 200 (no auth, public access) — MAY already exist via T11
-15. GET /api/public/share/{token} mit password → 401 ohne password — MAY already exist via T11
-16. GET /api/v1/dms/search?q=text → 200 + matching files
-17. GET /api/v1/dms/shared-with-me → 200 + shared files list
-18. POST /api/v1/dms/files/bulk-move → 200, files moved
-19. POST /api/v1/dms/files/bulk-delete → 200, files soft-deleted
-
-## Rules
-- No placeholder code. No Lorem Ipsum.
-- Follow existing patterns exactly (SQLAlchemy 2.0, FastAPI APIRouter, Pydantic v2)
-- All routes must have tenant_id scoping
-- Use `# noqa: F401` for __init__.py re-exports
-- Use `from None` in except blocks (B904)
-- File storage path: `/data/dms/{tenant_id}/{file_uuid}`
-- OnlyOffice: generate config only, don't run OnlyOffice server
-- For AC14/AC15: check if T11 permissions plugin already satisfies these. If yes, write tests that verify existing endpoint. If no, implement in DMS plugin.
-
-## Deliverables
-- All plugin files created
-- Plugin registered in builtins __init__.py
-- tests/test_dms.py with all 19 ACs tested
-- All tests passing
-- Coverage ≥80%
-- Report: files created, test count + pass/fail, coverage %

.a0/briefings/T05_briefing.md

@@ -1,335 +0,0 @@
-# T05 — Calendar Plugin Backend Briefing
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Context Files (read first)
-- `app/plugins/base.py` — BasePlugin abstract class
-- `app/plugins/manifest.py` — PluginManifest, PluginRouteDef
-- `app/plugins/builtins/tags/` — Reference plugin (subdirectory pattern)
-- `app/plugins/builtins/dms/` — Most recent plugin (complex reference)
-- `app/core/db.py` — Base, TenantMixin, TimestampMixin
-- `app/models/company.py` — Model pattern reference
-- `app/routes/companies.py` — Route pattern reference
-- `tests/test_dms.py` — Test pattern reference (uses authed_client from conftest)
-- `tests/conftest.py` — Shared fixtures (dms_app, dms_client, authed_client — adapt for calendar)
-- `architecture.md` — Calendar tables + endpoints (search for 'Calendar Plugin')
-
-## Plugin Structure
-```
-app/plugins/builtins/calendar/
-├── __init__.py          — Exports CalendarPlugin
-├── plugin.py            — CalendarPlugin(BasePlugin) with manifest
-├── routes.py            — 21 endpoints
-├── models.py            — 7 SQLAlchemy models
-├── schemas.py           — Pydantic schemas
-├── recurrence.py        — Recurrence engine (RRULE-style)
-├── ics_utils.py         — ICS export/import utilities
-└── migrations/
-    └── 0001_initial.sql — 7 tables
-```
-
-## Models (7 tables)
-
-### Calendar
-- id (UUID PK), tenant_id, name (str, not null), color (str, default '#3B82F6')
-- type (str: personal/team/project/company, default 'personal')
-- owner_id (UUID, not null), created_at, updated_at, deleted_at (soft delete)
-- Unique: (name, tenant_id) WHERE deleted_at IS NULL
-
-### CalendarEntry
-- id (UUID PK), tenant_id, calendar_id (FK→calendars.id)
-- entry_type (str: appointment/task, not null)
-- subtype (str: normal/follow_up/private, default 'normal')
-- title (str, not null), description (TEXT, nullable)
-- start_at (TIMESTAMPTZ, nullable — for appointments)
-- end_at (TIMESTAMPTZ, nullable — for appointments)
-- all_day (bool, default false)
-- location (str, nullable)
-- due_date (DATE, nullable — for tasks)
-- priority (str: low/medium/high, default 'medium')
-- status (str: open/in_progress/done/cancelled, default 'open')
-- assigned_to (UUID, nullable — for tasks)
-- reminder (JSONB, nullable: {value: int, unit: str, channel: str})
-- recurrence (JSONB, nullable: {pattern: str, custom_rule: str, end_date: date, exceptions: [date]})
-- source_mail_id (UUID, nullable)
-- created_by (UUID, not null), created_at, updated_at, deleted_at
-- Index: (tenant_id, calendar_id), (tenant_id, start_at), (tenant_id, due_date), (tenant_id, assigned_to, status)
-
-### CalendarEntryLink
-- id (UUID PK), tenant_id, entry_id (FK→calendar_entries.id)
-- entity_type (str: company/contact, not null), entity_id (UUID, not null)
-
-### CalendarShare
-- id (UUID PK), tenant_id, calendar_id (FK→calendars.id)
-- user_id (UUID, nullable), group_id (UUID, nullable)
-- permission (str: read/write, not null)
-
-### UserCalendarVisibility
-- user_id (FK→users.id), calendar_id (FK→calendars.id), tenant_id
-- visible (bool, default true)
-- PK: (user_id, calendar_id)
-
-### Subtask
-- id (UUID PK), tenant_id, entry_id (FK→calendar_entries.id)
-- title (str, not null), completed (bool, default false)
-- created_at
-
-### Resource
-- id (UUID PK), tenant_id, name (str, not null)
-- type (str: room/equipment, not null)
-
-### ResourceBooking
-- id (UUID PK), tenant_id, resource_id (FK→resources.id)
-- entry_id (FK→calendar_entries.id), start_at (TIMESTAMPTZ, not null), end_at (TIMESTAMPTZ, not null)
-
-## Endpoints (21 total)
-
-### Calendars (6)
-1. `GET /api/v1/calendars` → 200 + calendar list (filtered by tenant + visibility)
-2. `POST /api/v1/calendars` → 201, calendar created (name, color, type)
-3. `PATCH /api/v1/calendars/{id}` → 200, updated (name, color)
-4. `DELETE /api/v1/calendars/{id}` → 204, cascade delete entries + shares + visibility
-5. `POST /api/v1/calendars/{id}/share` → 200, calendar shared (user_id/group_id, permission)
-6. `GET /api/v1/calendars/{id}/permissions` → 200 + permission list
-
-### Entries (10)
-7. `GET /api/v1/calendar/entries?start=2026-01-01&end=2026-12-31` → 200 + entries in range
-8. `POST /api/v1/calendar/entries` (appointment) → 201, entry created with start_at/end_at
-9. `POST /api/v1/calendar/entries` (task) → 201, entry created with due_date/priority/status
-10. `GET /api/v1/calendar/entries/{id}` → 200 + entry detail with links+subtasks
-11. `PATCH /api/v1/calendar/entries/{id}` → 200, updated (drag&drop: PATCH start_at+end_at, or status change)
-12. `PATCH /api/v1/calendar/entries/{id}` status=done → 200, status updated
-13. `DELETE /api/v1/calendar/entries/{id}` → 204
-14. `POST /api/v1/calendar/entries/{id}/link` → 200, linked to company/contact (entity_type, entity_id)
-15. `POST /api/v1/calendar/entries/{id}/subtasks` → 201, subtask created (title)
-16. `PATCH /api/v1/calendar/entries/{id}/subtasks/{sub_id}` → 200, completed toggled
-
-### Bulk + Kanban + Export (3)
-17. `POST /api/v1/calendar/entries/bulk` → 200, bulk status change/delete (entry_ids, action)
-18. `GET /api/v1/calendar/kanban` → 200 + tasks grouped by status columns (open/in_progress/done/cancelled)
-19. `GET /api/v1/calendar/entries/export?format=csv` → 200 + CSV stream
-
-### ICS (2)
-20. `GET /api/v1/calendar/{calendar_id}/ics-feed?token=valid` → 200 + text/calendar (NO auth, token-based)
-21. `GET /api/v1/calendar/{calendar_id}/ics-feed?token=invalid` → 401
-22. `POST /api/v1/calendar/import` (multipart .ics file) → 200 + import result (entries_created count)
-
-### Resources (2)
-23. `POST /api/v1/resources` → 201 (admin only, 403 for non-admin)
-24. `POST /api/v1/calendar/entries/{id}/book-resource` → 200, resource booked (resource_id)
-25. `POST /api/v1/calendar/entries/{id}/book-resource` (conflict) → 409
-
-## Recurrence Engine
-- Patterns: daily, weekly, monthly, yearly
-- Custom rules: e.g. 'every 2nd Tuesday' → store as JSONB {pattern: 'custom', custom_rule: 'BYDAY=TU;BYSETPOS=2'}
-- Exceptions: array of dates excluded from occurrence generation
-- Occurrence generation: given a date range query (start, end), generate all occurrence instances
-- Max 2 years forward for appointments
-- Tasks: generate next instance on completion (post-completion, not on-the-fly)
-
-## ICS Export Format
-```
-BEGIN:VCALENDAR
-VERSION:2.0
-PRODID:-//LeoCRM//Calendar//EN
-BEGIN:VEVENT
-UID:<entry_uuid>@leocrm
-DTSTART:<start_at>
-DTEND:<end_at>
-SUMMARY:<title>
-DESCRIPTION:<description>
-LOCATION:<location>
-END:VEVENT
-END:VCALENDAR
-```
-- Token auth: each calendar has an `ics_token` (generate on first feed request, store in calendar_shares or a separate field)
-- Invalid token → 401
-
-## ICS Import
-- Parse .ics file (VCALENDAR → VEVENT blocks)
-- Create CalendarEntry per VEVENT
-- Map: DTSTART→start_at, DTEND→end_at, SUMMARY→title, DESCRIPTION→description, LOCATION→location
-- Return: {entries_created: N, errors: [...]}
-- Use Python `icalendar` library if available, else parse manually
-
-## Reminder System
-- reminder JSONB: {value: 15, unit: 'minutes', channel: 'in_app'}
-- When reminder is set on entry creation/update, schedule an ARQ job
-- ARQ job fires at (start_at - reminder) for appointments, (due_date - reminder) for tasks
-- Job sends in-app notification via EventBus
-- For now: just store the reminder config and schedule the ARQ job (don't need to implement the actual notification delivery)
-
-## Calendar Sharing
-- Owner can share with user_id or group_id, permission read/write
-- User with read permission: can view entries, cannot edit (403 on PATCH/POST/DELETE)
-- User with write permission: can create/edit entries
-- Private subtype entries: only owner + admin can see (filter in query)
-
-## Migration SQL
-```sql
-CREATE TABLE IF NOT EXISTS calendars (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    name VARCHAR(200) NOT NULL,
-    color VARCHAR(20) DEFAULT '#3B82F6',
-    type VARCHAR(20) DEFAULT 'personal',
-    owner_id UUID NOT NULL,
-    created_at TIMESTAMPTZ DEFAULT NOW(),
-    updated_at TIMESTAMPTZ DEFAULT NOW(),
-    deleted_at TIMESTAMPTZ
-);
-CREATE INDEX idx_calendars_tenant ON calendars(tenant_id) WHERE deleted_at IS NULL;
-
-CREATE TABLE IF NOT EXISTS calendar_entries (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    calendar_id UUID REFERENCES calendars(id) ON DELETE CASCADE,
-    entry_type VARCHAR(15) NOT NULL,
-    subtype VARCHAR(20) DEFAULT 'normal',
-    title VARCHAR(500) NOT NULL,
-    description TEXT,
-    start_at TIMESTAMPTZ,
-    end_at TIMESTAMPTZ,
-    all_day BOOLEAN DEFAULT false,
-    location VARCHAR(500),
-    due_date DATE,
-    priority VARCHAR(10) DEFAULT 'medium',
-    status VARCHAR(15) DEFAULT 'open',
-    assigned_to UUID,
-    reminder JSONB,
-    recurrence JSONB,
-    source_mail_id UUID,
-    created_by UUID NOT NULL,
-    created_at TIMESTAMPTZ DEFAULT NOW(),
-    updated_at TIMESTAMPTZ DEFAULT NOW(),
-    deleted_at TIMESTAMPTZ
-);
-CREATE INDEX idx_entries_tenant_cal ON calendar_entries(tenant_id, calendar_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_entries_tenant_start ON calendar_entries(tenant_id, start_at) WHERE deleted_at IS NULL;
-CREATE INDEX idx_entries_tenant_due ON calendar_entries(tenant_id, due_date) WHERE deleted_at IS NULL;
-CREATE INDEX idx_entries_assigned ON calendar_entries(tenant_id, assigned_to, status) WHERE deleted_at IS NULL;
-
-CREATE TABLE IF NOT EXISTS calendar_entry_links (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    entry_id UUID REFERENCES calendar_entries(id) ON DELETE CASCADE,
-    entity_type VARCHAR(50) NOT NULL,
-    entity_id UUID NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS calendar_shares (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    calendar_id UUID REFERENCES calendars(id) ON DELETE CASCADE,
-    user_id UUID,
-    group_id UUID,
-    permission VARCHAR(10) NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS user_calendar_visibility (
-    user_id UUID NOT NULL,
-    calendar_id UUID NOT NULL,
-    tenant_id UUID NOT NULL,
-    visible BOOLEAN DEFAULT true,
-    PRIMARY KEY (user_id, calendar_id)
-);
-
-CREATE TABLE IF NOT EXISTS subtasks (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    entry_id UUID REFERENCES calendar_entries(id) ON DELETE CASCADE,
-    title VARCHAR(500) NOT NULL,
-    completed BOOLEAN DEFAULT false,
-    created_at TIMESTAMPTZ DEFAULT NOW()
-);
-
-CREATE TABLE IF NOT EXISTS resources (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    name VARCHAR(200) NOT NULL,
-    type VARCHAR(50) NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS resource_bookings (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    resource_id UUID REFERENCES resources(id) ON DELETE CASCADE,
-    entry_id UUID REFERENCES calendar_entries(id) ON DELETE CASCADE,
-    start_at TIMESTAMPTZ NOT NULL,
-    end_at TIMESTAMPTZ NOT NULL
-);
-```
-
-## Registration
-Add to `app/plugins/builtins/__init__.py`:
-```python
-from app.plugins.builtins.calendar import CalendarPlugin
-__all__ = [..., "CalendarPlugin"]
-```
-
-## Test File: tests/test_calendar.py
-- Use shared fixtures from conftest.py (adapt: create calendar_app, calendar_client, calendar_authed_client)
-- OR add calendar fixtures to conftest.py (preferred — same pattern as DMS)
-- Test ALL 29 ACs
-- Coverage target: ≥80%
-- Add `concurrency = ["greenlet"]` already in pyproject.toml (done in T04)
-
-## Test Patterns
-- httpx AsyncClient with ASGITransport
-- `ORIGIN_HEADER` from conftest
-- `authed_client` returns (client, seed) with admin_a, viewer_a, editor_a
-- Multipart upload for ICS import: `files={'file': ('test.ics', ics_content, 'text/calendar')}`
-- ICS feed: no auth header, just `?token=valid_or_invalid`
-- Recurrence test: create weekly entry, query range, verify occurrences
-- Resource conflict: create 2 bookings with overlapping time → 409
-
-## Verification Commands
-```bash
-cd /a0/usr/workdir/dev-projects/leocrm
-python -m pytest tests/test_calendar.py -v --tb=short
-python -m pytest tests/test_calendar.py --cov=app/plugins/builtins/calendar --cov-report=term-missing
-ruff check app/plugins/builtins/calendar/ tests/test_calendar.py
-ruff format --check app/plugins/builtins/calendar/ tests/test_calendar.py
-```
-
-## 29 Acceptance Criteria — ALL must pass
-1. GET /api/v1/calendars → 200 + calendar list
-2. POST /api/v1/calendars → 201, calendar created
-3. PATCH /api/v1/calendars/{id} → 200
-4. DELETE /api/v1/calendars/{id} → 204, cascade delete entries
-5. POST /api/v1/calendars/{id}/share → 200, calendar shared
-6. GET /api/v1/calendars/{id}/permissions → 200 + permission list
-7. GET /api/v1/calendar/entries?start=...&end=... → 200 + entries in range
-8. POST /api/v1/calendar/entries (appointment) → 201, with start_at/end_at
-9. POST /api/v1/calendar/entries (task) → 201, with due_date/priority/status
-10. GET /api/v1/calendar/entries/{id} → 200 + detail with links+subtasks
-11. PATCH /api/v1/calendar/entries/{id} → 200, updated (drag&drop)
-12. PATCH /api/v1/calendar/entries/{id} status=done → 200
-13. DELETE /api/v1/calendar/entries/{id} → 204
-14. POST /api/v1/calendar/entries/{id}/link → 200, linked
-15. POST /api/v1/calendar/entries/{id}/subtasks → 201
-16. PATCH /api/v1/calendar/entries/{id}/subtasks/{sub_id} → 200, toggled
-17. POST /api/v1/calendar/entries/bulk → 200, bulk status/delete
-18. GET /api/v1/calendar/kanban → 200 + tasks grouped by status
-19. GET /api/v1/calendar/entries/export?format=csv → 200 + CSV
-20. GET /api/v1/calendar/{calendar_id}/ics-feed?token=valid → 200 + text/calendar
-21. GET /api/v1/calendar/{calendar_id}/ics-feed?token=invalid → 401
-22. POST /api/v1/calendar/import mit .ics file → 200 + import result
-23. POST /api/v1/resources → 201 (admin only, 403 non-admin)
-24. POST /api/v1/calendar/entries/{id}/book-resource → 200
-25. POST /api/v1/calendar/entries/{id}/book-resource (conflict) → 409
-26. Recurrence: weekly entry generates correct occurrences for date range query
-27. Recurrence: exception date excluded from occurrences
-28. Reminder: ARQ job scheduled when reminder JSONB set
-29. Calendar share: user with read permission can view, cannot edit (403)
-30. Private subtype: only owner+admin can see entry
-
-## Rules
-- No `# noqa: F401` for re-exports in routes/models (only in __init__.py)
-- Use `from None` in except blocks (B904)
-- No blocking file I/O in async functions without `# noqa: ASYNC230`
-- Follow existing plugin patterns exactly (see tags/dms plugins)
-- Tenant scoping on ALL queries
-- Soft delete for calendars and entries (deleted_at)
-- ICS feed endpoint: NO auth header, token-based only

.a0/briefings/T06_briefing.md

@@ -1,89 +0,0 @@
-# T06: Mail Plugin Backend — Implementation Briefing
-
-## Task
-Implement the complete Mail Plugin as a built-in plugin under `app/plugins/builtins/mail/`.
-
-## Requirements (F-MAIL-01 bis F-MAIL-19)
-- F-MAIL-01: Standard-Ordner (Posteingang, Postausgang, Entwürfe, Spam) + IMAP-Sync
-- F-MAIL-02: E-Mail schreiben, antworten, weiterleiten (HTML-Editor, SMTP)
-- F-MAIL-03: Volltext-Suche über Mails (body_tsv, FTS)
-- F-MAIL-04: Anhänge (hochladen, herunterladen, DMS-Link)
-- F-MAIL-05: Threading (Konversationen gruppieren, References/In-Reply-To)
-- F-MAIL-06: Vorlagen/Templates (Platzhalter-Substitution)
-- F-MAIL-07: Filter/Regeln (Condition → Action: move/label/flag/forward)
-- F-MAIL-08: Abwesenheitsnotiz (Auto-Reply, dedup via vacation_sent_log)
-- F-MAIL-09: Labels/Flags (Stern, Wichtig, Custom Labels, farbig)
-- F-MAIL-10: Kontakt-Verknüpfung (auto aus Email-Adressen, manuell)
-- F-MAIL-11: Kalender-Integration (Termin aus Mail erstellen)
-- F-MAIL-12: PGP-Verschlüsselung (Key-Import, encrypt/decrypt, contact public keys)
-- F-MAIL-13: Signaturen (pro User, pro Postfach, HTML-Content)
-- F-MAIL-14: Mehrere Postfächer (IMAP/SMTP pro User konfigurierbar)
-- F-MAIL-15: Geteilte Postfächer (Gruppen-Postfach, Seen-By-Tracking)
-- F-MAIL-16: Stellvertretung (Delegate access: read/full)
-- F-MAIL-17: Sende-Berechtigungen (wer darf als Gruppe senden)
-- F-MAIL-18: Postfach-Konfiguration (IMAP/SMTP, AES-256 encrypted credentials, Verbindungstest)
-- F-MAIL-19: Mail-Ordner verwalten (Erstellen, Umbenennen, Löschen, IMAP-Sync)
-
-## Acceptance Criteria (40 ACs)
-See task_graph.json T06.acceptance_criteria — ALL must pass.
-
-## Architecture
-- Plugin Pattern: Follow `app/plugins/builtins/dms/` structure exactly
-- Files to create:
-  - `app/plugins/builtins/mail/__init__.py`
-  - `app/plugins/builtins/mail/plugin.py` (MailPlugin class, PluginManifest)
-  - `app/plugins/builtins/mail/models.py` (14+ SQLAlchemy models)
-  - `app/plugins/builtins/mail/schemas.py` (Pydantic schemas for all entities)
-  - `app/plugins/builtins/mail/routes.py` (APIRouter with all endpoints)
-  - `app/plugins/builtins/mail/services.py` (Service layer: IMAP sync, SMTP send, rules, vacation, PGP)
-  - `app/plugins/builtins/mail/migrations/0001_initial.sql` (DB migration)
-  - `tests/test_mail.py` (Test all 40 ACs)
-
-## Models Required
-mail_accounts, mail_folders, mails, mail_attachments, mail_labels, mail_label_assignments, mail_rules, mail_templates, mail_signatures, vacation_sent_log, mail_seen_by, mail_account_delegates, mail_account_send_permissions, pgp_keys, contact_pgp_keys
-
-## Key Technical Details
-- AES-256 encryption for mail account passwords (use `cryptography` package)
-- IMAP sync as ARQ background job (arq already in requirements.txt)
-- body_tsv column with PostgreSQL FTS (tsvector)
-- PGP via `pgpy` or `python-gnupg` package
-- HTML sanitization (no script tags) — use `bleach` or `nh3`
-- Plugin manifest: name="mail", dependencies=["permissions"] or []
-- Routes prefix: `/api/v1/mail`
-- Follow existing test pattern from `tests/test_dms.py` (use authed_client, ORIGIN_HEADER)
-- All routes need `get_current_user` dependency from `app.deps`
-
-## Test Spec
-- Test file: `tests/test_mail.py`
-- Run: `cd /a0/usr/workdir/dev-projects/leocrm && python -m pytest tests/test_mail.py -v --tb=short`
-- Coverage: `python -m pytest tests/test_mail.py --cov=app/plugins/builtins/mail --cov-report=term-missing`
-- Coverage target: 80%
-- Follow `tests/test_dms.py` pattern: conftest fixtures (authed_client, ORIGIN_HEADER, login_client)
-
-## Dependencies to Add (requirements.txt)
-- `cryptography>=42.0` (AES-256 encryption)
-- `pgpy>=0.6.0` or `python-gnupg>=0.5` (PGP)
-- `bleach>=6.0` or `nh3>=0.2` (HTML sanitization)
-- `aiosmtplib>=3.0` (async SMTP)
-- `aioimaplib>=1.0` (async IMAP)
-
-## Forbidden Patterns
-- No synchronous IMAP/SMTP in route handlers — use async or ARQ jobs
-- No plaintext password storage — AES-256 encryption mandatory
-- No raw HTML in API responses without sanitization
-- No credential values in any API response
-- No `time.sleep()` in tests — use `asyncio.sleep()` or mocking
-
-## Existing Code References
-- Plugin base class: `app/plugins/base.py` → BasePlugin
-- Plugin manifest: `app/plugins/manifest.py` → PluginManifest, PluginRouteDef
-- DMS plugin (pattern to follow): `app/plugins/builtins/dms/`
-- Calendar plugin (pattern to follow): `app/plugins/builtins/calendar/`
-- Test pattern: `tests/test_dms.py`, `tests/test_calendar.py`
-- DB deps: `app/core/db.py` → get_db
-- Auth deps: `app/deps.py` → get_current_user
-- Test fixtures: `tests/conftest.py` → authed_client, ORIGIN_HEADER, login_client
-
-## Estimated Size
-- ~800 lines code (models + schemas + routes + services + plugin + migration)
-- ~400+ lines tests

.a0/briefings/T07a_briefing.md

@@ -1,133 +0,0 @@
-# T07a — Frontend Core SPA — Shell, Auth, Routing, i18n, UI Library, Accessibility
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Frontend Directory
-/a0/usr/workdir/dev-projects/leocrm/frontend/
-
-## Tech Stack (CONFIRMED from architecture.md)
-- React 18 + Vite + TypeScript
-- React Router v6
-- TanStack Query (React Query v5) for server state
-- Zustand for client state
-- react-i18next for i18n (de/en)
-- React Hook Form + Zod for forms
-- Tailwind CSS with design tokens from prototype
-- Vitest for testing
-
-## Backend API (already running, T01-T03 complete)
-- Base URL: http://localhost:8000
-- Auth: session cookie (leocrm_session), SameSite=strict
-- CORS: http://localhost:5173 (Vite dev) allowed
-- Endpoints available: /api/v1/auth/login, /api/v1/auth/logout, /api/v1/auth/me, /api/v1/auth/password-reset/request, /api/v1/auth/password-reset/confirm, /api/v1/users, /api/v1/companies, /api/v1/contacts, /api/v1/notifications, /api/v1/plugins, /health
-
-## Requirements (23)
-F-AUTH-01, F-AUTH-02, F-AUTH-03, F-AUTH-05, F-AUTH-07, F-CORE-06, F-CORE-07, F-CORE-08, F-CORE-09, F-CORE-13, F-A11Y-01, F-A11Y-02, F-A11Y-03, F-INT-01, F-NAV-01, F-UI-01 through F-UI-06, F-UI-08, F-TEST-01
-
-## Acceptance Criteria (27)
-1. Login page renders with email+password form
-2. Login with valid credentials → redirect to Dashboard
-3. Login with invalid credentials → error toast shown
-4. Password reset request page renders and submits
-5. Password reset confirm page renders with token validation
-6. App shell renders with sidebar (plugin menu), topbar (tenant switcher, search, notifications, user menu), content area
-7. Router navigates between routes without page reload (SPA)
-8. Protected routes redirect to /login when not authenticated
-9. Tenant switcher shows current tenant and allows switching
-10. API client sends session cookie automatically via axios interceptor
-11. API client handles 401 → redirect to login
-12. API client handles 422 → display validation errors
-13. i18n: German locale loads by default
-14. i18n: English locale switchable via settings
-15. UI Library: Button renders with variants (primary, secondary, danger, ghost)
-16. UI Library: Input renders with label, error, helper text
-17. UI Library: Modal opens/closes with backdrop click and ESC
-18. UI Library: Toast notifications appear and auto-dismiss
-19. UI Library: Table renders with sortable headers
-20. UI Library: Card, Badge, Avatar, Pagination, EmptyState, Skeleton, ConfirmDialog render correctly
-21. Accessibility: All interactive elements have ARIA labels
-22. Accessibility: Keyboard navigation works (Tab, Enter, Escape, Arrow keys)
-23. Accessibility: 44px minimum touch targets on mobile
-24. Accessibility: prefers-reduced-motion respected
-25. Vite dev server starts without errors
-26. Production build (npm run build) succeeds with 0 errors
-27. TypeScript: tsc --noEmit passes with 0 errors
-
-## Files to Create
-- frontend/package.json (React 18, Vite, TanStack Query, Zustand, react-i18next, React Hook Form, Zod, Tailwind CSS, Vitest, axios)
-- frontend/vite.config.ts
-- frontend/tsconfig.json, tsconfig.node.json
-- frontend/tailwind.config.js, postcss.config.js
-- frontend/index.html
-- frontend/src/main.tsx — React entry point with providers
-- frontend/src/App.tsx — Router + providers setup
-- frontend/src/api/client.ts — axios instance with interceptors (cookie, 401, 422)
-- frontend/src/api/hooks.ts — TanStack Query hooks for auth, users, companies, contacts, notifications
-- frontend/src/store/authStore.ts — Zustand auth store
-- frontend/src/store/uiStore.ts — Zustand UI store (theme, sidebar, locale)
-- frontend/src/i18n/index.ts — react-i18next setup
-- frontend/src/i18n/locales/de.json, en.json
-- frontend/src/components/ui/Button.tsx
-- frontend/src/components/ui/Input.tsx
-- frontend/src/components/ui/Select.tsx
-- frontend/src/components/ui/Modal.tsx
-- frontend/src/components/ui/Toast.tsx (ToastContainer + useToast)
-- frontend/src/components/ui/Table.tsx
-- frontend/src/components/ui/Card.tsx
-- frontend/src/components/ui/Badge.tsx
-- frontend/src/components/ui/Avatar.tsx
-- frontend/src/components/ui/Pagination.tsx
-- frontend/src/components/ui/EmptyState.tsx
-- frontend/src/components/ui/Skeleton.tsx
-- frontend/src/components/ui/ConfirmDialog.tsx
-- frontend/src/components/layout/AppShell.tsx — Sidebar + TopBar + ContentArea
-- frontend/src/components/layout/Sidebar.tsx — Plugin menu, navigation
-- frontend/src/components/layout/TopBar.tsx — Tenant switcher, search, notifications, user menu
-- frontend/src/pages/Login.tsx
-- frontend/src/pages/PasswordResetRequest.tsx
-- frontend/src/pages/PasswordResetConfirm.tsx
-- frontend/src/pages/Dashboard.tsx (placeholder)
-- frontend/src/pages/Settings.tsx (locale switch, theme)
-- frontend/src/routes/index.tsx — Route definitions with guards
-- frontend/src/routes/ProtectedRoute.tsx — Auth guard
-- frontend/src/hooks/useAuth.ts
-- frontend/src/hooks/useTenant.ts
-- frontend/src/index.css — Tailwind directives + design tokens
-- frontend/src/__tests__/shell/ (AppShell, Router, Sidebar, TopBar tests)
-- frontend/src/__tests__/auth/ (Login, PasswordReset tests)
-- frontend/src/__tests__/ui/ (Button, Input, Modal, Toast, Table, etc. tests)
-- frontend/vitest.config.ts (or merge into vite.config.ts)
-- frontend/src/test/setup.ts — Vitest setup (jsdom, i18n, mocks)
-
-## Design Tokens (from prototype)
-- Reference: https://webspace.media-on.de/leocrm-prototype-x7k2p9/
-- Primary color, secondary, accent, danger, warning, success
-- Spacing scale, border radius, shadows
-- Typography: font families, sizes, weights
-- Define as CSS custom properties in index.css + Tailwind config
-
-## Critical Rules
-- Use TypeScript strict mode
-- All components must have ARIA labels for interactive elements
-- 44px minimum touch targets on mobile (Tailwind min-h-[44px] min-w-[44px])
-- prefers-reduced-motion: use Tailwind motion-safe/motion-reduce variants
-- Session cookie: axios with withCredentials: true
-- 401 handler: redirect to /login, clear auth store
-- 422 handler: extract validation errors, display in form
-- i18n: German default, English switchable
-- No Lorem Ipsum — use real German/English content
-- Test with Vitest + jsdom + @testing-library/react
-- Coverage target: 80%
-
-## Test Commands
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx vitest run src/__tests__/ --reporter=verbose
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npm run build
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx tsc --noEmit
-
-## Deliverables
-1. Complete frontend/ directory with all files listed above
-2. All 27 ACs covered by tests
-3. npm run build succeeds with 0 errors
-4. tsc --noEmit passes with 0 errors
-5. Report: test results, AC coverage, files, bugs

.a0/briefings/T07b_briefing.md

@@ -1,164 +0,0 @@
-# T07b Briefing — Frontend Feature Pages
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Frontend Directory
-/a0/usr/workdir/dev-projects/leocrm/frontend/
-
-## Task
-Build all feature pages for the LeoCRM SPA. T07a (shell, auth, routing, i18n, UI library) is complete.
-
-## Tech Stack (already set up by T07a)
-- React 18 + Vite + TypeScript (strict)
-- TanStack Query v5 (hooks in src/api/hooks.ts)
-- Zustand (stores in src/store/)
-- react-i18next (de/en, src/i18n/)
-- React Hook Form + Zod
-- Tailwind CSS with design tokens
-- Vitest + @testing-library/react
-
-## Existing API Hooks (src/api/hooks.ts)
-- useCompanies(page, pageSize, search) → { items, total, page, page_size }
-- useContacts(page, pageSize, search) → { items, total, page, page_size }
-- useUsers(page, pageSize) → paginated users
-- useCurrentUser() → current user
-- useNotifications() → notifications list
-- usePlugins() → plugins list
-- useLogin(), useLogout(), useSwitchTenant()
-- API client: src/api/client.ts (axios, withCredentials, 401→login, 422→validation)
-
-## Backend API Endpoints
-- GET /api/v1/companies?page=1&page_size=25&search=...&industry=...&sort_by=...&sort_order=...
-- GET /api/v1/companies/{id} → CompanyDetailResponse (includes contacts[])
-- POST /api/v1/companies
-- PATCH /api/v1/companies/{id}
-- DELETE /api/v1/companies/{id}
-- GET /api/v1/companies/export?format=csv&search=...&industry=...
-- POST /api/v1/companies/import (CSV upload)
-- GET /api/v1/contacts?page=1&page_size=25&search=...
-- GET /api/v1/contacts/{id} → ContactDetailResponse (includes companies[])
-- POST /api/v1/contacts
-- PATCH /api/v1/contacts/{id}
-- DELETE /api/v1/contacts/{id}
-- GET /api/v1/users?page=1&page_size=25
-- GET /api/v1/users/{id}
-- POST /api/v1/users
-- PATCH /api/v1/users/{id}
-- DELETE /api/v1/users/{id}
-- GET /api/v1/notifications
-- GET /api/v1/plugins
-- GET /health
-
-Note: No dedicated audit log or global search API endpoint exists yet. For audit log, create a frontend page that calls GET /api/v1/audit (may 404 — handle gracefully with empty state). For global search, call useCompanies and useContacts with search param in parallel.
-
-## Company Schema (from backend)
-- name: string (required, 1-100)
-- account_number: string? (max 40)
-- industry: string? (max 50)
-- phone: string? (max 30)
-- email: string? (max 255)
-- website: string? (max 500)
-- description: string?
-- CompanyDetailResponse adds: contacts: list[dict]
-
-## Files to Create/Modify
-
-### New API Hooks (add to src/api/hooks.ts)
-- useCompany(id), useCreateCompany(), useUpdateCompany(), useDeleteCompany()
-- useContact(id), useCreateContact(), useUpdateContact(), useDeleteContact()
-- useCompanyExport(), useCompanyImport()
-- useAuditLog(page, pageSize, filters)
-- useGlobalSearch(query, entityTypes)
-
-### New Pages (src/pages/)
-- CompaniesList.tsx — TanStack Table with search/filter/sort/pagination, empty state
-- CompanyDetail.tsx — Tabs: overview, contacts, files, activity
-- CompanyForm.tsx — Create/edit with React Hook Form + Zod
-- ContactsList.tsx — TanStack Table, loading skeleton
-- ContactDetail.tsx — Tabs: overview, companies, files, activity
-- ContactForm.tsx — Create/edit with multi-company assignment
-- AuditLog.tsx — Filterable table (date, user, action, entity)
-- GlobalSearchResults.tsx — Filters (entity type, date), highlighting
-- SettingsProfile.tsx — Update name, email, password, avatar
-- SettingsRoles.tsx — Role editor: create, assign permissions
-- SettingsUsers.tsx — User management: list, invite, change role, deactivate
-
-### Modify Existing Pages
-- Dashboard.tsx — Expand with stat cards + recent activity feed
-- Settings.tsx — Add tree navigation (Profile, Roles, Users, System)
-
-### New Components (src/components/)
-- SearchDropdown.tsx — Global search dropdown in topbar
-- StatCard.tsx — Dashboard stat card
-- ActivityFeed.tsx — Recent activity feed
-- Tabs.tsx — Reusable tab component for detail pages
-- DataGrid.tsx — Wrapper around TanStack Table for list pages
-- CsvImportDialog.tsx — CSV upload → preview → import
-- UnsavedChangesGuard.tsx — Warn on navigation away with unsaved changes
-
-### Update Routes (src/routes/index.tsx)
-Add routes for all new pages under ProtectedRoute children:
-- /companies, /companies/:id, /companies/new, /companies/:id/edit
-- /contacts, /contacts/:id, /contacts/new, /contacts/:id/edit
-- /audit-log
-- /search?q=...
-- /settings/profile, /settings/roles, /settings/users
-
-### Tests (src/__tests__/)
-- companies/CompaniesList.test.tsx, CompanyDetail.test.tsx, CompanyForm.test.tsx
-- contacts/ContactsList.test.tsx, ContactDetail.test.tsx, ContactForm.test.tsx
-- settings/SettingsProfile.test.tsx, SettingsRoles.test.tsx, SettingsUsers.test.tsx
-- dashboard/Dashboard.test.tsx
-- search/GlobalSearch.test.tsx
-- AuditLog.test.tsx
-
-## Acceptance Criteria (23 total)
-1. Companies list renders with TanStack Table (search, filter, sort, pagination)
-2. Company detail renders with tabs (overview, contacts, files, activity)
-3. Company form validates required fields (name) with Zod
-4. Company import: CSV upload → preview → import → success toast
-5. Company export: download CSV with current filters
-6. Contacts list renders with TanStack Table
-7. Contact detail renders with tabs (overview, companies, files, activity)
-8. Contact form validates required fields (first_name, last_name, email) with Zod
-9. Contact can be assigned to multiple companies
-10. Settings renders with tree navigation (Profile, Roles, Users, System)
-11. Profile settings: update name, email, password, avatar
-12. Role editor: create role, assign permissions, save
-13. User management: list users, invite user, change role, deactivate
-14. Audit log renders with filterable table (date, user, action, entity)
-15. Dashboard renders with stat cards and recent activity feed
-16. Global search bar in topbar returns results dropdown
-17. Global search results page renders with filters (entity type, date)
-18. Search results highlight matched terms
-19. Search works across companies, contacts (v1 scope)
-20. Companies list: empty state shows helpful message + create button
-21. Contacts list: loading state shows skeleton rows
-22. Company form: error state shows inline validation errors
-23. Settings: unsaved changes warning when navigating away
-
-## Test Commands
-```bash
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx vitest run src/__tests__/companies/ src/__tests__/contacts/ src/__tests__/settings/ src/__tests__/dashboard/ src/__tests__/search/ --reporter=verbose
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npm run build
-cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx tsc --noEmit
-```
-
-## Rules
-- TypeScript only, no .js files
-- No Lorem Ipsum — use real German/English content
-- All interactive elements need ARIA labels
-- 44px minimum touch targets on mobile
-- Use existing UI components from T07a (Button, Input, Select, Modal, Toast, Table, Card, Badge, Avatar, Pagination, EmptyState, Skeleton, ConfirmDialog)
-- Use existing i18n setup — add new keys to de.json and en.json
-- Use existing API client (src/api/client.ts) — don't create new axios instances
-- Coverage target: 80%
-- Keep responses under 50 lines
-- Use files_create for new files, reference by path
-
-## Deliverables
-1. All files created and tests passing
-2. npm run build succeeds with 0 errors
-3. tsc --noEmit passes with 0 errors
-4. Report: test results, AC coverage, files created, bugs encountered

.a0/briefings/T07b_continuation_briefing.md

@@ -1,158 +0,0 @@
-# T07b Continuation — Frontend Feature Pages (Part 2)
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Frontend Directory
-/a0/usr/workdir/dev-projects/leocrm/frontend/
-
-## What's Already Done (DO NOT recreate)
-
-### API Hooks (src/api/hooks.ts — 432 lines, modified)
-16 new hooks already added: useCompany, useCreateCompany, useUpdateCompany, useDeleteCompany, useContact, useCreateContact, useUpdateContact, useDeleteContact, useCompanyExport, useCompanyImport, useAuditLog, useGlobalSearch, plus CRUD for users.
-
-### Shared Components (src/components/shared/ — all exist)
-- `Tabs.tsx` (2055 bytes) — Tab navigation component
-- `StatCard.tsx` (1107 bytes) — Dashboard stat card
-- `ActivityFeed.tsx` (1372 bytes) — Activity feed list
-- `DataGrid.tsx` (6067 bytes) — TanStack Table wrapper with search/sort/pagination
-- `SearchDropdown.tsx` (6275 bytes) — Debounced search dropdown with highlighting
-- `CsvImportDialog.tsx` (5429 bytes) — CSV upload + preview dialog
-- `UnsavedChangesGuard.tsx` (821 bytes) — useBlocker-based unsaved changes warning
-
-### Dependencies
-- @tanstack/react-table@8.21.3 installed
-
-## What Remains (ALL of this must be created)
-
-### 1. Feature Pages (src/pages/)
-
-**Companies:**
-- `CompaniesList.tsx` — Use DataGrid component, search/filter/sort/pagination, CSV import (CsvImportDialog) + export buttons, empty state with create button (AC 1, 4, 5, 20)
-- `CompanyDetail.tsx` — Tabs: overview, contacts, files, activity (AC 2)
-- `CompanyForm.tsx` — RHF + Zod, validate name required, unsaved changes guard (AC 3, 22)
-
-**Contacts:**
-- `ContactsList.tsx` — Use DataGrid, loading skeleton rows, empty state (AC 6, 21)
-- `ContactDetail.tsx` — Tabs: overview, companies, files, activity (AC 7)
-- `ContactForm.tsx` — RHF + Zod, validate first_name/last_name/email, multi-company assignment (AC 8, 9)
-
-**Settings:**
-- `SettingsProfile.tsx` — Update name, email, password, avatar (AC 11)
-- `SettingsRoles.tsx` — Create role, assign permissions, save (AC 12)
-- `SettingsUsers.tsx` — List users, invite user, change role, deactivate (AC 13)
-
-**Other:**
-- `AuditLog.tsx` — Filterable table (date, user, action, entity). Call useAuditLog hook. Handle 404 gracefully with empty state (AC 14)
-- `GlobalSearchResults.tsx` — Filters (entity type, date), highlight matched terms. Call useGlobalSearch hook (AC 17, 18)
-
-### 2. Page Updates
-
-- `Dashboard.tsx` — Replace placeholder with stat cards (StatCard component) + recent activity feed (ActivityFeed component) (AC 15)
-- `Settings.tsx` — Add tree navigation (Profile, Roles, Users, System). Render child routes (AC 10)
-- `TopBar.tsx` — Add SearchDropdown in topbar for global search (AC 16)
-
-### 3. Routes (src/routes/index.tsx)
-
-Add these routes:
-```
-/companies              → CompaniesList
-/companies/:id          → CompanyDetail
-/companies/new          → CompanyForm
-/companies/:id/edit     → CompanyForm
-/contacts               → ContactsList
-/contacts/:id           → ContactDetail
-/contacts/new           → ContactForm
-/contacts/:id/edit      → ContactForm
-/audit-log              → AuditLog
-/search                 → GlobalSearchResults
-/settings/profile       → SettingsProfile
-/settings/roles         → SettingsRoles
-/settings/users         → SettingsUsers
-```
-
-### 4. i18n Updates (src/i18n/locales/de.json + en.json)
-
-Add translation keys for all new pages: companies, contacts, settings, audit_log, search, dashboard sections.
-
-### 5. Tests (src/__tests__/)
-
-Create test files:
-- `companies/CompaniesList.test.tsx`
-- `companies/CompanyDetail.test.tsx`
-- `companies/CompanyForm.test.tsx`
-- `contacts/ContactsList.test.tsx`
-- `contacts/ContactDetail.test.tsx`
-- `contacts/ContactForm.test.tsx`
-- `settings/SettingsProfile.test.tsx`
-- `settings/SettingsRoles.test.tsx`
-- `settings/SettingsUsers.test.tsx`
-- `dashboard/Dashboard.test.tsx`
-- `search/GlobalSearch.test.tsx`
-- `AuditLog.test.tsx`
-
-### 6. Verification
-
-Run these commands and report results:
-```bash
-cd /a0/usr/workdir/dev-projects/leocrm/frontend
-npx vitest run src/__tests__/ --reporter=verbose
-npm run build
-npx tsc --noEmit
-```
-
-## Tech Stack
-- React 18 + Vite + TypeScript
-- TanStack Query v5 (hooks in src/api/hooks.ts)
-- Zustand (stores in src/store/)
-- react-i18next (de/en locales)
-- React Hook Form + Zod
-- Tailwind CSS
-- Vitest + @testing-library/react
-- @tanstack/react-table v8
-
-## Existing UI Components (src/components/ui/)
-Avatar, Badge, Button, Card, ConfirmDialog, EmptyState, Input, Modal, Pagination, Select, Skeleton, Table, Toast
-
-## Existing Layout (src/components/layout/)
-AppShell, Sidebar, TopBar
-
-## API Client (src/api/client.ts)
-Axios instance with interceptors. Base URL: http://localhost:8000. Auth via session cookie.
-
-## Backend API Endpoints
-```
-GET/POST/PATCH/DELETE /api/v1/companies
-GET /api/v1/companies/{id}            # includes contacts[]
-GET /api/v1/companies/export?format=csv
-POST /api/v1/companies/import          # CSV upload
-GET/POST/PATCH/DELETE /api/v1/contacts
-GET /api/v1/contacts/{id}             # includes companies[]
-GET/POST/PATCH/DELETE /api/v1/users
-GET /api/v1/users/{id}
-GET /api/v1/notifications
-GET /api/v1/plugins
-GET /health
-```
-Note: No /api/v1/audit endpoint exists yet. useAuditLog hook may 404 — handle gracefully.
-Note: No dedicated search endpoint. useGlobalSearch calls useCompanies + useContacts with search param.
-
-## Company Schema
-```python
-name: str (required, 1-100 chars)
-account_number: str | None (max 40)
-industry: str | None (max 50)
-phone: str | None (max 30)
-email: str | None (max 255)
-website: str | None (max 500)
-description: str | None
-```
-
-## Rules
-- TypeScript only, no .js files
-- No Lorem Ipsum — use real German/English content
-- Reuse existing UI components, don't recreate them
-- Keep responses under 50 lines — reference files by path
-- Use real content, not placeholder text
-- All 23 acceptance criteria must be covered
-- Test files must use @testing-library/react with vitest

.a0/briefings/T08a_briefing.md

@@ -1,123 +0,0 @@
-# T08a: Frontend DMS + Tags + Permissions UI — Implementation Briefing
-
-## Task
-Implement frontend UI for DMS plugin (file browser, upload, preview, share, trash), Tags UI (assign, bulk, tag cloud), and Permissions UI (share links, permission display).
-
-## Requirements
-- F-DMS-01–07: DMS file browser, folder tree, upload, preview, share, trash, search
-- F-FILEUI-01–06: File UI components (dropzone, preview modal, share dialog, bulk actions, trash view)
-- F-TAG-01–04: Tags UI (assign, bulk assign, tag cloud, tag picker)
-- F-PERM-03–05: Permissions UI (share links, permission display)
-- F-LINK-01–05: Entity links UI
-
-## Acceptance Criteria (12 ACs)
-1. DMS route /dms renders file browser with folder tree + file grid
-2. DMS upload: drag file to dropzone → upload progress → file appears in list
-3. DMS file preview modal opens with PDF.js for PDF files
-4. DMS share dialog: select user/group, set permission, share created
-5. DMS public share link: copy button generates URL, optional password+expiry fields
-6. DMS bulk select → bulk-move or bulk-delete actions appear
-7. DMS trash view: deleted files list, restore button per file
-8. Mail: shared mailbox selector (DO NOT IMPLEMENT — belongs to T08c)
-9. Tags: tag picker on company/contact detail → assign/unassign
-10. Tags: bulk select entities → bulk-tag dialog
-11. Plugin deactivate → plugin route+menu-item disappear from SPA
-12. Plugin activate → plugin route+menu-item appear in SPA
-
-## Backend API Endpoints (already implemented)
-### DMS (/api/v1/dms)
-- GET /folders — list folder tree
-- POST /folders — create folder
-- PATCH /folders/{id} — rename/move folder
-- DELETE /folders/{id} — delete folder
-- POST /files/upload — upload file (multipart)
-- GET /files/{id} — get file detail
-- PATCH /files/{id} — update file (rename/move)
-- DELETE /files/{id} — soft-delete file
-- POST /files/{id}/restore — restore from trash
-- GET /files/{id}/preview — stream file for preview
-- POST /files/{id}/edit-session — create OnlyOffice edit session
-- POST /files/{id}/share — share file with user/group
-- DELETE /files/{id}/share — remove share
-- GET /search?q=text — search files
-- GET /shared-with-me — files shared with current user
-- POST /files/bulk-move — bulk move files
-- POST /files/bulk-delete — bulk delete files
-
-### Tags (/api/v1/tags)
-- GET / — list tags
-- POST / — create tag
-- PATCH /{id} — update tag
-- DELETE /{id} — delete tag
-- POST /assign — assign tag to entity
-- DELETE /assign — unassign tag
-- POST /bulk-assign — bulk assign tags
-- GET /{id}/entities — list entities for tag
-
-### Permissions (/api/v1/permissions)
-- GET /files/{id}/permissions — list permissions
-- POST /files/{id}/permissions — grant permission
-- DELETE /files/{id}/permissions/{user_id} — revoke permission
-- POST /files/{id}/share-link — create public share link
-- DELETE /share-links/{id} — revoke share link
-
-## Frontend Architecture (follow existing patterns)
-- **Framework:** React + TypeScript + Vite
-- **Routing:** react-router-dom (createBrowserRouter, see src/routes/index.tsx)
-- **State:** TanStack Query (useQuery/useMutation)
-- **HTTP:** axios via src/api/client.ts (apiClient, baseURL /api/v1)
-- **API pattern:** See src/api/calendar.ts for plugin API client example
-- **UI components:** src/components/ui/ (Button, Card, Input, Modal, Table, Badge, ConfirmDialog, EmptyState, Pagination, Select, Skeleton, Toast)
-- **Shared components:** src/components/shared/ (DataGrid, SearchDropdown, Tabs, ActivityFeed)
-- **Store:** src/store/ (authStore, uiStore)
-- **Layout:** src/components/layout/AppShell (sidebar + main area)
-- **i18n:** src/i18n/ (add de.json + en.json keys for DMS/Tags)
-
-## Files to Create
-- `src/api/dms.ts` — DMS API client (types + functions)
-- `src/api/tags.ts` — Tags API client
-- `src/api/permissions.ts` — Permissions API client
-- `src/pages/Dms.tsx` — DMS file browser page (folder tree + file grid)
-- `src/pages/DmsTrash.tsx` — DMS trash view
-- `src/components/dms/FolderTree.tsx` — folder tree sidebar
-- `src/components/dms/FileGrid.tsx` — file grid with icons
-- `src/components/dms/UploadDropzone.tsx` — drag-drop upload
-- `src/components/dms/FilePreviewModal.tsx` — file preview modal
-- `src/components/dms/ShareDialog.tsx` — share dialog
-- `src/components/dms/BulkActions.tsx` — bulk select actions
-- `src/components/tags/TagPicker.tsx` — tag assign/unassign picker
-- `src/components/tags/TagCloud.tsx` — tag cloud display
-- `src/components/tags/BulkTagDialog.tsx` — bulk tag assignment dialog
-- `src/__tests__/dms/DmsPage.test.tsx` — DMS page tests
-- `src/__tests__/dms/UploadDropzone.test.tsx` — upload tests
-- `src/__tests__/tags/TagPicker.test.tsx` — tag picker tests
-- `src/__tests__/tags/BulkTagDialog.test.tsx` — bulk tag tests
-- `src/__tests__/permissions/ShareDialog.test.tsx` — share dialog tests
-
-## Files to Modify
-- `src/routes/index.tsx` — Add /dms, /dms/trash routes
-- `src/components/layout/AppShell.tsx` — Add DMS + Tags menu items to sidebar
-- `src/pages/CompanyDetail.tsx` — Add TagPicker component
-- `src/pages/ContactDetail.tsx` — Add TagPicker component
-- `src/i18n/locales/de.json` — Add DMS/Tags translations
-- `src/i18n/locales/en.json` — Add DMS/Tags translations
-
-## Test Spec
-- Run: `cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx vitest run src/__tests__/dms/ src/__tests__/tags/ src/__tests__/permissions/ --reporter=verbose`
-- Coverage: `npx vitest run src/__tests__/dms/ src/__tests__/tags/ --coverage`
-- Build: `npx vite build`
-- Type check: `npx tsc --noEmit`
-- Coverage target: 80%
-- Follow existing test pattern from src/__tests__/companies/ or src/__tests__/calendar/
-
-## Forbidden Patterns
-- No inline styles — use Tailwind classes
-- No any types — use proper TypeScript interfaces
-- No direct fetch() — use apiClient from src/api/client.ts
-- No hardcoded strings — use i18n (t() function)
-- No Lorem Ipsum — use realistic test data
-- No missing loading/error/empty states
-
-## Estimated Size
-- ~600 lines code (pages + components + API clients)
-- ~300+ lines tests

.a0/briefings/T08c_briefing.md

@@ -1,148 +0,0 @@
-# T08c: Frontend Mail UI + Global Search UI — Implementation Briefing
-
-## Task
-Implement frontend UI for Mail plugin (folder tree, mail list, reading pane, compose, templates, signatures, rules, labels, PGP, vacation, shared mailbox, delegates) and enhance Global Search UI with tabs.
-
-## Acceptance Criteria (17 ACs — skip AC1/DMS and AC16/Docker, already done)
-2. Mail route /mail renders folder tree + mail list + reading pane
-3. Mail: click folder → mail list updates with folder mails
-4. Mail: click mail → detail with sanitized HTML body + attachments
-5. Mail: compose button → editor with toolbar (bold, italic, link, template insert)
-6. Mail: reply/forward buttons → compose pre-filled
-7. Mail: template picker dropdown in compose → inserts template body
-8. Mail: signature manager in settings → create/edit/delete signatures
-9. Mail: rule editor → condition builder + action selector
-10. Mail: label manager → create labels with colors, assign to mails
-11. Mail: PGP settings → import private key, view contact public keys
-12. Mail: vacation responder toggle → date range + auto-reply text
-13. Mail: shared mailbox selector → switch between personal+shared accounts
-14. Mail: attachment download → file stream downloaded
-15. Mail: create event from mail → calendar event modal pre-filled
-16. Global search results page → tabs for companies/contacts/mails/files/events
-17. Global search autocomplete in TopBar → dropdown with suggestions
-
-## Backend API Endpoints (all implemented, prefix /api/v1/mail)
-### Accounts
-- GET /accounts — list accounts (password never returned)
-- POST /accounts — create account (AES-256 encrypted password)
-- PATCH /accounts/{id} — update account
-- DELETE /accounts/{id} — delete account
-- GET /accounts/shared — list shared mailboxes
-- POST /accounts/{id}/users — assign shared mailbox users
-- POST /accounts/{id}/delegates — create delegate access
-- POST /accounts/{id}/send-permissions — grant send permission
-- POST /accounts/{id}/test-connection — test IMAP connection
-- POST /accounts/{id}/sync — trigger IMAP sync
-
-### Folders
-- GET /folders?account_id=X — list folders with counts
-- POST /folders — create folder
-- PATCH /folders/{id} — rename folder
-- DELETE /folders/{id} — delete folder
-
-### Mails
-- GET /?folder_id=X&page=1 — paginated mail list
-- GET /{id} — mail detail (sanitized HTML, attachments)
-- POST /send — send mail via SMTP
-- POST /{id}/reply — reply with In-Reply-To
-- POST /{id}/forward — forward mail
-- PATCH /{id}/flags — toggle seen/flagged
-- POST /{id}/link — link to contact/company
-- POST /{id}/create-event — create calendar event from mail
-- POST /{id}/labels — assign label to mail
-
-### Search & Threads
-- GET /search?q=text — FTS search
-- GET /threads — threaded view
-
-### Attachments
-- GET /{mail_id}/attachments/{att_id} — file stream download
-
-### Templates
-- POST /templates — create template
-- GET /templates — list templates
-- POST /templates/substitute — substitute variables
-
-### Signatures
-- POST /signatures — create signature
-- GET /signatures — list signatures
-
-### Rules
-- POST /rules — create rule (conditions + actions)
-- GET /rules — list rules sorted by priority
-- DELETE /rules/{id} — delete rule
-
-### Vacation
-- POST /vacation — configure auto-reply
-- POST /vacation/test-dedup — test dedup
-
-### PGP
-- POST /pgp/keys — import private key (encrypted)
-- GET /pgp/keys — list PGP keys
-- POST /pgp/encrypt — encrypt message
-- POST /contacts/{contact_id}/pgp-key — store contact public key
-
-### Labels
-- POST /labels — create label (with color)
-- GET /labels — list labels
-
-## Frontend Architecture (follow existing patterns)
-- **Framework:** React + TypeScript + Vite
-- **Routing:** react-router-dom (src/routes/index.tsx)
-- **State:** TanStack Query (useQuery/useMutation)
-- **HTTP:** axios via src/api/client.ts (apiClient, baseURL /api/v1)
-- **API pattern:** See src/api/calendar.ts or src/api/dms.ts
-- **UI components:** src/components/ui/ (Button, Card, Input, Modal, Table, Badge, etc.)
-- **Shared:** src/components/shared/ (DataGrid, SearchDropdown, Tabs)
-- **Layout:** src/components/layout/AppShell.tsx + Sidebar.tsx
-- **i18n:** src/i18n/ (add de.json + en.json keys for Mail)
-- **Existing search page:** src/pages/GlobalSearchResults.tsx (enhance with tabs)
-
-## Files to Create
-- `src/api/mail.ts` — Mail API client (types + functions for all endpoints)
-- `src/pages/Mail.tsx` — Mail page (folder tree + mail list + reading pane)
-- `src/pages/MailSettings.tsx` — Mail settings (signatures, rules, PGP, vacation, labels)
-- `src/components/mail/MailFolderTree.tsx` — folder tree sidebar
-- `src/components/mail/MailList.tsx` — mail list with pagination
-- `src/components/mail/MailDetail.tsx` — reading pane (sanitized HTML, attachments)
-- `src/components/mail/ComposeModal.tsx` — compose editor (bold/italic/link/template)
-- `src/components/mail/TemplatePicker.tsx` — template dropdown
-- `src/components/mail/SignatureManager.tsx` — signature CRUD
-- `src/components/mail/RuleEditor.tsx` — rule condition builder + action selector
-- `src/components/mail/LabelManager.tsx` — label CRUD with colors
-- `src/components/mail/VacationResponder.tsx` — vacation toggle + date range
-- `src/components/mail/PgpSettings.tsx` — PGP key import + contact keys
-- `src/components/mail/SharedMailboxSelector.tsx` — account switcher
-- `src/components/mail/MailSearchBar.tsx` — mail search input
-- `src/__tests__/mail/MailPage.test.tsx` — mail page tests
-- `src/__tests__/mail/ComposeModal.test.tsx` — compose tests
-- `src/__tests__/mail/MailSettings.test.tsx` — settings tests
-- `src/__tests__/search/GlobalSearchTabs.test.tsx` — search tabs tests
-
-## Files to Modify
-- `src/routes/index.tsx` — Add /mail, /mail/settings routes
-- `src/components/layout/Sidebar.tsx` — Add Mail nav link
-- `src/pages/GlobalSearchResults.tsx` — Add tabs (companies/contacts/mails/files/events)
-- `src/components/layout/AppShell.tsx` — Add search autocomplete in TopBar
-- `src/i18n/locales/de.json` — Mail translations
-- `src/i18n/locales/en.json` — Mail translations
-
-## Test Spec
-- Run: `cd /a0/usr/workdir/dev-projects/leocrm/frontend && npx vitest run src/__tests__/mail/ src/__tests__/search/ --reporter=verbose`
-- Build: `npx vite build`
-- Type check: `npx tsc --noEmit`
-- Coverage target: 80%
-- Follow existing test pattern from src/__tests__/dms/ or src/__tests__/companies/
-
-## Forbidden Patterns
-- No inline styles — use Tailwind classes
-- No any types — use proper TypeScript interfaces
-- No direct fetch() — use apiClient from src/api/client.ts
-- No hardcoded strings — use i18n (t() function)
-- No Lorem Ipsum — use realistic test data
-- No missing loading/error/empty states
-- No dangerouslySetInnerHTML without sanitization check
-
-## Estimated Size
-- ~700 lines code (pages + components + API client)
-- ~350+ lines tests

.a0/briefings/T09_briefing.md

@@ -1,121 +0,0 @@
-# T09 — KI-Copilot API + Hybrid Workflow Engine Backend
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Backend Directory
-/a0/usr/workdir/dev-projects/leocrm/app/
-
-## Tech Stack (existing)
-- FastAPI + SQLAlchemy 2.0 + asyncpg + Pydantic v2 + ARQ
-- PostgreSQL 18 on localhost:5432 (user/db: leocrm/leocrm + leocrm_test)
-- Redis on localhost:6379
-- venv at /opt/venv (already activated)
-- T01-T03 complete (103 tests pass, commit 7a5a48f)
-
-## Requirements (5)
-F-AI-01, F-WF-01, F-CORE-01, F-CORE-06, F-TEST-01
-
-## Acceptance Criteria (22)
-### KI-Copilot (7 ACs)
-1. POST /api/v1/ai/copilot/query mit NL input → 200 + proposed_actions array
-2. POST /api/v1/ai/copilot/execute mit proposed action → 200 + API result (RBAC enforced)
-3. POST /api/v1/ai/copilot/execute als viewer mit delete action → 403 (RBAC blocks)
-4. GET /api/v1/ai/copilot/history → 200 + paginated conversation history
-5. Copilot action logged in audit_log with entity_type=ai_copilot
-6. Copilot respects tenant isolation: cross-tenant → 404
-7. Copilot respects field-level permissions: hidden fields not in response
-
-### Workflow Engine (15 ACs)
-8. POST /api/v1/workflows mit valid steps JSONB → 201 + workflow definition
-9. GET /api/v1/workflows → 200 + paginated list
-10. GET /api/v1/workflows/{id} → 200 + workflow detail with steps
-11. PATCH /api/v1/workflows/{id} → 200, updated
-12. DELETE /api/v1/workflows/{id} → 204
-13. POST /api/v1/workflows/{id}/instances → 201, instance created with status=pending
-14. GET /api/v1/workflows/instances?status=in_progress → 200 + filtered list
-15. GET /api/v1/workflows/instances/{id} → 200 + current_step_index + history
-16. POST /api/v1/workflows/instances/{id}/advance (approve) → 200, step advanced
-17. POST /api/v1/workflows/instances/{id}/advance (reject) → 200, status=rejected, initiator notified
-18. POST /api/v1/workflows/instances/{id}/cancel → 200, status=cancelled
-19. Event-triggered workflow: publish event → workflow instance auto-starts
-20. workflow_step_history entry created on every step transition
-21. Code-engine workflow: onboarding workflow runs on user creation
-22. Approval step timeout → auto-reject after configured hours (tested with mock timer)
-
-## Files to Create
-### KI-Copilot
-- app/models/ai_conversation.py — AIConversation, AIMessage models (tenant-scoped)
-- app/schemas/ai_copilot.py — CopilotQueryRequest, CopilotAction, CopilotExecuteRequest, CopilotHistoryResponse
-- app/services/ai_copilot_service.py — NL→API translation, LLM client, RBAC enforcement, audit logging
-- app/routes/ai_copilot.py — POST /query, POST /execute, GET /history
-- app/ai/__init__.py
-- app/ai/llm_client.py — Configurable LLM client (AI_MODEL, AI_API_KEY env vars)
-- app/ai/action_mapper.py — Maps NL intents to API calls
-
-### Workflow Engine
-- app/models/workflow.py — Workflow, WorkflowInstance, WorkflowStepHistory models (tenant-scoped)
-- app/schemas/workflow.py — WorkflowCreate, WorkflowResponse, InstanceCreate, InstanceResponse, AdvanceRequest
-- app/services/workflow_service.py — CRUD workflows, instance lifecycle (start/advance/approve/reject/cancel)
-- app/routes/workflows.py — Workflow CRUD + instance endpoints
-- app/workflows/__init__.py
-- app/workflows/code/__init__.py — Code-engine workflows
-- app/workflows/code/onboarding.py — Onboarding workflow (runs on user creation)
-- app/workflows/engine.py — Workflow execution engine (step processing, conditions, approvals)
-
-### Tests
-- tests/test_ai_copilot.py — 7 AC tests + edge cases
-- tests/test_workflows.py — 15 AC tests + edge cases
-
-### Migration
-- alembic/versions/0004_ai_workflows.py — ai_conversations, ai_messages, workflows, workflow_instances, workflow_step_history tables (all tenant-scoped with RLS)
-
-## Files to Modify
-- app/main.py — Register ai_copilot + workflows routers
-- app/models/__init__.py — Add new model imports
-- app/routes/__init__.py — Add new router imports
-- app/schemas/__init__.py — Add new schema imports
-- app/services/__init__.py — Add new service imports
-- tests/conftest.py — Add new tables to TRUNCATE list
-- app/core/event_bus.py — Add workflow event trigger integration (if not already present)
-
-## LLM Client Design
-- Read AI_MODEL and AI_API_KEY from environment
-- If not set, use mock/stub mode (returns predefined actions for tests)
-- Support OpenAI-compatible API (default)
-- NL → proposed API calls: method, path, body, description
-- Never execute directly — always return proposed actions for user confirmation
-
-## Workflow Engine Design
-- Step types: action, approval, notification, condition
-- Workflow definition: JSONB steps array
-- Instance lifecycle: pending → in_progress → completed/rejected/cancelled
-- Event bus integration: subscribe to events, auto-start workflows with matching trigger
-- Code-engine: hardcoded workflows in app/workflows/code/ (onboarding on user.created event)
-- Approval timeout: configurable hours, auto-reject via ARQ scheduled job or mock timer in tests
-
-## Critical Rules
-- All POST routes MUST have status_code=201 (except execute/advance/cancel which are actions → 200)
-- Use set_config() for tenant context, NOT SET LOCAL
-- Use .com emails in tests, NOT .test
-- All new tables MUST have tenant_id column + RLS policies
-- Update tests/conftest.py TRUNCATE list with new tables
-- Create Alembic migration 0004 for all new tables
-- Copilot MUST enforce RBAC (same middleware, same permissions)
-- Copilot MUST respect tenant isolation and field-level permissions
-- Audit log entity_type=ai_copilot for all copilot actions
-- Workflow mutations MUST be logged in workflow_step_history
-- Idempotent where applicable
-
-## Test Commands
-cd /a0/usr/workdir/dev-projects/leocrm && python -m pytest tests/test_ai_copilot.py tests/test_workflows.py -v --tb=short
-cd /a0/usr/workdir/dev-projects/leocrm && python -m pytest tests/ -v --tb=short (full suite regression)
-
-## Coverage Target
-80% for new modules
-
-## Deliverables
-1. All files listed above
-2. Alembic migration 0004
-3. tests/test_ai_copilot.py + tests/test_workflows.py covering all 22 ACs
-4. Report: test results, AC coverage, files, bugs

.a0/briefings/T10_briefing.md

@@ -1,87 +0,0 @@
-# T10: Monitoring, Performance, Documentation & Environment Config — Implementation Briefing
-
-## Task
-Three modules in one task: (1) Monitoring & Alerting, (2) Performance, (3) Documentation.
-
-## Acceptance Criteria (18 ACs)
-### Monitoring (AC1-6)
-1. GET /api/v1/health → 200 + JSON with status, checks.database, checks.redis, checks.storage, checks.worker
-2. GET /api/v1/health mit DB down → 200 + status=degraded, checks.database.status=down
-3. GET /api/v1/metrics → 200 + text/plain Prometheus format (admin only, 403 for non-admin)
-4. Prometheus metrics include leocrm_http_requests_total, leocrm_db_pool_connections, leocrm_arq_jobs_total
-5. Structured JSON log entry for API request: {timestamp, level, event, method, path, status, duration_ms, tenant_id}
-6. Error log includes stacktrace and request context
-
-### Performance (AC7-12)
-7. scripts/seed_perf_data.py --count 200000 → creates 200k contacts in test DB
-8. GET /api/v1/contacts?page=1&page_size=25 with 200k records → response time <500ms
-9. GET /api/v1/contacts?search=Mueller with 200k records → response time <500ms
-10. page_size > 100 → 422 (max page_size enforced)
-11. CSV export >1000 records → ARQ background job started → notification on completion
-12. Streaming CSV export: GET /api/v1/contacts/export?format=csv → text/csv stream (not buffered)
-
-### Documentation (AC13-18)
-13. README.md exists with Setup-Anleitung (dev + prod), API section, links to admin-guide
-14. Swagger UI available at /api/v1/docs (FastAPI auto-gen)
-15. docs/admin-guide.md exists with Deploy, Backup, Restore, Env-Vars, Troubleshooting sections
-16. docs/api-overview.md exists with endpoint summary table
-17. .env.example file exists with all required variables documented (database, redis, smtp, storage, secret_key)
-18. Environment-specific config: dev, test, prod profiles documented in docs/admin-guide.md
-
-## Existing Code References
-- **Health endpoint:** app/routes/health.py (simple, needs extension)
-- **Health test:** tests/test_health.py (basic 200 check)
-- **Main app:** app/main.py (FastAPI app with CORS, CSRF middleware)
-- **Config:** app/config.py (settings with pydantic-settings)
-- **DB:** app/core/db.py (async engine)
-- **Routes:** app/routes/ (auth, companies, contacts, etc.)
-- **Contacts route:** app/routes/contacts.py (has search param, pagination)
-- **Companies route:** app/routes/companies.py (has search, pagination, export)
-- **README.md:** exists (basic, needs update with prod setup, API section, admin-guide link)
-- **.env.example:** exists (good coverage, may need SMTP/storage additions)
-- **docs/:** only requirements docs, needs admin-guide.md + api-overview.md
-- **Docker:** docker-compose.yml + Dockerfile exist
-- **Coolify:** COOLIFY_SETUP.md exists
-
-## Files to Create
-- `app/core/monitoring.py` — Health check extensions, Prometheus metrics, structured logging
-- `app/routes/metrics.py` — Prometheus metrics endpoint (admin-only)
-- `scripts/seed_perf_data.py` — Performance test data seeding script
-- `scripts/check_indexes.py` — DB index verification script
-- `tests/test_monitoring.py` — Monitoring tests (health, metrics, logging)
-- `tests/test_performance.py` — Performance tests (pagination, export, page_size limit)
-- `docs/admin-guide.md` — Admin guide (Deploy, Backup, Restore, Env-Vars, Troubleshooting)
-- `docs/api-overview.md` — API endpoint summary
-
-## Files to Modify
-- `app/routes/health.py` — Extend health check with DB+Redis+Storage+Worker status
-- `app/main.py` — Add metrics route, structured logging middleware, request timing
-- `app/routes/contacts.py` — Enforce page_size max 100, add streaming CSV export
-- `app/routes/companies.py` — Enforce page_size max 100, add streaming CSV export
-- `app/config.py` — Add SMTP/storage config if missing
-- `README.md` — Update with prod setup, API section, admin-guide link, env profiles
-- `.env.example` — Add SMTP/storage/secret_key vars if missing
-- `tests/test_health.py` — Update for extended health check
-- `requirements.txt` — Add prometheus-client, structlog if needed
-
-## Dependencies to Add (if not present)
-- `prometheus-client>=0.20` (Prometheus metrics)
-- `structlog>=24.0` (structured JSON logging)
-
-## Test Spec
-- Run: `cd /a0/usr/workdir/dev-projects/leocrm && python -m pytest tests/test_monitoring.py tests/test_performance.py tests/test_health.py -v --tb=short`
-- Coverage: `python -m pytest tests/test_monitoring.py --cov=app/core/monitoring --cov-report=term-missing`
-- Docs check: `test -f README.md && test -f docs/admin-guide.md && test -f docs/api-overview.md && echo 'Docs OK'`
-- Coverage target: 80%
-- Follow existing test pattern from tests/test_health.py or tests/test_companies.py
-
-## Forbidden Patterns
-- No blocking I/O in async health check — use async DB ping
-- No credentials in logs or metrics
-- No unbounded pagination — max 100 per page enforced
-- No buffering large CSV exports — use StreamingResponse
-- No hardcoded config — use app/config.py settings
-
-## Estimated Size
-- ~500 lines code (monitoring + scripts + docs)
-- ~300+ lines tests

.a0/briefings/T11_briefing.md

@@ -1,154 +0,0 @@
-# T11 Briefing — Tags Plugin + Permissions Plugin + Entity Links Backend
-
-## Project Root
-/a0/usr/workdir/dev-projects/leocrm
-
-## Task
-Implement 3 builtin plugins: Tags, Permissions, Entity Links.
-
-## Plugin Framework (existing — read these files first)
-- `app/plugins/base.py` — BasePlugin abstract class with lifecycle hooks
-- `app/plugins/manifest.py` — PluginManifest, PluginRouteDef schemas
-- `app/plugins/registry.py` — PluginRegistry (discovers builtins, manages lifecycle)
-- `app/plugins/builtins/test_sample.py` — Example plugin (reference pattern)
-- `app/plugins/builtins/migrations/` — Migration SQL files go here
-- `app/core/event_bus.py` — EventBus for pub/sub
-- `app/core/service_container.py` — DI container
-- `app/core/db.py` — Base, TenantMixin, TimestampMixin
-- `app/models/company.py` — Company model (reference for model patterns)
-- `app/models/plugin.py` — Plugin + PluginMigration models
-
-## Architecture Rules
-- Plugins live in `app/plugins/builtins/` as subdirectories (e.g. `app/plugins/builtins/tags/`)
-- Each plugin has: `__init__.py` (exports plugin class), `plugin.py` (BasePlugin subclass), `routes.py` (APIRouter), `models.py` (SQLAlchemy models), `schemas.py` (Pydantic schemas), `migrations/` (SQL files)
-- Migrations are plain SQL files in `app/plugins/builtins/<plugin>/migrations/`
-- Models use SQLAlchemy 2.0 style (Mapped, mapped_column) with PGUUID, TenantMixin
-- Routes use FastAPI APIRouter, registered via manifest routes list
-- Events: subscribe in on_activate, handlers named `on_<event_name>`
-
-## 1. Tags Plugin (`app/plugins/builtins/tags/`)
-
-### Requirements (F-TAG-01 through F-TAG-04)
-- Tags can be applied to files, folders, companies, contacts
-- Tags are global (not per-user), centrally managed
-- Multiple tags per entity (N:M)
-- Tag CRUD with color support
-- Tag filtering in lists (AND/OR combination)
-- Tag cloud/sidebar with entity counts
-
-### Endpoints
-```
-GET    /api/v1/tags              → 200, list tags with entity counts
-POST   /api/v1/tags              → 201, create tag (name, color)
-PATCH  /api/v1/tags/{id}          → 200, update tag
-DELETE /api/v1/tags/{id}          → 204, cascade delete assignments
-POST   /api/v1/tags/assign        → 200, assign tag to entity (tag_id, entity_type, entity_id)
-DELETE /api/v1/tags/assign        → 204, remove tag assignment
-POST   /api/v1/tags/bulk-assign   → 200, assign multiple tags to entity
-GET    /api/v1/tags/{id}/entities → 200, list entities with this tag
-```
-
-### Models
-- `Tag`: id (UUID), name (str, unique per tenant), color (str, hex), tenant_id
-- `TagAssignment`: id, tag_id (FK), entity_type (str: company/contact/file/folder), entity_id (UUID), tenant_id
-
-### Migration
-- `0001_initial.sql`: Create `tags` and `tag_assignments` tables with tenant_id columns
-
-## 2. Permissions Plugin (`app/plugins/builtins/permissions/`)
-
-### Requirements (F-PERM-01 through F-PERM-06)
-- Personal root folder per user ("Mein Bereich")
-- Shared root folders for teams/departments
-- Share files/folders with individual users (read/write)
-- Share files/folders with user groups (read/write)
-- Public share links (with password, expiry, download-only or preview+download)
-- Permission display (who has access?)
-
-### Endpoints
-```
-GET    /api/v1/dms/files/{id}/permissions          → 200, permission list
-POST   /api/v1/dms/files/{id}/permissions          → 201, grant permission
-DELETE /api/v1/dms/files/{id}/permissions/{user_id} → 204, revoke
-POST   /api/v1/dms/files/{id}/share-link           → 200, create share link (returns public token URL)
-GET    /api/public/share/{token}                   → 200 (file) or 410 (expired)
-DELETE /api/v1/dms/share-links/{id}                → 204, revoke share link
-```
-
-### Models
-- `Permission`: id, file_id (UUID), user_id (UUID), group_id (UUID nullable), access_level (read/write), tenant_id
-- `ShareLink`: id, file_id (UUID), token (str, unique), password_hash (nullable), expires_at (nullable), access_level (download/preview), tenant_id
-
-### Migration
-- `0001_initial.sql`: Create `permissions` and `share_links` tables
-
-### Special
-- Public share endpoint `/api/public/share/{token}` must NOT require auth
-- Expired links return 410 Gone
-- Password-protected links verify password before serving
-
-## 3. Entity Links Backend (`app/plugins/builtins/entity_links/`)
-
-### Requirements (F-LINK-01 through F-LINK-06)
-- Link files/folders to companies (N:M)
-- Link files/folders to contacts (N:M)
-- Reverse links (file shows linked entities)
-- Multi-links (one file → many entities)
-- Event cleanup: on company.deleted/contact.deleted → remove links
-
-### Endpoints
-```
-POST   /api/v1/dms/files/{id}/link    → 200, link file to entity (entity_type, entity_id)
-DELETE /api/v1/dms/files/{id}/link    → 204, remove link (entity_type, entity_id in body)
-GET    /api/v1/dms/files/{id}/links    → 200, list all linked entities for file
-GET    /api/v1/companies/{id}/files   → 200, list linked files for company
-GET    /api/v1/contacts/{id}/files    → 200, list linked files for contact
-```
-
-### Models
-- `EntityLink`: id, file_id (UUID), entity_type (str: company/contact), entity_id (UUID), tenant_id, created_by (UUID)
-
-### Migration
-- `0001_initial.sql`: Create `entity_links` table
-
-### Event Handling
-- Subscribe to `company.deleted` → delete all EntityLink rows where entity_type='company' AND entity_id=deleted_id
-- Subscribe to `contact.deleted` → delete all EntityLink rows where entity_type='contact' AND entity_id=deleted_id
-
-## Acceptance Criteria (14 total — ALL must pass)
-1. GET /api/v1/dms/files/{id}/permissions → 200 + permission list
-2. POST /api/v1/dms/files/{id}/link → 200, file linked to entity
-3. DELETE /api/v1/dms/files/{id}/link → 204, link removed
-4. POST /api/v1/dms/files/{id}/share-link → 200 + public token URL
-5. GET /api/public/share/{token} with expired link → 410
-6. GET /api/v1/tags → 200 + tags with counts
-7. POST /api/v1/tags → 201, tag created
-8. PATCH /api/v1/tags/{id} → 200
-9. DELETE /api/v1/tags/{id} → 204, cascade delete assignments
-10. POST /api/v1/tags/assign → 200, tag assigned to entity
-11. DELETE /api/v1/tags/assign → 204, tag removed
-12. POST /api/v1/tags/bulk-assign → 200, multiple tags assigned
-13. DMS plugin listens to company.deleted event → linked files cleanup
-14. Folder permissions enforced: user without read → 403
-
-## Test Files (create in `tests/`)
-- `tests/test_tags.py` — Tag CRUD, assignment, bulk assign, cascade delete, counts
-- `tests/test_permissions.py` — Personal root, shared root, share with users/groups, share links (password, expiry), permission display, 403 enforcement
-- `tests/test_entity_links.py` — Link file to company, link to contact, reverse links, multi-links, event cleanup on deletion
-
-## Verification Commands
-```bash
-cd /a0/usr/workdir/dev-projects/leocrm
-python -m pytest tests/test_tags.py tests/test_permissions.py tests/test_entity_links.py -v --tb=short
-python -m pytest tests/test_tags.py tests/test_permissions.py tests/test_entity_links.py --cov=app/plugins/builtins --cov-report=term-missing
-```
-
-## Rules
-- Use text_editor:write for new files, text_editor:patch for updates
-- Read existing files before modifying
-- No Lorem Ipsum, no placeholder code
-- Follow existing patterns (SQLAlchemy 2.0, Pydantic v2, FastAPI APIRouter)
-- Each plugin must have manifest, plugin class, routes, models, schemas, migrations
-- Register plugins in `app/plugins/builtins/__init__.py`
-- Keep response under 50 lines
-- Report: files created, test count + pass/fail, coverage %

.a0/current_status.md

@@ -1,17 +0,0 @@
-# LeoCRM — Current Status
-**Phase**: 6 (Deployment) — COMPLETE
-**Last commit**: 1d3fccc (pushed to Forgejo)
-**Date**: 2026-07-02
-
-## Deployment Results
-- URL: https://crm.media-on.de ✅
-- Status: running:healthy ✅
-- Health: 200 OK ✅
-- Swagger: 200 OK ✅
-- PostgreSQL 16: running ✅
-- Redis 7: running ✅
-- Traefik SSL: Let's Encrypt ✅
-
-## Next Step
-- Phase 6 → Phase 7 transition (requires user approval)
-- Phase 7: Release (release_auditor) — final audit, handoff

.a0/next_steps.md

@@ -1,4 +0,0 @@
-# LeoCRM — Next Steps
-1. Phase 6 COMPLETE — deployed to https://crm.media-on.de
-2. Phase 7: Release — final audit, handoff documentation
-3. Requires user approval for Phase 6 → Phase 7 transition

.a0/project_state.json

@@ -1,30 +0,0 @@
-{
-  "project_name": "leocrm",
-  "phase": "phase-6-complete",
-  "status": "running:healthy",
-  "last_commit": "047b59a",
-  "forgejo_synced": true,
-  "completed_tasks": ["T01","T02","T03","T04","T05","T06","T07a","T07b","T08a","T08b","T08c","T09","T10","T11"],
-  "current_task": null,
-  "next_task": "phase7-release",
-  "test_results": {
-    "backend_tests": "564/564 passed (as of 2026-07-02)",
-    "frontend_tests": "318/318 passed (as of 2026-07-02)",
-    "coverage": "85.41%"
-  },
-  "runtime_results": {
-    "app_start": "successful",
-    "health_endpoint": "200 OK — {status: healthy, database: up, redis: up, storage: up, worker: up}",
-    "swagger": "200 OK"
-  },
-  "deployment_results": {
-    "url": "https://crm.media-on.de",
-    "status": "running:healthy",
-    "health_check": "200 OK",
-    "swagger": "200 OK",
-    "coolify_uuid": "stvabl4vaqru7jclx4ittzr3",
-    "deployed_commit": "047b59a",
-    "deployed_at": "2026-07-04T18:17:48+02:00"
-  },
-  "updated_at": "2026-07-04T18:19:00+02:00"
-}

.a0/worklog.md

@@ -1,205 +0,0 @@
-
-
-## T03 — Plugin System Framework — COMPLETE ✅
-**Date**: 2026-06-29 01:20
-**Commit**: 7a5a48f (pushed to Forgejo)
-**Tests**: 47/47 T03 tests pass, 103/103 full suite pass
-**Coverage**: 85.92% for plugin modules (target: 85% ✅)
-**Migration**: 0003_plugin_system.py applied (plugins + plugin_migrations tables)
-
-### Files Created (12 new)
-- app/plugins/__init__.py, manifest.py, base.py, registry.py, migration_runner.py
-- app/plugins/builtins/__init__.py, test_sample.py, migrations/0001_test_plugin.sql, migrations/0001_bad_migration.sql
-- app/models/plugin.py, app/schemas/plugin.py, app/services/plugin_service.py, app/routes/plugins.py
-- alembic/versions/0003_plugin_system.py
-- tests/test_plugins.py (47 tests, 14 ACs + 33 unit tests)
-
-### Files Modified (8)
-- app/main.py (plugins router + registry init in lifespan)
-- app/models/__init__.py, app/routes/__init__.py, app/schemas/__init__.py, app/services/__init__.py
-- tests/conftest.py (plugin tables in TRUNCATE list)
-
-### Bugs Fixed by Subagent
-1. Unterminated f-string in registry.py
-2. Migration runner DB connection visibility (now uses session's own connection)
-3. Route unregistration by path match (FastAPI wraps routes differently)
-4. Dollar-quote SQL splitting (flush after closing $$)
-5. AC11 assertion type (dict vs string for HTTPException detail)
-
-### Verification (Orchestrator Independent)
-- pytest tests/test_plugins.py -v: 47/47 PASS
-- pytest tests/ -v: 103/103 PASS (zero regressions)
-- Coverage: 85.92% (manifest 100%, base 88%, registry 88%, migration_runner 79%)
-- Migration 0003 applied via alembic upgrade head
-- No forbidden patterns found
-- Pushed to Forgejo: 6bf0746..7a5a48f
-
-### Next: T07a (Frontend SPA Shell) ∥ T09 (KI-Copilot API) — parallel delegation
-
-## T09 — KI-Copilot API + Hybrid Workflow Engine Backend — COMPLETE ✅
-**Date**: 2026-06-29 02:46
-**Commit**: 14bd4e3 (pushed to Forgejo)
-**Tests**: 238/238 full suite pass (30 AC + 105 coverage + 103 existing)
-**Coverage**: 84.12% for T09 modules (target: 80% ✅)
-**Migration**: 0004_ai_workflows.py applied (5 tables with RLS)
-
-### Files Created (24 new)
-- app/models/ai_conversation.py, app/models/workflow.py
-- app/schemas/ai_copilot.py, app/schemas/workflow.py
-- app/ai/__init__.py, app/ai/llm_client.py, app/ai/action_mapper.py
-- app/services/ai_copilot_service.py (~500 lines), app/services/workflow_service.py (~675 lines)
-- app/routes/ai_copilot.py, app/routes/workflows.py
-- app/workflows/__init__.py, app/workflows/engine.py
-- app/workflows/code/__init__.py, app/workflows/code/onboarding.py
-- alembic/versions/0004_ai_workflows.py
-- tests/test_ai_copilot.py (67 tests), tests/test_workflows.py (68 tests)
-- test_report.md
-
-### Files Modified (7)
-- app/models/__init__.py, app/routes/__init__.py, app/schemas/__init__.py, app/services/__init__.py
-- app/main.py (added ai_copilot + workflows routers)
-- tests/conftest.py (added new tables to TRUNCATE + model imports)
-- app/core/event_bus.py (added workflow event handler registration)
-
-### Bugs Fixed
-1. MissingGreenlet on async lazy-load of updated_at/created_at — fixed with _safe_iso() and _get_attr() helpers
-2. _message_to_dict in ai_copilot_service.py — patched by orchestrator (m.created_at.isoformat() → _safe_iso(_get_attr(m, "created_at")))
-
-### Coverage Breakdown
-- app/workflows/engine.py: 0% → 90.00%
-- app/services/ai_copilot_service.py: 38.89% → 98.61%
-- app/ai/action_mapper.py: 43.44% → 96.72%
-- app/ai/llm_client.py: 64.62% → 81.54%
-- app/services/workflow_service.py: 62.54% → 75.95%
-- app/routes/workflows.py: 59.48% → 62.93%
-- app/routes/ai_copilot.py: 65% → 65.00%
-- **Overall: 45.37% → 84.12%** ✅
-
-### Verification (Orchestrator Independent)
-- pytest tests/: 238/238 PASS (zero regressions)
-- Migration 0004 applied via alembic upgrade head
-- RLS policies on all 5 new tables (ai_conversations, ai_messages, workflows, workflow_instances, workflow_step_history)
-- No forbidden patterns (.test TLD, SET LOCAL, raise HTTPException in middleware, POST without status_code)
-- POST action endpoints (query/execute/advance/cancel) correctly use 200 default
-- POST creation endpoints (workflows, instances) correctly use 201
-- Pushed to Forgejo: 7a5a48f..14bd4e3
-
-### Next: T07a (Frontend SPA Shell — React 18)
-
-## 2026-06-29 08:03 — T07a Complete
-- **Task**: T07a — Frontend Core SPA (Shell, Auth, Routing, i18n, UI Library, Accessibility)
-- **Commit**: 22976ab (pushed to Forgejo)
-- **Tests**: 111/111 passing (20 test files)
-- **tsc**: 0 errors
-- **Build**: Success (471KB JS, 24KB CSS gzipped)
-- **Files**: 66 files, 8598 insertions
-- **Fixes applied by orchestrator**: 
-  - Login form aria-label for role=form accessibility
-  - Avatar img alt="" to prevent duplicate role=img
-  - Avatar test null-safety with non-null assertion
-  - index.css border-border → border-secondary-200 (Tailwind class missing)
-  - .gitignore created to exclude node_modules/dist
-  - Remote URL fixed from agent-zero to Forgejo leocrm repo
-- **Subagent**: implementation_engineer (hit context cap at ~90%, orchestrator completed remaining fixes)
-
-## 2026-06-29 11:05 — T07b Complete
-- **Task**: T07b — Frontend Feature Pages
-- **Commit**: 700b7a7 (47 files, +4088 lines)
-- **Pushed**: Forgejo remote, HEAD=700b7a7
-- **Verification**: 141 tests pass, build success, tsc clean
-- **Deliverables**: 11 feature pages, 3 page updates, 13 routes, 12 test files, i18n updates, 7 shared components, 16 API hooks
-- **Subagents used**: 3 (implementation_engineer x2, a0-orchestrator-git x1)
-
-## 2026-06-29 20:50 — T04 Complete
-- **Task**: T04 — DMS Plugin Backend (Folders, Files, Preview, OnlyOffice, Share Links)
-- **Commit**: fdb41da (14 files, +3760 lines)
-- **Pushed**: Forgejo remote, HEAD=fdb41da
-- **Verification**: 106 DMS tests pass (27 AC + 38 error + 41 coverage), 97.90% coverage, 412 total tests pass (full regression), 0 ruff errors
-- **Deliverables**: DMS plugin dir (6 files), 3 test files, conftest fixture sharing, pyproject.toml coverage config fix (concurrency=greenlet)
-- **Subagents used**: 2 (implementation_engineer x2 — initial + coverage improvement)
-- **Key finding**: coverage.py needed `concurrency = ["greenlet"]` for Python 3.13 async tracking
-
-## 2026-06-29 14:05 — T11 Complete
-- **Task**: T11 — Tags Plugin + Permissions Plugin + Entity Links Backend
-- **Commit**: 5d18507 (26 files, +2863 lines)
-- **Pushed**: Forgejo remote, HEAD=5d18507
-- **Verification**: 68 tests pass, coverage 66.61% (dead code gaps explained)
-- **Deliverables**: 3 plugin dirs (tags, permissions, entity_links), 3 test files, migration_runner fix, builtins registration, conftest updates
-- **Subagents used**: 3 (implementation_engineer x3 — initial, fixes, coverage improvement)
-
-## 2026-06-30 01:15 — T05 Complete
-- **Task**: T05 — Calendar Plugin Backend (Appointments, Tasks, Kanban, ICS, Resources, Recurrence)
-- **Commit**: 7fbeeda (14 files, +3674 lines)
-- **Pushed**: Forgejo remote, HEAD=7fbeeda
-- **Verification**: 69 calendar tests pass (33 AC + 36 recurrence unit), 86.87% coverage, 481 total tests pass (full regression), 0 ruff errors
-- **Deliverables**: Calendar plugin dir (8 files: __init__.py, plugin.py, routes.py, models.py, schemas.py, recurrence.py, ics_utils.py, migrations/0001_initial.sql), 2 test files (test_calendar.py 1075 lines, test_recurrence_unit.py), conftest.py calendar fixtures, builtins/__init__.py registration
-- **Subagents used**: 2 (implementation_engineer x2 — initial implementation + 8 bug fixes)
-- **Key fixes**: MissingGreenlet (db.refresh after flush), CSV export route ordering, ICS token commit, recurrence midnight boundary, datetime.UTC deprecation
-
-## 2026-06-30 13:50 — T06: Test Fixes Complete
-- **11 test failures resolved** across all test suites
-- Input.tsx: added required={required} native attribute
-- Card.tsx: added ...rest spread for data-testid forwarding
-- CompanyForm.tsx + ContactForm.tsx: added noValidate to bypass native HTML5 validation in tests
-- Test files fixed: CompaniesList, CompanyDetail, CompanyForm, ContactsList, SettingsRoles
-- ARIA spec: aria-sort value corrected to 'ascending'
-- **Results:** 112/112 tests pass, tsc clean, vite build successful
-- **Commit:** e28d11f
-
-## 2026-07-01 15:41 — T06: Mail Plugin Backend Complete
-- **Mail Plugin implementiert:** 8 neue Dateien, 4667 Zeilen
-- **14 Models:** mail_accounts, mail_folders, mails, attachments, labels, rules, templates, signatures, vacation_sent_log, seen_by, delegates, send_permissions, pgp_keys, contact_pgp_keys
-- **Features:** IMAP sync, SMTP send/reply/forward, threading, templates, rules, vacation (dedup), PGP, shared mailboxes, delegates, send permissions, HTML sanitization, FTS search, contact linking, calendar event creation
-- **Tests:** 46/46 pass, 74.56% coverage
-- **Regression:** 527/527 pass (0 failures)
-- **Ruff:** 0 errors, format clean
-- **Commit:** f646c59
-- **Risks:** Coverage 74.56% (target 80%), ILIKE fallback instead of tsvector, ARQ worker not wired
-
-## 2026-07-01 16:54 — T08a: Frontend DMS + Tags + Permissions UI Complete
-- **18 neue Dateien, 6 modified** — 3368 Zeilen
-- **DMS:** File browser (folder tree + file grid), upload dropzone, preview modal, share dialog, bulk actions, trash view
-- **Tags:** TagPicker, TagCloud, BulkTagDialog — integriert in CompanyDetail + ContactDetail
-- **Permissions:** Share dialog, public share links, permission display
-- **API clients:** dms.ts, tags.ts, permissions.ts
-- **Routes:** /dms, /dms/trash
-- **i18n:** de.json + en.json translations
-- **Tests:** 33/33 new tests pass, full regression 276/276 pass
-- **tsc:** 0 errors, **vite build:** 252 modules, 3.31s
-- **Commit:** 0962f3a
-
-## 2026-07-01 20:44 — T08c: Frontend Mail UI + Global Search UI Complete
-- **16 neue Dateien, 5 modified** — 4313 Zeilen
-- **Mail UI:** 3-pane layout (folder tree + mail list + reading pane), compose modal (bold/italic/link/template), reply/forward, shared mailbox selector, attachment download, create-event-from-mail
-- **Mail Settings:** 6 tabs (accounts, signatures, rules, labels, vacation, PGP)
-- **Global Search:** Tabs for companies/contacts/mails/files/events
-- **API client:** mail.ts (all endpoints)
-- **Routes:** /mail, /mail/settings
-- **i18n:** de.json + en.json translations
-- **Tests:** 44/44 new tests pass, full regression 318/318 pass
-- **tsc:** 0 errors, **vite build:** 267 modules, 5.19s
-- **Commit:** 0070fb3
-
-## 2026-07-01 23:01 — T10: Monitoring, Performance, Documentation & Environment Config Complete
-- **Monitoring:** Prometheus metrics (http_requests_total, db_pool_connections, arq_jobs_total), structured JSON logging via structlog, extended health checks (DB, Redis, storage, worker)
-- **Metrics endpoint:** GET /api/v1/metrics (admin-only, text/plain Prometheus format, 403 for non-admin)
-- **Health endpoint:** Extended with database, redis, storage, worker checks — status healthy/degraded
-- **Performance:** Streaming CSV export for contacts and companies (StreamingResponse with own DB session), page_size max 100 enforced (422 for >100)
-- **Scripts:** seed_perf_data.py (--count N), check_indexes.py
-- **Documentation:** README.md updated (prod setup, API section, admin-guide link, env profiles), docs/admin-guide.md created, docs/api-overview.md created
-- **Config:** .env.example updated with SMTP, storage, secret_key vars; config.py extended with SMTP/storage/secret_key settings
-- **Dependencies:** prometheus-client, structlog added to requirements.txt
-- **Tests:** 38/38 pass (test_monitoring.py 17, test_performance.py 15, test_health.py 6) in 24.24s
-- **Ruff:** All checks passed
-- **Docs check:** README.md, docs/admin-guide.md, docs/api-overview.md all present
-
-## 2026-07-01 23:15 — T10: Monitoring, Performance, Documentation Complete
-- **8 new files, 8 modified** — 2250 lines
-- **Monitoring:** Extended health (DB+Redis+Storage+Worker), Prometheus metrics (admin-only), structured JSON logging (structlog)
-- **Performance:** page_size max 100 enforced, streaming CSV export, seed_perf_data.py script
-- **Docs:** admin-guide.md, api-overview.md, README updated, .env.example updated
-- **Tests:** 38 new tests pass, full regression 564/564 pass
-- **Ruff:** all checks passed
-- **Commit:** 69e91fd
-
-## 🎉 PHASE 3 COMPLETE — ALL 14 TASKS DONE

.a0proj/mcp_servers.json

@@ -0,0 +1,3 @@
+{
+    "mcpServers": {}
+}

.env

@@ -1,6 +0,0 @@
-DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
-REDIS_URL=redis://localhost:6379/0
-ENVIRONMENT=development
-LOG_LEVEL=INFO
-BCRYPT_ROUNDS=12
-CORS_ORIGINS=http://localhost:5173,http://localhost:3000

.env.docker.example

@@ -6,34 +6,58 @@
 #   cp .env.docker.example .env.docker
 #   $EDITOR .env.docker
 #   docker compose --env-file .env.docker up --build
+#
+# Variable names MUST match docker-compose.yaml ${VARIABLE} references.
 # =============================================================================
 
 # --- PostgreSQL (local container) ---------------------------------------------
 POSTGRES_USER=crm_user
 # Generate a strong password, e.g.:
 #   python -c "import secrets; print(secrets.token_urlsafe(24))"
-POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
+DB_PASSWORD=STRONG_PASSWORD_HERE
 POSTGRES_DB=crm_db
 
-# --- CRM Application ----------------------------------------------------------
-# The host "postgres" is the docker-compose service name (internal DNS).
-# The DRIVER is asyncpg for production PostgreSQL.
-DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
+# --- Redis (REQUIRED) ---------------------------------------------------------
+# Generate a strong password:
+#   python -c "import secrets; print(secrets.token_urlsafe(24))"
+REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE
 
-# --- AUTH_SECRET (REQUIRED, min 32 chars) ------------------------------------
-# JWT signing secret. MUST be at least 32 characters.
+# --- SECRET_KEY (REQUIRED, min 32 chars) -------------------------------------
+# Session signing secret. MUST be at least 32 characters.
 # Generate with:
 #   python -c "import secrets; print(secrets.token_urlsafe(48))"
-AUTH_SECRET=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
+SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
 
-# --- CORS / environment -------------------------------------------------------
-# Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
-# :5173 (e.g. Vite dev server). In production, restrict to the real domain.
-CORS_ORIGINS=http://localhost:8000,http://localhost:5173
+# --- Domain / Frontend URL ----------------------------------------------------
+# The public URL where users access the LeoCRM frontend.
+# Used for password reset links, invitations, CORS, etc.
+APP_DOMAIN=https://crm.example.com
+FRONTEND_URL=https://crm.example.com
+CORS_ORIGINS=https://crm.example.com
+
+# --- Environment --------------------------------------------------------------
 ENVIRONMENT=production
 LOG_LEVEL=INFO
+SESSION_COOKIE_SECURE=true
+STORAGE_PATH=/data/storage
 
-# --- JWT / bcrypt tuning (keep aligned with .env.example) ---------------------
-JWT_ALGORITHM=HS256
-JWT_EXPIRY_HOURS=24
+# --- SMTP (for password reset emails) -----------------------------------------
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USERNAME=noreply@example.com
+SMTP_PASSWORD=YOUR_SMTP_PASSWORD
+SMTP_FROM_EMAIL=noreply@example.com
+SMTP_USE_TLS=true
+
+# --- bcrypt tuning ----------------------------------------------------------
 BCRYPT_ROUNDS=12
+
+# --- Admin user (seeded on first start) --------------------------------------
+ADMIN_EMAIL=admin@example.com
+ADMIN_PASSWORD=CHANGE_ME_generate_a_strong_password
+
+# --- MAIL_ENCRYPTION_KEY (REQUIRED) -------------------------------------------
+# AES-256 encryption key for mail account passwords (Fernet).
+# Generate with:
+#   python -c "import secrets; print(secrets.token_urlsafe(32))"
+MAIL_ENCRYPTION_KEY=GENERATE_STRONG_KEY_HERE

.env.example

@@ -1,51 +1,101 @@
-# LeoCRM v1.0 - Environment Variables Template
+# LeoCRM - Environment Variables Template
+# Copy to .env and fill in real values.
 
-# === REQUIRED ===
-DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
-REDIS_URL=redis://localhost:6379/0
+# === COOLIFY DEPLOYMENT (required for scripts/deploy.py) ===
+# Coolify API token (required for deploy)
+COOLIFY_API_TOKEN=
+# Coolify base URL
+COOLIFY_BASE_URL=https://server.media-on.de
+# Application UUID (optional — resolved via API lookup by APP_NAME if absent)
+COOLIFY_APP_UUID=
+# Worker Service UUID (optional — resolved via API lookup by WORKER_NAME if absent)
+COOLIFY_WORKER_UUID=
+# Application name for API lookup
+APP_NAME=leocrm
+# Worker name for API lookup
+WORKER_NAME=leocrm-worker
+# App domain (required for deploy, used for health check and FQDN)
+APP_DOMAIN=https://crm.media-on.de
 
-# === OPTIONAL (with defaults) ===
+# === COOLIFY INITIAL DEPLOY (only needed for --initial) ===
+# Coolify project UUID
+COOLIFY_PROJECT_UUID=
+# Coolify server UUID
+COOLIFY_SERVER_UUID=
+# Coolify private key UUID (for Git deploy key)
+COOLIFY_PRIVATE_KEY_UUID=
+# Coolify environment name
+COOLIFY_ENVIRONMENT=production
 
+# === DATABASE (required) ===
+# Single password for all DB roles (crm_user, crm_api, crm_auth, crm_worker, crm_migration)
+DB_PASSWORD=
+# Database name
+POSTGRES_DB=crm_db
+# Database user (superuser/owner)
+POSTGRES_USER=crm_user
+# Database host (container name in Docker network)
+DB_HOST=postgres
+# Full database URLs (constructed from DB_PASSWORD/DB_HOST if not set explicitly)
+DATABASE_URL=postgresql+asyncpg://crm_api:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB}
+AUTH_DATABASE_URL=postgresql+asyncpg://crm_auth:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB}
+WORKER_DATABASE_URL=postgresql+asyncpg://crm_worker:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB}
+MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_user:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB}
+
+# === REDIS (required) ===
+REDIS_PASSWORD=
+REDIS_HOST=redis
+REDIS_URL=redis://default:${REDIS_PASSWORD}@redis:6379/0
+
+# === SECURITY (required) ===
+# Secret key for signing, sessions (use a secure random string >= 32 chars)
+SECRET_KEY=
+
+# === SSH VERIFICATION (optional, deploy.py verification only) ===
+SSH_KEY=/a0/usr/workdir/.ssh/coolify-01-root
+SERVER_IP=46.225.91.159
+# Login test credentials (optional, for deploy verification)
+LOGIN_EMAIL=
+LOGIN_PASSWORD=
+
+# === APPLICATION ===
 # Environment: development | production | testing
-ENVIRONMENT=development
-
+ENVIRONMENT=production
 # Log level: DEBUG | INFO | WARNING | ERROR
 LOG_LEVEL=INFO
-
-# Database pool
-DB_POOL_SIZE=10
-DB_MAX_OVERFLOW=20
-DB_ECHO=false
-
-# Session settings
-SESSION_TTL_SECONDS=28800
-SESSION_COOKIE_NAME=leocrm_session
-SESSION_COOKIE_SECURE=false
-SESSION_COOKIE_SAMESITE=strict
-SESSION_COOKIE_HTTPONLY=true
-
-# Password hashing
-BCRYPT_ROUNDS=12
-PASSWORD_RESET_EXPIRY_HOURS=1
-
 # CORS allowed origins (comma-separated, NO wildcards)
-CORS_ORIGINS=http://localhost:5173,http://localhost:3000
+CORS_ORIGINS=https://crm.media-on.de
+# Frontend URL
+FRONTEND_URL=https://crm.media-on.de
+# Session cookie secure (true in production)
+SESSION_COOKIE_SECURE=true
 
-# Secret Key (for signing, sessions — use a secure random string ≥32 chars in prod)
-SECRET_KEY=change-me-in-production-use-a-secure-random-string
+# === DOCKER COMPOSE (optional overrides) ===
+# Traefik host
+APP_HOST=crm.media-on.de
+APP_PORT=8000
 
-# Storage (file uploads, DMS)
-STORAGE_PATH=/tmp
+# === STORAGE ===
+STORAGE_PATH=/data/storage
+# Storage backend: local (default) or s3
+STORAGE_BACKEND=local
+# S3-compatible storage (when STORAGE_BACKEND=s3)
+S3_ENDPOINT=
+S3_BUCKET=
+S3_ACCESS_KEY=
+S3_SECRET_KEY=
+S3_REGION=us-east-1
+S3_SECURE=true
 
-# SMTP / Email
+# === SMTP / EMAIL ===
 SMTP_HOST=localhost
 SMTP_PORT=587
 SMTP_USERNAME=
 SMTP_PASSWORD=
-SMTP_FROM_EMAIL=noreply@leocrm.local
+SMTP_FROM_EMAIL=no-reply@localhost
 SMTP_USE_TLS=true
 
-# Rate limiting
+# === RATE LIMITING ===
 RATE_LIMIT_LOGIN_MAX=5
 RATE_LIMIT_LOGIN_WINDOW=900
 RATE_LIMIT_RESET_MAX=3
@@ -55,10 +105,33 @@ RATE_LIMIT_RESET_CONFIRM_WINDOW=3600
 RATE_LIMIT_GENERAL_MAX=60
 RATE_LIMIT_GENERAL_WINDOW=60
 
-# === AI / Search ===
-# Ollama Cloud API Key (für LiteLLM)
+# === DATABASE POOL ===
+DB_POOL_SIZE=10
+DB_MAX_OVERFLOW=20
+DB_ECHO=false
+
+# === SESSION ===
+SESSION_TTL_SECONDS=28800
+SESSION_COOKIE_NAME=leocrm_session
+SESSION_COOKIE_SAMESITE=strict
+SESSION_COOKIE_HTTPONLY=true
+
+# === PASSWORD HASHING ===
+BCRYPT_ROUNDS=12
+PASSWORD_RESET_EXPIRY_HOURS=1
+
+# === AI / SEARCH ===
+# Ollama Cloud API Key (for LiteLLM)
 API_KEY_OLLAMA_CLOUD=
-# Embedding Modell (default: ollama/nomic-embed-text)
+# Embedding model (default: ollama/nomic-embed-text)
 SEARCH_EMBEDDING_MODEL=ollama/nomic-embed-text
-# LLM Modell für Query Understanding (default: ollama/deepseek-v4)
+# LLM model for query understanding (default: ollama/deepseek-v4)
 SEARCH_LLM_MODEL=ollama/deepseek-v4
+
+# === GIT (for initial deployment) ===
+API_GIT_REPO=https://forgejo.media-on.de/Leopoldadmin/leocrm.git
+API_GIT_BRANCH=main
+
+# === Admin User (auto-seeded on first start) ===
+ADMIN_EMAIL=admin@media-on.de
+ADMIN_PASSWORD=CHANGE_ME_generate_a_strong_password

.forgejo/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install Python deps
+        run: pip install -r requirements.txt
+      - name: Install Frontend deps
+        run: cd frontend && npm ci --legacy-peer-deps
+      - name: Run CI/CD Pipeline
+        run: bash scripts/ci_pipeline.sh

.github/workflows/check-cross-plugin-imports.yml

@@ -0,0 +1,25 @@
+# CI/CD: Check for forbidden cross-plugin imports on every push/PR
+
+name: Check Cross-Plugin Imports
+
+on:
+  push:
+    paths:
+      - 'app/plugins/**'
+      - 'scripts/check_cross_plugin_imports.py'
+  pull_request:
+    paths:
+      - 'app/plugins/**'
+      - 'scripts/check_cross_plugin_imports.py'
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Check cross-plugin imports
+        run: python scripts/check_cross_plugin_imports.py

.gitignore

@@ -11,23 +11,46 @@ __pycache__/
 *.so
 *.egg-info/
 .eggs/
-build/
-dist/
+/build/
+/dist/
 *.egg
 
 # Virtual environments
 .venv/
-venv/
-env/
-ENV/
+/venv/
+/env/
+/ENV/
 
 # Test and coverage
 .pytest_cache/
 .coverage
 .coverage.*
-htmlcov/
+/htmlcov/
 coverage.xml
 .mypy_cache/
+
+# Redis dump
+*.rdb
+dump.rdb
+
+# Frontend build output (regenerated on deploy)
+frontend/dist/
+frontend/node_modules/
+node_modules/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+/logs/
 .ruff_cache/
 
 # Database files
@@ -35,32 +58,10 @@ coverage.xml
 *.db-journal
 *.db-wal
 *.db-shm
-data/
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-.DS_Store
-
-# Logs
-*.log
-logs/
+/data/
 
 # Alembic (autogenerated migrations excluded, but keep 0001)
 alembic/versions/__pycache__/
 
-# Frontend build artifacts (Phase 4c)
-webui/node_modules/
-webui/dist/
-
 # Docker
 .docker-data/
-
-# Test artifacts
-.pytest_cache/
-.coverage
-.coverage.*
-htmlcov/

.pre-commit-cross-plugin.yaml

@@ -0,0 +1,14 @@
+# Pre-commit hook: Check for forbidden cross-plugin imports
+# Install: pip install pre-commit && pre-commit install
+# Or run manually: python scripts/check_cross_plugin_imports.py
+
+repos:
+  - repo: local
+    hooks:
+      - id: check-cross-plugin-imports
+        name: Check cross-plugin imports
+        entry: python scripts/check_cross_plugin_imports.py
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [commit]

AGENTS.md

@@ -1,571 +1,342 @@
 # LeoCRM — AGENTS.md
 
-**Projekt:** leocrm
-**Erstellt:** 2026-06-28
-**Status:** Draft — ready for implementation
+**Projekt:** leocrm | **Stack:** FastAPI + SQLAlchemy + PostgreSQL 16 (pgvector) + React/TypeScript/Vite/Tailwind
+
+---
+
+## 0. BINDENDE REGEL: Auf bestehendem Code aufbauen (NICHT VERHANDELBAR)
+
+### 0.0 Sub-Agents / Subordinates — Nuancierte Regel
+
+**Sub-Agents (call_subordinate) nur für einfache Jobs verwenden.**
+
+- Einfache Jobs: Research, Codebase-Exploration, Dokumentations-Zusammenfassung — Aufgaben ohne Code-Änderungen oder Schema-Migrationen.
+- Komplexe Jobs (Code-Änderungen, Tests, Migrationen, Deployments): vom Haupt-Agent selbst ausführen.
+- Wenn der User sagt "keine Sub-Agents verwenden": daran halten, keine Ausnahmen.
+- Sub-Agents haben in der Vergangenheit Code geschrieben der nicht gegen Produktion verifiziert wurde, Schema-Drifts verursacht und nicht getestet hat. Qualitätssicherung bleibt beim Haupt-Agent.
+
+**Gültig für jegliche Arbeit an diesem Projekt.**
+
+### 0.1 Pflicht zur Analyse vor Implementierung
+
+Der Agent MUSS vor jeder Implementierung das bestehende System analysieren:
+
+1. **Backend lesen:** Welche Models, Routes, Services, Plugins, Contracts, Hooks, ARQ-Jobs existieren bereits für den betroffenen Bereich? Der Agent greppt und liest die relevanten Dateien BEVOR er Code schreibt.
+2. **Frontend lesen:** Welche Pages, Components, Stores, Hooks, API-Clients, Block-Typen, Sidebar-Tabs existieren bereits für den betroffenen Bereich? Der Agent greppt und liest die relevanten Dateien BEVOR er Code schreibt.
+3. **Datenbank lesen:** Welche Tabellen, Foreign Keys, RLS-Policies, Migrationen existieren bereits? Der Agent prüft `alembic/versions/` und die Produktions-DB BEVOR er neue Migrationen schreibt.
+4. **Plugin-System lesen:** Welche Contracts, Manifests, Search Provider, Tools, Hooks existieren bereits in den betroffenen Plugins? Der Agent liest `plugin.py`, `contracts.py`, `manifest.py` BEVOR er neue Plugins oder Erweiterungen baut.
+
+### 0.2 Pflicht zum Aufbau auf bestehendem Code
+
+Der Agent MUSS auf bestehendem Code aufbauen. Es ist VERBOTEN:
+
+- ❌ Parallele Systeme zu bauen die vorhandene Funktionalität duplizieren (z.B. ein separates Workstream-System wenn das `kommunikation` Plugin schon Conversations, Messages, Blocks, WebSocket hat)
+- ❌ Neue Frontend-Pages zu bauen wenn vorhandene Pages die Funktion aufnehmen können (z.B. Dashboard, Communication, AgentDashboard, Workflows, Wiki, Settings)
+- ❌ Neue Sidebars oder Panels zu bauen wenn die AISidebar (5 Tabs) oder MessageSidebar die Funktion aufnehmen können
+- ❌ Neue Stores zu bauen wenn vorhandene Stores (commStore, uiStore, authStore, etc.) die Funktion aufnehmen können
+- ❌ Neue API-Clients zu bauen wenn vorhandene API-Clients (api/comm.ts, api/ai.ts, api/automation.ts, etc.) die Funktion abdecken können
+- ❌ Neue Block-Typen zu bauen wenn vorhandene Block-Typen (action_card, contact_card, miniapp, etc.) die Funktion abdecken können
+- ❌ Dataclasses zu schreiben wenn echte SQLAlchemy Models + FastAPI Routes die richtige Lösung sind
+- ❌ Mock-Tests zu schreiben wenn echte Integration-Tests mit der Test-DB möglich sind
+- ❌ Module zu bauen die 0 Referenzen aus Routes/Plugins haben (unverbundener Code)
+- ❌ Tasks als "done" zu markieren ohne echte Verifizierung (curl gegen echte API, grep-Beweis für Import-Verbindungen, tsc clean, Backend import OK)
+
+### 0.3 Pflicht zur Verbindung
+
+Jeder neue Code MUSS mit dem bestehenden System verbunden werden:
+
+- **Backend:** Neue Module müssen in `app/main.py` oder in Plugin `routes.py` registriert werden. Neue Models müssen in `alembic/versions/` migriert werden. Neue Tools müssen im `tool_registry` registriert werden. Neue Hooks müssen in `plugin.py on_activate` registriert werden. Neue ARQ-Jobs müssen in `worker.py` registriert werden.
+- **Frontend:** Neue Components müssen in vorhandene Pages integriert werden (nicht als neue Page). Neue API-Calls müssen vorhandene API-Clients nutzen oder erweitern. Neue Block-Typen müssen im `BlockRenderer.tsx` registriert werden. Neue Sidebar-Tabs müssen in der `AISidebar.tsx` registriert werden.
+- **Verifizierung:** Der Agent beweist mit grep dass neue Module importiert/referenziert werden. Der Agent beweist mit curl/pytest dass die API funktioniert. Der Agent markiert nichts als "done" ohne diese Beweise.
+
+### 0.4 Referenz-Architektur (was existiert und genutzt werden MUSS)
+
+**Frontend-Struktur:**
+- `AISidebar.tsx` — 5 Tabs: chat (KI Chat), proactive (Live KI/Suggestions), notifications, team, chatroom (Communication)
+- `MessageSidebar.tsx` (671 Zeilen) — voller Chat mit Conversations, Messages, WebSocket, BlockRenderer
+- `Communication.tsx` (859 Zeilen) — volle Chat-Seite mit Conversations (system/ai/colleague), Messages, Blocks, Pin/Unpin, Read
+- `comm/blocks/` — 10 Block-Typen: text, markdown, html, image, audio, video, file, action_card, contact_card, miniapp
+- `BlockRenderer.tsx` — rendert alle Block-Typen
+- `Dashboard.tsx` — StatCards, ActivityFeed, DashboardGrid mit Widgets
+- `AgentDashboard.tsx` — Agent CRUD, Execute, Test Run, Versions, Restore, Tools, Send Message
+- `Workflows.tsx` — Workflow CRUD, Instances, Editor, Step Config
+- `Wiki.tsx` — Categories, Articles, Markdown Editor, Version History, Restore
+- `components/knowledge/` — AskKnowledge.tsx, KnowledgeGraph.tsx
+- `components/onboarding/` — OnboardingTour.tsx, WelcomeDialog.tsx
+- `components/agents/` — AgentChat, AgentEditor, AgentMonitor, AgentRunLog
+- `components/workflows/` — StepConfigPanel, WorkflowEditor, WorkflowInstanceList, WorkflowInstanceDetail
+- `components/dashboard/` — DashboardGrid, RecentContactsWidget, TasksSummaryWidget, CalendarUpcomingWidget
+- `store/commStore.ts` — Conversation, Message, MessageBlock, MessageAttachment, Participant
+- `store/uiStore.ts` — aiSidebarCollapsed, aiSidebarTab, notifications
+- `api/comm.ts` — listConversations, getMessages, sendMessage, markRead, createConversation
+- `api/ai.ts` — createSession, fetchSessions, streamChat, fetchAgents
+- `api/automation.ts` — useAgents, useCreateAgent, useUpdateAgent, useDeleteAgent, useExecuteAgent, useTestRunAgent, useAgentRuns, useAgentVersions, useRestoreAgentVersion, useAgentTools, useSendAgentMessage
+- `api/workflows.ts` — useWorkflows, useDeleteWorkflow, useUpdateWorkflow
+- `api/knowledge.ts` — createWikiArticle, deleteWikiArticle, fetchWikiArticle, fetchWikiCategories, fetchWikiVersions, restoreWikiVersion, updateWikiArticle
+
+**Backend-Struktur:**
+- `kommunikation` Plugin — CommConversation, CommParticipant, CommMessage, CommMessageBlock, WebSocket, Contracts, MiniAppRegistry
+- `automation` Plugin — AgentDefinition, AgentRun, AgentRunStep, Triggers, Schedules, Pre-built Agents
+- `unified_search` Plugin — 14 Search Provider, Hybrid Search, Embeddings
+- `graph_rag` Plugin — Knowledge Graph, Relationships, Entities
+- `wiki` Plugin — WikiArticle, WikiCategory, WikiArticleVersion, Entity Links
+- `ai_assistant` Plugin — Tool Registry, CRM API Tool, AI Chat
+- `ai_proactive` Plugin — Proactive Suggestions, Context Tools
+- `agent_memory` Plugin — Agent Memory with Embeddings
+- `permissions` Plugin — ABAC/RBAC, Entity Permissions, Share Links
+- `app/ai/` — agent_loop.py, agent_runner.py, llm_client.py, context_builder.py, agent_permissions.py, agent_tools.py, data_policy.py, transparency.py, oversight.py, agent_stream.py, skill_registry.py, ai_use_case.py
+- `app/workflows/` — engine.py, step_handlers.py, decision_guard.py
+- `app/core/` — approval.py, hooks.py, outbox.py, worker.py, storage.py, monitoring.py, notifications.py
+- `app/routes/` — 468 API Routes über alle Plugins und Core-Module
+
+**Datenbank:**
+- 130 Tabellen, 159 Foreign Keys, 590 Indexes
+- 114 Tabellen mit RLS (Row Level Security)
+- 130 Alembic Migrationen (Head: 0130)
+- `set_tenant_context()` setzt `app.current_tenant_id` für RLS
+
+### 0.5 Konsequenzen bei Verstoss
+
+Wenn der Agent gegen diese Regel verstösst:
+1. Der Code wird nicht akzeptiert
+2. Der Agent muss den Code löschen und auf bestehendem Code neu aufbauen
+3. Der Agent muss den Verstoß dokumentieren und erklären warum er die Regel ignoriert hat
+4. Der Agent muss PROVE dass der neue Code mit grep-imports verbunden ist BEVOR er als done markiert wird
 
 ---
 
 ## 1. Build & Test Commands
 
-### Backend (Python / FastAPI)
-
-#### Setup
 ```bash
-cd backend
-python -m venv .venv
-source .venv/bin/activate
-pip install -e ".[dev]"
-```
-
-#### Run Dev Server
-```bash
-cd backend
+# Backend
 uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-#### Database Migrations (Alembic)
-```bash
-cd backend
-# Generate migration after model changes
-alembic revision --autogenerate -m "description"
-# Apply migrations
-alembic upgrade head
-# Rollback one migration
-alembic downgrade -1
-```
-
-#### Run All Backend Tests
-```bash
-cd backend
 python -m pytest -v --tb=short
-```
-
-#### Run Specific Test File
-```bash
-cd backend
 python -m pytest tests/test_auth.py -v --tb=short
-```
+alembic upgrade head
+alembic revision --autogenerate -m "description"
 
-#### Run Tests with Coverage
-```bash
-cd backend
-python -m pytest --cov=app --cov-report=term-missing --cov-report=html
-```
+# Frontend
+cd frontend && npm run dev
+cd frontend && npm run build
+cd frontend && npx vitest run --reporter=verbose
+cd frontend && npx tsc --noEmit
 
-#### Run Tests with Grep Filter
-```bash
-cd backend
-python -m pytest -k 'tenant or auth' -v
-```
-
-#### Type Checking
-```bash
-cd backend
-mypy app/ --ignore-missing-imports
-```
-
-#### Linting
-```bash
-cd backend
-ruff check app/
-ruff format app/
-```
-
-### Frontend (React / Vite / TypeScript)
-
-#### Setup
-```bash
-cd frontend
-npm install
-```
-
-#### Run Dev Server
-```bash
-cd frontend
-npm run dev
-```
-
-#### Build Production
-```bash
-cd frontend
-npm run build
-```
-
-#### Run All Frontend Tests
-```bash
-cd frontend
-npx vitest run --reporter=verbose
-```
-
-#### Run Tests with Coverage
-```bash
-cd frontend
-npx vitest run --coverage
-```
-
-#### Run Tests in Watch Mode (dev)
-```bash
-cd frontend
-npx vitest watch
-```
-
-#### Type Checking
-```bash
-cd frontend
-npx tsc --noEmit
-```
-
-#### Linting
-```bash
-cd frontend
-npx eslint src/ --ext .ts,.tsx
-```
-
-### Docker Compose (Full Stack)
-
-#### Build All Services
-```bash
-docker compose build
-```
-
-#### Start All Services
-```bash
+# Docker
 docker compose up -d
-```
-
-#### View Logs
-```bash
 docker compose logs -f backend
 ```
 
-#### Stop All Services
-```bash
-docker compose down
-```
-
-#### Validate Compose Config
-```bash
-docker compose config --quiet
-```
-
-### E2E Tests (Playwright)
-
-```bash
-cd e2e
-npx playwright install
-npx playwright test
-```
-
 ---
 
 ## 2. Test Rules
 
-### TDD (Test-Driven Development)
-
-- **Red-Green-Refactor:** Write failing test first → implement minimum code to pass → refactor.
-- **Every new endpoint gets a test BEFORE implementation.**
-- **Every bug fix starts with a reproduction test.**
-
-### Coverage Targets
-
-| Layer | Coverage Target | Measured By |
-|-------|----------------|-------------|
-| Backend Core (app/core/) | 85% | pytest-cov |
-| Backend Models+Services | 85% | pytest-cov |
-| Backend Routes | 85% | pytest-cov |
-| Backend Plugins | 80% | pytest-cov |
-| Frontend Components | 75% | vitest coverage |
-| Frontend Plugin UI | 70% | vitest coverage |
-| E2E (critical paths) | 100% of defined specs | Playwright |
-
-### Test File Structure
-
-#### Backend
-```
-backend/tests/
-├── conftest.py              — Fixtures: test client, test DB, auth helpers, seed data
-├── test_auth.py             — Auth endpoints, RBAC, password reset
-├── test_tenant.py           — Tenant isolation, cross-tenant access
-├── test_companies.py        — Company CRUD, search, filter, pagination, soft-delete
-├── test_contacts.py         — Contact CRUD, N:M links, GDPR delete
-├── test_import_export.py   — CSV import/export, XLSX export, dry-run preview
-├── test_plugins.py          — Plugin lifecycle, event bus, migrations
-├── test_dms.py             — DMS folders, files, upload, shares, permissions
-├── test_calendar.py        — Entries, recurrence, kanban, ICS, resources
-├── test_mail.py            — Accounts, IMAP sync, send, threading, rules, PGP
-├── test_tags.py            — Tag CRUD, assignment, bulk
-├── test_notifications.py   — Notification CRUD, unread count
-├── test_health.py          — Health endpoint
-├── test_ai_copilot.py      — KI-Copilot API, RBAC enforcement, history
-├── test_workflows.py       — Workflow CRUD, instances, approval/rejection, event triggers
-├── test_monitoring.py     — Extended health, Prometheus metrics, alerting
-└── test_performance.py    — 200k seed, list <500ms, FTS <500ms, streaming export
-```
-
-#### Frontend
-```
-frontend/src/__tests__/
-├── components/             — UI component unit tests (Button, Input, Modal, Table, etc.)
-├── features/               — Feature integration tests (CompanyList, ContactForm, etc.)
-├── hooks/                 — Custom hook tests (useDebounce, usePagination, etc.)
-├── plugins/               — Plugin UI tests (DMS, Calendar, Mail, Tags)
-└── search/                — Global search tests
-```
-
-#### E2E
-```
-e2e/
-├── auth.spec.ts            — Login → logout flow
-├── company-crud.spec.ts    — Create → edit → delete company
-├── contact-crud.spec.ts    — Create → link to company → delete
-├── search.spec.ts          — Global search
-└── plugin-toggle.spec.ts   — Activate/deactivate plugin
-```
-
-### Test Conventions
-
-- **Test names:** `test_<action>_<condition>_<expected_result>` (e.g., `test_login_with_invalid_credentials_returns_401`)
-- **Test structure:** Arrange → Act → Assert (AAA pattern)
-- **Fixtures:** Use `conftest.py` for shared fixtures. No fixture duplication across files.
-- **Test DB:** Use in-memory or ephemeral PostgreSQL (via testcontainers or pytest-postgresql). NEVER test against production DB.
-- **Mocking:** Mock external services (SMTP, IMAP, OnlyOffice) in tests. Use `unittest.mock.AsyncMock` for async mocks.
-- **Assertions:** Use pytest's native `assert` for backend, `expect()` from `@testing-library/jest-dom` for frontend.
-- **No flaky tests:** Tests must be deterministic. Use explicit waits, not sleeps.
-- **Test isolation:** Each test must be independent. No test depends on another test's side effects.
-
-### Don't Modify Tests Rule
-
-- **NEVER modify existing tests to make them pass.** If a test fails, fix the code, not the test.
-- **Exception:** If the test itself is wrong (testing incorrect behavior), document why and get approval before changing.
-- **Test files are owned by the QA process, not the implementer.**
+- TDD: failing test first → implement → refactor
+- NEVER modify tests to make them pass — fix the code
+- Test DB: ephemeral PostgreSQL, NEVER production DB
+- Mock external services (SMTP, IMAP, OnlyOffice) with AsyncMock
+- Tests must be deterministic and isolated
 
 ---
 
-## 3. Conventions
+## 3. Code Conventions
 
-### Backend Structure
+### Backend
+- Async first: all routes/services `async def`
+- UUID primary keys only, never integer auto-increment
+- TIMESTAMPTZ only, never naive datetime
+- Soft-delete via `deleted_at IS NULL`; hard-delete only with `?gdpr=true`
+- Pydantic schemas validate input, never validate in routes
+- All mutations create audit log entries
+- snake_case files/functions, PascalCase classes
+- Schemas: `<Entity>Create`, `<Entity>Update`, `<Entity>Read`
 
-```
-backend/app/
-├── main.py                 — FastAPI app entry point, lifespan, middleware registration
-├── config.py               — Pydantic Settings (reads from env vars)
-├── deps.py                 — FastAPI dependency injection (auth, db, tenant, permissions)
-├── core/                   — Core infrastructure (cross-cutting concerns)
-│   ├── db/                 — SQLAlchemy engine, session factory, base model
-│   ├── tenant.py           — TenantMixin, ORM auto-filter, tenant context
-│   ├── auth.py             — Session auth, password hashing (bcrypt), RBAC
-│   ├── event_bus.py        — Async in-process event bus
-│   ├── service_container.py — DI container
-│   ├── storage.py          — File storage (local/S3)
-│   ├── cache.py            — Redis cache wrapper
-│   ├── jobs.py             — ARQ job queue integration
-│   ├── notifications.py    — Notification service
-│   └── audit.py            — Audit log middleware
-├── models/                 — SQLAlchemy ORM models (one file per domain)
-├── schemas/                — Pydantic schemas (request/response, one file per domain)
-├── services/               — Business logic (one file per domain)
-├── routes/                  — FastAPI routers (one file per domain)
-├── plugins/                — Plugin system
-│   ├── registry.py         — Plugin discovery, registration
-│   ├── manifest.py         — Plugin manifest Pydantic schema
-│   ├── lifecycle.py        — Install/activate/deactivate/uninstall
-│   ├── migrations.py       — Plugin DB migration runner
-│   ├── ui_registry.py      — Plugin UI component registration
-│   └── builtins/           — Built-in plugins
-│       ├── dms/            — DMS plugin
-│       ├── calendar/       — Calendar plugin
-│       ├── mail/           — Mail plugin
-│       └── tags/           — Tags plugin
-└── utils/                  — Shared utilities (validation, export, import)
-```
+### Frontend
+- TypeScript strict, no `any`
+- Functional components only, no class components
+- TanStack Query for server state, Zustand for client state only
+- React Hook Form + Zod for all forms
+- Tailwind utility classes, no inline styles
+- i18n via `t()` from react-i18next, no hardcoded strings
+- ARIA attributes on all interactive elements, 44px touch targets
+- PascalCase.tsx for components, camelCase.ts for utilities
 
-### Backend Naming Conventions
-
-- **Files:** `snake_case.py` (e.g., `company_service.py`)
-- **Classes:** `PascalCase` (e.g., `CompanyService`, `CompanyModel`)
-- **Functions/Methods:** `snake_case` (e.g., `get_company_by_id`)
-- **Constants:** `UPPER_SNAKE_CASE` (e.g., `SESSION_TIMEOUT_HOURS`)
-- **Models:** `<Entity>Model` suffix or just `<Entity>` (e.g., `Company`, `Contact`)
-- **Schemas:** `<Entity>Create`, `<Entity>Update`, `<Entity>Read`, `<Entity>List` (Pydantic)
-- **Services:** `<Entity>Service` (e.g., `CompanyService`)
-- **Routers:** `<entity>_router` variable, file name `<entity>_router.py`
-- **Tests:** `test_<domain>.py` (e.g., `test_companies.py`)
-
-### Backend Code Conventions
-
-- **Async first:** All route handlers and service methods are `async def`.
-- **Type hints:** All function signatures have type hints (Python 3.12+ syntax).
-- **Docstrings:** All public functions/classes have docstrings (Google style).
-- **Error handling:** Use FastAPI `HTTPException` with proper status codes. Never raise generic `Exception`.
-- **Validation:** Pydantic schemas validate input. Never validate in routes directly.
-- **Tenant scoping:** Never query without tenant filter (ORM auto-filter handles this, but be aware).
-- **UUID:** All IDs are UUID. Never use integer auto-increment.
-- **Timestamps:** All datetime fields are `TIMESTAMPTZ`. Never use naive datetime.
-- **Soft-delete:** Use `deleted_at IS NULL` filter. Never hard-delete without explicit `gdpr=true` flag.
-- **Audit:** All mutations must create audit log entries. Use the audit middleware/decorator.
-
-### Frontend Structure
-
-```
-frontend/src/
-├── main.tsx               — React entry point
-├── App.tsx                — Root component, router, providers
-├── api/                   — API client (axios), interceptors, endpoint definitions
-├── components/            — Shared UI components
-│   ├── layout/            — Shell, Sidebar, TopBar, ContentArea
-│   ├── ui/               — Button, Input, Select, Modal, Toast, Table, Card, Badge, Avatar
-│   └── shared/           — EmptyState, LoadingState, ConfirmDialog, Pagination, Skeleton
-├── features/              — Feature modules (one folder per feature)
-│   ├── auth/             — Login, PasswordReset
-│   ├── companies/        — CompanyList, CompanyDetail, CompanyForm
-│   ├── contacts/         — ContactList, ContactDetail, ContactForm
-│   ├── settings/         — SettingsTree, ProfileSettings, RoleEditor
-│   ├── audit/            — AuditLog
-│   ├── dashboard/        — Dashboard
-│   └── search/           — GlobalSearch
-├── plugins/              — Plugin UI loading framework
-│   ├── PluginRegistry.tsx — Fetch manifests, register components
-│   └── PluginLoader.tsx   — Dynamic lazy-loading of plugin components
-├── hooks/                 — Custom React hooks (useDebounce, usePagination, useAuth, etc.)
-├── store/                 — Zustand stores (useAuthStore, useUIStore, useTenantStore)
-├── i18n/                  — react-i18next setup + locale files (de.json, en.json)
-├── styles/                — Global CSS, design tokens (Tailwind config), accessibility
-└── utils/                 — Utilities (format, validation, export, constants)
-```
-
-### Frontend Naming Conventions
-
-- **Files:** `PascalCase.tsx` for components (e.g., `CompanyList.tsx`), `camelCase.ts` for utilities (e.g., `apiClient.ts`)
-- **Components:** `PascalCase` (e.g., `CompanyList`, `ContactForm`)
-- **Hooks:** `use<Feature>` (e.g., `useDebounce`, `useAuth`)
-- **Stores:** `use<Domain>Store` (e.g., `useAuthStore`, `useUIStore`)
-- **Types/Interfaces:** `PascalCase` (e.g., `CompanyData`, `ContactFormValues`)
-- **API functions:** `camelCase` (e.g., `getCompanies`, `createContact`)
-- **Test files:** `<Component>.test.tsx` next to component or in `__tests__/` mirror
-
-### Frontend Code Conventions
-
-- **TypeScript strict:** `strict: true` in tsconfig.json. No `any` types.
-- **Functional components:** Only function components, no class components.
-- **Hooks:** Custom hooks for reusable logic. No inline hooks in JSX.
-- **TanStack Query:** Server state via `useQuery` / `useMutation`. No manual fetch in components.
-- **Zustand:** Client state only (UI toggles, theme, active tenant). No server data in Zustand.
-- **React Hook Form + Zod:** All forms use `react-hook-form` with `zodResolver`.
-- **Tailwind CSS:** No custom CSS files (except global + accessibility). Use Tailwind utility classes.
-- **i18n:** All user-visible strings go through `t()` from `react-i18next`. No hardcoded strings.
-- **Accessibility:** ARIA attributes on all interactive elements. 44px touch targets. Keyboard navigation.
-- **Lazy loading:** Plugin components use `React.lazy()` with `Suspense` boundaries.
-
-### Git Conventions
-
-- **Branch naming:** `feature/T01-core-infrastructure`, `fix/auth-tenant-isolation`, `hotfix/critical-bug`
-- **Commit messages:** Conventional Commits format:
-  - `feat(core): implement auth system with session-based login`
-  - `fix(dms): resolve folder permission bypass on move`
-  - `test(mail): add IMAP sync integration tests`
-  - `refactor(calendar): extract recurrence engine to separate module`
-  - `docs(architecture): update ADR-03 with plugin lifecycle details`
-- **PR titles:** `[T01] Core Infrastructure + Multi-Tenant + Auth System`
-- **Branch from:** `main` (or feature branch for sub-features)
-- **Merge strategy:** Squash merge to `main` after review + CI passes
+### Git
+- Conventional Commits: `feat(core): ...`, `fix(dms): ...`
+- Squash merge to main after review
 
 ---
 
-## 4. Task-Zuweisung (Subagenten pro Task)
+## 4. Forbidden Patterns
 
-### Phasen-Plan
+### Backend
+- ❌ SQLite — PostgreSQL 16 only
+- ❌ Jinja2/server-side HTML rendering — API-only backend
+- ❌ Cross-tenant data access — ORM auto-filter must not be bypassed
+- ❌ Plaintext passwords — bcrypt cost=12
+- ❌ JWT auth — session-based with HttpOnly cookies only
+- ❌ Naive datetime — TIMESTAMPTZ only
+- ❌ Integer IDs — UUID only
+- ❌ Hard-delete without `?gdpr=true`
+- ❌ Manual tenant filter — ORM auto-filter handles it
+- ❌ Sync I/O in routes — use asyncpg, aiofiles
+- ❌ Raw SQL without tenant_id check
+- ❌ Secrets in code — env vars only
+- ❌ Unvalidated input — Pydantic schemas required
+- ❌ Missing audit log on mutations
+- ❌ Plugin tables without tenant_id
 
-#### v1 Core Phases (Phase 3 — Implementation)
+### Frontend
+- ❌ Class components
+- ❌ Inline styles — Tailwind only
+- ❌ Hardcoded strings — use `t()`
+- ❌ Manual fetch/axios in components — use TanStack Query
+- ❌ Server data in Zustand
+- ❌ `any` types
+- ❌ Missing ARIA attributes
+- ❌ Touch targets < 44px
+- ❌ Direct DOM manipulation — use React refs
+- ❌ `dangerouslySetInnerHTML` without sanitization
 
-| Phase | Tasks | Parallel | Subagent Profile | Description |
-|-------|-------|----------|-------------------|-------------|
-| 1 | T01 | No | implementation_engineer | Foundation: Core, Auth, Multi-Tenant, RLS, Rate Limiting |
-| 2 | T02, T03 | Yes (2 agents) | implementation_engineer ×2 | Core entities + Plugin framework parallel |
-| 3 | T07a, T09 | Yes (2 agents) | implementation_engineer ×2 | Frontend Shell+Auth+UI Library + KI-Copilot/Workflow parallel |
-| 4 | T07b | No | implementation_engineer | Frontend Feature Pages (Companies, Contacts, Settings, Dashboard, Search) |
-| 5 | T10 | No | implementation_engineer | Monitoring, Performance, Doku, Environment Config |
-
-#### v2 Plugin Phases (nach v1 Deployment)
-
-| Phase | Tasks | Parallel | Subagent Profile | Description |
-|-------|-------|----------|-------------------|-------------|
-| 6 | T04, T05, T06, T11 | Yes (4 agents) | implementation_engineer ×4 | DMS, Calendar, Mail, Tags+Permissions backends parallel |
-| 7 | T08a, T08b, T08c | Yes (3 agents) | implementation_engineer ×3 | Frontend DMS+Tags, Calendar, Mail+Search parallel |
-
-### Task-to-Subagent Mapping
-
-| Task ID | Title | Subagent | Dependencies | Phase | Scope |
-|---------|-------|----------|--------------|-------|-------|
-| T01 | Core Infrastructure + Multi-Tenant + Auth | implementation_engineer | — | 1 | v1 |
-| T02 | Company + Contact + Import/Export | implementation_engineer | T01 | 2 | v1 |
-| T03 | Plugin System Framework | implementation_engineer | T01 | 2 | v1 |
-| T07a | Frontend SPA — Shell, Auth, Routing, i18n, UI Library | implementation_engineer | T01 | 3 | v1 |
-| T07b | Frontend SPA — Companies, Contacts, Settings, Dashboard, Search | implementation_engineer | T01, T02, T07a | 4 | v1 |
-| T09 | KI-Copilot + Workflow Engine | implementation_engineer | T01, T02 | 3 | v1 |
-| T10 | Monitoring + Performance + Doku + Env Config | implementation_engineer | T01, T02 | 5 | v1 |
-| T04 | DMS Plugin Backend | implementation_engineer | T01, T03 | 6 | v2 |
-| T05 | Calendar Plugin Backend | implementation_engineer | T01, T03 | 6 | v2 |
-| T06 | Mail Plugin Backend | implementation_engineer | T01, T03 | 6 | v2 |
-| T11 | Tags + Permissions + Entity Links Backend | implementation_engineer | T01, T03 | 6 | v2 |
-| T08a | Frontend DMS + Tags + Permissions UI | implementation_engineer | T04, T07b | 7 | v2 |
-| T08b | Frontend Calendar UI | implementation_engineer | T05, T07b | 7 | v2 |
-| T08c | Frontend Mail + Global Search UI | implementation_engineer | T06, T07b | 7 | v2 |
-
-### Parallelization Notes
-
-**v1 Phases:**
-- **Phase 2:** T02 (Company/Contact) and T03 (Plugin Framework) are independent after T01 — safe to run in parallel.
-- **Phase 3:** T07a (Frontend Shell+Auth+UI Library) depends only on T01. T09 (KI/Workflow) depends on T01+T02. Both can run in parallel if API contracts are frozen.
-- **Phase 4:** T07b (Frontend Feature Pages) depends on T07a (UI library, routing, auth) + T02 (company/contact API). Must run after T07a.
-- **Phase 5:** T10 (Monitoring+Doku) depends on T01+T02. Can run parallel with T07b.
-
-**v2 Phases (after v1 deployment):**
-- **Phase 6:** T04 (DMS), T05 (Calendar), T06 (Mail), T11 (Tags+Perm) all depend on T01+T03 — safe to run in parallel.
-- **Phase 7:** T08a/T08b/T08c depend on T07b + respective backend (T04/T05/T06) — safe to run in parallel.
-
-### Block Rules
-
-- Block = max 3 Tasks per implementation block.
-- After each block: quality_reviewer review → block_compactor → context_compactor → User checkpoint.
-- quality_reviewer and release_auditor do NOT count toward the 3-task limit.
-- After 3 blocks (9 tasks): release_auditor runs full audit.
-- Token budget: ~3000 tokens per task. If tool result >5000 tokens: context_compactor.
+### Deployment
+- ❌ Running as root in container — use app:app
+- ❌ Exposed DB port in production
+- ❌ Missing Docker health checks
+- ❌ Ephemeral storage — use named volumes
+- ❌ Secrets in docker-compose.yml
 
 ---
 
-## 5. Forbidden Patterns
+## 5. Quality Gates
 
-### Backend Forbidden
-
-- ❌ **SQLite:** No SQLite as database. PostgreSQL 16 only (ADR-01).
-- ❌ **Jinja2:** No server-side HTML rendering. API-only backend (ADR-03).
-- ❌ **Cross-Tenant Data Access:** No query without tenant_id filter. ORM auto-filter must not be bypassed.
-- ❌ **Plaintext Passwords:** Passwords must be bcrypt-hashed (cost=12). Never store or log plaintext.
-- ❌ **JWT Tokens:** No JWT auth in v1. Session-based auth with HttpOnly cookies only (ADR-05).
-- ❌ **Naive Datetime:** All datetime fields must be timezone-aware (TIMESTAMPTZ). Never use `datetime.now()` without tz.
-- ❌ **Integer IDs:** All primary keys are UUID. Never use auto-increment integer IDs.
-- ❌ **Hard-Delete without GDPR flag:** Companies/Contacts use soft-delete. Hard-delete only with explicit `?gdpr=true`.
-- ❌ **Manual Tenant Filter:** Never manually add `.filter(Tenant.id == x)` in services. The ORM auto-filter handles this.
-- ❌ **Sync I/O in Routes:** All route handlers are `async def`. Never use blocking I/O (use `asyncpg`, `aiofiles`, etc.).
-- ❌ **Raw SQL without Tenant Check:** Any raw SQL query must explicitly include `tenant_id` filter.
-- ❌ **Secrets in Code:** No hardcoded secrets. All secrets via environment variables.
-- ❌ **Unvalidated Input:** All request bodies validated by Pydantic schemas. Never trust raw request data.
-- ❌ **Missing Audit Log:** All create/update/delete operations must create audit log entries.
-- ❌ **Plugin Tables without tenant_id:** All plugin-created tables must include `tenant_id` column. The migration validator enforces this.
-
-### Frontend Forbidden
-
-- ❌ **Class Components:** No class components. Functional components with hooks only.
-- ❌ **Inline Styles:** No `style={{}}` props. Use Tailwind utility classes.
-- ❌ **Hardcoded Strings:** No user-visible hardcoded strings. Use `t()` from i18n.
-- ❌ **Manual Fetch in Components:** No `fetch()` or `axios` calls in components. Use TanStack Query hooks.
-- ❌ **Server Data in Zustand:** Zustand is for client state only. Server data goes in TanStack Query.
-- ❌ **`any` Types:** No `any` type. Use proper TypeScript types.
-- ❌ **Missing ARIA Attributes:** All interactive elements must have ARIA labels.
-- ❌ **Touch Targets < 44px:** All buttons/links must have minimum 44px touch target.
-- ❌ **Direct DOM Manipulation:** No `document.getElementById()` or `querySelector()` in components. Use React refs.
-- ❌ **Unsafe HTML Rendering:** No `dangerouslySetInnerHTML` without sanitization. Mail bodies must be sanitized (DOMPurify equivalent).
-
-### Deployment Forbidden
-
-- ❌ **Running as Root in Container:** Containers run as non-root user (app:app).
-- ❌ **Exposed DB Port in Production:** PostgreSQL port (5432) must not be exposed externally in production.
-- ❌ **No Health Check:** All services must have Docker health checks configured.
-- ❌ **No Volume for Storage:** File storage must use a named volume, not ephemeral container storage.
-- ❌ **Secrets in docker-compose.yml:** No secrets in compose file. Use `.env` file or Docker secrets.
+- Per-Task: tests pass, coverage met, tsc/ruff clean, build succeeds, no forbidden patterns
+- Phase: all tasks pass → quality_reviewer review → user checkpoint
+- Release: all tasks complete → release_auditor audit → Docker builds → health 200 → E2E pass
 
 ---
 
-## 6. Quality Gates
+## 6. ADRs
 
-### Per-Task Quality Gate
-
-Before a task is marked complete:
-1. All test_spec commands must pass.
-2. Coverage target must be met (measured by pytest-cov / vitest coverage).
-3. TypeScript compiles without errors (`tsc --noEmit`).
-4. Linting passes (ruff for backend, eslint for frontend).
-5. Build succeeds (Vite build for frontend, no build step for backend).
-6. No forbidden patterns detected.
-7. All acceptance criteria verified as testable.
-
-### Phase Gate (after each phase)
-
-1. All tasks in the phase pass their quality gates.
-2. quality_reviewer subagent reviews the phase output.
-3. No critical issues from quality_reviewer.
-4. Block compactor saves progress.
-5. User checkpoint before next phase.
-
-### Release Gate (before v1 deployment)
-
-1. All 7 v1 tasks complete (T01, T02, T03, T07a, T07b, T09, T10).
-2. release_auditor runs full audit.
-3. Docker Compose builds and starts successfully.
-4. Health endpoint returns 200.
-5. E2E tests (Playwright) pass.
-6. All forbidden patterns checked.
-
-### v2 Release Gate (before v2 plugin deployment)
-
-1. All 7 v2 tasks complete (T04, T05, T06, T11, T08a, T08b, T08c).
-2. release_auditor runs full audit.
-3. All plugin backends + frontends pass quality gates.
-4. Plugin install/activate/deactivate lifecycle tested.
-5. All forbidden patterns checked.
-
----
-
-## 7. Environment Setup
-
-### Development Environment
-
-| Variable | Value | Purpose |
-|----------|-------|---------|
-| `POSTGRES_HOST` | `localhost` (dev) / `postgres` (docker) | Database host |
-| `POSTGRES_PORT` | `5432` | Database port |
-| `POSTGRES_DB` | `leocrm` | Database name |
-| `POSTGRES_USER` | `leocrm` | Database user |
-| `POSTGRES_PASSWORD` | (from .env) | Database password |
-| `REDIS_URL` | `redis://localhost:6379/0` | Redis for cache + sessions + jobs |
-| `LEOCRM_SECRET_KEY` | (min 32 chars) | Session signing secret |
-| `SESSION_TIMEOUT_HOURS` | `8` | Session expiry |
-| `MAIL_ENCRYPTION_KEY` | (32-byte hex) | AES-256 key for mail credentials |
-| `STORAGE_BACKEND` | `local` (dev) / `s3` (prod) | File storage backend |
-| `STORAGE_PATH` | `/data/leocrm/storage` | Local storage path |
-| `ONLYOFFICE_URL` | `http://onlyoffice:80` | OnlyOffice document server |
-| `LOG_LEVEL` | `INFO` | Logging level |
-
-### Test Environment
-
-- Test DB: Ephemeral PostgreSQL (pytest-postgresql or testcontainers).
-- Test Redis: Ephemeral or fakeredis.
-- External services (IMAP, SMTP, OnlyOffice): Mocked via `unittest.mock.AsyncMock`.
-- Test fixtures in `conftest.py` provide: test client, authenticated client (per role), seeded data.
-
----
-
-## 8. Architecture Reference
-
-Full architecture details: `architecture.md`
-
-Full task graph with test specs: `task_graph.json`
-
-Key ADRs:
 - ADR-01: PostgreSQL 16 (not SQLite)
 - ADR-02: ARQ (not Celery)
-- ADR-03: Built-in plugins with manifest (not dynamic pip-install)
+- ADR-03: Built-in plugins with manifest (not pip-install)
 - ADR-04: TanStack Query (not Redux)
 - ADR-05: Session-based auth (not JWT)
-- ADR-06: Soft-delete with `deleted_at` column
+- ADR-06: Soft-delete with `deleted_at`
+
+Full architecture: `architecture.md` | Full task graph: `task_graph.json`
 
 ---
 
-## Handoff
+## 7. Deploy
 
-- **AGENTS.md status:** COMPLETE
-- **task_graph.json status:** COMPLETE (14 tasks: 7 v1 + 7 v2, all with test_spec, 143 features covered, v1/v2 separated, v2.1.0)
-- **architecture.md status:** COMPLETE (73/73 v1 features referenced, v2 sections marked)
-- **Ready for v1 implementation:** YES (pending quality_reviewer review + plan_mode transition to implementation_allowed)
-- **v2 implementation:** After v1 deployment, separate phase
+**Vor Deploy:** `docs/deploy-guide.md` lesen (Befehle, Credentials, Server-Info).
+
+- Frontend-only: `bash /a0/usr/projects/leocrm/scripts/fast-deploy.sh frontend`
+- Full (Backend): `bash /a0/usr/projects/leocrm/scripts/fast-deploy.sh full`
+- Git Workflow: commit → push → deploy
+
+---
+
+## 8. Dokumentations-Pflichten
+
+### Wichtige MD-Dateien im Projekt
+
+| Datei | Zweck |
+|-------|------|
+| `README.md` | Projekt-Overview, Setup |
+| `PLATFORM_ROADMAP.md` | EINZIGE Planungs-Datei für zukünftige Entwicklung, Umbauten, Roadmap. Alle Phasen, Tasks und Architekturentscheidungen |
+| `PROGRESS.md` | Fortschritts-Tracking — pro Task: Status, Forgejo Issue, Verifiziert. Wird vom Agent bei jedem Status-Wechsel aktualisiert |
+| `AGENTS.md` | Agent-Definitionen (diese Datei) |
+| `docs/test-strategy.md` | Test-Strategie, Konventionen, Einschränkungen |
+| `docs/security_kernel.md` | Security-Konzept (ABAC, RLS, Session) |
+| `docs/permissions.md` | Permission-System-Dokumentation |
+| `docs/permissions_plugin_dev.md` | Permission-Plugin-Entwicklung |
+| `docs/monitoring.md` | Monitoring, Health-Checks |
+| `docs/infrastructure.md` | Infrastruktur (Docker, PostgreSQL, Redis) |
+| `docs/admin-guide.md` | Admin-Handbuch |
+| `docs/api-documentation.md` | API-Dokumentation |
+| `docs/INSTALL.md` | Installationsanleitung |
+| `docs/plugin-development-guide.md` | Plugin-Entwicklungs-Guide |
+| `docs/ui-design-guidelines.md` | UI-Design-Richtlinien |
+| `docs/deploy-guide.md` | Deploy-Anleitung, Credentials, Server-Info |
+
+### Pflicht: Aktualisierung nach größeren Änderungen
+
+**Nach jeder größeren Änderung MÜSSEN die betroffenen MD-Dateien überarbeitet werden:**
+
+1. Neue Plugins/Module → `docs/plugin-development-guide.md`, `docs/api-documentation.md`, `docs/test-strategy.md`
+2. Security-Änderungen → `docs/security_kernel.md`, `docs/permissions.md`, `docs/test-strategy.md`
+3. Neue Test-Infrastruktur → `docs/test-strategy.md`
+4. CI-Pipeline-Änderungen → `docs/test-strategy.md`, `docs/infrastructure.md`
+5. Größere Refactoring → `README.md`, betroffene `docs/`-Dateien, `docs/test-strategy.md`
+6. Nach Bugfix-Session → `docs/test-strategy.md`, `docs/security_kernel.md`
+7. Roadmap-Änderungen → `PLATFORM_ROADMAP.md`
+8. Infrastruktur-Änderungen → `docs/infrastructure.md`, `docs/INSTALL.md`
+9. UI/UX-Änderungen → `docs/ui-design-guidelines.md`
+10. API-Änderungen → `docs/api-documentation.md`
+
+**Verantwortlich:** Agent/Entwickler der die Änderung durchführt.
+
+### Test-Konventionen (MUST FOLLOW)
+
+**Vor Tests:** `docs/test-strategy.md` lesen für vollständige Konventionen und Einschränkungen.
+
+1. Plugin-Aktivierung: `init_permission_registry(active_plugin_names={...})` in jeder Plugin-Test-Datei
+2. Entity-Typen: Korrekte ENTITY_MODELS-Keys (`file` nicht `dms_file`, `mail_account` nicht `mailbox`)
+3. URLs: Korrekte API-Pfade (`/api/v1/entity-links/` nicht `/api/v1/dms/`)
+4. Dedup-Tests: Unterschiedlichen Dateiinhalt pro Upload verwenden
+5. Keine zufälligen UUIDs: Echte Entity-IDs aus der DB verwenden
+6. Test-Dateien: `tests/test_<modul>.py` | Fixtures: `tests/conftest.py`
+
+---
+
+## 9. Progress-Tracking & Forgejo-Issue-Verwaltung
+
+### Planungs- und Fortschrittsdateien
+
+| Datei | Zweck | Wann aktualisieren |
+|-------|------|-------------------|
+| `PLATFORM_ROADMAP.md` | EINZIGE Planungs-Datei. Alle Phasen, Tasks, Architekturentscheidungen | Bei Planungsänderungen |
+| `PROGRESS.md` | Fortschritts-Tracking. Pro Task: Status, Forgejo Issue, Verifiziert | Bei jedem Task-Status-Wechsel |
+
+### Task-Status-Verwaltung
+
+Jeder Task in der Roadmap hat einen Status der in `PROGRESS.md` verfolgt wird:
+
+- `not_started` — Task noch nicht begonnen
+- `in_progress` — Task wird bearbeitet
+- `blocked` — Task blockiert (Abhängigkeit fehlt, Entscheidung ausstehend)
+- `review` — Task implementiert, wartet auf Review/Tests
+- `done` — Task hat Definition of Done (DoD) erfüllt
+
+**Der Agent MUSS `PROGRESS.md` bei jedem Status-Wechsel aktualisieren.** Kein Task-Wechsel ohne PROGRESS.md-Update.
+
+### Forgejo Issues & Milestones
+
+- **Pro Phase (A-J):** Ein Forgejo Milestone (z.B. "Phase A — Stabilität", "Phase B — System-Konsolidierung")
+- **Pro Task:** Ein Forgejo Issue mit Label `task` + Milestone der jeweiligen Phase
+- **Pro Bug:** Ein Forgejo Issue mit Label `bug` + Priorität (`critical`, `high`, `medium`, `low`)
+- **Pro Feature-Request:** Ein Forgejo Issue mit Label `enhancement`
+
+**Der Agent MUSS für jeden Task ein Forgejo Issue erstellen** und die Issue-Nummer in `PROGRESS.md` eintragen.
+
+### Commit-Messages
+
+- Commit-Messages enthalten die Task-ID: `feat(B-LLM): zentraler LLM Client implementiert`
+- Bug-Fixes referenzieren das Issue: `fix(#123): Redis-Connection-Leak behoben`
+- `fixes #123` oder `closes #123` im Commit schließt das Issue automatisch
+
+### Definition of Done (DoD)
+
+Ein Task gilt erst als **DONE** wenn alle 8 DoD-Kriterien erfüllt sind (siehe `PLATFORM_ROADMAP.md`). Ein Task ohne Test ist NICHT done. Der Agent darf keinen Task als `done` markieren ohne DoD erfüllt zu haben.
+
+### Phase-Gate-Review
+
+Eine Phase gilt erst als **ABGESCHLOSSEN** wenn alle 7 Phase-Gate-Kriterien erfüllt sind (siehe `PLATFORM_ROADMAP.md`). Der Agent darf nicht zur nächsten Phase übergehen ohne Phase-Gate-Review bestanden zu haben.
+
+## 10. Tracking-Ein-Datei-Regel (bindend seit 2026-08-27)
+
+- **PROGRESS.md ist die einzige Source of Truth** fuer Status und offene Punkte. Keine weiteren parallelen Tracking-Dateien (test-bugs.md/fix-plan-v3 sind in docs/archive/ historisiert).
+- Ein Finding wird nur eingetragen mit **tagesaktueller Live-Messung** (Befehl + Zaehler). 'Scanner sagt' oder Plan-Text allein reicht nie.
+- Tests duerfen nur zusammen mit Pflegeanspruch entstehen: UI-Aenderung zieht Test-Nachzug im selben Commit nach sich. Geister-Tests (Importziel geloescht) werden sofort geloescht.
+- Playwright-e2e bleibt dem eigenen Runner vorbehalten (vite.config exclude), kein Vitest-Collection.

COOLIFY_SETUP.md

@@ -1,269 +0,0 @@
-# Coolify Setup — CRM System v1.0
-
-Production deployment guide for the **CRM System** to the Coolify PaaS instance
-at `server.media-on.de` (server UUID `lw80w8scs4044gwcw084s00s4`).
-
-The deploy consists of **two Coolify resources** in the same project/environment:
-
-1. A **PostgreSQL 16** database resource (one-click or Docker image).
-2. The **crm-app** Application (Dockerfile build from a Git repository).
-
-The two resources talk to each other over the internal Docker network. The app
-is exposed publicly on `https://crm.media-on.de:443` (Let's Encrypt via Coolify).
-
----
-
-## 0. ⚠️ Critical domain-format gotcha
-
-Coolify's per-application **Domain field must contain an explicit port** in the
-URL. If you enter the domain without `:443`, Let's Encrypt certificate issuance
-will silently fail and Traefik will not route traffic correctly.
-
-```
-✅  https://crm.media-on.de:443
-❌  https://crm.media-on.de
-❌  crm.media-on.de
-```
-
-> The same rule applies in the Coolify API: when calling
-> `PATCH /api/v1/applications/{uuid}` you must set
-> `{"domains": "https://crm.media-on.de:443"}` (note the `:443` suffix).
-> This is a known bug-fix from earlier deployments — never drop the port.
-
----
-
-## 1. Prerequisites
-
-- Coolify server reachable at `https://server.media-on.de`, API token created
-  in *Keys & Tokens → API tokens* (Bearer token, scope: `*`).
-- The DNS **A record** for `crm.media-on.de` points to the public IP of the
-  Coolify server (Traefik will answer on `:443` and route by `Host` header).
-- The CRM source code lives in a **Forgejo repository** that Coolify can
-  clone. Suggested location:
-  `https://forge.media-on.de/leopoldadmin/crm-system` (branch `master`).
-  > If the repo does not exist yet, create it and push the project:
-  > ```bash
-  > # One-time: create the repo via Forgejo API or UI
-  > git remote add origin https://leopoldadmin:<TOKEN>@forge.media-on.de/leopoldadmin/crm-system.git
-  > git push -u origin master
-  > ```
-- You have the **internal host:port** of the Postgres resource that will be
-  provisioned in step 2 (Coolify will print it, e.g. `abc123-postgres:5432`).
-
----
-
-## 2. Resource A — PostgreSQL 16 database
-
-In the Coolify UI:
-
-1. Go to **Databases → + Add**.
-2. Choose **PostgreSQL 16** (Alpine).
-3. Configuration:
-   - **Name**: `crm-postgres`
-   - **Database name**: `crm_db`
-   - **User**: `crm_user`
-   - **Password**: *(generate a strong one — see Secret generation below)*
-   - **Public accessibility**: **disabled** (only the crm-app talks to it)
-4. Click **Deploy** and wait for status `running:healthy`.
-5. Note the **internal host:port** Coolify exposes (typically
-   `<resource-uuid>-postgres:5432`). You will need it in step 3.
-
-> **Alternative (API):**
-> ```bash
-> curl -X POST http://server.media-on.de/api/v1/databases \
->   -H "Authorization: Bearer $COOLIFY_TOKEN" \
->   -H "Content-Type: application/json" \
->   -d '{"type":"postgresql","project_uuid":"...","environment_name":"production",
->        "server_uuid":"lw80w8scs4044gwcw084s00s4",
->        "name":"crm-postgres","postgres_user":"crm_user",
->        "postgres_password":"<STRONG_PASSWORD>",
->        "postgres_db":"crm_db","is_public":false}'
-> ```
-
----
-
-## 3. Resource B — crm-app (Dockerfile build)
-
-In the Coolify UI:
-
-1. **Projects → + Add Project** if you don't have one yet (e.g. `CRM`).
-2. **Environment → + Add Environment** → name: `production`.
-3. Inside that environment, **+ Add → Application → Public/Private Repository**.
-4. Fill in:
-   - **Git repository**: `https://forge.media-on.de/leopoldadmin/crm-system`
-   - **Branch**: `master`
-   - **Build pack**: `Dockerfile`
-   - **Dockerfile location**: `Dockerfile` (default, repo root)
-   - **Port**: `8000`
-5. Click **Deploy** once to let Coolify create the resource (it will fail to
-   start without environment variables — that's expected).
-6. Note the **Application UUID** (visible in the URL or via
-   `GET /api/v1/applications`).
-
----
-
-## 4. Environment variables (on the crm-app resource)
-
-In **crm-app → Environment Variables**, set:
-
-| Key | Value | Notes |
-|-----|-------|-------|
-| `DATABASE_URL` | `postgresql+asyncpg://crm_user:<PW>@<postgres-internal-host>:5432/crm_db` | Use the internal host from step 2 (e.g. `crm-postgres-xyz:5432`), **not** `localhost` and **not** the public DNS. |
-| `AUTH_SECRET` | *see secret generation* | **MUST be ≥ 32 chars.** |
-| `CORS_ORIGINS` | `https://crm.media-on.de:443` | Comma-separated, no wildcards, must match the domain where the browser actually loads the SPA. |
-| `ENVIRONMENT` | `production` | |
-| `LOG_LEVEL` | `INFO` | `DEBUG` only temporarily. |
-| `BCRYPT_ROUNDS` | `12` | Aligned with `.env.example`. |
-| `JWT_ALGORITHM` | `HS256` | Aligned with `.env.example`. |
-| `JWT_EXPIRY_HOURS` | `24` | Aligned with `.env.example`. |
-
-### Secret generation (run once, locally)
-
-```bash
-# AUTH_SECRET (min 32 chars, recommended 48+)
-python -c "import secrets; print(secrets.token_urlsafe(48))"
-
-# POSTGRES_PASSWORD (min 16 chars, recommended 24+)
-python -c "import secrets; print(secrets.token_urlsafe(24))"
-```
-
-**Never commit these values.** Coolify stores them encrypted at rest, but they
-are still rendered in the UI to anyone with read access to the environment.
-
-> **Alternative (API — bulk update):**
-> ```bash
-> curl -X PATCH http://server.media-on.de/api/v1/applications/$APP_UUID/envs/bulk \
->   -H "Authorization: Bearer $COOLIFY_TOKEN" \
->   -H "Content-Type: application/json" \
->   -d '{
->     "data": [
->       {"key":"DATABASE_URL",        "value":"postgresql+asyncpg://crm_user:<PW>@<PG_HOST>:5432/crm_db"},
->       {"key":"AUTH_SECRET",          "value":"<TOKEN_URLSAFE_48>"},
->       {"key":"CORS_ORIGINS",         "value":"https://crm.media-on.de:443"},
->       {"key":"ENVIRONMENT",          "value":"production"},
->       {"key":"LOG_LEVEL",            "value":"INFO"},
->       {"key":"BCRYPT_ROUNDS",        "value":"12"},
->       {"key":"JWT_ALGORITHM",        "value":"HS256"},
->       {"key":"JWT_EXPIRY_HOURS",     "value":"24"}
->     ]
->   }'
-> ```
-
----
-
-## 5. Configure the public domain (with port!)
-
-In **crm-app → Domains → + Add Domain**:
-
-- **Domain**: `https://crm.media-on.de:443`
-  - ⚠️ **Port `:443` is mandatory.** See section 0.
-- **Let's Encrypt**: **enabled** (default).
-- Click **Save**. Coolify will issue the certificate and reload Traefik.
-
-> **Alternative (API):**
-> ```bash
-> curl -X PATCH http://server.media-on.de/api/v1/applications/$APP_UUID \
->   -H "Authorization: Bearer $COOLIFY_TOKEN" \
->   -H "Content-Type: application/json" \
->   -d '{"domains": "https://crm.media-on.de:443"}'
-> ```
-
----
-
-## 6. Healthcheck (Coolify side)
-
-In **crm-app → Advanced → Healthcheck**:
-
-- **Healthcheck path**: `/health`
-- **Healthcheck method**: `GET`
-- **Healthcheck interval**: `30s`
-- **Healthcheck timeout**: `10s`
-- **Healthcheck retries**: `3`
-- **Healthcheck start period**: `15s`
-
-> The Dockerfile's in-container `HEALTHCHECK` is the source of truth for
-> Docker-level health. The Coolify/Traefik healthcheck is what drives
-> automatic rollbacks and load-balancer routing. Set both, identically.
-
----
-
-## 7. Build & deploy
-
-In the Coolify UI: **crm-app → Deployments → Deploy**.
-
-Watch the build log. The first deploy will:
-
-1. Clone the repo (branch `master`).
-2. Build the multi-stage Dockerfile (≈ 1–2 min, depending on cache).
-3. Start the container. `prestart.sh` runs `alembic upgrade head` against the
-   Postgres database.
-4. Uvicorn binds to `0.0.0.0:8000` and starts serving.
-
-A healthy deploy ends with the container status `running:healthy`.
-
-> **Alternative (API):**
-> ```bash
-> curl -X POST http://server.media-on.de/api/v1/deploy \
->   -H "Authorization: Bearer $COOLIFY_TOKEN" \
->   -H "Content-Type: application/json" \
->   -d "{\"uuid\":\"$APP_UUID\"}"
-> ```
-
----
-
-## 8. Verification
-
-From anywhere with internet access:
-
-```bash
-# 1. Root health (used by Docker HEALTHCHECK & Coolify healthcheck)
-curl -fsSL -o /dev/null -w "%{http_code}\n" https://crm.media-on.de:443/health
-# → 200
-
-# 2. API v1 health (mounted under the versioned router)
-curl -fsSL -o /dev/null -w "%{http_code}\n" https://crm.media-on.de:443/api/v1/health
-# → 200
-
-# 3. Frontend SPA (served by the static-files mount)
-curl -fsSL -o /dev/null -w "%{http_code} %{content_type}\n" \
-  https://crm.media-on.de:443/index.html
-# → 200 text/html
-
-# 4. Interactive API docs
-# Open in a browser:  https://crm.media-on.de:443/docs
-# Register a user via POST /api/v1/auth/register
-# Login via POST /api/v1/auth/login → access_token
-# Use the token as `Authorization: Bearer <access_token>` on protected routes
-```
-
-If any of these return `502` / `503` / `504`:
-
-- Check **crm-app → Logs** in Coolify (the UI is the only place with full
-  stdout/stderr, the API does not expose logs).
-- Confirm the container is `running:healthy` (not `running:unhealthy`,
-  `exited`, or `starting`).
-- Confirm the Postgres resource is `running:healthy` and the
-  `DATABASE_URL` host matches its internal DNS name.
-
-For full incident response, see [`/a0/.a0/runbook-restore.md`](../../a0/runbook-restore.md).
-
----
-
-## 9. Going forward — redeploys
-
-- **Code change** → push to `master` on Forgejo → **Deployments → Deploy** in
-  Coolify. The Dockerfile layer-cache will reuse `pip install -r
-  requirements.txt` if `requirements.txt` is unchanged.
-- **Environment variable change** → edit in Coolify UI (or `PATCH .../envs/bulk`
-  via API) → **Deploy** (Coolify does *not* auto-restart on ENV change alone).
-- **Domain change** → use the API (`PATCH /api/v1/applications/{uuid}`) so it
-  is reproducible; the UI is a fallback only.
-
----
-
-## 10. References
-
-- Coolify v4 API — `/a0/usr/plugins/coolify_control/help/coolify-control/help.md`
-- App architecture (Section 13 lockdown) — `/a0/.a0/02-architecture.md`
-- Task graph (Phase 4d) — `/a0/.a0/03-task-graph.json`
-- Restore runbook — `/a0/.a0/runbook-restore.md`

Dockerfile

@@ -12,7 +12,7 @@ WORKDIR /frontend
 
 # Copy package files first for layer caching
 COPY frontend/package.json frontend/package-lock.json ./
-RUN npm ci --silent 2>/dev/null || npm install --silent
+RUN npm ci --legacy-peer-deps
 
 # Copy frontend source and build
 COPY frontend/ ./
@@ -30,12 +30,17 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         build-essential \
         libpq-dev \
+        libpango-1.0-0 \
+        libpangoft2-1.0-0 \
+        libcairo2 \
+        libgdk-pixbuf-2.0-0 \
+        libffi-dev \
  && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-COPY requirements.txt .
-RUN pip install --user --no-cache-dir -r requirements.txt
+COPY requirements.txt requirements.lock ./
+RUN pip install --user --no-cache-dir -r requirements.lock
 
 # === Stage 2: Runtime ===
 FROM python:3.12-slim AS runtime
@@ -50,6 +55,11 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         libpq5 \
         curl \
+        libpango-1.0-0 \
+        libpangoft2-1.0-0 \
+        libcairo2 \
+        libgdk-pixbuf-2.0-0 \
+        libffi8 \
  && rm -rf /var/lib/apt/lists/* \
  && groupadd -g 1000 appuser \
  && useradd -m -u 1000 -g appuser appuser
@@ -65,8 +75,8 @@ COPY --chown=appuser:appuser . .
 # Copy built frontend from frontend stage
 COPY --from=frontend --chown=appuser:appuser /frontend/dist /app/frontend/dist
 
-# Make prestart.sh executable
-RUN chmod +x /app/prestart.sh
+# Make entrypoint scripts executable
+RUN chmod +x /app/prestart.sh /app/worker.sh /app/healthcheck.sh
 
 # Create storage directory
 RUN mkdir -p /data/storage && chown -R appuser:appuser /data
@@ -76,6 +86,6 @@ USER appuser
 EXPOSE 8000
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
-    CMD curl -fsS http://localhost:8000/api/v1/health || exit 1
+    CMD /app/healthcheck.sh
 
 ENTRYPOINT ["/app/prestart.sh"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LeoCRM
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,7 +1,58 @@
 # LeoCRM v1.0
 
-> Self-hosted CRM for small sales teams (5–25 sales reps).
-> Stack: FastAPI + SQLAlchemy (async) + PostgreSQL + Redis + Alpine.js + Tailwind + Docker + Coolify
+> Plugin-basierte KI und Business-Plattform mit 25 Plugins (CRM, Mail, DMS, Chat, AI-Agenten, Workflows, Knowledge, Search, Self-Improvement, Compliance). FastAPI Backend + React/TypeScript Frontend. Deployiert über Coolify auf Hetzner VPS.
+> Stack: FastAPI + SQLAlchemy (async) + PostgreSQL 16 (pgvector) + Redis 7 + React 18 + TypeScript + Vite + TanStack Query + Zustand + Tailwind + Docker + Coolify
+
+## Features
+
+### Core Platform
+- **Multi-Tenant** — Tenant-Isolation via ORM Auto-Filter + Row Level Security (RLS)
+- **Plugin System** — 25 Built-in Plugins, Manifest-basiert, aktivierbar/deaktivierbar
+- **Permission System** — ABAC/RBAC mit feingranularen Permissions
+- **Audit Log** — Vollständige Audit-Trail, CSV/JSON Export, 365 Tage Retention
+- **Entity History** — Undo/Restore für alle Entitäten
+- **Soft Delete** — `deleted_at` auf allen Entitäten, Hard-Delete mit `?gdpr=true`
+- **Unified Search** — Hybrid-Suche (PostgreSQL FTS + pgvector), KI Query-Understanding
+- **System Dashboard** — Admin-only Monitoring (DB, Redis, Worker, Errors, LLM Costs)
+- **Backup Automation** — ARQ-gesteuert, einstellbar in Settings, Backup-History
+- **Trash Cleanup** — Automatische endgültige Löschung nach 90 Tagen
+
+### 25 Plugins
+
+| # | Plugin | Beschreibung |
+|---|--------|-------------|
+| 1 | **contacts** | Kontakt-Verwaltung (Personen, Firmen, Ordner, Custom Fields) |
+| 2 | **mail** | IMAP/SMTP E-Mail-Integration, PGP, Filter-Regeln, Vacation Responder |
+| 3 | **dms** | Document Management System, File Upload, Preview, Sharing, Permissions |
+| 4 | **calendar** | Kalender, Termine, Ressourcen-Buchung, ICS Import/Export, Kanban |
+| 5 | **tasks** | Unified Task System, Subtasks, Goals, polymorphe Zuweisung |
+| 6 | **kommunikation** | Unified Messaging, Chat, Mini-Apps, WebSocket-basiert |
+| 7 | **automation** | Automation Builder, Trigger, Agent Runner, Cron-Scheduler |
+| 8 | **ai_assistant** | AI Chat Sessions, Provider, Models, Presets, Tools |
+| 9 | **ai_proactive** | Proactive AI, Suggestions, SSE Streaming, Settings |
+| 10 | **ai_ui_control** | AI-driven UI Control via WebSocket |
+| 11 | **agent_memory** | Agent Memory Plugin, eigene Routes |
+| 12 | **unified_search** | Hybrid-Suche, Embeddings, RRF Rank Fusion, Facets |
+| 13 | **graph_rag** | GraphRAG, Knowledge Graph, Relationship Extraction |
+| 14 | **wiki** | Wiki Plugin, Article Versioning, Categories, Entity Links |
+| 15 | **report_generator** | Report Templates, Generation, Download |
+| 16 | **entity_links** | Entity Linking, File-Entity Connections |
+| 17 | **tags** | Tag Management, Bulk-Assign, Entity-Tag Queries |
+| 18 | **permissions** | File-level Permissions, Share Links |
+| 19 | **mcp_server** | MCP Server, Tool Definitions für AI Agents |
+| 20 | **mcp_client** | MCP Client für externe Tool-Integration |
+| 21 | **marketplace** | Marketplace Listings |
+| 22 | **system_notif** | System Notifications, Alerting via Communication-System |
+| 23 | **forgejo_error_reporter** | Forgejo Error Reporting |
+| 24 | **knowledge** | LLM-based Knowledge Extraction, Ask-Knowledge, Review Queue |
+| 25 | **self_improvement** | Controlled Self-Improvement Loop (Signals, Patterns, Proposals, Impact) |
+
+### AI & Automation
+- **Agent System** — ReAct-Loop, Tool-Calls, Skills, Approvals, Monitoring, SSE Streaming
+- **Workflow Engine** — 14 Step-Types, Durable Runs, Retry, Idempotency, SSRF-Schutz
+- **Decision Guard** — Automated-Decision Guard für High-Risk Actions
+- **Approval System** — Human Approval für Agent Actions und Workflow Steps
+- **LLM Client** — Zentraler LLM Client, Cost-Tracking, Multi-Provider
 
 ## Quick Start (Development)
 
@@ -60,13 +111,10 @@ Open:
 ### Docker Compose
 
 ```bash
-cp .env.example .env
-# Edit .env — set DATABASE_URL, REDIS_URL, SECRET_KEY, CORS_ORIGINS
+cp .env.docker.example .env.docker
+# Edit .env.docker — set DB_PASSWORD, REDIS_PASSWORD, SECRET_KEY, APP_DOMAIN
 # Set ENVIRONMENT=production, SESSION_COOKIE_SECURE=true
-docker compose up -d
-
-# Run migrations
-docker compose exec api alembic upgrade head
+docker compose --env-file .env.docker up --build -d
 ```
 
 ### Manual (without Docker)
@@ -90,13 +138,23 @@ See [docs/admin-guide.md](docs/admin-guide.md) for detailed deployment, backup,
 
 | Endpoint | Method | Auth | Description |
 |---|---|---|---|
-| `/api/v1/health` | GET | No | Health check (DB, Redis, storage, worker) |
+| `/health/live` | GET | No | Liveness probe |
+| `/health/ready` | GET | No | Readiness probe (DB, Redis, storage, worker) |
+| `/api/v1/health` | GET | No | Full health check (DB, Redis, storage, worker) |
 | `/api/v1/metrics` | GET | Admin | Prometheus metrics (text/plain) |
+| `/api/v1/system/dashboard` | GET | Admin | System dashboard (DB, Redis, worker, errors, LLM costs) |
+| `/api/v1/system/alerts` | GET | Admin | Active system alerts |
 | `/api/v1/auth/login` | POST | No | Login |
 | `/api/v1/contacts` | GET | Yes | List contacts (paginated, max page_size=100) |
 | `/api/v1/contacts/export` | GET | Yes | Stream contacts as CSV |
 | `/api/v1/companies` | GET | Yes | List companies (paginated, max page_size=100) |
 | `/api/v1/companies/export` | GET | Yes | Stream companies as CSV |
+| `/api/v1/search` | POST | Yes | Hybrid search (FTS + pgvector) |
+| `/api/v1/audit-log` | GET | Admin | Query audit log entries |
+| `/api/v1/audit-log/export` | GET | Admin | Export audit log (CSV/JSON) |
+| `/api/v1/system-settings/backup-config` | GET/PUT | Admin | Backup configuration |
+| `/api/v1/system-settings/backup-now` | POST | Admin | Trigger immediate backup |
+| `/api/v1/system-settings/backup-history` | GET | Admin | Backup history (last 10) |
 
 ### Pagination
 
@@ -112,18 +170,25 @@ Uses `StreamingResponse` — does not buffer the entire file in memory.
 
 Interactive API documentation: http://localhost:8000/docs
 
-See [docs/api-overview.md](docs/api-overview.md) for the full endpoint summary.
+See [docs/api-documentation.md](docs/api-documentation.md) for the full endpoint reference.
 
 ## Monitoring
 
-### Health Check
+### Health Checks
 
 ```bash
-curl http://localhost:8000/api/v1/health
-```
+# Liveness
+curl http://localhost:8000/health/live
+# → {"status":"alive"}
 
-Returns JSON with overall status (`healthy`/`degraded`) and individual checks for
-`database`, `redis`, `storage`, and `worker`.
+# Readiness
+curl http://localhost:8000/health/ready
+# → {"status":"ready","checks":{"database":"ok","redis":"ok","storage":"ok"}}
+
+# Full health
+curl http://localhost:8000/api/v1/health
+# → {"status":"healthy","version":"1.0.0","checks":{...}}
+```
 
 ### Prometheus Metrics
 
@@ -138,6 +203,15 @@ Available metrics:
 - `leocrm_db_pool_connections` — Database connection pool size
 - `leocrm_arq_jobs_total` — Total ARQ background jobs
 
+### System Dashboard
+
+Admin-only dashboard at `/system-dashboard` in the WebUI. Shows:
+- System Health, DB Stats, Redis Stats, Worker Queue
+- API Stats (total requests, error rate, avg response time)
+- Plugin Stats (discovered, active)
+- Storage Stats (disk usage, file count)
+- Alert Feed (system messages from Communication-System)
+
 ### Structured Logging
 
 LeoCRM uses `structlog` for structured JSON logging. All API requests are logged with:
@@ -202,41 +276,73 @@ leocrm/
 ├── app/
 │   ├── main.py               # FastAPI entry point with logging middleware
 │   ├── config.py             # Pydantic settings
+│   ├── deps.py               # FastAPI dependencies (auth, permissions)
 │   ├── core/
 │   │   ├── monitoring.py      # Prometheus metrics + structured logging + health checks
 │   │   ├── db.py             # Async database engine
 │   │   ├── middleware.py     # CSRF middleware
+│   │   ├── worker.py        # ARQ worker settings
+│   │   ├── backup_job.py    # Automated backup job
+│   │   ├── notifications.py  # System notification dispatch
 │   │   └── ...
 │   ├── routes/
-│   │   ├── health.py         # Health endpoint
+│   │   ├── health.py         # Health endpoints
 │   │   ├── metrics.py        # Prometheus metrics endpoint (admin-only)
+│   │   ├── system_dashboard.py # System dashboard (admin-only)
+│   │   ├── system_settings.py # System settings + backup config
+│   │   ├── audit.py          # Audit log (list, export, retention)
 │   │   ├── contacts.py       # Contact CRUD + streaming CSV export
 │   │   ├── companies.py      # Company CRUD + streaming CSV export
+│   │   ├── workflows.py      # Workflow engine routes
 │   │   └── ...
 │   ├── models/               # SQLAlchemy models
 │   ├── schemas/              # Pydantic schemas
 │   ├── services/             # Business logic
-│   └── plugins/              # Plugin system
+│   ├── plugins/              # Plugin system (registry, manifest, base)
+│   │   └── builtins/         # 25 built-in plugins
+│   ├── workflows/            # Workflow engine
+│   └── ai/                   # AI modules
 ├── scripts/
+│   ├── fast-deploy.sh        # Frontend-only / full deploy
+│   ├── deploy.py             # Coolify API deployment
+│   ├── backup.py             # Backup script (pg_dump + files)
+│   ├── restore.py            # Restore script
 │   ├── seed_perf_data.py     # Performance test data seeding
 │   └── check_indexes.py      # Database index verification
 ├── tests/                    # Test suite (pytest + pytest-asyncio)
 ├── docs/
 │   ├── admin-guide.md       # Admin guide (deploy, backup, restore, troubleshooting)
-│   └── api-overview.md      # API endpoint summary
-├── alembic/                  # Database migrations
+│   ├── api-documentation.md  # Full API endpoint reference
+│   ├── monitoring.md        # Monitoring & health checks
+│   ├── infrastructure.md    # Infrastructure guide
+│   ├── deploy-guide.md      # Deploy guide (fast-deploy, Coolify, server info)
+│   └── ...
+├── alembic/                  # Database migrations (130+ files)
+├── frontend/                 # React + TypeScript + Vite + Tailwind
+│   └── src/pages/            # SystemDashboard, Contacts, Mail, DMS, Calendar, etc.
 ├── requirements.txt          # Production dependencies
 ├── requirements-dev.txt     # Test/lint dependencies
 ├── .env.example              # Environment template
-├── docker-compose.yml        # Docker Compose
+├── docker-compose.yaml       # Docker Compose (postgres, redis, crm_app, crm_worker)
+├── Dockerfile                # Multi-stage build (frontend → builder → runtime)
+├── prestart.sh               # Container entrypoint (migrations, seed, uvicorn)
+├── worker.sh                 # ARQ worker entrypoint
+├── healthcheck.sh            # Container healthcheck
 └── README.md                # This file
 ```
 
 ## Documentation
 
 - [Admin Guide](docs/admin-guide.md) — Deployment, backup, restore, env vars, troubleshooting
-- [API Overview](docs/api-overview.md) — Full endpoint reference
-- [Coolify Setup](COOLIFY_SETUP.md) — Coolify deployment instructions
+- [API Documentation](docs/api-documentation.md) — Full endpoint reference (300+ endpoints)
+- [Monitoring](docs/monitoring.md) — Health checks, metrics, system dashboard, alerting
+- [Infrastructure](docs/infrastructure.md) — Docker, PgBouncer, audit partitioning, backup
+- [Deploy Guide](docs/deploy-guide.md) — Fast-deploy, Coolify API, server info
+- [Plugin Development](docs/plugin-development-guide.md) — Plugin development guide
+- [Security Kernel](docs/security_kernel.md) — ABAC, RLS, session security
+- [Permissions](docs/permissions.md) — Permission system documentation
+- [Test Strategy](docs/test-strategy.md) — Test conventions and constraints
+- [UI Design Guidelines](docs/ui-design-guidelines.md) — UI design rules
 - [Swagger UI](http://localhost:8000/docs) — Interactive API docs (auto-generated)
 
 ## License

THIRD_PARTY_LICENSES.md

@@ -0,0 +1,74 @@
+# Third-Party Licenses
+
+This file lists all third-party software components used by LeoCRM,
+along with their respective licenses.
+
+## Backend Dependencies (Python)
+
+| Package | License | Usage |
+|---|---|---|
+| FastAPI | MIT | Web framework |
+| SQLAlchemy | MIT | ORM / database toolkit |
+| Alembic | MIT | Database migrations |
+| Pydantic | MIT | Data validation |
+| Pydantic Settings | MIT | Settings management |
+| asyncpg | Apache 2.0 | PostgreSQL async driver |
+| Redis (redis-py) | MIT | Redis client |
+| httpx | BSD-3-Clause | HTTP client |
+| LiteLLM | MIT | Unified LLM interface |
+| PydanticAI | MIT | AI agent framework |
+| pypdf | BSD-3-Clause | PDF text extraction |
+| python-docx | MIT | DOCX text extraction |
+| openpyxl | MIT | XLSX text extraction |
+| python-pptx | MIT | PPTX text extraction |
+| aiofiles | Apache 2.0 | Async file I/O |
+| minio | Apache 2.0 | S3-compatible storage client |
+| cryptography | Apache 2.0 | Encryption (Fernet, PBKDF2) |
+| bcrypt | Apache 2.0 | Password hashing |
+| nh3 | MIT | HTML sanitization |
+| python-multipart | Apache 2.0 | Multipart form parsing |
+| pgvector | PostgreSQL License | Vector similarity search |
+| APScheduler | MIT | Job scheduling |
+| websockets | BSD-3-Clause | WebSocket support |
+
+## Frontend Dependencies (Node.js)
+
+| Package | License | Usage |
+|---|---|---|
+| React | MIT | UI framework |
+| React Router | MIT | Client-side routing |
+| TanStack Query | MIT | Server state management |
+| TanStack Table | MIT | Table/data grid |
+| Zustand | MIT | State management |
+| Tailwind CSS | MIT | CSS framework |
+| lucide-react | ISC | Icon library |
+| date-fns | MIT | Date utilities |
+| react-i18next | MIT | Internationalization |
+| i18next | MIT | Internationalization core |
+| react-hook-form | MIT | Form management |
+| zod | MIT | Schema validation |
+| clsx | MIT | Class name utility |
+| Vite | MIT | Build tool |
+| Vitest | MIT | Test framework |
+
+## External Services
+
+| Service | License | Usage |
+|---|---|---|
+| Collabora Online | LGPL/MPL | Document editing (DMS) |
+| PostgreSQL | PostgreSQL License | Database |
+| Redis | BSD-3-Clause | Cache / sessions |
+
+## Replaced AGPL Components
+
+The following AGPL-licensed components have been replaced with permissively
+licensed alternatives to allow commercial use without copyleft obligations:
+
+| Original | License | Replacement | License |
+|---|---|---|---|
+| PyMuPDF (fitz) | AGPL-3.0 | pypdf | BSD-3-Clause |
+| OnlyOffice | AGPL-3.0 | Collabora Online | LGPL/MPL |
+
+---
+
+*This file is maintained manually and should be updated when dependencies change.*

alembic/env.py

@@ -3,6 +3,15 @@
 from __future__ import annotations
 
 import asyncio
+
+# F19 (Astra P1): deterministic full-model discovery for Alembic.
+# `from app.models import *` only loads CORE models (48 tables in a fresh
+# process). Contact and ~80 other tables physically live in plugins
+# (e.g. app.plugins.builtins.contacts.models) — the lazy package
+# __getattr__ never fires for wildcard imports. Without the plugin models
+# the metadata sort fails (contact_merge_history → contacts FK) and
+# `alembic check` compares against an incomplete schema.
+import importlib
 from logging.config import fileConfig
 
 from sqlalchemy import pool
@@ -13,6 +22,15 @@ from alembic import context
 from app.config import get_settings
 from app.core.db import Base
 from app.models import *  # noqa: F401,F403
+from app.plugins.registry import get_registry
+
+_registry = get_registry()
+_registry.discover_builtins()
+for _plugin_name in _registry.list_discovered():
+    try:
+        importlib.import_module(f"app.plugins.builtins.{_plugin_name}.models")
+    except ImportError:
+        pass  # plugin has no models module
 
 config = context.config
 if config.config_file_name is not None:
@@ -20,7 +38,11 @@ if config.config_file_name is not None:
 
 target_metadata = Base.metadata
 settings = get_settings()
-config.set_main_option("sqlalchemy.url", settings.database_url)
+# ⚠️ RLS Migration History: 21 Migrationen mit 8 Disable-Zyklen. Dies ist historisch bedingt
+# und zeigt trial-and-error. Aktuelle RLS-Konfiguration ist stabil (113 Tabellen).
+# Bei neuen RLS-Änderungen nur noch Migration-Runner nutzen.
+# Use migration_database_url (crm_migration role, table owner) for Alembic
+config.set_main_option("sqlalchemy.url", settings.migration_database_url or settings.database_url)
 
 
 def run_migrations_offline() -> None:

alembic/migration_hashes.txt

@@ -0,0 +1,93 @@
+1f59cbca47ea189432d25a9bd924ead13b6f285ce7740510714e01ccc4bb7dd8  0001_initial.py
+6e5af9bb75ea05893bcd929152dbea449c54e0df27a1cb450a86fd675089519c  0002_contacts_fts.py
+6e7ac65fce63d0fcea897a897abe527ce360ae747ab96be5e0439cf6ad1dbeff  0003_plugin_system.py
+129dca600710901612ff71dd409a40bedf50570cbc19419ebe38987516369991  0004_ai_workflows.py
+22187aa9158aa994b96b496475adf46c95db4c7c98aa99c3d39d27c00696d084  0005_user_role_fk.py
+e7d4bf646eb7e88807f9fa81ba014596f6f15386908887936dcd7c7f8db4233f  0006_add_addresses.py
+b125bdbf99b7f2239860a99258750941f6711a7082ae2391686f1a351abea18b  0007_currencies.py
+c15fa1c8883c27520624945cad88a052c7e1f35f524e8d5ebf9d9c7f46a9cba1  0008_tax_rates.py
+19da33700de8f512f4ed0b1761f525e66f2bc429620eff2ebea1533a5c1acbd3  0009_sequences.py
+10761f179cd5e51007ae5cf09ff72da5c31d2dd0f5b3f8a8b4a09c6d086f8c22  0010_system_settings.py
+90965449194517d7e9de4c4d9c81947632dcd0fdd392b545c775bcccf5f8b706  0011_attachments.py
+f60cc4ee0c2b5b1b963453d821910196422d488f94ddbaface7a5ebe8f998554  0012_soft_delete.py
+79d675096e1d546ea3bf2ccdb768ae0d50099c4cd10091796660ef0307326e0b  0013_addresses.py
+c327ac7e64becaecbb0d64639e65084ad79b7eddda3bdedc0c69b8db38749a2c  0014_currency_unique_fix.py
+bb764156af7ec85d3d157c85c7f4694296d124d1bddb8e9a92eb8afba7a3769a  0015_rls_policies.py
+a59265ece8e32886b447138d23203c2689dfe5a5bd3fcd06f853c027748f72e9  0016_plugin_is_core.py
+eef54bd0625d0d53463a22560cee2c18903bf83d72c377c948c7164e000570fa  0017_notification_preferences.py
+eb7789038fe80185e95c412a0011287fa8a1e15b96d0d858f2b59168eec2271e  0018_fix_notification_preferences_columns.py
+af2dbd9f06a2fa67c00417025088147463c58a5547ae90e80050c8adf972e0e5  0019_rbac_groups.py
+d6288d579085b64c688a01ed7e071705c0347f03d0af56de0c7e2554991496ae  0020_notifications_updated_at.py
+67f0f745af1f77b2db6e8f39c61e10d160b0c770a8eb0c748c342361c31bed87  0021_unified_contacts.py
+62f105366204bcb8bbfbb5537d3135725010873d1007323f0c8c4a10e1914f63  0022_contact_folders.py
+f6e266744c91465bc9cb5739e57bc69a575484b93dee49f7cecc5dc0d1faa746  0023_theme_customization.py
+56587cd59d6d7d39a5859c8707cdb0fc05b3dd5c34afc20caeb5391b89604afd  0024_heartbeat_config.py
+fe98eaa00e3de292ee23539399b62c847574d01743066b084a693d7ff22d84dd  0025_entity_history.py
+4ede1b730f8e00c8ad33d1f184b07fda333bfa55bab5ced2f35d05da2a4699e2  0026_mail_salt_security.py
+5fd05dbb6bc8a1f97d04f6dfff1491e002cea3a0fd1e6138f3a0a627ae8d7681  0027_unify_company_to_contact.py
+4f61886ec7649debc2a1d0ea65f35a8a13947c1faed14512712e28210644a20b  0028_rls_force.py
+92792e3fe5591a1de73605b1d1faefd7910fee41b4773757092fb8fcf6ebfca9  0028_user_preferences.py
+873484c820181b0190e8ca175eb16a6445eac399d614c7fdd81026c2ae88e399  0029_saved_filters.py
+d3b5fe559110b070cb642feb9801b48df600b5e11c469d4a6aa0fe04beddd4da  0030_contact_merge_history.py
+3ca8a3c626bead4e14da8ebf1adef5b34c21622662158ceb2db997256f8a240f  0031_permissions_soft_delete.py
+4f21f30045fa9b9798df26701bef88499d2f2f871727cffefd5f98ce7b344d91  0032_user_profile_fields.py
+e736f93427dd128b45007d351923af150c7093eec1f41e3dafb22900875084d1  0033_bank_accounts.py
+2eca394a15cb1bef34c4a3e3d60e58a9fdc46321715eefb74272e3079f94d516  0034_automation_config.py
+6f07d56fe2204ff181c61b16e71fa59f6270d6245045fd8ce5174570339b09d0  0035_comm_search_index.py
+c891187cbb5cee0281322855f4232134093e3ce26db20d142e29900c14a5b651  0036_cross_tenant_fk.py
+ac0239040a0f5695d4477dda2728297bfee15b0c090a13e91650d0c2a17922ba  0037_user_tenant_model.py
+19ecb258a0db97db3ecce0e21018a73602f680cdcdafc9203a778c256437fb29  0038_dms_content_hash.py
+a886a1c4b8c89fb1d244aef8559accfdc21209393bffd1c1d86ee6995bfb4d4b  0039_contact_normalize.py
+815899de164dc7b4418044ff8de3631449c7baec1c83b1f7ae683577becb185f  0040_outbox.py
+7af62a3ce31bcad2e5dbddae509194586b4f45f28b1fca47fd2365c9f288d695  0041_custom_field_definitions.py
+19ef4dfb877683bf794f7009e4cdb33a2674418a54d893a1120c742253e7eb3d  0042_webhooks.py
+cb04f579ad7fb1444446d6e06dcb5a5d9cb824d0fe71c46835d2243d92c2df8f  0043_backups.py
+0efd2a980f1e104b4cf7b3ea5ce4de776ca7d73a09d34834fd65a5de0c9a6b7e  0044_rls_repair_and_db_roles.py
+d1e8f1fd12237d8635918b89da34ef45c99af832b3f372e0bde876ca8314639d  0045_repair_contact_migration.py
+07fc01641d4dc30881f664e9c795466adaff864dc72d377ff1f6b6b7b5ba0b1c  0046_plugin_allowlist.py
+afc8c9f2b1392882cd41d8b28a98640167a162cd210beeb1bd64df5b649b6500  0047_saved_views.py
+4f3daeec7ae3a5ba3a40c4329d5e1664d29539608b13f101d8914b00a69cbb48  0048_contact_folder_permissions.py
+b352752857101f46779c0d9232a793af79f3850121fe9cc77c27fb08fc14e29a  0049_entity_permissions.py
+831551810e0ba27f186123c2e8113722a4ed664fdc5ffd014a1efd139f4c9bdf  0050_owner_id_all_tables.py
+17867264f7631016349293c1a38114446d4261516e8ed0e1bf181a105a828217  0051_migrate_folder_acls.py
+ee73eba6e99341380b8129da620f6a2d309af1d3ed8e300b11ee7740d1208b33  0052_rls_contacts.py
+49a0c541bdbd4b1a0e92e1487d502d8f330776aec60ce022b349ce6462fefd0e  0053_mail_owner_id.py
+1a4285967290c358130bac536ec9d0a40bca370639c4cac53b295e217ee7082b  0054_plugin_owner_id.py
+27ce5c11c3fb0c0b69b87f4499f7eae936f3035f3eca4696de9daef94610c219  0055_entity_policies.py
+690dd996dc2bf44777ed0d7ecb717d1af0a641aa58294f9e7092e2d94a9a3f16  0056_permission_templates.py
+b5389ab783714d9f391484b7dd1437088de06fe8b8dd753090f755ed62e61fb4  0057_permission_delegations.py
+0bdf3a15a532c0934c73c36a15a5367c4f69d92138e0155c255b8cde64f4a795  0058_resolution_strategy.py
+bb87f8836425f097c7d70e736896e9f6fd68c3e8ea80756065e74e45ebc77162  0059_guest_users.py
+240957a7bdc90bac008d8af3ffbc1c4205c0aa582fff6b89861655631c4670fa  0060_rls_contacts_secure.py
+f020ea4b687a148663c8da4188503e55ba3c5d2072408590767f5984512b9287  0061_db_roles_secure.py
+ad6876b5e15b44547cd91bebb54e977f985decc4b25e9c8c63cd9b1f000ae0a7  0062_guest_invitations_secure.py
+78db5dea0a068749b0e86c157d1fa92068e023d9605b32eec26fffe477a78e64  0063_notification_entity_fields.py
+c2a1669e0afa8f30bc1c2696fe2a20541507a515266f1f8d3416fd7daafaabe2  0064_rls_all_tenant_tables.py
+eafe25abb7cd7a493d590ae04a15326c8c4aa6ee22693f1599c72ebdf859b847  0065_consumer_inbox.py
+c69e5d22853555b79b2fc4632308a0520ddb6639f61fa1c39d912fce175d1ca2  0066_tenant_plugin_activation.py
+790fd62ee1523633720963802287bf31c607f0fcd2b8ec2a3d6dd1eb4e0951bb  0067_disable_rls_system_tables.py
+c9b22694060fa92a725c79c781988ff66b326301090c290062af7226dcbf84f2  0068_entity_permissions_deleted_at.py
+6e269eab56fa261bed460bedcf9fcb1dba55bfb36918cedd8adda36b6bddc20a  0069_rls_tenant_isolation_only.py
+4d93eb1c7d26d51a4f411041a6979c7f5dcaaa411d7bba23cc37aa27fa045374  0070_db_roles_separation.py
+1d750493a9d5d224952308c8903a6b86f6ca5dfe74e11a270888edea0d873005  0071_entity_attachments.py
+fce10ad1f18c0a383d1c4ab60d403f14298d8cb644c7e0637a2e56f349bbb4cb  0072_workspaces.py
+4a2409f12241c129f1e0a28219be9d2f6801a6d9a6b5d8671be376a9f7d0a622  0073_workspace_deleted_at.py
+a6256de26d248323e4f68d9b035fb42349aac98458dd15dec1597e2223e71e27  0074_workspace_users_timestamps.py
+5c48afc9032acdcb05cdd89fb650116dacac1662c7bf2605c28596b7d14d31d4  0075_outbox_envelope.py
+48558039eee96b6d4b0f687d5231ce7643460e64f5803112d3c330af654c3c7b  0076_disable_rls_startup_tables.py
+d15e524e257a738beb955ab891db35492089aaded7033f1e3d5d82f739cefe25  0077_disable_rls_tax_rates.py
+5e102c1ff963b5ddbefa96515a114ffa5bec25e9e41f53a555f743af06e2d24e  0078_disable_rls_automation.py
+2e72ed88053416b8525205ab0c71d416a4caed32ac475d3c539541b86e5ab683  0079_disable_rls_system_tables.py
+099b0259a865a8b9aff6c6af40c9481a813ed30d6cf9e061a054e85545e6ca75  0080_disable_rls_audit_sessions.py
+ba5b221f7ce0271a1b531eb441d2f0afe7b3d53bd44e602b8e839a3806059bfb  0081_disable_rls_all_system_tables.py
+1705c1788ea57085c2ffe99d985e077ffa2e2e45482a5b6af162a76dcbeda34c  0082_add_sensitivity_to_custom_field_definitions.py
+f8409a0e4952703b5a1a1ba064f8622071f12c657ad4e8ff1a09c2020d768762  0083_add_missing_deleted_at_columns.py
+d2bdad015bdf16f6c911f58a08103b1814f0f6d987b4ecd290732ee7a185a843  0084_rls_fail_closed_reactivate.py
+b66e11bbcb52d7cfde518cde523a4d8808ddb4a62cc3b8c39aec3c58b95abe19  0085_restore_tenant_rls.py
+b184eab067c0dfaa66712bd74471b4c65715e90a07521b17577ed15bac707259  0086_fix_global_tables_force_rls.py
+f0f33e314b52a849f1bad06cfa9ffb5da07890764bc8d22dcd43237293ed90db  0087_add_timestamps_to_password_reset_tokens.py
+38e3f4454e079faed2e6fc78cec632d6f78189c46750a7668a9c9c1a845f2bd4  0088_auth_rls_policies.py
+2e279fe7afd72b2093695249e16bdf7bf3be400935099fe21f3c4c3aa87059ba  0089_sessions_updated_at.py
+d7cabfb4c3d4665bd12aded82dc0727a55705bf9124c7e0b11574929dc806ab2  0090_fix_legacy_tenant_policies.py
+94d48243191c7fee0c2106afc9e4809fbc8ef3a38786b0e0582f2cce488a219d  0091_add_tenant_fk_constraints.py
+53d4c6e01d59da4fbf9785de05237d2656473a5c5fcccb08edf79be8284db4c4  0092_outbox_dlq.py

alembic/versions/0001_initial.py

@@ -29,7 +29,7 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_tenants_slug", "tenants", ["slug"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_tenants_slug ON tenants (slug)')
 
     # users
     op.create_table(
@@ -46,8 +46,8 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.UniqueConstraint("tenant_id", "email", name="uq_users_tenant_email"),
     )
-    op.create_index("ix_users_tenant_id", "users", ["tenant_id"])
-    op.create_index("ix_users_email", "users", ["email"])
+    op.execute("CREATE INDEX IF NOT EXISTS ix_users_tenant_id ON users (tenant_id)")
+    op.execute('CREATE INDEX IF NOT EXISTS ix_users_email ON users (email)')
 
     # user_tenants
     op.create_table(
@@ -68,7 +68,7 @@ def upgrade() -> None:
         sa.Column("field_permissions", postgresql.JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_roles_tenant_id", "roles", ["tenant_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_roles_tenant_id ON roles (tenant_id)')
 
     # sessions
     op.create_table(
@@ -80,8 +80,8 @@ def upgrade() -> None:
         sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_sessions_tenant_id", "sessions", ["tenant_id"])
-    op.create_index("ix_sessions_user_id", "sessions", ["user_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_sessions_tenant_id ON sessions (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_sessions_user_id ON sessions (user_id)')
 
     # audit_log
     op.create_table(
@@ -95,10 +95,10 @@ def upgrade() -> None:
         sa.Column("changes", postgresql.JSONB, nullable=True),
         sa.Column("timestamp", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_audit_log_tenant_id", "audit_log", ["tenant_id"])
-    op.create_index("ix_audit_log_entity_type", "audit_log", ["entity_type"])
-    op.create_index("ix_audit_log_user_id", "audit_log", ["user_id"])
-    op.create_index("ix_audit_log_timestamp", "audit_log", ["timestamp"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_audit_log_tenant_id ON audit_log (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_audit_log_entity_type ON audit_log (entity_type)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_audit_log_user_id ON audit_log (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_audit_log_timestamp ON audit_log (timestamp)')
 
     # deletion_log
     op.create_table(
@@ -124,9 +124,9 @@ def upgrade() -> None:
         sa.Column("read_at", sa.DateTime(timezone=True), nullable=True),
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_notifications_tenant_id", "notifications", ["tenant_id"])
-    op.create_index("ix_notifications_user_id", "notifications", ["user_id"])
-    op.create_index("ix_notifications_tenant_user_read", "notifications", ["tenant_id", "user_id", "read_at"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notifications_tenant_id ON notifications (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notifications_user_id ON notifications (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notifications_tenant_user_read ON notifications (tenant_id, user_id, read_at)')
 
     # password_reset_tokens
     op.create_table(
@@ -138,9 +138,9 @@ def upgrade() -> None:
         sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
         sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_password_reset_tokens_tenant_id", "password_reset_tokens", ["tenant_id"])
-    op.create_index("ix_password_reset_tokens_user_id", "password_reset_tokens", ["user_id"])
-    op.create_index("ix_password_reset_tokens_token_hash", "password_reset_tokens", ["token_hash"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_password_reset_tokens_tenant_id ON password_reset_tokens (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_password_reset_tokens_user_id ON password_reset_tokens (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_password_reset_tokens_token_hash ON password_reset_tokens (token_hash)')
 
     # api_tokens
     op.create_table(
@@ -156,9 +156,9 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_api_tokens_tenant_id", "api_tokens", ["tenant_id"])
-    op.create_index("ix_api_tokens_token_hash", "api_tokens", ["token_hash"])
-    op.create_index("ix_api_tokens_tenant_user", "api_tokens", ["tenant_id", "user_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_api_tokens_tenant_id ON api_tokens (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_api_tokens_token_hash ON api_tokens (token_hash)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_api_tokens_tenant_user ON api_tokens (tenant_id, user_id)')
 
     # companies
     op.create_table(
@@ -178,9 +178,9 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_companies_tenant_id", "companies", ["tenant_id"])
-    op.create_index("ix_companies_tenant_deleted", "companies", ["tenant_id", "deleted_at"])
-    op.create_index("ix_companies_tenant_name", "companies", ["tenant_id", "name"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_companies_tenant_id ON companies (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_companies_tenant_deleted ON companies (tenant_id, deleted_at)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_companies_tenant_name ON companies (tenant_id, name)')
 
     # Enable RLS on tenant-scoped tables
     for table in ["companies", "users", "roles", "sessions", "audit_log", "notifications", "api_tokens"]:

alembic/versions/0002_contacts_fts.py

@@ -34,17 +34,8 @@ def upgrade() -> None:
         ) STORED
         """
     )
-    op.create_index(
-        "ix_companies_search_vec",
-        "companies",
-        ["search_tsv"],
-        postgresql_using="gin",
-    )
-    op.create_index(
-        "ix_companies_industry",
-        "companies",
-        ["tenant_id", "industry"],
-    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_companies_search_vec ON companies (search_tsv)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_companies_industry ON companies (tenant_id, industry)')
 
     # --- contacts ---
     op.create_table(
@@ -66,10 +57,10 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_contacts_tenant_id", "contacts", ["tenant_id"])
-    op.create_index("ix_contacts_tenant_deleted", "contacts", ["tenant_id", "deleted_at"])
-    op.create_index("ix_contacts_tenant_name", "contacts", ["tenant_id", "last_name", "first_name"])
-    op.create_index("ix_contacts_email", "contacts", ["email"])
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_tenant_id ON contacts (tenant_id)")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_tenant_deleted ON contacts (tenant_id, deleted_at)")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_tenant_name ON contacts (tenant_id, last_name, first_name)")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_email ON contacts (email)")
 
     # --- company_contacts (N:M join) ---
     op.create_table(
@@ -84,9 +75,9 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.UniqueConstraint("company_id", "contact_id", "tenant_id", name="uq_company_contact_tenant"),
     )
-    op.create_index("ix_cc_company", "company_contacts", ["company_id"])
-    op.create_index("ix_cc_contact", "company_contacts", ["contact_id"])
-    op.create_index("ix_company_contacts_tenant_id", "company_contacts", ["tenant_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cc_company ON company_contacts (company_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cc_contact ON company_contacts (contact_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_company_contacts_tenant_id ON company_contacts (tenant_id)')
 
     # --- RLS on new tenant-scoped tables ---
     for table in ["contacts", "company_contacts"]:

alembic/versions/0003_plugin_system.py

@@ -34,7 +34,7 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_plugins_name", "plugins", ["name"], unique=True)
+    op.execute('CREATE INDEX IF NOT EXISTS ix_plugins_name ON plugins (name)')
 
     # --- plugin_migrations table (tracks which migrations have been applied) ---
     op.create_table(
@@ -47,7 +47,7 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.UniqueConstraint("plugin_name", "migration_file", name="ix_plugin_migrations_unique"),
     )
-    op.create_index("ix_plugin_migrations_plugin", "plugin_migrations", ["plugin_name"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_plugin_migrations_plugin ON plugin_migrations (plugin_name)')
 
 
 def downgrade() -> None:

alembic/versions/0004_ai_workflows.py

@@ -31,8 +31,8 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_ai_conversations_tenant_id", "ai_conversations", ["tenant_id"])
-    op.create_index("ix_ai_conversations_tenant_user", "ai_conversations", ["tenant_id", "user_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ai_conversations_tenant_id ON ai_conversations (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ai_conversations_tenant_user ON ai_conversations (tenant_id, user_id)')
 
     # --- ai_messages table (tenant-scoped) ---
     op.create_table(
@@ -49,9 +49,9 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_ai_messages_tenant_id", "ai_messages", ["tenant_id"])
-    op.create_index("ix_ai_messages_tenant_conversation", "ai_messages", ["tenant_id", "conversation_id"])
-    op.create_index("ix_ai_messages_conversation_id", "ai_messages", ["conversation_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ai_messages_tenant_id ON ai_messages (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ai_messages_tenant_conversation ON ai_messages (tenant_id, conversation_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ai_messages_conversation_id ON ai_messages (conversation_id)')
 
     # --- workflows table (tenant-scoped) ---
     op.create_table(
@@ -67,9 +67,9 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_workflows_tenant_id", "workflows", ["tenant_id"])
-    op.create_index("ix_workflows_tenant_active", "workflows", ["tenant_id", "is_active"])
-    op.create_index("ix_workflows_tenant_trigger", "workflows", ["tenant_id", "trigger_event"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_workflows_tenant_id ON workflows (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_workflows_tenant_active ON workflows (tenant_id, is_active)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_workflows_tenant_trigger ON workflows (tenant_id, trigger_event)')
 
     # --- workflow_instances table (tenant-scoped) ---
     op.create_table(
@@ -87,10 +87,10 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_wf_instances_tenant_id", "workflow_instances", ["tenant_id"])
-    op.create_index("ix_wf_instances_tenant_status", "workflow_instances", ["tenant_id", "status"])
-    op.create_index("ix_wf_instances_tenant_workflow", "workflow_instances", ["tenant_id", "workflow_id"])
-    op.create_index("ix_wf_instances_workflow_id", "workflow_instances", ["workflow_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_instances_tenant_id ON workflow_instances (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_instances_tenant_status ON workflow_instances (tenant_id, status)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_instances_tenant_workflow ON workflow_instances (tenant_id, workflow_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_instances_workflow_id ON workflow_instances (workflow_id)')
 
     # --- workflow_step_history table (tenant-scoped) ---
     op.create_table(
@@ -106,9 +106,9 @@ def upgrade() -> None:
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_wf_step_history_tenant_id", "workflow_step_history", ["tenant_id"])
-    op.create_index("ix_wf_step_history_tenant_instance", "workflow_step_history", ["tenant_id", "instance_id"])
-    op.create_index("ix_wf_step_history_instance_id", "workflow_step_history", ["instance_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_step_history_tenant_id ON workflow_step_history (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_step_history_tenant_instance ON workflow_step_history (tenant_id, instance_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_wf_step_history_instance_id ON workflow_step_history (instance_id)')
 
     # --- RLS Policies ---
     for table in ["ai_conversations", "ai_messages", "workflows", "workflow_instances", "workflow_step_history"]:

alembic/versions/0005_user_role_fk.py

@@ -20,16 +20,8 @@ depends_on: Union[str, Sequence[str], None] = None
 
 
 def upgrade() -> None:
-    op.add_column(
-        "users",
-        sa.Column(
-            "role_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("roles.id", ondelete="SET NULL"),
-            nullable=True,
-        ),
-    )
-    op.create_index("ix_users_role_id", "users", ["role_id"])
+    op.execute("ALTER TABLE users ADD COLUMN IF NOT EXISTS role_id UUID REFERENCES roles(id) ON DELETE SET NULL")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_users_role_id ON users (role_id)")
 
 
 def downgrade() -> None:

alembic/versions/0006_add_addresses.py

@@ -20,18 +20,18 @@ depends_on: Union[str, Sequence[str], None] = None
 
 def upgrade() -> None:
     # Add address columns to companies
-    op.add_column("companies", sa.Column("address_street", sa.String(255), nullable=True))
-    op.add_column("companies", sa.Column("address_city", sa.String(100), nullable=True))
-    op.add_column("companies", sa.Column("address_zip", sa.String(20), nullable=True))
-    op.add_column("companies", sa.Column("address_country", sa.String(2), nullable=True))
-    op.add_column("companies", sa.Column("address_state", sa.String(100), nullable=True))
+    op.execute("ALTER TABLE companies ADD COLUMN IF NOT EXISTS address_street VARCHAR(255)")
+    op.execute("ALTER TABLE companies ADD COLUMN IF NOT EXISTS address_city VARCHAR(100)")
+    op.execute("ALTER TABLE companies ADD COLUMN IF NOT EXISTS address_zip VARCHAR(20)")
+    op.execute("ALTER TABLE companies ADD COLUMN IF NOT EXISTS address_country VARCHAR(2)")
+    op.execute("ALTER TABLE companies ADD COLUMN IF NOT EXISTS address_state VARCHAR(100)")
 
     # Add address columns to contacts
-    op.add_column("contacts", sa.Column("address_street", sa.String(255), nullable=True))
-    op.add_column("contacts", sa.Column("address_city", sa.String(100), nullable=True))
-    op.add_column("contacts", sa.Column("address_zip", sa.String(20), nullable=True))
-    op.add_column("contacts", sa.Column("address_country", sa.String(2), nullable=True))
-    op.add_column("contacts", sa.Column("address_state", sa.String(100), nullable=True))
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS address_street VARCHAR(255)")
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS address_city VARCHAR(100)")
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS address_zip VARCHAR(20)")
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS address_country VARCHAR(2)")
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS address_state VARCHAR(100)")
 
 
 def downgrade() -> None:

alembic/versions/0007_currencies.py

@@ -32,8 +32,8 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_currencies_tenant_code", "currencies", ["tenant_id", "code"])
-    op.create_index("ix_currencies_tenant_default", "currencies", ["tenant_id", "is_default"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_currencies_tenant_code ON currencies (tenant_id, code)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_currencies_tenant_default ON currencies (tenant_id, is_default)')
 
 
 def downgrade() -> None:

alembic/versions/0008_tax_rates.py

@@ -32,8 +32,8 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_tax_rates_tenant_name", "tax_rates", ["tenant_id", "name"])
-    op.create_index("ix_tax_rates_tenant_default", "tax_rates", ["tenant_id", "is_default"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_tax_rates_tenant_name ON tax_rates (tenant_id, name)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_tax_rates_tenant_default ON tax_rates (tenant_id, is_default)')
 
 
 def downgrade() -> None:

alembic/versions/0009_sequences.py

@@ -32,7 +32,7 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_sequences_tenant_name", "sequences", ["tenant_id", "name"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_sequences_tenant_name ON sequences (tenant_id, name)')
 
 
 def downgrade() -> None:

alembic/versions/0010_system_settings.py

@@ -48,7 +48,7 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_system_settings_tenant", "system_settings", ["tenant_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_system_settings_tenant ON system_settings (tenant_id)')
 
 
 def downgrade() -> None:

alembic/versions/0011_attachments.py

@@ -36,7 +36,7 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_attachments_entity", "attachments", ["entity_type", "entity_id", "tenant_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_attachments_entity ON attachments (entity_type, entity_id, tenant_id)')
 
 
 def downgrade() -> None:

alembic/versions/0013_addresses.py

@@ -41,8 +41,8 @@ def upgrade() -> None:
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
 
-    op.create_index("ix_addresses_tenant_entity", "addresses", ["tenant_id", "entity_type", "entity_id"])
-    op.create_index("ix_addresses_tenant_type", "addresses", ["tenant_id", "address_type"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_addresses_tenant_entity ON addresses (tenant_id, entity_type, entity_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_addresses_tenant_type ON addresses (tenant_id, address_type)')
 
     # Unique constraint: one default per (tenant, entity_type, entity_id, address_type)
     # Using a partial unique index WHERE is_default = true

alembic/versions/0017_notification_preferences.py

@@ -54,7 +54,7 @@ def upgrade() -> None:
         sa.Column("is_enabled_by_default", sa.Boolean(), nullable=False, server_default=sa.text("true")),
         sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.create_index("ix_notification_types_key", "notification_types", ["type_key"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notification_types_key ON notification_types (type_key)')
 
     # notification_preferences table
     op.create_table(
@@ -67,8 +67,8 @@ def upgrade() -> None:
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.UniqueConstraint("user_id", "type_key", name="uq_notif_pref_user_type"),
     )
-    op.create_index("ix_notif_prefs_user", "notification_preferences", ["user_id"])
-    op.create_index("ix_notif_prefs_tenant", "notification_preferences", ["tenant_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notif_prefs_user ON notification_preferences (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_notif_prefs_tenant ON notification_preferences (tenant_id)')
 
     # Seed mail plugin notification types
     for nt in MAIL_NOTIFICATION_TYPES:

alembic/versions/0018_fix_notification_preferences_columns.py

@@ -15,14 +15,8 @@ depends_on = None
 
 def upgrade() -> None:
     # Add missing columns from TimestampMixin and SoftDeleteMixin
-    op.add_column(
-        "notification_preferences",
-        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
-    )
-    op.add_column(
-        "notification_preferences",
-        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
-    )
+    op.execute("ALTER TABLE notification_preferences ADD COLUMN IF NOT EXISTS created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()")
+    op.execute("ALTER TABLE notification_preferences ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMPTZ")
 
 
 def downgrade() -> None:

alembic/versions/0019_rbac_groups.py

@@ -53,7 +53,7 @@ def upgrade() -> None:
         "user_tenants",
         sa.Column("role_id", PGUUID(as_uuid=True), sa.ForeignKey("roles.id", ondelete="SET NULL"), nullable=True),
     )
-    op.create_index("ix_user_tenants_role_id", "user_tenants", ["role_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_user_tenants_role_id ON user_tenants (role_id)')
 
     # ── roles: add denied_permissions + permission_version + missing mixin columns ──
     op.add_column(
@@ -65,14 +65,12 @@ def upgrade() -> None:
         sa.Column("permission_version", sa.Integer, nullable=False, server_default="1"),
     )
     # Add missing TimestampMixin + SoftDeleteMixin columns
+    # Note: deleted_at may already exist if 0012_soft_delete ran first
     op.add_column(
         "roles",
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.add_column(
-        "roles",
-        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
-    )
+    op.execute("ALTER TABLE roles ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE")
 
     # ── Seed default roles per tenant ──
     # For each tenant, create admin/editor/viewer role records if they don't exist

alembic/versions/0021_unified_contacts.py

@@ -3,27 +3,75 @@
 Revision ID: 0021
 Revises: 0020
 Create Date: 2026-07-19
+
+SAFE MIGRATION: Old tables are renamed (not dropped), data is migrated
+via INSERT ... SELECT, and old tables are preserved for rollback.
 """
+
+from __future__ import annotations
+
+import logging
+from typing import Sequence, Union
+
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID, TSVECTOR, JSON
 
+revision: str = "0021_unified_contacts"
+down_revision: Union[str, None] = "0020"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
 
-revision = "0021_unified_contacts"
-down_revision = "0020"
+logger = logging.getLogger("alembic.migration.0021")
 
 
-def upgrade():
-    # 1. Drop old company_contacts join table
-    op.execute("DROP TABLE IF EXISTS company_contacts CASCADE")
+def _table_exists(conn, table_name: str) -> bool:
+    """Check whether *table_name* exists in the public schema."""
+    result = conn.execute(
+        sa.text(
+            "SELECT 1 FROM information_schema.tables "
+            "WHERE table_schema = 'public' AND table_name = :t"
+        ),
+        {"t": table_name},
+    ).fetchone()
+    return result is not None
 
-    # 2. Drop old contacts table (will recreate with new schema)
-    op.execute("DROP TABLE IF EXISTS contacts CASCADE")
 
-    # 3. Drop old companies table
-    op.execute("DROP TABLE IF EXISTS companies CASCADE")
+def _column_exists(conn, table_name: str, column_name: str) -> bool:
+    """Check whether *column_name* exists on *table_name*."""
+    result = conn.execute(
+        sa.text(
+            "SELECT 1 FROM information_schema.columns "
+            "WHERE table_schema = 'public' "
+            "AND table_name = :t AND column_name = :c"
+        ),
+        {"t": table_name, "c": column_name},
+    ).fetchone()
+    return result is not None
 
-    # 4. Create contacts table (without default_person_id/admin_contactperson_id FKs first)
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Rename old tables instead of dropping ──────────────────────
+    #    Only rename if the table exists and the _old version doesn't.
+    old_tables = ["company_contacts", "contacts", "companies"]
+    renamed: list[str] = []
+
+    for tbl in old_tables:
+        old_name = f"{tbl}_old"
+        if _table_exists(conn, tbl) and not _table_exists(conn, old_name):
+            op.execute(f'ALTER TABLE "{tbl}" RENAME TO "{old_name}"')
+            renamed.append(old_name)
+            logger.info("Renamed %s → %s", tbl, old_name)
+        elif _table_exists(conn, old_name):
+            logger.info("%s already exists — skipping rename of %s", old_name, tbl)
+        else:
+            logger.info("Table %s does not exist — nothing to rename", tbl)
+
+    # ── 2. Create new contacts table ──────────────────────────────────
+    # Drop indexes that were carried over from the renamed old tables
+    op.execute("DROP INDEX IF EXISTS ix_contacts_tenant_id")
     op.create_table(
         "contacts",
         sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
@@ -115,15 +163,18 @@ def upgrade():
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_contacts_tenant_deleted", "contacts", ["tenant_id", "deleted_at"])
-    op.create_index("ix_contacts_tenant_type", "contacts", ["tenant_id", "type"])
-    op.create_index("ix_contacts_tenant_name", "contacts", ["tenant_id", "name"])
-    op.create_index("ix_contacts_tenant_displayname", "contacts", ["tenant_id", "displayname"])
-    op.create_index("ix_contacts_email", "contacts", ["email_1"])
-    op.create_index("ix_contacts_code", "contacts", ["code"])
-    op.create_index("ix_contacts_search_vec", "contacts", ["search_tsv"], postgresql_using="gin")
+    op.execute("DROP INDEX IF EXISTS ix_contacts_tenant_deleted")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_tenant_deleted ON contacts (tenant_id, deleted_at)")
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contacts_tenant_type ON contacts (tenant_id, type)')
+    op.execute("DROP INDEX IF EXISTS ix_contacts_tenant_name")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_tenant_name ON contacts (tenant_id, name)")
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contacts_tenant_displayname ON contacts (tenant_id, displayname)')
+    op.execute("DROP INDEX IF EXISTS ix_contacts_email")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_contacts_email ON contacts (email_1)")
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contacts_code ON contacts (code)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contacts_search_vec ON contacts (search_tsv)')
 
-    # 5. Create contactpersons table
+    # ── 3. Create contactpersons table ────────────────────────────────
     op.create_table(
         "contactpersons",
         sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
@@ -151,15 +202,179 @@ def upgrade():
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_contactpersons_tenant_deleted", "contactpersons", ["tenant_id", "deleted_at"])
-    op.create_index("ix_contactpersons_contact", "contactpersons", ["contact_id"])
-    op.create_index("ix_contactpersons_email", "contactpersons", ["email"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contactpersons_tenant_deleted ON contactpersons (tenant_id, deleted_at)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contactpersons_contact ON contactpersons (contact_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contactpersons_email ON contactpersons (email)')
 
-    # 6. Add FK columns to contacts that reference contactpersons
-    op.add_column("contacts", sa.Column("default_person_id", UUID(as_uuid=True), sa.ForeignKey("contactpersons.id", ondelete="SET NULL"), nullable=True))
-    op.add_column("contacts", sa.Column("admin_contactperson_id", UUID(as_uuid=True), sa.ForeignKey("contactpersons.id", ondelete="SET NULL"), nullable=True))
+    # ── 4. Add FK columns to contacts that reference contactpersons ───
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS default_person_id UUID REFERENCES contactpersons(id) ON DELETE SET NULL")
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS admin_contactperson_id UUID REFERENCES contactpersons(id) ON DELETE SET NULL")
+
+    # ── 5. Migrate data from old tables ────────────────────────────────
+
+    # 5a. companies_old → contacts (type='company')
+    if _table_exists(conn, "companies_old"):
+        # Build column list dynamically based on what exists in companies_old
+        company_cols = {
+            "id": "id",
+            "tenant_id": "tenant_id",
+            "name": "name",
+            "phone": "phone_1",
+            "email": "email_1",
+            "website": "website",
+            "description": "projectnote",
+            "deleted_at": "deleted_at",
+            "created_by": "created_by",
+            "updated_by": "updated_by",
+            "created_at": "created_at",
+            "updated_at": "updated_at",
+        }
+        # account_number → code (check if it exists)
+        if _column_exists(conn, "companies_old", "account_number"):
+            company_cols["account_number"] = "code"
+        # industry → tags (check if it exists)
+        if _column_exists(conn, "companies_old", "industry"):
+            company_cols["industry"] = "tags"
+
+        select_cols = []
+        insert_cols = []
+        for old_col, new_col in company_cols.items():
+            select_cols.append(old_col)
+            insert_cols.append(new_col)
+
+        # Build the INSERT ... SELECT statement
+        select_list = ", ".join(f'"{c}"' for c in select_cols)
+        # Add computed columns
+        select_list += ", 'company' AS type, "
+        # displayname = name
+        if "name" in select_cols:
+            select_list += '"name" AS displayname'
+        else:
+            select_list += "'' AS displayname"
+
+        insert_list = ", ".join(f'"{c}"' for c in insert_cols) + ', "type", "displayname"'
+
+        sql = f'INSERT INTO contacts ({insert_list}) SELECT {select_list} FROM companies_old'
+        op.execute(sql)
+
+        row_count = conn.execute(sa.text("SELECT COUNT(*) FROM companies_old")).scalar()
+        logger.info("Migrated %d rows from companies_old → contacts (type='company')", row_count or 0)
+
+    # 5b. contacts_old → contacts (type='person')
+    if _table_exists(conn, "contacts_old"):
+        # Map old contact columns to new contacts columns
+        contact_cols = {
+            "id": "id",
+            "tenant_id": "tenant_id",
+            "first_name": "firstname",
+            "last_name": "surname",
+            "email": "email_1",
+            "phone": "phone_1",
+            "deleted_at": "deleted_at",
+            "created_by": "created_by",
+            "updated_by": "updated_by",
+            "created_at": "created_at",
+            "updated_at": "updated_at",
+        }
+        # mobile → phone_2
+        if _column_exists(conn, "contacts_old", "mobile"):
+            contact_cols["mobile"] = "phone_2"
+        # notes → projectnote
+        if _column_exists(conn, "contacts_old", "notes"):
+            contact_cols["notes"] = "projectnote"
+
+        select_cols = []
+        insert_cols = []
+        for old_col, new_col in contact_cols.items():
+            select_cols.append(old_col)
+            insert_cols.append(new_col)
+
+        select_list = ", ".join(f'"{c}"' for c in select_cols)
+        # Add computed columns
+        select_list += ", 'person' AS type, "
+        # displayname = first_name || ' ' || last_name
+        if _column_exists(conn, "contacts_old", "first_name") and _column_exists(conn, "contacts_old", "last_name"):
+            select_list += "COALESCE(first_name, '') || ' ' || COALESCE(last_name, '') AS displayname"
+        elif _column_exists(conn, "contacts_old", "first_name"):
+            select_list += "first_name AS displayname"
+        else:
+            select_list += "'' AS displayname"
+
+        insert_list = ", ".join(f'"{c}"' for c in insert_cols) + ', "type", "displayname"'
+
+        sql = f'INSERT INTO contacts ({insert_list}) SELECT {select_list} FROM contacts_old'
+        op.execute(sql)
+
+        row_count = conn.execute(sa.text("SELECT COUNT(*) FROM contacts_old")).scalar()
+        logger.info("Migrated %d rows from contacts_old → contacts (type='person')", row_count or 0)
+
+    # 5c. company_contacts_old → contactpersons
+    #     Each row links a company to a person. In the new schema, contactpersons
+    #     are persons attached to a company contact. We map:
+    #       contact_id (FK to contacts) = company_id (the company, now a contact)
+    #       person details come from the old contacts table
+    if _table_exists(conn, "company_contacts_old") and _table_exists(conn, "contacts_old"):
+        sql = """
+            INSERT INTO contactpersons (
+                id, tenant_id, contact_id, displayname,
+                firstname, lastname, function, phone, email,
+                tags, created_at, updated_at, deleted_at
+            )
+            SELECT
+                gen_random_uuid(),
+                cc.tenant_id,
+                cc.company_id,
+                COALESCE(c.first_name, '') || ' ' || COALESCE(c.last_name, ''),
+                c.first_name,
+                c.last_name,
+                cc.role_at_company,
+                c.phone,
+                c.email,
+                CASE WHEN cc.is_primary THEN 'primary' ELSE NULL END,
+                cc.created_at,
+                cc.updated_at,
+                cc.deleted_at
+            FROM company_contacts_old cc
+            JOIN contacts_old c ON cc.contact_id = c.id
+        """
+        op.execute(sql)
+
+        row_count = conn.execute(sa.text("SELECT COUNT(*) FROM company_contacts_old")).scalar()
+        logger.info("Migrated %d rows from company_contacts_old → contactpersons", row_count or 0)
+
+    # ── 6. Enable RLS on new tables ───────────────────────────────────
+    for table_name in ["contacts", "contactpersons"]:
+        op.execute(f'ALTER TABLE "{table_name}" ENABLE ROW LEVEL SECURITY')
+        op.execute(f'DROP POLICY IF EXISTS tenant_isolation ON "{table_name}"')
+        op.execute(
+            f'CREATE POLICY tenant_isolation ON "{table_name}" '
+            f"USING (tenant_id = current_setting('app.current_tenant_id')::uuid)"
+        )
 
 
-def downgrade():
-    op.drop_table("contacts")
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # Drop RLS policies on new tables
+    for table_name in ["contactpersons", "contacts"]:
+        op.execute(f'DROP POLICY IF EXISTS tenant_isolation ON "{table_name}"')
+        op.execute(f'ALTER TABLE "{table_name}" DISABLE ROW LEVEL SECURITY')
+
+    # Drop FK columns from contacts
+    op.drop_column("contacts", "admin_contactperson_id")
+    op.drop_column("contacts", "default_person_id")
+
+    # Drop new tables
     op.drop_table("contactpersons")
+    op.drop_table("contacts")
+
+    # Restore old tables by renaming _old suffix back
+    for tbl in ["companies", "contacts", "company_contacts"]:
+        old_name = f"{tbl}_old"
+        if _table_exists(conn, old_name) and not _table_exists(conn, tbl):
+            op.execute(f'ALTER TABLE "{old_name}" RENAME TO "{tbl}"')
+            logger.info("Restored %s → %s", old_name, tbl)
+        elif _table_exists(conn, old_name) and _table_exists(conn, tbl):
+            # Both exist — drop the _old version (new table takes precedence)
+            op.execute(f'DROP TABLE "{old_name}" CASCADE')
+            logger.info("Dropped leftover %s (new %s already exists)", old_name, tbl)

alembic/versions/0022_contact_folders.py

@@ -27,15 +27,12 @@ def upgrade():
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
         sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
     )
-    op.create_index("ix_contact_folders_tenant_parent", "contact_folders", ["tenant_id", "parent_id"])
-    op.create_index("ix_contact_folders_user", "contact_folders", ["user_id"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contact_folders_tenant_parent ON contact_folders (tenant_id, parent_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contact_folders_user ON contact_folders (user_id)')
 
     # 2. Add folder_id column to contacts
-    op.add_column(
-        "contacts",
-        sa.Column("folder_id", UUID(as_uuid=True), sa.ForeignKey("contact_folders.id", ondelete="SET NULL"), nullable=True),
-    )
-    op.create_index("ix_contacts_folder_id", "contacts", ["folder_id"])
+    op.execute("ALTER TABLE contacts ADD COLUMN IF NOT EXISTS folder_id UUID REFERENCES contact_folders(id) ON DELETE SET NULL")
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contacts_folder_id ON contacts (folder_id)')
 
 
 def downgrade():

alembic/versions/0023_theme_customization.py

@@ -0,0 +1,26 @@
+"""Theme customization — add theme fields to system_settings.
+
+Revision ID: 0023
+Revises: 0022_contact_folders
+Create Date: 2026-07-23
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0023_theme_customization"
+down_revision = "0022_contact_folders"
+
+
+def upgrade():
+    op.execute("ALTER TABLE system_settings ADD COLUMN IF NOT EXISTS theme_primary_color VARCHAR(20) NOT NULL DEFAULT '#2563eb'")
+    op.execute("ALTER TABLE system_settings ADD COLUMN IF NOT EXISTS theme_accent_color VARCHAR(20) NOT NULL DEFAULT '#d946ef'")
+    op.execute("ALTER TABLE system_settings ADD COLUMN IF NOT EXISTS theme_font_family VARCHAR(100) NOT NULL DEFAULT 'Inter'")
+    op.execute("ALTER TABLE system_settings ADD COLUMN IF NOT EXISTS theme_border_radius VARCHAR(20) NOT NULL DEFAULT '0.5rem'")
+
+
+def downgrade():
+    op.drop_column("system_settings", "theme_border_radius")
+    op.drop_column("system_settings", "theme_font_family")
+    op.drop_column("system_settings", "theme_accent_color")
+    op.drop_column("system_settings", "theme_primary_color")

alembic/versions/0024_heartbeat_config.py

@@ -0,0 +1,30 @@
+"""Heartbeat configuration — add heartbeat fields to ai_proactive_settings.
+
+Revision ID: 0024
+Revises: 0023_theme_customization
+Create Date: 2026-07-23
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0024_heartbeat_config"
+down_revision = "0023_theme_customization"
+
+
+def upgrade():
+    op.execute("""
+        DO $$ BEGIN
+          IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'ai_proactive_settings') THEN
+            ALTER TABLE ai_proactive_settings ADD COLUMN IF NOT EXISTS heartbeat_enabled BOOLEAN NOT NULL DEFAULT true;
+            ALTER TABLE ai_proactive_settings ADD COLUMN IF NOT EXISTS heartbeat_interval_seconds INTEGER NOT NULL DEFAULT 300;
+            ALTER TABLE ai_proactive_settings ADD COLUMN IF NOT EXISTS heartbeat_target_room VARCHAR(200) NOT NULL DEFAULT 'Live KI';
+          END IF;
+        END $$
+    """)
+
+
+def downgrade():
+    op.drop_column("ai_proactive_settings", "heartbeat_target_room")
+    op.drop_column("ai_proactive_settings", "heartbeat_interval_seconds")
+    op.drop_column("ai_proactive_settings", "heartbeat_enabled")

alembic/versions/0025_entity_history.py

@@ -0,0 +1,53 @@
+"""Entity history table for undo/restore functionality.
+
+Revision ID: 0025_entity_history
+Revises: 0024_heartbeat_config
+Create Date: 2026-07-23
+"""
+
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0025_entity_history"
+down_revision: Union[str, None] = "0024_heartbeat_config"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "entity_history",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("tenant_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("entity_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("action", sa.String(20), nullable=False),
+        sa.Column("snapshot_before", postgresql.JSONB, nullable=True),
+        sa.Column("snapshot_after", postgresql.JSONB, nullable=True),
+        sa.Column("changes", postgresql.JSONB, nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_tenant_id ON entity_history (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_entity_type ON entity_history (entity_type)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_entity_id ON entity_history (entity_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_user_id ON entity_history (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_created_at ON entity_history (created_at)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_entity_history_tenant_entity ON entity_history (tenant_id, entity_type, entity_id, created_at)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_entity_history_tenant_entity", table_name="entity_history")
+    op.drop_index("ix_entity_history_created_at", table_name="entity_history")
+    op.drop_index("ix_entity_history_user_id", table_name="entity_history")
+    op.drop_index("ix_entity_history_entity_id", table_name="entity_history")
+    op.drop_index("ix_entity_history_entity_type", table_name="entity_history")
+    op.drop_index("ix_entity_history_tenant_id", table_name="entity_history")
+    op.drop_table("entity_history")

alembic/versions/0026_mail_salt_security.py

@@ -0,0 +1,24 @@
+"""Mail salt security fix — add password_salt column to mail_accounts.
+
+Revision ID: 0026
+Revises: 0025_entity_history
+Create Date: 2026-07-23
+
+Existing accounts get an empty salt and will use the legacy hardcoded salt
+for backward compatibility. New accounts and password changes will use
+per-account random salts.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0026_mail_salt_security"
+down_revision = "0025_entity_history"
+
+
+def upgrade():
+    op.execute("ALTER TABLE IF EXISTS mail_accounts ADD COLUMN IF NOT EXISTS password_salt VARCHAR(64) NOT NULL DEFAULT ''")
+
+
+def downgrade():
+    op.drop_column("mail_accounts", "password_salt")

alembic/versions/0027_unify_company_to_contact.py

@@ -0,0 +1,186 @@
+"""Unify entity_type 'company' to 'contact' across all plugins.
+
+Revision ID: 0027
+Revises: 0026_mail_salt_security
+Create Date: 2026-07-23
+
+SAFE MIGRATION: When both company_id and contact_id columns exist in mails,
+company_id values are copied to contact_id (where contact_id IS NULL) before
+the column is dropped. A backup column is created to track which rows were
+originally linked to companies for safe downgrade.
+
+Changes:
+- UPDATE entity_links SET entity_type='contact' WHERE entity_type='company'
+- UPDATE tag_assignments SET entity_type='contact' WHERE entity_type='company'
+- UPDATE calendar_entry_links SET entity_type='contact' WHERE entity_type='company'
+- UPDATE addresses SET entity_type='contact' WHERE entity_type='company'
+- mails: copy company_id → contact_id WHERE contact_id IS NULL, then drop company_id
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0027_unify_company_to_contact"
+down_revision: Union[str, None] = "0026_mail_salt_security"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+logger = logging.getLogger("alembic.migration.0027")
+
+
+def _column_exists(conn, table_name: str, column_name: str) -> bool:
+    """Check whether *column_name* exists on *table_name* in public schema."""
+    result = conn.execute(
+        sa.text(
+            "SELECT 1 FROM information_schema.columns "
+            "WHERE table_schema = 'public' "
+            "AND table_name = :t AND column_name = :c"
+        ),
+        {"t": table_name, "c": column_name},
+    ).fetchone()
+    return result is not None
+
+
+def _table_exists(conn, table_name: str) -> bool:
+    """Check whether *table_name* exists in public schema."""
+    result = conn.execute(
+        sa.text(
+            "SELECT 1 FROM information_schema.tables "
+            "WHERE table_schema = 'public' AND table_name = :t"
+        ),
+        {"t": table_name},
+    ).fetchone()
+    return result is not None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Update entity_type: 'company' → 'contact' across link tables ──
+
+    if _table_exists(conn, "entity_links"):
+        result = conn.execute(
+            sa.text("UPDATE entity_links SET entity_type = 'contact' WHERE entity_type = 'company'")
+        )
+        logger.info("Updated %d rows in entity_links (company → contact)", result.rowcount)
+
+    if _table_exists(conn, "tag_assignments"):
+        result = conn.execute(
+            sa.text("UPDATE tag_assignments SET entity_type = 'contact' WHERE entity_type = 'company'")
+        )
+        logger.info("Updated %d rows in tag_assignments (company → contact)", result.rowcount)
+
+    if _table_exists(conn, "calendar_entry_links"):
+        result = conn.execute(
+            sa.text("UPDATE calendar_entry_links SET entity_type = 'contact' WHERE entity_type = 'company'")
+        )
+        logger.info("Updated %d rows in calendar_entry_links (company → contact)", result.rowcount)
+
+    if _table_exists(conn, "addresses"):
+        result = conn.execute(
+            sa.text("UPDATE addresses SET entity_type = 'contact' WHERE entity_type = 'company'")
+        )
+        logger.info("Updated %d rows in addresses (company → contact)", result.rowcount)
+
+    # ── 2. Mails: unify company_id into contact_id ──────────────────────
+    if not _table_exists(conn, "mails"):
+        logger.info("Table 'mails' does not exist — skipping column migration")
+        return
+
+    has_company_id = _column_exists(conn, "mails", "company_id")
+    has_contact_id = _column_exists(conn, "mails", "contact_id")
+
+    if has_company_id and has_contact_id:
+        # Both columns exist: copy company_id → contact_id WHERE contact_id IS NULL
+        result = conn.execute(
+            sa.text(
+                "UPDATE mails SET contact_id = company_id "
+                "WHERE contact_id IS NULL AND company_id IS NOT NULL"
+            )
+        )
+        logger.info("Copied %d rows from company_id → contact_id in mails", result.rowcount)
+
+        # Create a backup marker column to track rows originally linked via company_id
+        # This enables a targeted downgrade (only revert these rows, not all contact rows)
+        if not _column_exists(conn, "mails", "_orig_company_id"):
+            op.add_column("mails", sa.Column("_orig_company_id", sa.dialects.postgresql.UUID(as_uuid=True), nullable=True))
+            # Record which rows had company_id set (these came from companies)
+            op.execute(
+                "UPDATE mails SET _orig_company_id = company_id WHERE company_id IS NOT NULL"
+            )
+            logger.info("Created _orig_company_id backup column for downgrade tracking")
+
+        # Now safe to drop company_id
+        op.drop_column("mails", "company_id")
+        logger.info("Dropped column company_id from mails")
+
+    elif has_company_id and not has_contact_id:
+        # Only company_id exists: simple rename
+        op.alter_column("mails", "company_id", new_column_name="contact_id")
+        logger.info("Renamed company_id → contact_id in mails")
+
+    else:
+        logger.info("No company_id column in mails — nothing to do")
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Revert mails: contact_id → company_id ────────────────────────
+    if not _table_exists(conn, "mails"):
+        return
+
+    has_contact_id = _column_exists(conn, "mails", "contact_id")
+    has_company_id = _column_exists(conn, "mails", "company_id")
+    has_orig = _column_exists(conn, "mails", "_orig_company_id")
+
+    if has_contact_id and not has_company_id:
+        if has_orig:
+            # Targeted revert: only restore rows that originally came from company_id
+            # Re-add company_id column
+            op.add_column("mails", sa.Column("company_id", sa.dialects.postgresql.UUID(as_uuid=True), nullable=True))
+            # Restore company_id from the backup marker where it was originally set
+            op.execute(
+                "UPDATE mails SET company_id = _orig_company_id WHERE _orig_company_id IS NOT NULL"
+            )
+            # Clear contact_id for rows that were originally company links
+            # (only where contact_id matches the original company_id, i.e. it was copied)
+            op.execute(
+                "UPDATE mails SET contact_id = NULL "
+                "WHERE _orig_company_id IS NOT NULL AND contact_id = _orig_company_id"
+            )
+            # Drop the backup marker
+            op.drop_column("mails", "_orig_company_id")
+            logger.info("Restored company_id from _orig_company_id backup (targeted revert)")
+        else:
+            # No backup column — simple rename (fallback for clean installs)
+            op.alter_column("mails", "contact_id", new_column_name="company_id")
+            logger.info("Renamed contact_id → company_id in mails (no backup marker)")
+
+    # ── 2. Revert entity_type: 'contact' → 'company' ────────────────────
+    # NOTE: This is a lossy revert — we cannot distinguish rows that were
+    # originally 'company' from rows that were always 'contact'. This only
+    # reverts rows that are currently 'contact' back to 'company'.
+    # A proper revert requires application-level audit logs.
+
+    if _table_exists(conn, "entity_links"):
+        conn.execute(
+            sa.text("UPDATE entity_links SET entity_type = 'company' WHERE entity_type = 'contact'")
+        )
+    if _table_exists(conn, "tag_assignments"):
+        conn.execute(
+            sa.text("UPDATE tag_assignments SET entity_type = 'company' WHERE entity_type = 'contact'")
+        )
+    if _table_exists(conn, "calendar_entry_links"):
+        conn.execute(
+            sa.text("UPDATE calendar_entry_links SET entity_type = 'company' WHERE entity_type = 'contact'")
+        )
+    if _table_exists(conn, "addresses"):
+        conn.execute(
+            sa.text("UPDATE addresses SET entity_type = 'company' WHERE entity_type = 'contact'")
+        )

alembic/versions/0028_rls_force.py

@@ -0,0 +1,104 @@
+"""FORCE Row Level Security + WITH CHECK on all tenant-scoped tables.
+
+Revision ID: 0028_rls_force
+Revises: 0027_unify_company_to_contact
+Create Date: 2026-07-25
+
+This migration:
+1. Discovers all tables in the public schema that have a tenant_id column.
+2. ALTER TABLE ... FORCE ROW LEVEL SECURITY on each (ensures RLS applies to table owners too).
+3. Drops existing tenant_isolation policies and recreates them with both
+   USING and WITH CHECK clauses so writes are also filtered by tenant.
+4. Covers core tables AND plugin tables (anything with tenant_id).
+
+Idempotent: safe to run multiple times.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0028_rls_force"
+down_revision: Union[str, None] = "0027_unify_company_to_contact"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+logger = logging.getLogger("alembic.migration.0028_rls_force")
+
+
+def _discover_tenant_tables(conn) -> list[str]:
+    """Return all table names in the public schema that have a tenant_id column."""
+    result = conn.execute(
+        sa.text(
+            "SELECT table_name FROM information_schema.columns "
+            "WHERE table_schema = 'public' AND column_name = 'tenant_id' "
+            "ORDER BY table_name"
+        )
+    )
+    return [row[0] for row in result.fetchall()]
+
+
+def _discover_existing_policies(conn, table_name: str) -> list[str]:
+    """Return all policy names on *table_name* that contain 'tenant' or 'isolation'."""
+    result = conn.execute(
+        sa.text(
+            "SELECT policyname FROM pg_policies "
+            "WHERE schemaname = 'public' AND tablename = :t"
+        ),
+        {"t": table_name},
+    )
+    return [row[0] for row in result.fetchall()]
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    tenant_tables = _discover_tenant_tables(conn)
+    logger.info("Discovered %d tenant-scoped tables: %s", len(tenant_tables), tenant_tables)
+
+    for table_name in tenant_tables:
+        # 1. Enable RLS (idempotent — ENABLE is safe to repeat)
+        op.execute(f'ALTER TABLE "{table_name}" ENABLE ROW LEVEL SECURITY')
+
+        # 2. FORCE RLS — ensures policies apply even to table owners/superusers
+        #    who would otherwise bypass RLS
+        op.execute(f'ALTER TABLE "{table_name}" FORCE ROW LEVEL SECURITY')
+
+        # 3. Drop ALL existing policies on this table that relate to tenant isolation
+        existing_policies = _discover_existing_policies(conn, table_name)
+        for policy_name in existing_policies:
+            op.execute(f'DROP POLICY IF EXISTS "{policy_name}" ON "{table_name}"')
+            logger.info("Dropped policy %s on %s", policy_name, table_name)
+
+        # 4. Create new policy with both USING and WITH CHECK
+        #    USING:   filters rows visible in SELECT/UPDATE/DELETE
+        #    WITH CHECK: enforces tenant_id on INSERT/UPDATE
+        op.execute(
+            f'CREATE POLICY tenant_isolation ON "{table_name}" '
+            f"USING (tenant_id = current_setting('app.current_tenant_id')::uuid) "
+            f"WITH CHECK (tenant_id = current_setting('app.current_tenant_id')::uuid)"
+        )
+        logger.info("Created policy tenant_isolation on %s (USING + WITH CHECK)", table_name)
+
+
+def downgrade() -> None:
+    """Revert FORCE RLS and restore USING-only policies (matching 0015 behavior)."""
+    conn = op.get_bind()
+    tenant_tables = _discover_tenant_tables(conn)
+
+    for table_name in tenant_tables:
+        # Drop the USING+WITH CHECK policy
+        op.execute(f'DROP POLICY IF EXISTS tenant_isolation ON "{table_name}"')
+
+        # Remove FORCE but keep ENABLE (matching pre-0028 state)
+        op.execute(f'ALTER TABLE "{table_name}" NO FORCE ROW LEVEL SECURITY')
+
+        # Recreate USING-only policy (matching original 0015 behavior)
+        op.execute(
+            f'CREATE POLICY tenant_isolation ON "{table_name}" '
+            f"USING (tenant_id = current_setting('app.current_tenant_id')::uuid)"
+        )
+        logger.info("Reverted %s to USING-only policy (removed FORCE, removed WITH CHECK)", table_name)

alembic/versions/0028_user_preferences.py

@@ -0,0 +1,46 @@
+"""Create user_preferences table for per-user UI settings.
+
+Revision ID: 0028
+Revises: 0027_unify_company_to_contact
+Create Date: 2026-07-23
+
+Changes:
+- Create user_preferences table with tenant_id, user_id, key, value (JSONB)
+- Unique constraint on (tenant_id, user_id, key)
+- Indexes on tenant_id+user_id and user_id
+- tenant_id column (required by TenantMixin / RLS)
+- created_at, updated_at, deleted_at columns (TimestampMixin + SoftDeleteMixin)
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+
+revision = "0028_user_preferences"
+down_revision = "0028_rls_force"
+
+
+def upgrade():
+    op.create_table(
+        "user_preferences",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("key", sa.String(100), nullable=False),
+        sa.Column("value", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+        sa.UniqueConstraint("tenant_id", "user_id", "key", name="uq_user_prefs_tenant_user_key"),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_user_prefs_tenant_user ON user_preferences (tenant_id, user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_user_prefs_user_id ON user_preferences (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_user_prefs_tenant_id ON user_preferences (tenant_id)')
+
+
+def downgrade():
+    op.drop_index("ix_user_prefs_tenant_id", table_name="user_preferences")
+    op.drop_index("ix_user_prefs_user_id", table_name="user_preferences")
+    op.drop_index("ix_user_prefs_tenant_user", table_name="user_preferences")
+    op.drop_table("user_preferences")

alembic/versions/0029_saved_filters.py

@@ -0,0 +1,40 @@
+"""saved_filters table
+
+Revision ID: 0029_saved_filters
+Revises: 0028_user_preferences
+Create Date: 2025-07-23
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+# revision identifiers
+revision = "0029_saved_filters"
+down_revision = "0028_user_preferences"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "saved_filters",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", UUID(as_uuid=True), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("name", sa.String(100), nullable=False),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("filter_criteria", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+        sa.UniqueConstraint("tenant_id", "user_id", "entity_type", "name", name="uq_saved_filters_tenant_user_entity_name"),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_saved_filters_tenant_user ON saved_filters (tenant_id, user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_saved_filters_tenant_entity ON saved_filters (tenant_id, entity_type)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_saved_filters_tenant_entity", table_name="saved_filters")
+    op.drop_index("ix_saved_filters_tenant_user", table_name="saved_filters")
+    op.drop_table("saved_filters")

alembic/versions/0030_contact_merge_history.py

@@ -0,0 +1,42 @@
+"""contact_merge_history table
+
+Revision ID: 0030_contact_merge_history
+Revises: 0029_saved_filters
+Create Date: 2025-07-23
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+# revision identifiers
+revision = "0030_contact_merge_history"
+down_revision = "0029_saved_filters"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "contact_merge_history",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", UUID(as_uuid=True), nullable=False),
+        sa.Column("source_contact_id", UUID(as_uuid=True), sa.ForeignKey("contacts.id", ondelete="SET NULL"), nullable=False),
+        sa.Column("target_contact_id", UUID(as_uuid=True), sa.ForeignKey("contacts.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("merged_fields", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+        sa.Column("merged_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("note", sa.Text, nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contact_merge_history_tenant ON contact_merge_history (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contact_merge_history_target ON contact_merge_history (tenant_id, target_contact_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_contact_merge_history_source ON contact_merge_history (tenant_id, source_contact_id)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_contact_merge_history_source", table_name="contact_merge_history")
+    op.drop_index("ix_contact_merge_history_target", table_name="contact_merge_history")
+    op.drop_index("ix_contact_merge_history_tenant", table_name="contact_merge_history")
+    op.drop_table("contact_merge_history")

alembic/versions/0031_permissions_soft_delete.py

@@ -0,0 +1,31 @@
+"""Add deleted_at column to permissions and share_links tables.
+
+The Permission and ShareLink models inherit TenantMixin which includes
+SoftDeleteMixin (deleted_at), but the original plugin migration did not
+create this column. This migration adds it for existing databases.
+
+Revision ID: 0031_permissions_soft_delete
+Revises: 0030_contact_merge_history
+Create Date: 2025-07-24
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers
+revision = "0031_permissions_soft_delete"
+down_revision = "0030_contact_merge_history"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Add deleted_at to permissions table (if not exists)
+    op.execute("ALTER TABLE IF EXISTS permissions ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE")
+    # Add deleted_at to share_links table (if not exists)
+    op.execute("ALTER TABLE IF EXISTS share_links ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE")
+
+
+def downgrade() -> None:
+    op.drop_column("share_links", "deleted_at")
+    op.drop_column("permissions", "deleted_at")

alembic/versions/0032_user_profile_fields.py

@@ -0,0 +1,25 @@
+"""Add first_name, last_name, avatar_url to users table.
+
+Revision ID: 0032
+Revises: 0031
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0032_user_profile_fields"
+down_revision = "0031_permissions_soft_delete"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE users ADD COLUMN IF NOT EXISTS first_name VARCHAR(100)")
+    op.execute("ALTER TABLE users ADD COLUMN IF NOT EXISTS last_name VARCHAR(100)")
+    op.execute("ALTER TABLE users ADD COLUMN IF NOT EXISTS avatar_url VARCHAR(500)")
+
+
+def downgrade() -> None:
+    op.drop_column("users", "avatar_url")
+    op.drop_column("users", "last_name")
+    op.drop_column("users", "first_name")

alembic/versions/0033_bank_accounts.py

@@ -0,0 +1,45 @@
+"""Add bank_accounts table.
+
+Revision ID: 0033
+Revises: 0032_user_profile_fields
+Create Date: 2026-07-25
+"""
+
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision: str = "0033_bank_accounts"
+down_revision: Union[str, None] = "0032_user_profile_fields"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "bank_accounts",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False, index=True),
+        sa.Column("bank_name", sa.String(100), nullable=False),
+        sa.Column("iban", sa.String(34), nullable=False),
+        sa.Column("bic", sa.String(11), nullable=True),
+        sa.Column("account_holder", sa.String(200), nullable=True),
+        sa.Column("default_tax", sa.String(50), nullable=True),
+        sa.Column("is_default", sa.Boolean, nullable=False, server_default=sa.text("false")),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+    op.execute('CREATE INDEX IF NOT EXISTS ix_bank_accounts_tenant ON bank_accounts (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_bank_accounts_tenant_default ON bank_accounts (tenant_id, is_default)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_bank_accounts_tenant_default", table_name="bank_accounts")
+    op.drop_index("ix_bank_accounts_tenant", table_name="bank_accounts")
+    op.drop_table("bank_accounts")

alembic/versions/0034_automation_config.py

@@ -0,0 +1,27 @@
+"""Add automation_config JSONB column to system_settings.
+
+Revision ID: 0034
+Revises: 0033_bank_accounts
+Create Date: 2026-07-25
+"""
+
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB
+
+revision: str = "0034_automation_config"
+down_revision: Union[str, None] = "0033_bank_accounts"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE system_settings ADD COLUMN IF NOT EXISTS automation_config JSONB")
+
+
+def downgrade() -> None:
+    op.drop_column("system_settings", "automation_config")

alembic/versions/0035_comm_search_index.py

@@ -0,0 +1,53 @@
+"""Add search_tsv and embedding columns to comm_messages for full-text search indexing.
+
+Revision ID: 0035
+Revises: 0034_automation_config
+Create Date: 2026-07-25
+"""
+
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import TSVECTOR
+
+revision: str = "0035_comm_search_index"
+down_revision: Union[str, None] = "0034_automation_config"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Add search_tsv column for full-text search
+    op.execute("ALTER TABLE IF EXISTS comm_messages ADD COLUMN IF NOT EXISTS search_tsv tsvector")
+    # Add embedding column for vector search (768 dimensions matching pgvector)
+    op.execute(
+        "ALTER TABLE IF EXISTS comm_messages ADD COLUMN IF NOT EXISTS embedding vector(768)"
+    )
+    # Create GIN index on search_tsv for fast FTS queries (only if table exists)
+    op.execute("""
+        DO $$ BEGIN
+          IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'comm_messages') THEN
+            CREATE INDEX IF NOT EXISTS ix_comm_messages_search_tsv ON comm_messages (search_tsv);
+          END IF;
+        END $$
+    """)
+    # Create IVFFlat index on embedding for fast vector search (only if table exists)
+    op.execute("""
+        DO $$ BEGIN
+          IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'comm_messages') THEN
+            CREATE INDEX IF NOT EXISTS ix_comm_messages_embedding
+            ON comm_messages USING ivfflat (embedding vector_cosine_ops)
+            WITH (lists = 100);
+          END IF;
+        END $$
+    """)
+
+
+def downgrade() -> None:
+    op.drop_index("ix_comm_messages_embedding", table_name="comm_messages")
+    op.drop_index("ix_comm_messages_search_tsv", table_name="comm_messages")
+    op.drop_column("comm_messages", "embedding")
+    op.drop_column("comm_messages", "search_tsv")

alembic/versions/0036_cross_tenant_fk.py

@@ -0,0 +1,182 @@
+"""Cross-tenant referential integrity: composite FKs on (tenant_id, contact_id).
+
+Revision ID: 0036_cross_tenant_fk
+Revises: 0035_comm_search_index
+Create Date: 2026-07-25
+
+Changes:
+1. Add UNIQUE (tenant_id, id) on contacts — prerequisite for composite FK.
+2. Replace contactpersons.contact_id FK with composite (tenant_id, contact_id)
+   → contacts(tenant_id, id).
+3. Replace contact_merge_history.source_contact_id FK with composite
+   (tenant_id, source_contact_id) → contacts(tenant_id, id).
+4. Replace contact_merge_history.target_contact_id FK with composite
+   (tenant_id, target_contact_id) → contacts(tenant_id, id).
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0036_cross_tenant_fk"
+down_revision: Union[str, None] = "0035_comm_search_index"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def _constraint_exists(name: str) -> str:
+    """Return SQL that checks if a constraint exists."""
+    return (
+        f"SELECT 1 FROM information_schema.table_constraints "
+        f"WHERE constraint_name = '{name}'"
+    )
+
+
+def _fk_exists(name: str) -> str:
+    """Return SQL that checks if a foreign key constraint exists."""
+    return (
+        f"SELECT 1 FROM information_schema.table_constraints "
+        f"WHERE constraint_name = '{name}' AND constraint_type = 'FOREIGN KEY'"
+    )
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Add UNIQUE (tenant_id, id) on contacts ──────────────────────────
+    unique_name = "uq_contacts_tenant_id"
+    result = conn.execute(sa.text(_constraint_exists(unique_name))).fetchone()
+    if result is None:
+        op.execute(
+            f"ALTER TABLE contacts ADD CONSTRAINT {unique_name} "
+            f"UNIQUE (tenant_id, id)"
+        )
+
+    # ── 2. contactpersons: replace single-column FK with composite FK ──────
+    # Find and drop the existing FK on contactpersons.contact_id
+    old_cp_fk_result = conn.execute(
+        sa.text(
+            "SELECT conname FROM pg_constraint c "
+            "JOIN pg_class cls ON c.conrelid = cls.oid "
+            "JOIN pg_namespace nsp ON c.connamespace = nsp.oid "
+            "WHERE cls.relname = 'contactpersons' "
+            "AND nsp.nspname = 'public' "
+            "AND c.contype = 'f' "
+            "AND EXISTS ("
+            "  SELECT 1 FROM pg_attribute a "
+    "  WHERE a.attrelid = c.conrelid AND a.attname = 'contact_id' "
+    "  AND a.attnum = ANY(c.conkey)"
+            ")"
+        )
+    ).fetchone()
+
+    if old_cp_fk_result is not None:
+        old_cp_fk_name = old_cp_fk_result[0]
+        op.execute(f"ALTER TABLE contactpersons DROP CONSTRAINT IF EXISTS {old_cp_fk_name}")
+
+    # Add composite FK on contactpersons (tenant_id, contact_id) → contacts(tenant_id, id)
+    cp_composite_fk = "fk_contactpersons_tenant_contact"
+    result = conn.execute(sa.text(_fk_exists(cp_composite_fk))).fetchone()
+    if result is None:
+        op.execute(
+            f"ALTER TABLE contactpersons ADD CONSTRAINT {cp_composite_fk} "
+            f"FOREIGN KEY (tenant_id, contact_id) "
+            f"REFERENCES contacts (tenant_id, id) ON DELETE CASCADE"
+        )
+
+    # ── 3. contact_merge_history: replace source_contact_id FK ─────────────
+    old_src_fk_result = conn.execute(
+        sa.text(
+            "SELECT conname FROM pg_constraint c "
+            "JOIN pg_class cls ON c.conrelid = cls.oid "
+            "JOIN pg_namespace nsp ON c.connamespace = nsp.oid "
+            "WHERE cls.relname = 'contact_merge_history' "
+            "AND nsp.nspname = 'public' "
+            "AND c.contype = 'f' "
+            "AND EXISTS ("
+            "  SELECT 1 FROM pg_attribute a "
+    "  WHERE a.attrelid = c.conrelid AND a.attname = 'source_contact_id' "
+    "  AND a.attnum = ANY(c.conkey)"
+            ")"
+        )
+    ).fetchone()
+
+    if old_src_fk_result is not None:
+        old_src_fk_name = old_src_fk_result[0]
+        op.execute(f"ALTER TABLE contact_merge_history DROP CONSTRAINT IF EXISTS {old_src_fk_name}")
+
+    src_composite_fk = "fk_merge_history_tenant_source"
+    result = conn.execute(sa.text(_fk_exists(src_composite_fk))).fetchone()
+    if result is None:
+        op.execute(
+            f"ALTER TABLE contact_merge_history ADD CONSTRAINT {src_composite_fk} "
+            f"FOREIGN KEY (tenant_id, source_contact_id) "
+            f"REFERENCES contacts (tenant_id, id) ON DELETE SET NULL"
+        )
+
+    # ── 4. contact_merge_history: replace target_contact_id FK ──────────────
+    old_tgt_fk_result = conn.execute(
+        sa.text(
+            "SELECT conname FROM pg_constraint c "
+            "JOIN pg_class cls ON c.conrelid = cls.oid "
+            "JOIN pg_namespace nsp ON c.connamespace = nsp.oid "
+            "WHERE cls.relname = 'contact_merge_history' "
+            "AND nsp.nspname = 'public' "
+            "AND c.contype = 'f' "
+            "AND EXISTS ("
+            "  SELECT 1 FROM pg_attribute a "
+    "  WHERE a.attrelid = c.conrelid AND a.attname = 'target_contact_id' "
+    "  AND a.attnum = ANY(c.conkey)"
+            ")"
+        )
+    ).fetchone()
+
+    if old_tgt_fk_result is not None:
+        old_tgt_fk_name = old_tgt_fk_result[0]
+        op.execute(f"ALTER TABLE contact_merge_history DROP CONSTRAINT IF EXISTS {old_tgt_fk_name}")
+
+    tgt_composite_fk = "fk_merge_history_tenant_target"
+    result = conn.execute(sa.text(_fk_exists(tgt_composite_fk))).fetchone()
+    if result is None:
+        op.execute(
+            f"ALTER TABLE contact_merge_history ADD CONSTRAINT {tgt_composite_fk} "
+            f"FOREIGN KEY (tenant_id, target_contact_id) "
+            f"REFERENCES contacts (tenant_id, id) ON DELETE CASCADE"
+        )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # Restore single-column FKs and remove composite FKs
+
+    # ── contact_merge_history: target ──
+    op.execute("ALTER TABLE contact_merge_history DROP CONSTRAINT IF EXISTS fk_merge_history_tenant_target")
+    op.execute(
+        "ALTER TABLE contact_merge_history ADD CONSTRAINT "
+        "contact_merge_history_target_contact_id_fkey "
+        "FOREIGN KEY (target_contact_id) REFERENCES contacts (id) ON DELETE CASCADE"
+    )
+
+    # ── contact_merge_history: source ──
+    op.execute("ALTER TABLE contact_merge_history DROP CONSTRAINT IF EXISTS fk_merge_history_tenant_source")
+    op.execute(
+        "ALTER TABLE contact_merge_history ADD CONSTRAINT "
+        "contact_merge_history_source_contact_id_fkey "
+        "FOREIGN KEY (source_contact_id) REFERENCES contacts (id) ON DELETE SET NULL"
+    )
+
+    # ── contactpersons ──
+    op.execute("ALTER TABLE contactpersons DROP CONSTRAINT IF EXISTS fk_contactpersons_tenant_contact")
+    op.execute(
+        "ALTER TABLE contactpersons ADD CONSTRAINT "
+        "contactpersons_contact_id_fkey "
+        "FOREIGN KEY (contact_id) REFERENCES contacts (id) ON DELETE CASCADE"
+    )
+
+    # ── Remove unique (tenant_id, id) on contacts ──
+    op.execute("ALTER TABLE contacts DROP CONSTRAINT IF EXISTS uq_contacts_tenant_id")

alembic/versions/0037_user_tenant_model.py

@@ -0,0 +1,197 @@
+"""User-Tenant model cleanup: single source of truth for membership and role.
+
+Revision ID: 0037_user_tenant_model
+Revises: 0036_cross_tenant_fk
+Create Date: 2026-07-25
+
+Changes:
+1. Make users.email globally unique (drop composite uq_users_tenant_email, add UNIQUE on email).
+2. Drop tenant_id, role, role_id columns from users table (with data migration to user_tenants).
+3. Add role column to user_tenants (built-in role string: admin/editor/viewer).
+4. Add status column to user_tenants (active/invited/disabled).
+5. Migrate existing data: copy users.tenant_id + users.role_id → user_tenants (if not already present).
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0037_user_tenant_model"
+down_revision: Union[str, None] = "0036_cross_tenant_fk"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def _constraint_exists(name: str, table: str) -> str:
+    """Return SQL that checks if a constraint exists on a table."""
+    return (
+        f"SELECT 1 FROM information_schema.table_constraints "
+        f"WHERE constraint_name = '{name}' AND table_name = '{table}'"
+    )
+
+
+def _column_exists(table: str, column: str) -> str:
+    """Return SQL that checks if a column exists on a table."""
+    return (
+        f"SELECT 1 FROM information_schema.columns "
+        f"WHERE table_name = '{table}' AND column_name = '{column}'"
+    )
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Add UNIQUE constraint on users.email (globally unique) ───────────
+    # First check if a unique constraint on email already exists
+    email_unique_result = conn.execute(
+        sa.text(
+            "SELECT 1 FROM information_schema.table_constraints "
+            "WHERE constraint_name = 'uq_users_email' AND table_name = 'users'"
+        )
+    ).fetchone()
+    if email_unique_result is None:
+        # Check if there's a unique index on email already
+        email_index_result = conn.execute(
+            sa.text(
+                "SELECT 1 FROM pg_index i "
+                "JOIN pg_class c ON i.indexrelid = c.oid "
+                "WHERE c.relname = 'ix_users_email' AND i.indisunique = true"
+            )
+        ).fetchone()
+        if email_index_result is None:
+            op.execute("ALTER TABLE users ADD CONSTRAINT uq_users_email UNIQUE (email)")
+
+    # ── 2. Drop composite unique constraint uq_users_tenant_email ───────────
+    result = conn.execute(sa.text(_constraint_exists("uq_users_tenant_email", "users"))).fetchone()
+    if result is not None:
+        op.execute("ALTER TABLE users DROP CONSTRAINT IF EXISTS uq_users_tenant_email")
+
+    # ── 3. Add role column to user_tenants ─────────────────────────────────
+    role_col_result = conn.execute(sa.text(_column_exists("user_tenants", "role"))).fetchone()
+    if role_col_result is None:
+        op.add_column("user_tenants", sa.Column("role", sa.String(50), nullable=False, server_default="viewer"))
+
+    # ── 4. Add status column to user_tenants ───────────────────────────────
+    status_col_result = conn.execute(sa.text(_column_exists("user_tenants", "status"))).fetchone()
+    if status_col_result is None:
+        op.add_column("user_tenants", sa.Column("status", sa.String(20), nullable=False, server_default="active"))
+
+    # ── 4b. Add updated_at column to user_tenants ──────────────────────────
+    updated_col_result = conn.execute(sa.text(_column_exists("user_tenants", "updated_at"))).fetchone()
+    if updated_col_result is None:
+        op.add_column("user_tenants", sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True, server_default=sa.func.now()))
+
+    # ── 5. Data migration: copy tenant_id, role, role_id from users to user_tenants ─
+    # Only create UserTenant rows that don't already exist
+    conn.execute(sa.text("""
+        INSERT INTO user_tenants (user_id, tenant_id, is_default, role, role_id, status, created_at)
+        SELECT 
+            u.id, 
+            u.tenant_id, 
+            TRUE, 
+            COALESCE(u.role, 'viewer'), 
+            u.role_id,
+            'active',
+            NOW()
+        FROM users u
+        WHERE NOT EXISTS (
+            SELECT 1 FROM user_tenants ut 
+            WHERE ut.user_id = u.id AND ut.tenant_id = u.tenant_id
+        )
+        AND u.tenant_id IS NOT NULL
+    """))
+
+    # Update existing UserTenant rows with role from users table (if they don't have one set yet)
+    conn.execute(sa.text("""
+        UPDATE user_tenants ut
+        SET role = COALESCE(u.role, 'viewer'),
+            role_id = COALESCE(ut.role_id, u.role_id)
+        FROM users u
+        WHERE ut.user_id = u.id
+        AND ut.tenant_id = u.tenant_id
+    """))
+
+    # ── 6. Drop role_id FK from users (if it exists) ───────────────────────
+    # Find and drop the FK on users.role_id
+    role_id_fk_result = conn.execute(
+        sa.text(
+            "SELECT conname FROM pg_constraint c "
+            "JOIN pg_class cls ON c.conrelid = cls.oid "
+            "JOIN pg_namespace nsp ON c.connamespace = nsp.oid "
+            "WHERE cls.relname = 'users' "
+            "AND nsp.nspname = 'public' "
+            "AND c.contype = 'f' "
+            "AND EXISTS ("
+            "  SELECT 1 FROM pg_attribute a "
+            "  WHERE a.attrelid = c.conrelid AND a.attname = 'role_id' "
+            "  AND a.attnum = ANY(c.conkey)"
+            ")"
+        )
+    ).fetchone()
+    if role_id_fk_result is not None:
+        fk_name = role_id_fk_result[0]
+        op.execute(f"ALTER TABLE users DROP CONSTRAINT IF EXISTS {fk_name}")
+
+    # ── 7. Drop tenant_id, role, role_id columns from users ────────────────
+    # Drop tenant_id
+    tenant_col_result = conn.execute(sa.text(_column_exists("users", "tenant_id"))).fetchone()
+    if tenant_col_result is not None:
+        # Drop RLS policy that depends on tenant_id
+        op.execute("DROP POLICY IF EXISTS tenant_isolation ON users")
+        # Drop any indexes on tenant_id first
+        op.execute("DROP INDEX IF EXISTS ix_users_tenant_id")
+        op.drop_column("users", "tenant_id")
+
+    # Drop role
+    role_col_result = conn.execute(sa.text(_column_exists("users", "role"))).fetchone()
+    if role_col_result is not None:
+        op.drop_column("users", "role")
+
+    # Drop role_id
+    role_id_col_result = conn.execute(sa.text(_column_exists("users", "role_id"))).fetchone()
+    if role_id_col_result is not None:
+        op.execute("DROP INDEX IF EXISTS ix_users_role_id")
+        op.drop_column("users", "role_id")
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # ── Re-add tenant_id, role, role_id to users ───────────────────────────
+    tenant_col_result = conn.execute(sa.text(_column_exists("users", "tenant_id"))).fetchone()
+    if tenant_col_result is None:
+        op.add_column("users", sa.Column("tenant_id", sa.dialects.postgresql.UUID(as_uuid=True), nullable=True))
+        op.execute('CREATE INDEX IF NOT EXISTS ix_users_tenant_id ON users (tenant_id)')
+
+    role_col_result = conn.execute(sa.text(_column_exists("users", "role"))).fetchone()
+    if role_col_result is None:
+        op.add_column("users", sa.Column("role", sa.String(50), nullable=False, server_default="viewer"))
+
+    role_id_col_result = conn.execute(sa.text(_column_exists("users", "role_id"))).fetchone()
+    if role_id_col_result is None:
+        op.add_column("users", sa.Column("role_id", sa.dialects.postgresql.UUID(as_uuid=True), nullable=True))
+        op.execute('CREATE INDEX IF NOT EXISTS ix_users_role_id ON users (role_id)')
+        # Re-add FK
+        op.create_foreign_key("fk_users_role_id", "users", "roles", ["role_id"], ["id"], ondelete="SET NULL")
+
+    # ── Restore data from user_tenants to users (default tenant) ────────────
+    conn.execute(sa.text("""
+        UPDATE users u
+        SET tenant_id = ut.tenant_id,
+            role = ut.role,
+            role_id = ut.role_id
+        FROM user_tenants ut
+        WHERE ut.user_id = u.id AND ut.is_default = TRUE
+    """))
+
+    # ── Re-add composite unique constraint ─────────────────────────────────
+    op.execute("ALTER TABLE users DROP CONSTRAINT IF EXISTS uq_users_email")
+    op.execute("ALTER TABLE users ADD CONSTRAINT uq_users_tenant_email UNIQUE (tenant_id, email)")
+
+    # ── Drop role and status columns from user_tenants ──────────────────────
+    op.drop_column("user_tenants", "status")
+    op.drop_column("user_tenants", "role")

alembic/versions/0038_dms_content_hash.py

@@ -0,0 +1,48 @@
+"""Add content_hash column to files table for SHA-256 dedup and integrity.
+
+Revision ID: 0038_dms_content_hash
+Revises: 0037_user_tenant_model
+Create Date: 2026-07-25
+
+Changes:
+1. Add content_hash (String(64), nullable) column to files table.
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0038_dms_content_hash"
+down_revision: Union[str, None] = "0037_user_tenant_model"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def _column_exists(table: str, column: str) -> str:
+    """Return SQL that checks if a column exists on a table."""
+    return (
+        f"SELECT 1 FROM information_schema.columns "
+        f"WHERE table_name = '{table}' AND column_name = '{column}'"
+    )
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    # Check if table exists first
+    table_exists = conn.execute(sa.text("SELECT 1 FROM information_schema.tables WHERE table_name = 'files'")).fetchone()
+    if table_exists is None:
+        return
+    result = conn.execute(sa.text(_column_exists("files", "content_hash"))).fetchone()
+    if result is None:
+        op.execute("ALTER TABLE files ADD COLUMN IF NOT EXISTS content_hash VARCHAR(64)")
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    result = conn.execute(sa.text(_column_exists("files", "content_hash"))).fetchone()
+    if result is not None:
+        op.drop_column("files", "content_hash")

alembic/versions/0039_contact_normalize.py

@@ -0,0 +1,178 @@
+"""Normalize contact model: fix surfix typo, Float→Numeric(5,2) discounts, JSON→JSONB, unique constraints.
+
+Revision ID: 0039_contact_normalize
+Revises: 0038_dms_content_hash
+Create Date: 2026-07-25
+
+Changes:
+1. Rename column surfix → suffix on contacts table.
+2. Convert discount_* columns from Float to Numeric(5,2) with CHECK constraints (0-100).
+3. Convert custom columns from JSON to JSONB on contacts and contactpersons.
+4. Add partial unique constraints: (tenant_id, code) and (tenant_id, accounting_code) where NOT NULL.
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0039_contact_normalize"
+down_revision: Union[str, None] = "0038_dms_content_hash"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+DISCOUNT_COLUMNS = [
+    "discount_crew",
+    "discount_transport",
+    "discount_rental",
+    "discount_sale",
+    "discount_subrent",
+    "discount_total",
+]
+
+
+def _column_exists(table: str, column: str) -> str:
+    """Return SQL that checks if a column exists on a table."""
+    return (
+        f"SELECT 1 FROM information_schema.columns "
+        f"WHERE table_name = '{table}' AND column_name = '{column}'"
+    )
+
+
+def _constraint_exists(table: str, constraint: str) -> str:
+    """Return SQL that checks if a constraint exists on a table."""
+    return (
+        f"SELECT 1 FROM information_schema.table_constraints "
+        f"WHERE table_name = '{table}' AND constraint_name = '{constraint}'"
+    )
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 0. Add status column to contacts (for state machine) ──
+    status_col = conn.execute(sa.text(_column_exists("contacts", "status"))).fetchone()
+    if not status_col:
+        op.add_column("contacts", sa.Column("status", sa.String(20), nullable=False, server_default="lead"))
+
+    # ── 1a. Rename surfix → suffix ──
+    result = conn.execute(sa.text(_column_exists("contacts", "surfix"))).fetchone()
+    if result:
+        op.alter_column("contacts", "surfix", new_column_name="suffix")
+
+    # ── 1b. Convert discount_* from Float to Numeric(5,2) with CHECK ──
+    for col in DISCOUNT_COLUMNS:
+        conn.execute(
+            sa.text(
+                f"ALTER TABLE contacts ALTER COLUMN {col} "
+                f"TYPE NUMERIC(5,2) USING {col}::numeric(5,2)"
+            )
+        )
+        # Add CHECK constraint if not exists
+        ck_name = f"ck_contacts_{col}_range"
+        ck_exists = conn.execute(
+            sa.text(_constraint_exists("contacts", ck_name))
+        ).fetchone()
+        if not ck_exists:
+            conn.execute(
+                sa.text(
+                    f"ALTER TABLE contacts ADD CONSTRAINT {ck_name} "
+                    f"CHECK ({col} BETWEEN 0 AND 100)"
+                )
+            )
+
+    # ── 1c. JSON → JSONB for contacts.custom ──
+    result = conn.execute(
+        sa.text(
+            "SELECT data_type FROM information_schema.columns "
+            "WHERE table_name = 'contacts' AND column_name = 'custom'"
+        )
+    ).fetchone()
+    if result and result[0] == "json":
+        conn.execute(
+            sa.text(
+                "ALTER TABLE contacts ALTER COLUMN custom "
+                "TYPE JSONB USING custom::jsonb"
+            )
+        )
+
+    # ── 1d. JSON → JSONB for contactpersons.custom ──
+    result = conn.execute(
+        sa.text(
+            "SELECT data_type FROM information_schema.columns "
+            "WHERE table_name = 'contactpersons' AND column_name = 'custom'"
+        )
+    ).fetchone()
+    if result and result[0] == "json":
+        conn.execute(
+            sa.text(
+                "ALTER TABLE contactpersons ALTER COLUMN custom "
+                "TYPE JSONB USING custom::jsonb"
+            )
+        )
+
+    # ── 1e. Partial unique constraints ──
+    # (tenant_id, code) where code IS NOT NULL
+    uq_code_exists = conn.execute(
+        sa.text(_constraint_exists("contacts", "uq_contacts_tenant_code"))
+    ).fetchone()
+    if not uq_code_exists:
+        conn.execute(
+            sa.text(
+                "CREATE UNIQUE INDEX uq_contacts_tenant_code "
+                "ON contacts (tenant_id, code) WHERE code IS NOT NULL"
+            )
+        )
+
+    # (tenant_id, accounting_code) where accounting_code IS NOT NULL
+    uq_acct_exists = conn.execute(
+        sa.text(_constraint_exists("contacts", "uq_contacts_tenant_accounting_code"))
+    ).fetchone()
+    if not uq_acct_exists:
+        conn.execute(
+            sa.text(
+                "CREATE UNIQUE INDEX uq_contacts_tenant_accounting_code "
+                "ON contacts (tenant_id, accounting_code) WHERE accounting_code IS NOT NULL"
+            )
+        )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # Drop unique indexes
+    conn.execute(sa.text("DROP INDEX IF EXISTS uq_contacts_tenant_accounting_code"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS uq_contacts_tenant_code"))
+
+    # JSONB → JSON
+    conn.execute(
+        sa.text(
+            "ALTER TABLE contactpersons ALTER COLUMN custom "
+            "TYPE JSON USING custom::json"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "ALTER TABLE contacts ALTER COLUMN custom TYPE JSON USING custom::json"
+        )
+    )
+
+    # Drop CHECK constraints and revert Numeric → Float
+    for col in DISCOUNT_COLUMNS:
+        ck_name = f"ck_contacts_{col}_range"
+        conn.execute(sa.text(f"ALTER TABLE contacts DROP CONSTRAINT IF EXISTS {ck_name}"))
+        conn.execute(
+            sa.text(
+                f"ALTER TABLE contacts ALTER COLUMN {col} "
+                f"TYPE FLOAT USING {col}::float"
+            )
+        )
+
+    # Rename suffix → surfix
+    result = conn.execute(sa.text(_column_exists("contacts", "suffix"))).fetchone()
+    if result:
+        op.alter_column("contacts", "suffix", new_column_name="surfix")

alembic/versions/0040_outbox.py

@@ -0,0 +1,71 @@
+"""Create event_outbox table for transactional outbox pattern.
+
+Revision ID: 0040_outbox
+Revises: 0039_contact_normalize
+Create Date: 2026-07-25
+
+Stores domain events in a durable table so they survive process crashes,
+restarts, and multi-replica deployments.  A background worker polls the
+outbox and publishes events to the in-process event bus.
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0040_outbox"
+down_revision: Union[str, None] = "0039_contact_normalize"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Ensure pgcrypto extension for gen_random_uuid()
+    conn.execute(sa.text("CREATE EXTENSION IF NOT EXISTS pgcrypto"))
+
+    conn.execute(
+        sa.text(
+            """
+            CREATE TABLE IF NOT EXISTS event_outbox (
+                id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                tenant_id       UUID NOT NULL,
+                event_name      VARCHAR(255) NOT NULL,
+                payload         JSONB NOT NULL,
+                status          VARCHAR(20) NOT NULL DEFAULT 'pending',
+                attempts        INT NOT NULL DEFAULT 0,
+                max_attempts    INT NOT NULL DEFAULT 5,
+                next_retry_at   TIMESTAMPTZ,
+                created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                published_at    TIMESTAMPTZ
+            )
+            """
+        )
+    )
+
+    # Index for the worker query: WHERE status = 'pending' ORDER BY next_retry_at
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_outbox_status "
+            "ON event_outbox (status, next_retry_at)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_outbox_tenant "
+            "ON event_outbox (tenant_id)"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_outbox_tenant"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_outbox_status"))
+    conn.execute(sa.text("DROP TABLE IF EXISTS event_outbox"))

alembic/versions/0041_custom_field_definitions.py

@@ -0,0 +1,86 @@
+"""Create custom_field_definitions table for user-defined custom fields.
+
+Revision ID: 0041_custom_field_definitions
+Revises: 0040_outbox
+Create Date: 2026-07-26
+
+Stores user-defined custom field definitions that are merged with
+plugin-provided custom fields at query time.
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0041_custom_field_definitions"
+down_revision: Union[str, None] = "0040_outbox"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    conn.execute(
+        sa.text(
+            """
+            CREATE TABLE IF NOT EXISTS custom_field_definitions (
+                id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                tenant_id       UUID NOT NULL,
+                entity          VARCHAR(50) NOT NULL,
+                name            VARCHAR(100) NOT NULL,
+                label           VARCHAR(200) NOT NULL,
+                field_type      VARCHAR(20) NOT NULL DEFAULT 'text',
+                options         JSONB,
+                default_value   JSONB,
+                required        BOOLEAN NOT NULL DEFAULT FALSE,
+                is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+                sort_order      INTEGER NOT NULL DEFAULT 0,
+                created_by      UUID,
+                updated_by      UUID,
+                created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                deleted_at      TIMESTAMPTZ
+            )
+            """
+        )
+    )
+
+    # Indexes
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_custom_field_def_tenant "
+            "ON custom_field_definitions (tenant_id)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_custom_field_def_entity "
+            "ON custom_field_definitions (entity)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_custom_field_def_tenant_active "
+            "ON custom_field_definitions (tenant_id, is_active)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE UNIQUE INDEX IF NOT EXISTS uq_custom_field_def_tenant_entity_name "
+            "ON custom_field_definitions (tenant_id, entity, name)"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DROP INDEX IF EXISTS uq_custom_field_def_tenant_entity_name"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_custom_field_def_tenant_active"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_custom_field_def_entity"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_custom_field_def_tenant"))
+    conn.execute(sa.text("DROP TABLE IF EXISTS custom_field_definitions"))

alembic/versions/0042_webhooks.py

@@ -0,0 +1,69 @@
+"""Create webhooks table for outgoing webhook subscriptions.
+
+Revision ID: 0042_webhooks
+Revises: 0041_custom_field_definitions
+Create Date: 2026-07-26
+
+Stores outgoing webhook subscriptions with target URL, event subscriptions,
+and delivery settings (retry count, timeout, HMAC secret).
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0042_webhooks"
+down_revision: Union[str, None] = "0041_custom_field_definitions"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    conn.execute(
+        sa.text(
+            """
+            CREATE TABLE IF NOT EXISTS webhooks (
+                id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                tenant_id       UUID NOT NULL,
+                url             VARCHAR(500) NOT NULL,
+                events          JSONB NOT NULL DEFAULT '[]',
+                secret          VARCHAR(255),
+                is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+                retry_count     INTEGER NOT NULL DEFAULT 3,
+                timeout_seconds INTEGER NOT NULL DEFAULT 30,
+                created_by      UUID,
+                updated_by      UUID,
+                created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                deleted_at      TIMESTAMPTZ
+            )
+            """
+        )
+    )
+
+    # Indexes
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_webhooks_tenant "
+            "ON webhooks (tenant_id)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_webhooks_tenant_active "
+            "ON webhooks (tenant_id, is_active)"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_webhooks_tenant_active"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_webhooks_tenant"))
+    conn.execute(sa.text("DROP TABLE IF EXISTS webhooks"))

alembic/versions/0043_backups.py

@@ -0,0 +1,66 @@
+"""Create backups table for database backup tracking.
+
+Revision ID: 0042_backups
+Revises: 0041_custom_field_definitions
+Create Date: 2026-07-26
+
+Stores database backup records per tenant with status tracking.
+"""
+
+from __future__ import annotations
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers
+revision: str = "0043_backups"
+down_revision: Union[str, None] = "0042_webhooks"
+branch_labels: Union[str, None] = None
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    conn.execute(
+        sa.text(
+            """
+            CREATE TABLE IF NOT EXISTS backups (
+                id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                tenant_id       UUID NOT NULL,
+                filename        VARCHAR(255) NOT NULL,
+                size_bytes      BIGINT,
+                status          VARCHAR(20) NOT NULL DEFAULT 'pending',
+                error_message   TEXT,
+                created_by      UUID,
+                created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+                completed_at    TIMESTAMPTZ,
+                updated_at      TIMESTAMPTZ,
+                deleted_at      TIMESTAMPTZ
+            )
+            """
+        )
+    )
+
+    # Indexes
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_backups_tenant "
+            "ON backups (tenant_id)"
+        )
+    )
+    conn.execute(
+        sa.text(
+            "CREATE INDEX IF NOT EXISTS ix_backups_tenant_status "
+            "ON backups (tenant_id, status)"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_backups_tenant_status"))
+    conn.execute(sa.text("DROP INDEX IF EXISTS ix_backups_tenant"))
+    conn.execute(sa.text("DROP TABLE IF EXISTS backups"))

alembic/versions/0044_rls_repair_and_db_roles.py

@@ -0,0 +1,125 @@
+"""RLS repair + separate DB runtime user.
+
+Revision ID: 0044
+Revises: 0043
+Created: 2026-07-26
+
+This migration:
+1. Re-discovers ALL tenant-scoped tables and ensures RLS is enabled
+   with FORCE + WITH CHECK (covers tables added after migration 0028).
+2. Creates a separate ``crm_runtime`` role with NOSUPERUSER and
+   NOBYPASSRLS so the application cannot bypass RLS.
+3. Grants only DML permissions (SELECT/INSERT/UPDATE/DELETE) to
+   ``crm_runtime`` on all tenant-scoped tables.
+
+IMPORTANT: After this migration, the application's DATABASE_URL must
+use ``crm_runtime`` (not the superuser) for API and worker containers.
+Migration/DDL operations continue to use the owner user (crm_user).
+"""
+
+from alembic import op
+import sqlalchemy as sa
+import logging
+
+logger = logging.getLogger(__name__)
+
+revision = "0044"
+down_revision = "0043_backups"
+branch_labels = None
+depends_on = None
+
+
+def _discover_tenant_tables(conn) -> list[str]:
+    """Return all table names in the public schema that have a tenant_id column."""
+    result = conn.execute(
+        sa.text(
+            "SELECT table_name FROM information_schema.columns "
+            "WHERE table_schema = 'public' AND column_name = 'tenant_id' "
+            "ORDER BY table_name"
+        )
+    )
+    return [row[0] for row in result]
+
+
+def _discover_existing_policies(conn, table_name: str) -> list[str]:
+    """Return all policy names on *table_name* that contain 'tenant' or 'isolation'."""
+    result = conn.execute(
+        sa.text(
+            "SELECT policyname FROM pg_policies "
+            "WHERE schemaname = 'public' AND tablename = :t "
+            "AND (policyname LIKE '%tenant%' OR policyname LIKE '%isolation%')"
+        ),
+        {"t": table_name},
+    )
+    return [row[0] for row in result]
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. RLS Repair: ensure all tenant tables have RLS + WITH CHECK ──
+    tenant_tables = _discover_tenant_tables(conn)
+    logger.info("RLS repair: discovered %d tenant-scoped tables: %s", len(tenant_tables), tenant_tables)
+
+    for table_name in tenant_tables:
+        # Enable RLS
+        op.execute(f'ALTER TABLE "{table_name}" ENABLE ROW LEVEL SECURITY')
+        # Force RLS (applies to table owner too)
+        op.execute(f'ALTER TABLE "{table_name}" FORCE ROW LEVEL SECURITY')
+
+        # Drop existing tenant policies
+        existing_policies = _discover_existing_policies(conn, table_name)
+        for policy_name in existing_policies:
+            op.execute(f'DROP POLICY IF EXISTS "{policy_name}" ON "{table_name}"')
+            logger.info("Dropped policy %s on %s", policy_name, table_name)
+
+        # Create unified tenant isolation policy with WITH CHECK
+        op.execute(
+            f'CREATE POLICY tenant_isolation ON "{table_name}" '
+            f"USING (tenant_id = current_setting('app.tenant_id', true)::uuid) "
+            f"WITH CHECK (tenant_id = current_setting('app.tenant_id', true)::uuid)"
+        )
+        logger.info("Created/updated tenant_isolation policy on %s (USING + WITH CHECK)", table_name)
+
+    # ── 2. Create crm_runtime role (NOSUPERUSER, NOBYPASSRLS) ──
+    # Use DO block for idempotent creation
+    op.execute(
+        sa.text(
+            "DO $$ "
+            "BEGIN "
+            "  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_runtime') THEN "
+            "    CREATE ROLE crm_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE "
+            "    NOREPLICATION NOBYPASSRLS; "
+            "  END IF; "
+            "END $$;"
+        )
+    )
+    logger.info("Ensured crm_runtime role exists (NOSUPERUSER, NOBYPASSRLS)")
+
+    # ── 3. Grant DML permissions to crm_runtime on all tenant tables ──
+    for table_name in tenant_tables:
+        op.execute(
+            f'GRANT SELECT, INSERT, UPDATE, DELETE ON "{table_name}" TO crm_runtime'
+        )
+
+    # Grant usage on sequences (for SERIAL/IDENTITY columns)
+    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
+
+    logger.info("Granted DML permissions to crm_runtime on %d tables", len(tenant_tables))
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # Revoke permissions from crm_runtime
+    tenant_tables = _discover_tenant_tables(conn)
+    for table_name in tenant_tables:
+        op.execute(f'REVOKE SELECT, INSERT, UPDATE, DELETE ON "{table_name}" FROM crm_runtime')
+    op.execute("REVOKE USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public FROM crm_runtime")
+
+    # Drop crm_runtime role
+    op.execute("DROP ROLE IF EXISTS crm_runtime")
+    logger.info("Dropped crm_runtime role")
+
+    # Note: RLS policies are NOT reverted here to avoid weakening security.
+    # Migration 0028's downgrade handles the original set of tables.

alembic/versions/0045_repair_contact_migration.py

@@ -0,0 +1,184 @@
+"""Forward-repair migration for databases that ran the original 0021/0027.
+
+Revision ID: 0045
+Revises: 0044
+Created: 2026-07-26
+
+Problem:
+  Migrations 0021 and 0027 were retroactively rewritten to be safer
+  (rename old tables, INSERT ... SELECT, preserve *_old tables).
+  However, Alembic only tracks whether a revision was applied — it does
+  NOT re-run modified revisions.  Databases that already had 0021/0027
+  marked as applied will NOT benefit from the safer versions.
+
+This migration:
+  1. Detects *_old tables (left behind by the rewritten 0021).
+  2. Compares row counts between *_old and current tables.
+  3. Migrates any missing rows from *_old to the current tables.
+  4. Logs discrepancies and aborts on data integrity issues.
+  5. Also repairs entity_type='company' → 'contact' (from rewritten 0027).
+
+Safe to run on fresh installations (no *_old tables → no-op).
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+logger = logging.getLogger("alembic.migration.0045")
+
+revision = "0045"
+down_revision = "0044"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _table_exists(conn, table_name: str) -> bool:
+    """Check whether *table_name* exists in the public schema."""
+    result = conn.execute(
+        sa.text(
+            "SELECT EXISTS (SELECT 1 FROM information_schema.tables "
+            "WHERE table_schema = 'public' AND table_name = :t)"
+        ),
+        {"t": table_name},
+    )
+    return result.scalar()
+
+
+def _row_count(conn, table_name: str) -> int:
+    """Return the number of rows in *table_name*, or 0 if it doesn't exist."""
+    if not _table_exists(conn, table_name):
+        return -1
+    result = conn.execute(sa.text(f'SELECT COUNT(*) FROM "{table_name}"'))
+    return result.scalar()
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── 1. Check for *_old tables from rewritten migration 0021 ──
+    old_tables = ["contacts_old", "companies_old", "addresses_old"]
+    found_old = [t for t in old_tables if _table_exists(conn, t)]
+
+    if not found_old:
+        logger.info("0045: No *_old tables found — fresh install or already repaired. Skipping.")
+    else:
+        logger.info("0045: Found *_old tables: %s — checking data integrity...", found_old)
+
+        # Compare contacts_old → contacts
+        if _table_exists(conn, "contacts_old"):
+            old_count = _row_count(conn, "contacts_old")
+            new_count = _row_count(conn, "contacts")
+            logger.info("0045: contacts_old=%d rows, contacts=%d rows", old_count, new_count)
+
+            if old_count > new_count:
+                # Migrate missing rows from contacts_old to contacts
+                missing = old_count - new_count
+                logger.warning("0045: %d contacts missing from current table — migrating...", missing)
+                op.execute(
+                    sa.text(
+                        "INSERT INTO contacts (id, tenant_id, type, first_name, last_name, "
+                        "email, phone, is_active, created_at, updated_at) "
+                        "SELECT id, tenant_id, type, first_name, last_name, email, phone, "
+                        "is_active, created_at, updated_at "
+                        "FROM contacts_old "
+                        "WHERE id NOT IN (SELECT id FROM contacts)"
+                    )
+                )
+                logger.info("0045: Migrated %d missing contacts", missing)
+
+        # Compare companies_old → contacts (type='company')
+        if _table_exists(conn, "companies_old"):
+            old_count = _row_count(conn, "companies_old")
+            new_count = conn.execute(
+                sa.text("SELECT COUNT(*) FROM contacts WHERE type = 'company'")
+            ).scalar()
+            logger.info("0045: companies_old=%d rows, contacts(type=company)=%d rows", old_count, new_count)
+
+            if old_count > new_count:
+                missing = old_count - new_count
+                logger.warning("0045: %d companies missing — migrating...", missing)
+                op.execute(
+                    sa.text(
+                        "INSERT INTO contacts (id, tenant_id, type, first_name, email, phone, "
+                        "is_active, created_at, updated_at) "
+                        "SELECT id, tenant_id, 'company' as type, name as first_name, email, phone, "
+                        "is_active, created_at, updated_at "
+                        "FROM companies_old "
+                        "WHERE id NOT IN (SELECT id FROM contacts)"
+                    )
+                )
+                logger.info("0045: Migrated %d missing companies", missing)
+
+    # ── 2. Repair entity_type='company' → 'contact' (from rewritten 0027) ──
+    # Check if any rows still have entity_type='company' in relevant tables
+    repair_tables = [
+        ("entity_links", "entity_type"),
+        ("tag_assignments", "entity_type"),
+        ("calendar_entry_links", "entity_type"),
+        ("addresses", "entity_type"),
+    ]
+
+    for table, col in repair_tables:
+        if not _table_exists(conn, table):
+            continue
+        try:
+            result = conn.execute(
+                sa.text(f"SELECT COUNT(*) FROM \"{table}\" WHERE {col} = 'company'")
+            )
+            count = result.scalar()
+            if count > 0:
+                logger.warning("0045: Found %d rows with entity_type='company' in %s — repairing...", count, table)
+                op.execute(
+                    sa.text(f"UPDATE \"{table}\" SET {col} = 'contact' WHERE {col} = 'company'")
+                )
+                logger.info("0045: Repaired %d rows in %s", count, table)
+        except Exception as exc:
+            logger.warning("0045: Could not check/repair %s: %s", table, exc)
+
+    # ── 3. Repair mails.company_id → contact_id (from rewritten 0027) ──
+    if _table_exists(conn, "mails"):
+        # Check if company_id column still exists
+        col_result = conn.execute(
+            sa.text(
+                "SELECT EXISTS (SELECT 1 FROM information_schema.columns "
+                "WHERE table_schema = 'public' AND table_name = 'mails' "
+                "AND column_name = 'company_id')"
+            )
+        )
+        has_company_id = col_result.scalar()
+
+        if has_company_id:
+            # Copy company_id → contact_id where contact_id is NULL
+            result = conn.execute(
+                sa.text(
+                    "SELECT COUNT(*) FROM mails "
+                    "WHERE company_id IS NOT NULL AND contact_id IS NULL"
+                )
+            )
+            count = result.scalar()
+            if count > 0:
+                logger.warning("0045: Found %d mails with company_id but no contact_id — repairing...", count)
+                op.execute(
+                    sa.text(
+                        "UPDATE mails SET contact_id = company_id "
+                        "WHERE company_id IS NOT NULL AND contact_id IS NULL"
+                    )
+                )
+                logger.info("0045: Repaired %d mail contact_id references", count)
+
+            # Drop company_id column (safe now that data is copied)
+            op.execute(sa.text("ALTER TABLE mails DROP COLUMN IF EXISTS company_id"))
+            logger.info("0045: Dropped mails.company_id column")
+
+    logger.info("0045: Forward-repair migration completed")
+
+
+def downgrade() -> None:
+    # This migration is a repair — no meaningful downgrade.
+    # The *_old tables and original data are preserved by migration 0021.
+    logger.info("0045: Downgrade is a no-op (repair migration)")

alembic/versions/0046_plugin_allowlist.py

@@ -0,0 +1,40 @@
+"""Create plugin_allowlist table for authorized external plugins.
+
+Revision ID: 0046
+Revises: 0045
+Create Date: 2026-07-26
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0046"
+down_revision = "0045"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "plugin_allowlist",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("plugin_name", sa.String(80), nullable=False),
+        sa.Column("allowed_hash", sa.String(64), nullable=True),
+        sa.Column("allowed_signature", sa.Text, nullable=True),
+        sa.Column("public_key", sa.Text, nullable=True),
+        sa.Column("added_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("is_active", sa.Boolean, nullable=False, server_default=sa.text("true")),
+        sa.Column("notes", sa.Text, nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_plugin_allowlist_plugin_name ON plugin_allowlist (plugin_name)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_plugin_allowlist_hash ON plugin_allowlist (allowed_hash)')
+
+
+def downgrade():
+    op.drop_index("ix_plugin_allowlist_hash", table_name="plugin_allowlist")
+    op.drop_index("ix_plugin_allowlist_plugin_name", table_name="plugin_allowlist")
+    op.drop_table("plugin_allowlist")

alembic/versions/0047_saved_views.py

@@ -0,0 +1,39 @@
+"""Create saved_views table
+
+Revision ID: 0047_saved_views
+Revises: 0046_plugin_allowlist
+Create Date: 2026-07-28
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+revision = "0047_saved_views"
+down_revision = "0046"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "saved_views",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("name", sa.String(100), nullable=False),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("view_config", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("tenant_id", UUID(as_uuid=True), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.create_unique_constraint("uq_saved_views_tenant_user_entity_name", "saved_views", ["tenant_id", "user_id", "entity_type", "name"])
+    op.execute('CREATE INDEX IF NOT EXISTS ix_saved_views_tenant_user ON saved_views (tenant_id, user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_saved_views_tenant_entity ON saved_views (tenant_id, entity_type)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_saved_views_tenant_entity", table_name="saved_views")
+    op.drop_index("ix_saved_views_tenant_user", table_name="saved_views")
+    op.drop_unique_constraint("uq_saved_views_tenant_user_entity_name", "saved_views")
+    op.drop_table("saved_views")

alembic/versions/0048_contact_folder_permissions.py

@@ -0,0 +1,48 @@
+"""Contact folder permissions (ACLs for folder sharing).
+
+Revision ID: 0048
+Revises: 0047
+Create Date: 2026-07-28
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0048"
+down_revision = "0047_saved_views"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "contact_folder_permissions",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
+        sa.Column("folder_id", PGUUID(as_uuid=True), sa.ForeignKey("contact_folders.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=True),
+        sa.Column("group_id", PGUUID(as_uuid=True), sa.ForeignKey("groups.id", ondelete="CASCADE"), nullable=True),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("permission_level", sa.String(20), nullable=False, server_default="read"),
+        sa.Column("inherit_to_subfolders", sa.Boolean, nullable=False, server_default="true"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.UniqueConstraint("folder_id", "user_id", "group_id", "tenant_id", name="uq_cfp_folder_user_group_tenant"),
+        sa.CheckConstraint(
+            "(user_id IS NOT NULL AND group_id IS NULL) OR "
+            "(user_id IS NULL AND group_id IS NOT NULL)",
+            name="ck_cfp_exactly_one_principal",
+        ),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cfp_folder ON contact_folder_permissions (folder_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cfp_user ON contact_folder_permissions (user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cfp_group ON contact_folder_permissions (group_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_cfp_tenant ON contact_folder_permissions (tenant_id)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_cfp_tenant", table_name="contact_folder_permissions")
+    op.drop_index("ix_cfp_group", table_name="contact_folder_permissions")
+    op.drop_index("ix_cfp_user", table_name="contact_folder_permissions")
+    op.drop_index("ix_cfp_folder", table_name="contact_folder_permissions")
+    op.drop_table("contact_folder_permissions")

alembic/versions/0049_entity_permissions.py

@@ -0,0 +1,47 @@
+"""Universal entity_permissions table — ACLs for ALL entities.
+
+Revision ID: 0049
+Revises: 0048
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0049"
+down_revision = "0048"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "entity_permissions",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("principal_type", sa.String(10), nullable=False),
+        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("permission_level", sa.String(20), nullable=False, server_default="read"),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.UniqueConstraint("entity_type", "entity_id", "principal_type", "principal_id", "tenant_id", name="uq_ep_entity_principal_tenant"),
+        sa.CheckConstraint("principal_type IN ('user', 'group', 'role', 'guest')", name="ck_ep_principal_type"),
+        sa.CheckConstraint("permission_level IN ('none', 'read', 'write', 'admin', 'delete')", name="ck_ep_permission_level"),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ep_entity ON entity_permissions (entity_type, entity_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ep_principal ON entity_permissions (principal_type, principal_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ep_tenant ON entity_permissions (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_ep_expires ON entity_permissions (expires_at)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_ep_expires", table_name="entity_permissions")
+    op.drop_index("ix_ep_tenant", table_name="entity_permissions")
+    op.drop_index("ix_ep_principal", table_name="entity_permissions")
+    op.drop_index("ix_ep_entity", table_name="entity_permissions")
+    op.drop_table("entity_permissions")

alembic/versions/0050_owner_id_all_tables.py

@@ -0,0 +1,49 @@
+"""Add owner_id to all entity tables for row-level ownership.
+
+Revision ID: 0050
+Revises: 0049
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0050"
+down_revision = "0049"
+branch_labels = None
+depends_on = None
+
+# Tables that get owner_id (all entity tables except system tables)
+TABLES = [
+    "contacts",
+    "contactpersons",
+    "addresses",
+    "bank_accounts",
+    "attachments",
+    "workflows",
+    "workflow_instances",
+    "sequences",
+    "saved_filters",
+    "saved_views",
+    "webhooks",
+    "custom_field_definitions",
+    "notifications",
+    "entity_history",
+    "ai_conversations",
+]
+
+
+def upgrade() -> None:
+    for table in TABLES:
+        op.add_column(
+            table,
+            sa.Column("owner_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        )
+        op.create_index(f"ix_{table}_owner", table, ["owner_id"])
+
+
+def downgrade() -> None:
+    for table in TABLES:
+        op.drop_index(f"ix_{table}_owner", table_name=table)
+        op.drop_column(table, "owner_id")

alembic/versions/0051_migrate_folder_acls.py

@@ -0,0 +1,41 @@
+"""Migrate contact_folder_permissions to universal entity_permissions table.
+
+Revision ID: 0051
+Revises: 0050
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0051"
+down_revision = "0050"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Migrate existing contact_folder_permissions to entity_permissions
+    op.execute("""
+        INSERT INTO entity_permissions (id, entity_type, entity_id, principal_type, principal_id, permission_level, tenant_id, created_at, updated_at)
+        SELECT 
+            gen_random_uuid(),
+            'contact_folder',
+            folder_id,
+            CASE 
+                WHEN user_id IS NOT NULL THEN 'user'
+                WHEN group_id IS NOT NULL THEN 'group'
+            END,
+            COALESCE(user_id, group_id),
+            permission_level,
+            tenant_id,
+            created_at,
+            updated_at
+        FROM contact_folder_permissions
+        ON CONFLICT DO NOTHING
+    """)
+
+
+def downgrade() -> None:
+    op.execute("DELETE FROM entity_permissions WHERE entity_type = 'contact_folder'")

alembic/versions/0052_rls_contacts.py

@@ -0,0 +1,90 @@
+"""Create PostgreSQL RLS policies for row-level security on contacts.
+
+Revision ID: 0052
+Revises: 0051
+Create Date: 2026-07-29
+
+This migration enables PostgreSQL Row-Level Security on the contacts table
+and creates policies that enforce visibility based on:
+1. System admin sees everything
+2. Owner sees own rows
+3. Tenant-owned (owner_id IS NULL) visible to all
+4. Shared via entity_permissions
+"""
+
+from alembic import op
+
+revision = "0052"
+down_revision = "0051"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Enable RLS on contacts table
+    op.execute("ALTER TABLE contacts ENABLE ROW LEVEL SECURITY")
+    
+    # Policy: System admin sees everything
+    op.execute("""
+        CREATE POLICY contacts_admin_visible ON contacts
+        FOR ALL
+        USING (current_setting('app.is_system_admin', true) = 'true')
+    """)
+    
+    # Policy: Owner sees own rows
+    op.execute("""
+        CREATE POLICY contacts_owner_visible ON contacts
+        FOR ALL
+        USING (
+            owner_id::text = current_setting('app.current_user_id', true)
+        )
+    """)
+    
+    # Policy: Tenant-owned (owner_id IS NULL) visible to all in tenant
+    op.execute("""
+        CREATE POLICY contacts_tenant_owned_visible ON contacts
+        FOR ALL
+        USING (owner_id IS NULL)
+    """)
+    
+    # Policy: Shared via entity_permissions
+    op.execute("""
+        CREATE POLICY contacts_shared_visible ON contacts
+        FOR ALL
+        USING (
+            EXISTS (
+                SELECT 1 FROM entity_permissions ep
+                WHERE ep.entity_type = 'contact'
+                AND ep.entity_id = contacts.id
+                AND ep.tenant_id = contacts.tenant_id
+                AND ep.permission_level != 'none'
+                AND (
+                    ep.expires_at IS NULL OR ep.expires_at > NOW()
+                )
+                AND (
+                    (ep.principal_type = 'user' 
+                     AND ep.principal_id::text = current_setting('app.current_user_id', true))
+                    OR
+                    (ep.principal_type = 'group'
+                     AND ep.principal_id::text = ANY(
+                         string_to_array(current_setting('app.current_user_groups', true), ',')
+                     ))
+                    OR
+                    (ep.principal_type = 'role'
+                     AND ep.principal_id IN (
+                         SELECT ut.role_id FROM user_tenants ut
+                         WHERE ut.user_id::text = current_setting('app.current_user_id', true)
+                         AND ut.tenant_id = contacts.tenant_id
+                     ))
+                )
+            )
+        )
+    """)
+
+
+def downgrade() -> None:
+    op.execute("DROP POLICY IF EXISTS contacts_shared_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_owner_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_admin_visible ON contacts")
+    op.execute("ALTER TABLE contacts DISABLE ROW LEVEL SECURITY")

alembic/versions/0053_mail_owner_id.py

@@ -0,0 +1,29 @@
+"""Add owner_id to mail_accounts for row-level permissions.
+
+Revision ID: 0053
+Revises: 0052
+Create Date: 2026-07-29
+
+This migration adds owner_id to mail_accounts so that the universal
+visibility/permission system (apply_visibility_filter, check_single_entity_access)
+can be used for mail accounts.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0053"
+down_revision = "0052"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.execute("ALTER TABLE IF EXISTS mail_accounts ADD COLUMN IF NOT EXISTS owner_id UUID REFERENCES users(id) ON DELETE SET NULL")
+    op.execute("DO $$ BEGIN IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'mail_accounts') THEN CREATE INDEX IF NOT EXISTS ix_mail_accounts_owner ON mail_accounts (owner_id); END IF; END $$")
+
+
+def downgrade():
+    op.drop_index("ix_mail_accounts_owner", table_name="mail_accounts")
+    op.drop_column("mail_accounts", "owner_id")

alembic/versions/0054_plugin_owner_id.py

@@ -0,0 +1,63 @@
+"""Add owner_id to plugin entity tables for row-level ownership.
+
+Revision ID: 0054
+Revises: 0053
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+
+revision = "0054"
+down_revision = "0053"
+branch_labels = None
+depends_on = None
+
+# Tables that need owner_id
+TABLES = [
+    "files",
+    "folders",
+    "calendar_entries",
+    "calendars",
+    "tasks",
+    "subtasks",
+]
+
+
+def upgrade() -> None:
+    # Check which columns already exist before adding
+    conn = op.get_bind()
+    for table in TABLES:
+        # Check if table exists
+        table_exists = conn.execute(
+            sa.text(
+                "SELECT 1 FROM information_schema.tables WHERE table_name = :table"
+            ),
+            {"table": table},
+        ).fetchone()
+        if table_exists is None:
+            continue
+        # Check if column already exists
+        result = conn.execute(
+            sa.text(
+                "SELECT column_name FROM information_schema.columns "
+                "WHERE table_name = :table AND column_name = 'owner_id'"
+            ),
+            {"table": table},
+        )
+        if result.fetchone() is None:
+            op.execute(f"ALTER TABLE {table} ADD COLUMN IF NOT EXISTS owner_id UUID REFERENCES users(id) ON DELETE SET NULL")
+            op.execute(f"CREATE INDEX IF NOT EXISTS ix_{table}_owner ON {table} (owner_id)")
+
+
+def downgrade() -> None:
+    for table in TABLES:
+        try:
+            op.drop_index(f"ix_{table}_owner", table_name=table)
+        except Exception:
+            pass
+        try:
+            op.drop_column(table, "owner_id")
+        except Exception:
+            pass

alembic/versions/0055_entity_policies.py

@@ -0,0 +1,55 @@
+"""Create entity_policies table for ABAC engine.
+
+Revision ID: 0055
+Revises: 0054
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+revision = "0055"
+down_revision = "0054"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "entity_policies",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("principal_type", sa.String(10), nullable=False),
+        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("effect", sa.String(10), nullable=False, server_default=sa.text("'allow'")),
+        sa.Column("conditions", JSONB, nullable=True),
+        sa.Column("priority", sa.Integer, nullable=False, server_default=sa.text("0")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.text("true")),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.CheckConstraint(
+            "principal_type IN ('user', 'group', 'role')",
+            name="ck_epol_principal_type",
+        ),
+        sa.CheckConstraint(
+            "effect IN ('allow', 'deny')",
+            name="ck_epol_effect",
+        ),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_entity_type ON entity_policies (entity_type)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_principal ON entity_policies (principal_type, principal_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_tenant ON entity_policies (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_priority ON entity_policies (priority)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_enabled ON entity_policies (enabled)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_epol_enabled", table_name="entity_policies")
+    op.drop_index("ix_epol_priority", table_name="entity_policies")
+    op.drop_index("ix_epol_tenant", table_name="entity_policies")
+    op.drop_index("ix_epol_principal", table_name="entity_policies")
+    op.drop_index("ix_epol_entity_type", table_name="entity_policies")
+    op.drop_table("entity_policies")

alembic/versions/0056_permission_templates.py

@@ -0,0 +1,42 @@
+"""Create permission_templates table.
+
+Revision ID: 0056
+Revises: 0055
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+revision = "0056"
+down_revision = "0055"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "permission_templates",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("trigger_condition", JSONB, nullable=True),
+        sa.Column("auto_share_with", JSONB, nullable=True),
+        sa.Column("level", sa.String(20), nullable=False, server_default=sa.text("'read'")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.CheckConstraint(
+            "level IN ('read', 'write', 'admin', 'delete')",
+            name="ck_pt_level",
+        ),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pt_entity_type ON permission_templates (entity_type)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pt_tenant ON permission_templates (tenant_id)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_pt_tenant", table_name="permission_templates")
+    op.drop_index("ix_pt_entity_type", table_name="permission_templates")
+    op.drop_table("permission_templates")

alembic/versions/0057_permission_delegations.py

@@ -0,0 +1,47 @@
+"""Create permission_delegations table.
+
+Revision ID: 0057
+Revises: 0056
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+revision = "0057"
+down_revision = "0056"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "permission_delegations",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("from_user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("to_user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("start_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("end_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("scope", JSONB, nullable=True),
+        sa.Column("active", sa.Boolean, nullable=False, server_default=sa.text("true")),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.CheckConstraint(
+            "end_at > start_at",
+            name="ck_pd_end_after_start",
+        ),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pd_from_user ON permission_delegations (from_user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pd_to_user ON permission_delegations (to_user_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pd_tenant ON permission_delegations (tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_pd_active ON permission_delegations (active)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_pd_active", table_name="permission_delegations")
+    op.drop_index("ix_pd_tenant", table_name="permission_delegations")
+    op.drop_index("ix_pd_to_user", table_name="permission_delegations")
+    op.drop_index("ix_pd_from_user", table_name="permission_delegations")
+    op.drop_table("permission_delegations")

alembic/versions/0058_resolution_strategy.py

@@ -0,0 +1,36 @@
+"""Add resolution_strategy field to tenants table.
+
+Revision ID: 0058
+Revises: 0057
+Create Date: 2026-07-29
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0058"
+down_revision = "0057"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "tenants",
+        sa.Column(
+            "resolution_strategy",
+            sa.String(30),
+            nullable=False,
+            server_default=sa.text("'highest_wins'"),
+        ),
+    )
+    op.create_check_constraint(
+        "ck_tenant_resolution_strategy",
+        "tenants",
+        "resolution_strategy IN ('highest_wins', 'deny_overrides_allow', 'direct_overrides_group', 'most_restrictive_wins')",
+    )
+
+
+def downgrade() -> None:
+    op.drop_constraint("ck_tenant_resolution_strategy", "tenants")
+    op.drop_column("tenants", "resolution_strategy")

alembic/versions/0059_guest_users.py

@@ -0,0 +1,46 @@
+"""Create guest_users table.
+
+Revision ID: 0059
+Revises: 0058
+Create Date: 2026-07-29 02:47:00.000000
+"""
+
+from __future__ import annotations
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0059"
+down_revision: str | None = "0058"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "guest_users",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("email", sa.String(255), nullable=False),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column("password_hash", sa.String(255), nullable=True),
+        sa.Column("tenant_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("invited_by", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("status", sa.String(20), nullable=False, server_default="invited"),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.execute('CREATE INDEX IF NOT EXISTS ix_guest_users_email_tenant ON guest_users (email, tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_guest_users_status ON guest_users (status, tenant_id)')
+    op.execute('CREATE INDEX IF NOT EXISTS ix_guest_users_invited_by ON guest_users (invited_by)')
+
+
+def downgrade() -> None:
+    op.drop_index("ix_guest_users_invited_by", table_name="guest_users")
+    op.drop_index("ix_guest_users_status", table_name="guest_users")
+    op.drop_index("ix_guest_users_email_tenant", table_name="guest_users")
+    op.drop_table("guest_users")

alembic/versions/0060_rls_contacts_secure.py

@@ -0,0 +1,202 @@
+"""Fix RLS policies on contacts — add tenant_id isolation.
+
+Revision ID: 0060
+Revises: 0059
+Create Date: 2026-07-29
+
+This migration drops the insecure contact RLS policies (created in 0052)
+and recreates them with proper tenant_id isolation.
+
+Problems fixed:
+1. contacts_tenant_owned_visible had USING (owner_id IS NULL) without tenant_id check
+2. contacts_admin_visible had no tenant_id check
+3. contacts_owner_visible had no tenant_id check
+4. All policies used FOR ALL instead of separate SELECT/INSERT/UPDATE/DELETE
+5. No WITH CHECK on write operations
+"""
+
+from alembic import op
+
+revision = "0060"
+down_revision = "0059"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Drop all existing contact policies
+    op.execute("DROP POLICY IF EXISTS contacts_admin_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_owner_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_shared_visible ON contacts")
+    op.execute("DROP POLICY IF EXISTS tenant_isolation ON contacts")
+
+    # ── Restrive policy: Tenant isolation (always enforced) ──
+    # This is the base policy that ALL other permissive policies are ANDed with
+    op.execute("""
+        CREATE POLICY contacts_tenant_isolation ON contacts
+        FOR ALL
+        USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+        WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+    """)
+
+    # ── Permissive policies for SELECT (visibility) ──
+
+    # System admin sees everything (within tenant)
+    op.execute("""
+        CREATE POLICY contacts_admin_select ON contacts
+        FOR SELECT
+        USING (
+            current_setting('app.is_system_admin', true) = 'true'
+            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
+        )
+    """)
+
+    # Owner sees own rows (within tenant)
+    op.execute("""
+        CREATE POLICY contacts_owner_select ON contacts
+        FOR SELECT
+        USING (
+            owner_id::text = current_setting('app.current_user_id', true)
+            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
+        )
+    """)
+
+    # Tenant-owned (owner_id IS NULL) visible to all in tenant
+    op.execute("""
+        CREATE POLICY contacts_tenant_owned_select ON contacts
+        FOR SELECT
+        USING (
+            owner_id IS NULL
+            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
+        )
+    """)
+
+    # Shared via entity_permissions (within tenant)
+    op.execute("""
+        CREATE POLICY contacts_shared_select ON contacts
+        FOR SELECT
+        USING (
+            EXISTS (
+                SELECT 1 FROM entity_permissions ep
+                WHERE ep.entity_type = 'contact'
+                AND ep.entity_id = contacts.id
+                AND ep.tenant_id = contacts.tenant_id
+                AND ep.permission_level != 'none'
+                AND (
+                    ep.expires_at IS NULL OR ep.expires_at > NOW()
+                )
+                AND (
+                    (ep.principal_type = 'user'
+                     AND ep.principal_id::text = current_setting('app.current_user_id', true))
+                    OR
+                    (ep.principal_type = 'group'
+                     AND ep.principal_id::text = ANY(
+                         string_to_array(current_setting('app.current_user_groups', true), ',')
+                     ))
+                    OR
+                    (ep.principal_type = 'role'
+                     AND ep.principal_id IN (
+                         SELECT ut.role_id FROM user_tenants ut
+                         WHERE ut.user_id::text = current_setting('app.current_user_id', true)
+                         AND ut.tenant_id = contacts.tenant_id
+                     ))
+                )
+            )
+            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
+        )
+    """)
+
+    # ── Permissive policies for INSERT ──
+    op.execute("""
+        CREATE POLICY contacts_insert_policy ON contacts
+        FOR INSERT
+        WITH CHECK (
+            tenant_id = current_setting('app.current_tenant_id', true)::uuid
+            AND (
+                current_setting('app.is_system_admin', true) = 'true'
+                OR owner_id::text = current_setting('app.current_user_id', true)
+                OR owner_id IS NULL
+            )
+        )
+    """)
+
+    # ── Permissive policies for UPDATE ──
+    op.execute("""
+        CREATE POLICY contacts_update_policy ON contacts
+        FOR UPDATE
+        USING (
+            tenant_id = current_setting('app.current_tenant_id', true)::uuid
+            AND (
+                current_setting('app.is_system_admin', true) = 'true'
+                OR owner_id::text = current_setting('app.current_user_id', true)
+                OR owner_id IS NULL
+                OR EXISTS (
+                    SELECT 1 FROM entity_permissions ep
+                    WHERE ep.entity_type = 'contact'
+                    AND ep.entity_id = contacts.id
+                    AND ep.tenant_id = contacts.tenant_id
+                    AND ep.permission_level IN ('write', 'admin', 'delete')
+                    AND (
+                        ep.expires_at IS NULL OR ep.expires_at > NOW()
+                    )
+                    AND (
+                        (ep.principal_type = 'user'
+                         AND ep.principal_id::text = current_setting('app.current_user_id', true))
+                        OR
+                        (ep.principal_type = 'group'
+                         AND ep.principal_id::text = ANY(
+                             string_to_array(current_setting('app.current_user_groups', true), ',')
+                         ))
+                    )
+                )
+            )
+        )
+        WITH CHECK (
+            tenant_id = current_setting('app.current_tenant_id', true)::uuid
+        )
+    """)
+
+    # ── Permissive policies for DELETE ──
+    op.execute("""
+        CREATE POLICY contacts_delete_policy ON contacts
+        FOR DELETE
+        USING (
+            tenant_id = current_setting('app.current_tenant_id', true)::uuid
+            AND (
+                current_setting('app.is_system_admin', true) = 'true'
+                OR owner_id::text = current_setting('app.current_user_id', true)
+                OR EXISTS (
+                    SELECT 1 FROM entity_permissions ep
+                    WHERE ep.entity_type = 'contact'
+                    AND ep.entity_id = contacts.id
+                    AND ep.tenant_id = contacts.tenant_id
+                    AND ep.permission_level IN ('admin', 'delete')
+                    AND (
+                        ep.expires_at IS NULL OR ep.expires_at > NOW()
+                    )
+                    AND (
+                        (ep.principal_type = 'user'
+                         AND ep.principal_id::text = current_setting('app.current_user_id', true))
+                        OR
+                        (ep.principal_type = 'group'
+                         AND ep.principal_id::text = ANY(
+                             string_to_array(current_setting('app.current_user_groups', true), ',')
+                         ))
+                    )
+                )
+            )
+        )
+    """)
+
+
+def downgrade() -> None:
+    # Drop the new secure policies
+    op.execute("DROP POLICY IF EXISTS contacts_tenant_isolation ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_admin_select ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_owner_select ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_select ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_shared_select ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_insert_policy ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_update_policy ON contacts")
+    op.execute("DROP POLICY IF EXISTS contacts_delete_policy ON contacts")

alembic/versions/0061_db_roles_secure.py

@@ -0,0 +1,65 @@
+"""Fix DB roles — add default privileges and grants for all tables.
+
+Revision ID: 0061
+Revises: 0060
+Create Date: 2026-07-29
+
+Problems fixed:
+1. crm_runtime role has no grants on tables created after migration 0044
+2. No ALTER DEFAULT PRIVILEGES for future tables
+3. Auth tables (users, tenants, user_tenants, user_groups) need SELECT grants
+4. New permission/guest/policy tables need grants
+"""
+
+from alembic import op
+
+revision = "0061"
+down_revision = "0060"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Grant privileges on all existing tables to crm_runtime
+    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_runtime")
+    
+    # Grant USAGE on sequences
+    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
+    
+    # Default privileges for future tables created by migration owner
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_runtime")
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO crm_runtime")
+    
+    # Ensure RLS is enabled on all tenant tables that have tenant_id
+    # (covers tables created after migration 0044 that missed RLS)
+    tenant_tables = [
+        "entity_permissions",
+        "entity_policies",
+        "permission_templates",
+        "guest_users",
+        "contact_folder_permissions",
+    ]
+    for table in tenant_tables:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
+        # Create tenant isolation policy if not exists
+        op.execute(f"""
+            DO $$
+            BEGIN
+                IF NOT EXISTS (
+                    SELECT 1 FROM pg_policy 
+                    WHERE polname = '{table}_tenant_isolation' 
+                    AND polrelid = '{table}'::regclass
+                ) THEN
+                    CREATE POLICY {table}_tenant_isolation ON {table}
+                    FOR ALL
+                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+                END IF;
+            END $$;
+        """)
+
+
+def downgrade() -> None:
+    # Revoke default privileges
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")

alembic/versions/0062_guest_invitations_secure.py

@@ -0,0 +1,51 @@
+"""Fix guest invitation security — separate token table.
+
+Revision ID: 0062
+Revises: 0061
+Create Date: 2026-07-29
+
+Problems fixed:
+1. Guest UUID was used as invitation token (P1.6)
+2. No separate token with sufficient entropy
+3. No one-time use tracking
+4. No session revocation on guest deletion
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0062"
+down_revision = "0061"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "guest_invitations",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("guest_user_id", UUID(as_uuid=True), sa.ForeignKey("guest_users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("token_hash", sa.String(64), nullable=False, unique=True, index=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
+    )
+    op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY")
+    op.execute("""
+        CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations
+        FOR ALL
+        USING (
+            EXISTS (
+                SELECT 1 FROM guest_users gu
+                WHERE gu.id = guest_invitations.guest_user_id
+                AND gu.tenant_id = current_setting('app.current_tenant_id', true)::uuid
+            )
+        )
+    """)
+
+
+def downgrade() -> None:
+    op.drop_table("guest_invitations")

alembic/versions/0063_notification_entity_fields.py

@@ -0,0 +1,29 @@
+"""Add entity_type and entity_id to notifications table.
+
+Revision ID: 0063
+Revises: 0062
+Create Date: 2026-07-29
+
+The notification model has entity_type and entity_id fields but the DB
+table was never migrated. This causes INSERT failures.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0063"
+down_revision = "0062"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE notifications ADD COLUMN IF NOT EXISTS entity_type VARCHAR(50)")
+    op.execute("CREATE INDEX IF NOT EXISTS ix_notifications_entity_type ON notifications (entity_type)")
+    op.execute("ALTER TABLE notifications ADD COLUMN IF NOT EXISTS entity_id UUID")
+
+
+def downgrade() -> None:
+    op.drop_column("notifications", "entity_id")
+    op.drop_column("notifications", "entity_type")

alembic/versions/0064_rls_all_tenant_tables.py

@@ -0,0 +1,86 @@
+"""Enable RLS on all remaining tenant tables.
+
+Revision ID: 0064
+Revises: 0063
+Create Date: 2026-07-29
+
+Currently RLS is only on contacts. This migration enables RLS on all
+tenant-scoped tables that have a tenant_id column but no RLS yet.
+
+System tables (users, tenants, groups, roles) are excluded — they need
+special handling for the login bootstrap process.
+"""
+
+from alembic import op
+
+revision = "0064"
+down_revision = "0063"
+branch_labels = None
+depends_on = None
+
+# Tables that should have RLS (tenant-scoped data)
+TENANT_TABLES = [
+    "addresses",
+    "attachments",
+    "bank_accounts",
+    "contact_folders",
+    "contact_merge_history",
+    "workflows",
+    "sequences",
+    "saved_filters",
+    "saved_views",
+    "webhooks",
+    "custom_field_definitions",
+    "notifications",
+    "ai_conversations",
+    "contact_persons",
+    "tags",
+    "entity_links",
+    "dms_files",
+    "dms_folders",
+    "calendar_events",
+    "calendars",
+    "tasks",
+    "task_lists",
+    "mail_messages",
+    "mail_accounts",
+    "mail_folders",
+    "conversations",
+    "conversation_messages",
+    "conversation_participants",
+    "audit_log",
+    "permission_delegations",
+    "guest_invitations",
+]
+
+
+def upgrade() -> None:
+    for table in TENANT_TABLES:
+        # Enable RLS if not already enabled
+        op.execute(f"""
+            DO $$
+            BEGIN
+                IF NOT EXISTS (
+                    SELECT 1 FROM pg_class c
+                    WHERE c.relname = '{table}'
+                    AND c.relrowsecurity = true
+                ) AND EXISTS (
+                    SELECT 1 FROM information_schema.columns
+                    WHERE table_name = '{table}'
+                    AND column_name = 'tenant_id'
+                ) THEN
+                    ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;
+                    
+                    CREATE POLICY {table}_tenant_isolation ON {table}
+                    FOR ALL
+                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+                END IF;
+            END $$;
+        """)
+
+
+def downgrade() -> None:
+    for table in TENANT_TABLES:
+        op.execute(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}")
+        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")

alembic/versions/0065_consumer_inbox.py

@@ -0,0 +1,40 @@
+"""Add consumer_inbox table for outbox idempotency.
+
+Revision ID: 0065
+Revises: 0064
+Create Date: 2026-07-29
+
+Without idempotency, a worker crash between sending an email/webhook
+and marking the event as published can lead to duplicate deliveries.
+
+This migration creates a consumer_inbox table that tracks which
+consumers have already processed which events.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0065"
+down_revision = "0064"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "consumer_inbox",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("event_id", UUID(as_uuid=True), sa.ForeignKey("event_outbox.id", ondelete="CASCADE"), nullable=False, index=True),
+        sa.Column("consumer_name", sa.String(100), nullable=False, index=True),
+        sa.Column("status", sa.String(20), nullable=False, default="pending"),  # pending, processed, failed
+        sa.Column("processed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("error_message", sa.Text, nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
+        sa.UniqueConstraint("event_id", "consumer_name", name="uq_consumer_inbox_event_consumer"),
+    )
+    op.execute("ALTER TABLE consumer_inbox ENABLE ROW LEVEL SECURITY")
+
+
+def downgrade() -> None:
+    op.drop_table("consumer_inbox")

alembic/versions/0066_tenant_plugin_activation.py

@@ -0,0 +1,44 @@
+"""Add tenant_plugin_activation table for per-tenant plugin activation.
+
+Revision ID: 0066
+Revises: 0065
+Create Date: 2026-07-29
+
+Currently plugins are activated globally. This migration creates a
+table for per-tenant plugin activation so that different tenants can
+enable/disable plugins independently.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0066"
+down_revision = "0065"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "tenant_plugin_activation",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True),
+        sa.Column("plugin_name", sa.String(100), nullable=False, index=True),
+        sa.Column("is_active", sa.Boolean, nullable=False, default=True),
+        sa.Column("activated_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
+        sa.UniqueConstraint("tenant_id", "plugin_name", name="uq_tenant_plugin"),
+    )
+    op.execute("ALTER TABLE tenant_plugin_activation ENABLE ROW LEVEL SECURITY")
+    op.execute("""
+        CREATE POLICY tenant_plugin_activation_tenant_isolation ON tenant_plugin_activation
+        FOR ALL
+        USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+        WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+    """)
+
+
+def downgrade() -> None:
+    op.drop_table("tenant_plugin_activation")

alembic/versions/0067_disable_rls_system_tables.py

@@ -0,0 +1,56 @@
+"""Disable RLS on system identity tables to fix login bootstrap circle.
+
+Revision ID: 0067
+Revises: 0066
+Create Date: 2026-07-29
+
+Problem: users, user_tenants, groups, roles have RLS enabled. The login
+process needs to query these tables BEFORE a tenant context is set
+(bootstrap circle: Login → Membership → Tenant-Context → Login).
+
+RLS on these tables blocks login because there's no tenant context yet.
+
+Solution: Disable RLS on system identity tables. Tenant isolation for
+these tables is enforced at the application level (auth_service always
+filters by user_id + tenant_id in queries).
+"""
+
+from alembic import op
+
+revision = "0067"
+down_revision = "0066"
+branch_labels = None
+depends_on = None
+
+# System identity tables — no RLS (needed for login bootstrap)
+SYSTEM_TABLES = [
+    "users",
+    "user_tenants",
+    "groups",
+    "user_groups",
+    "roles",
+]
+
+
+def upgrade() -> None:
+    for table in SYSTEM_TABLES:
+        # Drop any existing policies
+        op.execute(f"""
+            DO $$
+            DECLARE pol RECORD;
+            BEGIN
+                FOR pol IN
+                    SELECT polname FROM pg_policy
+                    WHERE polrelid = '{table}'::regclass
+                LOOP
+                    EXECUTE format('DROP POLICY IF EXISTS %I ON {table}', pol.polname);
+                END LOOP;
+            END $$;
+        """)
+        # Disable RLS
+        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
+
+
+def downgrade() -> None:
+    for table in SYSTEM_TABLES:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")

alembic/versions/0068_entity_permissions_deleted_at.py

@@ -0,0 +1,28 @@
+"""Add deleted_at to entity_permissions table.
+
+Revision ID: 0068
+Revises: 0067
+Create Date: 2026-07-29
+
+The EntityPermission model has SoftDeleteMixin but the table was never
+migrated to include the deleted_at column.
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0068"
+down_revision = "0067"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("entity_permissions", sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True))
+    op.execute("CREATE INDEX IF NOT EXISTS ix_entity_permissions_deleted_at ON entity_permissions (deleted_at)")
+
+
+def downgrade() -> None:
+    op.drop_index("ix_entity_permissions_deleted_at", table_name="entity_permissions")
+    op.drop_column("entity_permissions", "deleted_at")