first commit

database/migrations/2026_10_27_090000_create_workshop_direct_costs.php

@@ -0,0 +1,16 @@
+<?php
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+return new class extends Migration {
+    public function up(): void {
+        $old=substr(DB::selectOne("SELECT pg_get_constraintdef(oid) AS d FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->d,6);
+        DB::statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');
+        DB::statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK (($old) OR (permission IN ('direct_costs.view','direct_costs.prepare','direct_costs.validate') AND unit_id IS NOT NULL))");
+        DB::unprepared(file_get_contents(__DIR__.'/../sql/direct-costs.sql'));
+        foreach(['dc_rates','dc_calculations','dc_decisions','dc_commands','dc_events','dc_outbox'] as $t){
+            DB::statement("CREATE TRIGGER {$t}_immutable BEFORE UPDATE OR DELETE ON {$t} FOR EACH ROW EXECUTE FUNCTION sgf_append_only_audit()");
+            DB::statement("CREATE TRIGGER {$t}_test_only BEFORE INSERT ON {$t} FOR EACH ROW EXECUTE FUNCTION sgf_dc_test_only()");
+        }
+    }
+    public function down(): void {throw new RuntimeException('Direct cost history requires a reviewed preservation procedure.');}
+};