feat(copy): SEL-452 copy gate with capabilities registry and baseline ratchet

.github/workflows/copy-gate.yml

@@ -0,0 +1,58 @@
+name: Copy gate
+
+on:
+  pull_request:
+    paths:
+      - 'frontend/**'
+      - 'scripts/copy-lint/**'
+      - '.github/workflows/copy-gate.yml'
+      - 'scripts/copy-lint/baseline.json'
+  push:
+    branches: [main]
+    paths:
+      - 'frontend/**'
+      - 'scripts/copy-lint/**'
+      - '.github/workflows/copy-gate.yml'
+      - 'scripts/copy-lint/baseline.json'
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    name: Copy gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v6
+        with:
+          node-version: '20'
+      - run: node --test scripts/copy-lint/check-copy.test.mjs
+      - name: Read base copy baseline
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+            base_ref="origin/${BASE_REF}"
+          else
+            if [[ "$BEFORE_SHA" =~ ^0{40}$ ]]; then
+              exit 0
+            fi
+            base_ref="$BEFORE_SHA"
+          fi
+          base_commit=$(git rev-parse --verify "${base_ref}^{commit}") || exit 1
+          baseline_path="scripts/copy-lint/baseline.json"
+          if git cat-file -e "${base_commit}:${baseline_path}" 2>/dev/null; then
+            git show "${base_commit}:${baseline_path}" > "$RUNNER_TEMP/base-baseline.json" || exit 1
+          else
+            baseline_entry=$(git ls-tree -r --name-only "$base_commit" -- "$baseline_path") || exit 1
+            if [ -n "$baseline_entry" ]; then
+              echo "Unable to read base copy baseline" >&2
+              exit 1
+            fi
+          fi
+      - run: node scripts/copy-lint/check-copy.mjs . --gate --github --base-baseline "$RUNNER_TEMP/base-baseline.json"

docs/schema/expected_schema.json

@@ -5525,6 +5525,55 @@
       }
     ]
   },
+  "public.data_gap_events": {
+    "columns": {
+      "closed_at": {
+        "nullable": true,
+        "type": "timestamp"
+      },
+      "closing_record_hash": {
+        "nullable": true,
+        "type": "text"
+      },
+      "closing_record_id": {
+        "nullable": true,
+        "type": "uuid"
+      },
+      "cte_type": {
+        "nullable": false,
+        "type": "text"
+      },
+      "gap_key": {
+        "nullable": false,
+        "type": "text"
+      },
+      "gap_kind": {
+        "nullable": false,
+        "type": "text"
+      },
+      "id": {
+        "nullable": false,
+        "type": "uuid"
+      },
+      "lot_code": {
+        "nullable": false,
+        "type": "text"
+      },
+      "opened_at": {
+        "nullable": false,
+        "type": "timestamp"
+      },
+      "supplier_key": {
+        "nullable": false,
+        "type": "text"
+      },
+      "tenant_id": {
+        "nullable": false,
+        "type": "uuid"
+      }
+    },
+    "foreign_keys": []
+  },
   "public.food_traceability_list": {
     "columns": {
       "applicable_ctes": {

frontend/package.json

@@ -31,6 +31,7 @@
       "src/lib/capabilities.ts"
     ]
   },
+  "//knip": "src/lib/capabilities.ts is read by scripts/copy-lint/check-copy.mjs (the SEL-452 copy gate registry), not imported by frontend code.",
   "//": "Pinning policy (#569): next, eslint-config-next, @sentry/nextjs, and @supabase/supabase-js are pinned to exact versions (no ^ or ~ prefix) because breaking changes in these packages have caused production incidents. Bump them deliberately after testing. All other deps use ^ for minor/patch auto-updates.",
   "dependencies": {
     "@radix-ui/react-checkbox": "^1.4.1",

frontend/src/lib/capabilities.ts

@@ -2,5 +2,15 @@
 export const capabilities = {
   live: ['CSV upload', 'JSON events API'],
   preview: ['EPCIS intake', 'EPCIS export'],
-  neverShown: ['EDI', 'SFTP'],
+  planned: [],
+  off: ['EDI', 'SFTP'],
 } as const;
+
+export type CapabilityStatus = keyof typeof capabilities;
+
+export function statusOf(name: string): CapabilityStatus | undefined {
+  for (const status of ['live', 'preview', 'planned', 'off'] as const) {
+    if ((capabilities[status] as readonly string[]).includes(name)) return status;
+  }
+  return undefined;
+}