phase 1: Go foundation — module, migrations, domain, seed ingest

Core deliverables:
- Go module github.com/dtoro/oikos (Go 1.26.3)
- cmd/oikos: single binary with role subcommands (migrate, seed, export)
- 6 SQL migrations: ontology meta-schema, entity instances (UUID+slug,
  blast_radius recursive function), operations (signals/checks/approvals),
  cognition (classifications/executions/feedback/patterns/skills), policy,
  observability (TimescaleDB hypertables + CAGGs + retention)
- Domain layer: entity, signal, execution, classification, pattern, skill,
  approval, check types + 11 sentinel errors + lifecycle state machines
- DB layer: pgx pool, SQL splitter (handles 94436 and -- comments), migration
  runner, seed ingest (ontology+inventory+policy) with content-hash dedup
- Config: env-based with defaults, secrets redaction
- Observability: slog JSON logger with debug mode
- Infrastructure: Makefile, docker-compose.yml, multi-stage Dockerfile
  (distroless, CGO_ENABLED=0)

Verified end-to-end against timescale/timescaledb:2.17.2-pg16:
- 6 migrations applied (65 SQL statements)
- Seeds ingested: 6 lifecycles, 59 entity types, 46 relationship types,
  111 entities, 144 relationships, 4 risk classes, 27 approval rules,
  9 autonomy settings
- Idempotent: second seed run is a no-op (content hash matches)

Bugs fixed during implementation:
- TimescaleDB CAGGs can't run in a transaction -> splitSQL() executes
  statements individually
- Semicolons in -- comments treated as separators -> comment handling
- YAML keys source/target didn't match code's source_type/target_type
- yaml.Marshal produced YAML for JSONB columns -> json.Marshal

migrations/003_operations.up.sql

@@ -0,0 +1,71 @@
+-- Migration 003: Operations (signals, checks, approvals, status)
+-- Signals are dual entities (entities row + signals table for indexed querying).
+
+CREATE TABLE check_defs (
+    entity_id     UUID PRIMARY KEY REFERENCES entities(id),
+    target_id     UUID REFERENCES entities(id),
+    target_type   TEXT REFERENCES entity_types(name),
+    kind          TEXT NOT NULL,
+    config        JSONB NOT NULL DEFAULT '{}',
+    interval_s    INTEGER NOT NULL DEFAULT 600,
+    timeout_s     INTEGER NOT NULL DEFAULT 10,
+    zone          TEXT,
+    enabled       BOOLEAN NOT NULL DEFAULT true,
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE signals (
+    entity_id         UUID PRIMARY KEY REFERENCES entities(id),
+    kind              TEXT NOT NULL,
+    severity          TEXT NOT NULL CHECK (severity IN ('info','warning','critical')),
+    target_entity_id  UUID REFERENCES entities(id),
+    check_id          UUID REFERENCES check_defs(entity_id),
+    evidence          TEXT,
+    likely_cause      TEXT,
+    state             TEXT NOT NULL DEFAULT 'raised',
+    occurrence_count  INTEGER NOT NULL DEFAULT 1,
+    first_seen_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    last_seen_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    flap_count        INTEGER NOT NULL DEFAULT 0,
+    hold_down_until   TIMESTAMPTZ,
+    mute_until        TIMESTAMPTZ,
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+-- At most ONE open signal per (target, kind) — repeats update the open row
+CREATE UNIQUE INDEX uq_signals_open ON signals(target_entity_id, kind)
+    WHERE state NOT IN ('resolved','failed');
+CREATE INDEX idx_signals_state ON signals(state);
+
+CREATE TABLE approvals (
+    entity_id         UUID PRIMARY KEY REFERENCES entities(id),
+    subject_entity_id UUID REFERENCES entities(id),
+    action            TEXT NOT NULL,
+    risk_class        TEXT NOT NULL,
+    kind              TEXT NOT NULL DEFAULT 'execution',
+    payload           JSONB,
+    status            TEXT NOT NULL DEFAULT 'pending',
+    token_hash        TEXT,
+    expires_at        TIMESTAMPTZ NOT NULL,
+    decided_at        TIMESTAMPTZ,
+    decided_by        UUID REFERENCES entities(id),
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE entity_status (
+    entity_id     UUID PRIMARY KEY REFERENCES entities(id),
+    health        TEXT NOT NULL DEFAULT 'unknown',
+    last_check_at TIMESTAMPTZ,
+    details       JSONB NOT NULL DEFAULT '{}',
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE idempotency_keys (
+    key           TEXT NOT NULL,
+    actor         TEXT NOT NULL,
+    request_hash  TEXT NOT NULL,
+    response_code INTEGER,
+    response_body JSONB,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (actor, key)
+);