phase 1: Go foundation — module, migrations, domain, seed ingest

Core deliverables:
- Go module github.com/dtoro/oikos (Go 1.26.3)
- cmd/oikos: single binary with role subcommands (migrate, seed, export)
- 6 SQL migrations: ontology meta-schema, entity instances (UUID+slug,
  blast_radius recursive function), operations (signals/checks/approvals),
  cognition (classifications/executions/feedback/patterns/skills), policy,
  observability (TimescaleDB hypertables + CAGGs + retention)
- Domain layer: entity, signal, execution, classification, pattern, skill,
  approval, check types + 11 sentinel errors + lifecycle state machines
- DB layer: pgx pool, SQL splitter (handles 94436 and -- comments), migration
  runner, seed ingest (ontology+inventory+policy) with content-hash dedup
- Config: env-based with defaults, secrets redaction
- Observability: slog JSON logger with debug mode
- Infrastructure: Makefile, docker-compose.yml, multi-stage Dockerfile
  (distroless, CGO_ENABLED=0)

Verified end-to-end against timescale/timescaledb:2.17.2-pg16:
- 6 migrations applied (65 SQL statements)
- Seeds ingested: 6 lifecycles, 59 entity types, 46 relationship types,
  111 entities, 144 relationships, 4 risk classes, 27 approval rules,
  9 autonomy settings
- Idempotent: second seed run is a no-op (content hash matches)

Bugs fixed during implementation:
- TimescaleDB CAGGs can't run in a transaction -> splitSQL() executes
  statements individually
- Semicolons in -- comments treated as separators -> comment handling
- YAML keys source/target didn't match code's source_type/target_type
- yaml.Marshal produced YAML for JSONB columns -> json.Marshal

migrations/004_cognition.up.sql

@@ -0,0 +1,91 @@
+-- Migration 004: Cognition (classifications, executions, learning)
+-- All cognition objects are dual entities (entities row + typed table).
+-- Classifications persist every autonomous decision (SA5).
+
+CREATE TABLE classifications (
+    entity_id         UUID PRIMARY KEY REFERENCES entities(id),
+    signal_entity_id  UUID REFERENCES signals(entity_id),
+    target_entity_id  UUID REFERENCES entities(id),
+    action            TEXT NOT NULL,
+    recommended_action JSONB,
+    risk_class        TEXT NOT NULL,
+    route             TEXT NOT NULL CHECK (route IN ('auto-act','escalate','hold')),
+    blast_radius      UUID[],
+    pattern_confidence REAL,
+    skill_id          UUID,
+    autonomy_check    TEXT,
+    reasoning         JSONB NOT NULL,
+    correlation_id    TEXT NOT NULL,
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_class_signal ON classifications(signal_entity_id);
+CREATE INDEX idx_class_entity ON classifications(target_entity_id);
+
+CREATE TABLE executions (
+    entity_id         UUID PRIMARY KEY REFERENCES entities(id),
+    classification_id UUID REFERENCES classifications(entity_id),
+    signal_entity_id  UUID REFERENCES signals(entity_id),
+    target_entity_id  UUID REFERENCES entities(id),
+    action            TEXT NOT NULL,
+    risk_class        TEXT NOT NULL,
+    approval_id       UUID REFERENCES approvals(entity_id),
+    agent_id          UUID REFERENCES entities(id),
+    skill_id          UUID,
+    skill_version     INTEGER,
+    status            TEXT NOT NULL DEFAULT 'proposed',
+    result            JSONB,
+    duration_ms       INTEGER,
+    verified          BOOLEAN NOT NULL DEFAULT false,
+    correlation_id    TEXT NOT NULL,
+    started_at        TIMESTAMPTZ,
+    completed_at      TIMESTAMPTZ,
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_exec_target ON executions(target_entity_id);
+CREATE INDEX idx_exec_status ON executions(status);
+
+CREATE TABLE feedback (
+    entity_id     UUID PRIMARY KEY REFERENCES entities(id),
+    execution_id  UUID NOT NULL REFERENCES executions(entity_id),
+    outcome       TEXT NOT NULL CHECK (outcome IN ('success','failure','partial','unexpected')),
+    observation   TEXT,
+    lesson        TEXT,
+    unexpected_side_effects TEXT[],
+    tags          TEXT[],
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_feedback_ts ON feedback(created_at);
+
+CREATE TABLE patterns (
+    entity_id     UUID PRIMARY KEY REFERENCES entities(id),
+    applies_type  TEXT NOT NULL REFERENCES entity_types(name),
+    action        TEXT NOT NULL,
+    pattern       TEXT NOT NULL,
+    confidence    REAL NOT NULL DEFAULT 0,
+    evidence_count INTEGER NOT NULL DEFAULT 0,
+    success_count INTEGER NOT NULL DEFAULT 0,
+    failure_count INTEGER NOT NULL DEFAULT 0,
+    status        TEXT NOT NULL DEFAULT 'hypothesized',
+    quarantined   BOOLEAN NOT NULL DEFAULT false,
+    version       INTEGER NOT NULL DEFAULT 1,
+    last_validated_at TIMESTAMPTZ,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (applies_type, action)
+);
+
+CREATE TABLE skills (
+    entity_id     UUID NOT NULL REFERENCES entities(id),
+    version       INTEGER NOT NULL DEFAULT 1,
+    name          TEXT NOT NULL,
+    procedure     JSONB NOT NULL,
+    applies_type  TEXT REFERENCES entity_types(name),
+    action        TEXT NOT NULL,
+    pattern_ids   UUID[],
+    status        TEXT NOT NULL DEFAULT 'drafted',
+    success_rate  REAL,
+    changed_by    UUID,
+    change_reason TEXT,
+    last_used_at  TIMESTAMPTZ,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (entity_id, version)
+);