[Ediminator]

Task

• ID: TASK-0064
• Title: Contract templates and contracts schema, migrations, repositories, merge-field engine, and audit registrations
• Epic: E6 — Contracts & e-signature
• Contract: control/ownlight/backlog/TASK-0064-contracts-schema-repositories-merge-engine-and-audit.md
• Iterations: 2 (8b69468dd648ec86c7d2d9a3ca42bac5562c3133)

Summary

• Database Schema & Migrations (drizzle/0022_nifty_blazing_skull.sql):
  • Added contract_templates (id, name, slug, description, project_type_key, title_en, title_de, body_en, body_de, is_default, is_active, position, timestamps) and contracts (id, project_id, client_id, proposal_id, template_id, contract_number, title, locale, status, rendered_body, merge_values_snapshot, canonical_text_sha256, SES signature & countersignature evidence columns, PDF storage seal columns, token hash/revocation/expiry, reminder tracking, timestamps).
  • Extended studio_settings with 10 studio signatory and physical business address columns (contract_signatory_name, contract_signatory_title, contract_countersignature_mode, studio_address_line1, studio_address_line2, studio_postal_code, studio_city, studio_country_code, studio_phone, studio_email).
  • Added synthetic seed fixtures (src/server/db/seeds/contracts.ts) and committed Accepted ADR-0019 (docs/architecture/adr/0019-contracts-and-e-signature.md).
• Deterministic Merge-Field & Snapshot Engine (src/server/contracts/merge-engine.ts):
  • Pure, deterministic token evaluation across 6 allowlisted namespaces (client, project, shoot, package, studio, contract) with strict HTML-escaping, C0 control character stripping, unmapped token reporting, and canonical UTF-8 SHA-256 snapshot freezing (createCanonicalSha256).
• Repositories & Validation (src/server/contracts/template-repo.ts, src/server/contracts/repo.ts, src/server/studio/signing-settings.ts, src/server/contracts/schema.ts):
  • Type-safe CRUD repositories with requireActor authorization, sequential CTR-YYYY-NNNN contract numbering, draft-only immutability enforcement (ContractImmutableError), public cookieless-safe getContractByTokenHash (enforcing tokenRevokedAt === null and masking internalNotes: null), and strict Zod validation.
• Audit, Timeline & Privacy Inventory (src/server/audit/allowlist.ts, src/server/timeline/registry.ts, docs/privacy/data-inventory.md):
  • Registered 12 PII-free audit actions (contract_template.*, contract.*, studio_settings.contract_updated), 4 localized timeline events (contract.sent, contract.signed_by_client, contract.countersigned, contract.voided), and GDPR Art. 30 data inventory entries.

Validation

• L1 Quality Gate (--profile full): 13/13 steps PASS (stmts: 90.86%, branches: 85.63%, funcs: 87.33%, lines: 91.16%)
• L2 Functional Review (validator): PASS (0 blocking)
• L3 Security & Privacy Audit (security-privacy-auditor): PASS (0 blocking)