-- Migration 079: Add evidence_type to canonical_controls
-- Classifies HOW a control is evidenced:
--   code    = Technical control, verifiable in source code / IaC / CI-CD
--   process = Organizational / governance control, verified via documents / policies
--   hybrid  = Both code and process evidence required

DO $$
BEGIN
    IF EXISTS (SELECT 1 FROM information_schema.tables
               WHERE table_schema = 'compliance' AND table_name = 'canonical_controls') THEN
        ALTER TABLE canonical_controls ADD COLUMN IF NOT EXISTS
            evidence_type VARCHAR(20) DEFAULT NULL
            CHECK (evidence_type IN ('code', 'process', 'hybrid'));
        CREATE INDEX IF NOT EXISTS idx_cc_evidence_type ON canonical_controls(evidence_type);
    END IF;
END $$;
