fix(license): replace psycopg2 synchronous PostgreSQL boundary

.github/workflows/tests.yml

@@ -52,6 +52,28 @@ jobs:
           version: "0.11.28"
           enable-cache: false
 
+      - name: Verify committed universal lock
+        id: lock
+        shell: bash
+        run: |
+          set -euo pipefail
+          if uv lock --check; then
+            echo "stale=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          uv lock
+          echo "stale=true" >> "$GITHUB_OUTPUT"
+          exit 1
+
+      - name: Preserve resolver-generated lock candidate
+        if: failure() && steps.lock.outputs.stale == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: uv-lock-candidate-${{ github.sha }}-${{ github.run_attempt }}
+          path: uv.lock
+          if-no-files-found: error
+          retention-days: 7
+
       - name: Select pinned Rust toolchain
         run: |
           rustup toolchain install 1.97.1 --profile minimal

CHANGELOG.d/2.28.0-postgres-sync-driver.md

@@ -0,0 +1,13 @@
+## 2.28.0 — Commercial-safe synchronous PostgreSQL boundary
+
+- Replace the synchronous seed/admin/schema `psycopg2-binary` dependency with
+  a pinned `pg8000` adapter while keeping runtime persistence on `asyncpg`.
+- Preserve generated-identifier quoting, SQLSTATE-specific schema/security
+  assertions, libpq-style DSN semantics that are representable by the adapter,
+  and fail closed on unsupported or ambiguous connection options.
+- Reject boolean, non-finite, non-positive, and float-unrepresentable explicit
+  connection timeouts through the adapter validation contract instead of
+  leaking arithmetic conversion errors.
+- Keep dependency-lock verification fail closed: a stale committed `uv.lock`
+  fails before frozen install/tests while the pinned resolver output is retained
+  as short-lived evidence for an exact, non-hand-edited lock update.

backend/app/main.py

@@ -147,6 +147,7 @@
 )
 from backend.app.occupational_construct_ingestion import (
     load_occupational_construct_assertions,
+    load_occupational_construct_evidence_status,
 )
 from backend.app.occupational_construct_search import (
     OccupationalConstructSearchError,

backend/tests/test_api.py

@@ -23,10 +23,10 @@
 
 import asyncpg
 import jwt
-import psycopg2
 import pytest
 import redis
 
+from lineageweave import postgres_sync as psycopg2
 from lineageweave.http_client import HttpClientError, get_json, post_form
 from lineageweave.knowledge_graph import knowledge_graph_edges_for_post
 from lineageweave.post_summary import POST_SUMMARY_CONTRACT_VERSION
@@ -217,6 +217,40 @@
     / "migrations"
     / "0218_global_ask_public_verification.sql"
 )
+_TEPP_RECEIPT_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0217_analysis_run_tepp_receipt.sql"
+)
+_PROV_O_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0017_prov_o_standard_relations.sql"
+)
+_VOICE_TAXONOMY_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0235_voice_of_x_post_taxonomy.sql"
+)
+_ONTOLOGY_TRUTH_STATUS_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0175_ontology_truth_status.sql"
+)
+_CONVERSATION_EVIDENCE_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0233_source_conversation_turn_evidence.sql"
+)
+_SOURCE_POST_VOICE_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0237_source_post_voice_combination.sql"
+)
+_OCCUPATIONAL_CONSTRUCT_ASSERTION_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0238_occupational_construct_assertion.sql"
+)
+_OCCUPATIONAL_CONSTRUCT_EXTRACTION_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0240_occupational_construct_extraction_run.sql"
+)
 _GLOBAL_ASK_KNOWLEDGE_CUTOFF_MIGRATION = (
     Path(__file__).resolve().parents[2]
     / "migrations"
@@ -332,6 +366,7 @@ def seeded_db(demo_analyst_token):
     try:
         with conn.cursor() as cur:
             cur.execute(_MIGRATION_PATH.read_text())
+            cur.execute(_PROV_O_MIGRATION.read_text())
             cur.execute(_REGISTRY_MIGRATION.read_text())
             cur.execute(_RETENTION_MIGRATION.read_text())
             cur.execute(_RECONSTRUCTION_MIGRATION.read_text())
@@ -415,16 +450,23 @@ def seeded_db(demo_analyst_token):
             )
             conn.autocommit = False
             cur.execute(_GLOBAL_ASK_KNOWLEDGE_CUTOFF_MIGRATION.read_text())
+            cur.execute(_TEPP_RECEIPT_MIGRATION.read_text())
             cur.execute(_GLOBAL_ASK_PUBLIC_VERIFICATION_MIGRATION.read_text())
             cur.execute(_EVENT_OCCURRED_AT_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_AXIS_MIGRATION.read_text())
             cur.execute(_CHANNEL_EVIDENCE_MIGRATION.read_text())
+            cur.execute(_ONTOLOGY_TRUTH_STATUS_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_UNEXPLAINED_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_CROSS_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_RECONSTRUCTION_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_UNEXPLAINED_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_EXPLAINED_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_COORDINATES_MIGRATION.read_text())
+            cur.execute(_CONVERSATION_EVIDENCE_MIGRATION.read_text())
+            cur.execute(_VOICE_TAXONOMY_MIGRATION.read_text())
+            cur.execute(_SOURCE_POST_VOICE_MIGRATION.read_text())
+            cur.execute(_OCCUPATIONAL_CONSTRUCT_ASSERTION_MIGRATION.read_text())
+            cur.execute(_OCCUPATIONAL_CONSTRUCT_EXTRACTION_MIGRATION.read_text())
             cur.execute(
                 "insert into common_lookup_value (lookup_category, lookup_code, lookup_label) values "
                 "('corporate_entity_level', 'group', 'Group'), "

docs/adr/0366-synchronous-postgresql-default-tls.md

@@ -0,0 +1,48 @@
+# ADR 0366 — Verify synchronous PostgreSQL server identity by default
+
+**Decision status:** Proposed
+**Date:** 2026-09-05
+
+## Context
+
+LineageWeave's synchronous administrative and test adapter accepts PostgreSQL
+URIs and translates their transport policy to pg8000. PostgreSQL documents
+`sslmode=prefer` as a backwards-compatibility default that may reconnect in
+plaintext and does not authenticate the server. That behavior is unsuitable as
+an implicit product default for credentials in transit. Explicit DSN policy
+must remain representable for controlled compatibility paths.
+
+## Decision
+
+A network DSN that omits `sslmode` uses `verify-full`: TLS is required, the
+certificate chain is validated, and the requested hostname must match. It never
+retries in plaintext. An explicit `sslmode=prefer` remains TLS-first with
+plaintext fallback only after PostgreSQL's exact SSL-refusal response.
+`disable`, `require`, `verify-ca`, and `verify-full` retain their documented
+meanings. Unix-socket inference remains unavailable because the adapter cannot
+recover libpq's socket selection from a hostless URI.
+
+## Consequences
+
+- Accidental network DSNs fail closed against untrusted or mismatched servers.
+- Existing private-CA deployments must install their CA or state an explicit
+  reviewed compatibility mode; a silent downgrade is no longer possible.
+- Explicit `prefer` remains weaker and must be chosen in the DSN rather than
+  inherited from an omission.
+
+## Alternatives considered
+
+### Keep implicit `prefer`
+
+Rejected because an SSL-refusing endpoint can cause credential-bearing tooling
+to reconnect without encryption.
+
+### Default to `require`
+
+Rejected because encryption without certificate and hostname verification does
+not authenticate the server.
+
+## References
+
+- PostgreSQL 18, *SSL Support* and *Database Connection Control Functions*.
+- pg8000 1.31.5, `ssl_context` connection contract.

lineageweave/optional_extra_collection.py

@@ -2,7 +2,7 @@
 
 OpenCode coverage-evidence runs in a networkless sandbox that supplies
 pytest and coverage but not LineageWeave's optional backend extras
-(``asyncpg``, ``psycopg2``, ``redis``, ``fast_mlsirm``, ``numpy``). Hosted CI
+(``asyncpg``, ``pg8000``, ``redis``, ``fast_mlsirm``, ``numpy``). Hosted CI
 installs those extras and collects every suite. This helper keeps
 collection from failing with ``ModuleNotFoundError`` when extras are
 absent, without skipping anything when they are present.
@@ -17,7 +17,7 @@
 
 OPTIONAL_EXTRA_MODULES: tuple[str, ...] = (
     "asyncpg",
-    "psycopg2",
+    "pg8000",
     "redis",
     "fast_mlsirm",
     "numpy",
@@ -28,7 +28,14 @@
 
 
 def _imported_module_names(source: str) -> frozenset[str]:
-    """Return exact top-level module paths from syntactically valid imports."""
+    """Return exact top-level module paths from syntactically valid imports.
+
+    For ``from package import submodule`` both the package and candidate
+    submodule path are retained. The local-source resolver later decides
+    whether that candidate is a real repository module, which lets collection
+    tracing follow imports such as ``from lineageweave import postgres_sync``
+    without mistaking ordinary imported attributes for modules.
+    """
     try:
         tree = ast.parse(source)
     except (SyntaxError, ValueError):
@@ -39,6 +46,12 @@ def _imported_module_names(source: str) -> frozenset[str]:
             imported.update(alias.name for alias in node.names)
         elif isinstance(node, ast.ImportFrom) and node.module:
             imported.add(node.module)
+            if node.level == 0:
+                imported.update(
+                    f"{node.module}.{alias.name}"
+                    for alias in node.names
+                    if alias.name != "*"
+                )
     return frozenset(imported)