fix(ci): execute live PostgreSQL integration suite

[seonghobae]

Live PostgreSQL acceptance — ACTIVE DRAFT

Addresses #340 as the serialized CI successor to current workflow owner #328. Direct base is #328 exact 973ab37d9be13d552cc2266d341c042971d33425; current head is 5998c5f9d8623d2be20319f943f93ac9d3217a2e. Compare from the direct base has merge base exactly #328, 5 ahead / 0 behind. This PR owns the permanent live-PostgreSQL CI lane and its workflow/fixture regressions; production batch/RLS code is unchanged by the latest repair.

Reality RED and minimum repair

Test-only head 3d90055a69e00c419712c287f2c747cb9f43d3cc made permanent live PostgreSQL execution an executable workflow contract and produced failing CI 34508620373, proving the missing pytest -m integration path was a CI acceptance defect.

After the lane was enabled, exact 0a6486e4727c6a77474ecc3c6fab39ec98556bb3 reached PostgreSQL build/start/health and exposed a second reality RED in CI 34509304922: test_live_rls_separates_identical_provider_ids_by_tenant failed while composing its temporary CREATE ROLE ... LOGIN PASSWORD statement. The fixture incorrectly used a psycopg bind placeholder in utility DDL before any tenant/RLS assertion ran.

Current 5998c5f9d8623d2be20319f943f93ac9d3217a2e changes only that fixture seam. The generated role name remains psycopg.sql.Identifier; the fresh random password is safely composed with psycopg.sql.Literal. The test is not skipped, weakened, mocked, or converted to a superuser/BYPASSRLS path, and production RLS code is untouched.

The permanent lane uses the existing container-build job rather than adding always-on fan-out; sets up locked Python/uv dependencies; builds the explicit first-party PostgreSQL with-tiktoken target; creates and masks an ephemeral database credential; starts the local fixture and fails closed on fixture/pg_tiktoken readiness; runs the complete uv run pytest -q -m integration marker on the exact checked-out PR head; and tears down credential/container material under if: always(). Existing Python 3.10–3.14 unit lanes, exact 100% production coverage/public-docstring gates, lock/package checks, component/PostgreSQL smokes, log routing, legacy cleanup, immutable action pins, exact-head verification, and Release Acceptance remain in place.

Exact-head evidence

On exact 5998c5f9d8623d2be20319f943f93ac9d3217a2e, CI 34523873091 and Release Acceptance 34523873101 are terminal SUCCESS. The container/PostgreSQL job passed exact-head verification, locked dependency setup, Compose validation, component/default PostgreSQL/with-tiktoken builds, log-routing and legacy-cleanup smokes, ephemeral credential setup, fixture startup/health, pg_tiktoken readiness, the complete live PostgreSQL integration suite, and teardown. Fresh formal reviews contain no qualifying approval and inline review threads are empty. Keep Draft.

Successor convergence — 2026-09-11

The newer #296 restore-readiness specimen is now proven through this permanent lane without moving this workflow branch or duplicating workflow ownership. #296 was retargeted onto this exact head and advanced non-force to ordinary two-parent child 431fd16f78e41be1654469c16fc21494d2eacf45, preserving its prior semantic head as first parent and this exact #341 as second parent. Its relative delta remains exactly its three restore-readiness source/test files.

Exact child CI 34530155105 is terminal SUCCESS. Container/PostgreSQL job 103048641159 passed Run live PostgreSQL integration suite, which includes #296's exact-shape, non-security-definer LANGUAGE SQL health-impostor regression. Release Acceptance 34530155125 is also terminal SUCCESS and verifies two-clean-tree wheel/sdist reproducibility and artifact identity. Thus the branch-level acceptance condition that motivated #340 is now demonstrated on the current successor stack.

Do not close #340 yet: protected integration/final-head evidence is still absent. #341 and #296 remain Draft without qualifying independent approval; #233 remains the earliest protected integration root; central required-workflow recovery remains an external foundation prerequisite. Branch-level GREEN is not protected-main integration or immutable release authority.

Canonical TEST_STRATEGY/OPERABILITY and product-gap documentation remain with the documentation owner rather than being duplicated here. Refs #233, #242, #244, #247, #296, #325, #328, #340.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Successor convergence verified without changing this workflow branch: #296 was retargeted onto exact #341 5998c5f9d8623d2be20319f943f93ac9d3217a2e via ordinary two-parent non-force child 431fd16f78e41be1654469c16fc21494d2eacf45. The child's relative delta remains exactly its three restore-readiness source/test files, so #341 retains sole workflow ownership.

On that exact child, CI 34530155105 is terminal SUCCESS and container/PostgreSQL job 103048641159 completed Run live PostgreSQL integration suite successfully against the first-party PostgreSQL/pg_tiktoken fixture. That suite includes #296's exact-shape non-security-definer LANGUAGE SQL health-impostor regression, so the newer specimen is now exercised through this permanent lane. Release Acceptance 34530155125 is also terminal SUCCESS with two-clean-tree wheel/sdist reproducibility. #340 should nevertheless remain open until protected integration/final-head evidence completes; this branch and #296 remain Draft without qualifying independent approval.