ci(backend): adopt safe migrate-once database reset

.agent-loop/initiatives/WS-CI-001-backend-ci-acceleration/STATUS.md

@@ -1,12 +1,14 @@
 # STATUS: WS-CI-001 - Backend CI Acceleration
 
-- Phase: signed planning amendment
-- Active planning chunk: `WS-CI-001-02`
-- Active implementation chunk: none
-- Proposed implementation successor: `WS-CI-001-02A`
+- Phase: signed implementation
+- Active planning chunk: none
+- Active implementation chunk: `WS-CI-001-02A`
+- Proposed implementation successor: `WS-CI-001-02B`
 - Later proposed chunk: `WS-CI-001-02B` (cannot start before 02A evidence)
 - Human direction: preserve Konan's authorship and measured work from PR #180,
   but adopt it only under prospective zero-trust scope and evidence
-- Current gate: internal review passed; planning-only PR and user-owned PR decision
+- Current gate: runtime schema recovery reviewed at `cf91bb81`; full Backend suite,
+  canonical fingerprint, and all coverage gates remain before user-owned merge
+  decision
 - Deferred option: routing/cache/timing reassessment is future `WS-CI-001-03`,
   with no start or successor declaration

.agent-loop/initiatives/WS-CI-001-backend-ci-acceleration/reviews/WS-CI-001-02A-external-review-response.md

@@ -0,0 +1,72 @@
+# External Review Response
+
+## Chunk
+
+`WS-CI-001-02A` — Safe Migrate-Once Database Reset
+
+## Source
+
+GitHub Backend run `29924806229` on PR #186.
+
+## Comments Addressed
+
+- Shards 1, 3, and 4 exposed order-dependent schema contamination after
+  whole-schema Alembic tests. Later ordinary tests correctly failed closed on
+  missing final tables or a noncanonical fingerprint.
+- The schema-contract fixture teardown previously trusted `upgrade head`, which
+  cannot repair structural state when revision metadata already claims head.
+- Setup and teardown for explicitly marked `postgres_schema_contract` tests now
+  perform the same database-custody-checked drop, recreate, and migrate-to-head
+  sequence under the database-specific DDL lock.
+- A second hosted rerun exposed four migration-mutating tests outside
+  `test_alembic.py`. The three artifact-admission migration tests and one task
+  downgrade test are now individually marked as schema-contract owners, so
+  they receive the same full rebuild without slowing their entire modules.
+- Every unmarked database test now revalidates database custody and the full
+  canonical schema fingerprint during teardown. The AST ownership scan remains
+  early guidance; runtime verification is authoritative even when DDL is hidden
+  behind aliases, helpers, fixtures, or another migration entry point.
+- When ordinary teardown detects drift, it fails the originating test, performs
+  a custody-checked full rebuild, and then re-raises the original verification
+  error. If recovery also fails, both failures are preserved in an exception
+  group, preventing both silent healing and shard-wide contamination.
+- Ordinary resets retain the exact table inventory and full fingerprint gate.
+- Removed the trust bundle's extra blank line at EOF.
+- Removed CodeRabbit's valid obsolete `include_canonical_actors` reset argument;
+  it had no callers and no behavior beyond deleting its value.
+
+## Comments Deferred
+
+- CodeRabbit's generic 80 percent docstring-coverage warning is not a repository
+  gate and would require unrelated documentation churn outside signed 02A scope.
+
+## Human Decisions Needed
+
+None before rerunning CI. Merge still requires explicit user approval for this
+specific PR.
+
+## Commands Rerun
+
+```bash
+cd backend
+ruff check tests/conftest.py tests/test_database_reset.py
+python scripts/run_isolated_tests.py --metadata-json <temp>/repair.json \
+  --timeout-seconds 1200 -- python -m pytest -q \
+  tests/test_alembic.py::test_artifact_recovery_schema_and_empty_downgrade \
+  tests/test_database_reset.py::test_database_reset_preserves_schema_and_restores_guards
+cd ..
+git diff --check
+```
+
+The focused ordering proof passed 2/2. Full-suite duration and coverage are
+accepted only from the rerun GitHub Backend workflow.
+
+The runtime-boundary proof also passed 2/2: direct Alembic ownership guidance
+and hidden helper-driven schema drift rejected by ordinary fixture teardown.
+
+## Remaining Risks
+
+- All four hosted shards must prove that schema-contract tests no longer poison
+  subsequent ordinary tests.
+- Combined global 78 percent and every protected 90 percent coverage gate must
+  pass unchanged.

.agent-loop/initiatives/WS-CI-001-backend-ci-acceleration/reviews/WS-CI-001-02A-internal-review-evidence.md

@@ -0,0 +1,76 @@
+# Internal Review Evidence
+
+## Chunk
+
+`WS-CI-001-02A` — Safe Migrate-Once Database Reset
+
+## Required Statements
+
+open sub-agent sessions: none
+
+valid findings addressed: yes
+
+## Reviewed Revision
+
+Reviewed code SHA: cf91bb81ac44e9ff9cbdc0f8b924959ee1a0554e
+
+Reviewed at: 2026-07-22T14:22:45Z
+
+Reviewer run IDs: eng006_senior_arch_docs, eng006_qa_ci_tests, eng006_security_ops_reuse
+
+After the reviewed SHA, only review evidence, status, and trust-bundle files
+changed.
+
+## Reviewer Results
+
+| Reviewer | Result | Blocking findings | Notes |
+|---|---:|---|---|
+| senior engineering | PASS | None | Full hosted Backend and coverage evidence remains required. |
+| QA/test | PASS | None | Exact collection is 1,888 baseline plus 29 reset tests; hosted proof remains required. |
+| security/auth | PASS | None | Custody, schema drift, rollback, and destructive boundaries pass. |
+| product/ops | PASS | None | Product behavior is unchanged and contributor attribution is preserved. |
+| architecture | PASS | None | Generic namespace inventory closed the last schema-object gap. |
+| CI integrity | PASS | None | No workflow, runner, coverage-command, or threshold change; hosted gates remain blocking. |
+| docs | PASS | None | Status, evidence, and trust bundle describe the bounded implementation. |
+| reuse/dedup | PASS | None | The canonical isolated runner and one reset inventory remain authoritative. |
+| test delta | PASS | None | No removed, skipped, deselected, or weakened tests; hosted completion remains required. |
+
+## Valid Findings Addressed
+
+- Rejected destructive reset targets unless the URL and live PostgreSQL state
+  prove an isolated loopback database owned by its exact least-privileged role.
+- Replaced dynamic table discovery with reviewed protected and resettable
+  inventories, including all seven trigger-guarded tables.
+- Bound reset to an exact migrated-schema fingerprint covering direct public
+  namespace membership and detailed structural and executable definitions.
+- Added fail-closed tests for unexpected tables, functions, composite types,
+  collations, columns, and triggers, proving rejection occurs before mutation.
+- Proved repeated reset, exception, cancellation, and real termination preserve
+  protected state and restore every guarded trigger.
+- Replaced schema-contract teardown's marker-trusting upgrade with a full
+  custody-checked rebuild so migration tests cannot poison later shard tests.
+- Removed the obsolete, uncalled `include_canonical_actors` reset keyword after
+  CodeRabbit identified that it no longer represented behavior.
+- Marked all four migration mutators outside `test_alembic.py`, added static
+  ownership guidance, and made runtime teardown detect, attribute, recover, and
+  preserve errors for hidden schema drift.
+- Restored exact Boolean assertions and preserved the trusted-main collection.
+
+## Evidence
+
+- `ruff check tests/conftest.py tests/test_database_reset.py`: passed.
+- Isolated reset suite: 27 passed on a freshly migrated database.
+- Focused schema-contract-to-ordinary-test ordering proof: 2 passed.
+- Runtime hidden-drift detection and recovery proof: passed.
+- Isolated runner suite: 16 passed.
+- Collection: 1,917 tests, exactly 1,888 trusted-main tests plus 29 reset tests.
+- Agent gates: 95 passed.
+- `git diff --check`: passed.
+
+## Remaining Hosted Conditions
+
+- The unchanged GitHub Backend job must pass the complete 1,917-test suite on
+  the PR head; local machine timing is not performance evidence.
+- Hosted PostgreSQL must reproduce the committed canonical schema fingerprint.
+- The unchanged global 78 percent and every protected 90 percent coverage gate
+  must pass before merge readiness is reported.

.agent-loop/initiatives/WS-CI-001-backend-ci-acceleration/reviews/WS-CI-001-02A-pr-trust-bundle.md

@@ -0,0 +1,88 @@
+# PR Trust Bundle
+
+## Chunk
+
+`WS-CI-001-02A` — Safe Migrate-Once Database Reset
+
+Merge intent: `.agent-loop/merge-intents/WS-CI-001-02A.json`
+
+## Goal
+
+Adopt Konan's migrate-once fixture work while proving that every destructive
+reset is confined to an exact runner-owned database and reviewed schema.
+
+## What Changed
+
+- Migrated selected backend fixtures to one migration followed by transactional
+  database resets.
+- Added live database and role custody checks before any destructive action.
+- Added exact protected/resettable inventories and a canonical full-schema
+  fingerprint, including generic public namespace-object membership.
+- Added rollback, signal, repeated-reset, and adversarial schema-drift tests.
+- Made explicitly marked whole-schema migration tests rebuild from blank,
+  custody-checked schema state in both setup and teardown.
+- Preserved exact assertions, existing test collection, coverage thresholds,
+  workflows, runner topology, product code, and migrations.
+
+## Scope and Attribution
+
+The implementation stays within the signed 02A allowlist. The adopted source
+work is preserved in commit `58125242` with Konan as author; subsequent commits
+are bounded safety and review repairs. No workflow or product behavior changed.
+
+## Acceptance Evidence
+
+- Fresh isolated reset safety suite: 27 passed; two subsequent ownership and
+  runtime-boundary regressions passed independently.
+- Exact collection: 1,917 tests, equal to 1,888 on trusted main plus 29 new
+  reset tests; no existing node was lost.
+- Rerun, exception, cancellation, and SIGTERM paths preserve Alembic and actor
+  migration state and leave all seven guarded triggers enabled.
+- Unexpected table, function, type, collation, column, and trigger drift fails
+  before reset and remains present after rejection.
+- 95 agent gate tests and diff integrity passed.
+
+## CI Integrity
+
+- [x] No workflow, shard, lane, runner, or coverage command changed
+- [x] No test was skipped, deselected, removed, or weakened
+- [x] Global 78 percent and all protected 90 percent floors remain blocking
+- [ ] Full GitHub Backend workflow passes the exact PR head
+- [ ] Hosted PostgreSQL reproduces the canonical schema fingerprint
+
+## Internal Review
+
+Reviewed code SHA: cf91bb81ac44e9ff9cbdc0f8b924959ee1a0554e
+
+Reviewed at: 2026-07-22T14:22:45Z
+
+Reviewer run IDs: eng006_senior_arch_docs, eng006_qa_ci_tests, eng006_security_ops_reuse
+
+Senior/architecture and QA/CI/test-delta passed after the hosted ordering repair,
+with only hosted evidence conditions. Security/auth, product/ops, reuse/dedup,
+and documentation passed without a code blocker. All valid internal findings
+were repaired.
+
+## Remaining Risk and Human Review Focus
+
+The fingerprint intentionally binds PostgreSQL catalog definitions, so the
+hosted PostgreSQL run is the portability proof. Review database/role custody,
+schema fingerprint completeness, rollback restoration, exact test delta, and
+Konan's preserved attribution.
+
+Local duration is not used to claim performance success. Only the complete
+GitHub Backend job and all coverage gates determine acceptance.
+
+## Follow-up
+
+Do not start `WS-CI-001-02B` automatically. After this PR merges and signed
+memory reconciles, it remains a same-initiative successor requiring explicit
+start.
+
+## Human Merge Ownership
+
+- [ ] I can explain what changed.
+- [ ] I can explain why it changed.
+- [ ] I know what could break.
+- [ ] I accept the remaining risks.
+- [ ] The user explicitly approved this specific PR for merge.

.agent-loop/merge-intents/WS-CI-001-02A.json

@@ -0,0 +1,9 @@
+{
+  "chunk_id": "WS-CI-001-02A",
+  "chunk_title": "Safe Migrate-Once Database Reset",
+  "initiative_id": "WS-CI-001",
+  "next_chunk_id": "WS-CI-001-02B",
+  "next_chunk_title": "Exact-Custody Semantic Test Lanes",
+  "next_requires_explicit_start": true,
+  "schema_version": 2
+}

backend/pyproject.toml

@@ -40,6 +40,9 @@ dev = [
 
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+markers = [
+  "postgres_schema_contract: test owns whole-schema Alembic transitions and requires a rebuilt PostgreSQL baseline",
+]
 pythonpath = ["."]
 testpaths = ["tests"]