sales-trainer/docs/engineering-log/2026-08-15-postgresql-runtime-gate.md

PostgreSQL Runtime Gate — 2026-08-15

Date: 2026-08-15 22:35 +0700 Status: local PostgreSQL schema/runtime gate passed; production target cutover remains pending

Scope

This entry records the safe local S4.2 runtime verification performed after the code/schema review. It used randomly named temporary PostgreSQL databases on the local service only. No production database, JSON store, credential, deployment, or runtime cutover was touched.

Verification evidence

• pg_isready -h 127.0.0.1 -p 5432 — accepting connections.
• alembic upgrade head against a temporary local PostgreSQL database — passed for migrations 0001_initial_schema and 0002_audit_actor_tenant_check.
• Runtime PostgreSQL probe — passed:
  • all 7 application tables present;
  • non-preview partial unique index preserved;
  • audit actor tenant check constraint present;
  • valid tenant fixture inserted;
  • cross-tenant group-owner FK rejected;
  • cross-tenant audit-actor FK rejected;
  • partial audit actor attribution rejected;
  • duplicate non-preview attempt rejected;
  • duplicate preview attempt accepted.
• ORM-vs-Alembic PostgreSQL parity probe — passed: 7 application tables, columns, indexes, unique constraints, foreign keys, and check constraints matched.
• Offline PostgreSQL Alembic SQL render — passed: generated DDL contained organizations, sessions, the non-preview predicate, the audit check constraint, and transactional COMMIT.
• alembic downgrade base — passed; remaining application tables in the temporary migration database: 0.
• Cleanup — both temporary databases were dropped by the shell cleanup trap.

The bundled generic SQLite parity helper was also run. Its non-zero diagnostic result consisted of the expected alembic_version bookkeeping-table difference plus a MySQL partial-index warning. The project’s supported-dialect guard rejects MySQL before migration/SQL rendering; the target PostgreSQL parity probe above is the relevant runtime evidence.

Environment boundary

• backend/.venv remains version-drifted and pip check reports the pre-existing conflict: alibabacloud-tea-openapi 0.4.4 requires cryptography<47.0.0, while cryptography 50.0.0 is installed.
• uv pip sync --dry-run --python backend/.venv/bin/python backend/requirements.lock.txt proposed package alignment but was not applied; no existing venv was mutated.
• The isolated requirements.lock.txt environment remains the reproducible verification environment.
• Docker and redis-cli are unavailable locally. PostgreSQL schema verification does not close the Docker, Redis persistence, or production-operation gates.

Remaining gates

• Run JSON importer parity against a real target PostgreSQL snapshot, including backup and data rollback rehearsal.
• Verify runtime repository wiring and transaction behavior before any cutover; JSON stores remain authoritative.
• Verify Redis-backed/persistent audit and rate-limit behavior.
• Run Docker build, container /ready smoke, real-provider QA, authenticated production smoke, and operator-approved deployment steps separately.

No commit, push, deploy, credential rotation, public-access change, production migration, or production data mutation occurred.