ACE-040: safety regression corpus — the F9 done-bar

[sandeep-agami]

Summary

Spec: ACE-040 — the F9 done-bar. One adversarial safety regression corpus that drives every attack class through the REAL execute_sql tool and asserts its expected Envelope, on both surfaces (stdio subprocess + in-process HTTP) and both model paths (file-served: SQLite + disk YAML; DB-served: Postgres + model_store), plus a read-only role floor that proves the DB rejects a write with the app gate bypassed. This is the regression bar a future change must not drop below. Test-only + CI — no src changes; it locks the controls built in ACE-035…039.

Stacked on #120 (ACE-039) — base is ACE-039-recon-error-hardening; retarget to main once the stack lands.

Changes

• tests/safety/corpus.py — the single canonical source: the demo SCHEMA (the harness derives BOTH the semantic model and the physical datasource from it) + CASES mapping each class to its outcome. Classes: integrity→permission, object-scope→table_out_of_scope/select_star/column_out_of_scope (incl. hidden in UNION/EXCEPT arms), fail-closed→unscopable_sql, recon→recon, availability→bounded (row-cap truncate+flag), governed→ok (no false refusals).
• tests/e2e/harness.py — ONE copy of the stdio + HTTP drivers + the model/datasource builders (test_safety_envelope.py now imports them — drivers single-sourced, no duplication).
• tests/e2e/conftest.py — surface (stdio|http) + file_safety_env + the Postgres fixtures (pg_admin, create_ro_role, db_safety_env, pg_ro_conn).
• tests/e2e/test_safety_corpus.py — the corpus over {surface} × {file, DB} paths.
• tests/e2e/test_role_floor_pg.py — writes on a RAW agami_ro connection (app gate bypassed) → Postgres raises InsufficientPrivilege; a SELECT succeeds.
• .github/workflows/ci.yml — a new integration-pg job (a postgres:16 service — the repo's first CI service) runs the DB-dependent tests; an AGAMI_IT_PG_REQUIRED sentinel makes an unavailable DB fail (not skip) so an all-skip can't pass green.

Verification

• File path (local): green — uv run dev.py check passes; 58 corpus cases (29 × both surfaces) + the envelope tests. Full suite 1752 passed / 62 skipped.
• Postgres path (local): skips — no Docker on this machine, so the DB-served corpus + role-floor skip cleanly locally; the integration-pg CI job is their first real run. The fixtures were written against the compose fixture's known creds and read as if debugging; a focused security review traced the guard order per case, confirmed the role-floor genuinely bypasses the app gate, and confirmed the corpus is non-vacuous (a regressed control degrades each case to a failure, never a silent pass).

Reviewer notes / follow-ups

1. Make integration-pg a required check (branch protection — outside this diff). The sentinel guarantees it can't pass green on an all-skip, but it must actually be required to gate merges.
2. PG path is first-run-in-CI (no local Docker here) — worth a close look at the first integration-pg run.
3. High-lane → security sign-off required per the spec.
4. Consolidation is additive (per sign-off): the corpus is the new end-to-end bar + single-sourced vectors; the existing ~15 unit gate-tests stay as the fine-grained layer (full retire is a follow-up).

Checklist

• Spec: ACE-040 on every commit; diff stays in spec scope (declined a PII/sensitive_columns case — spec assigns PII to F10's corpus)
• Both surfaces + both paths exercised and asserted identically
• No weakened/deleted tests; the one refactor (shared drivers) keeps test_safety_envelope.py green
• uv run dev.py check green (file path); review dispositioned (1 must-fix fixed)
• integration-pg green in CI (first run) + made a required check

🤖 Generated with Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}