CI doesn't exercise the Alembic migration chain — broken migration 004 shipped undetected

[Svaag]

Context

Tests use aiosqlite + SQLAlchemy create_all — there is no Postgres and no Alembic in ci.yml. The migration chain (001→006) is never run end-to-end in CI.

This let a real defect ship: migration 004_intent_engine was written non-self-contained (it assumed a pre-existing toy crypto_intents table + crypto_intent_status enum and only did add_column / ALTER TYPE). It was unappliable on any clean DB and would have failed every fresh deploy. CI was green throughout because prod sat at alembic 001 and the test suite builds its schema via create_all, never via the migrations. The break was only caught during the manual production deploy and fixed in PR #8 (004 rewritten self-contained, verified by diffing the migrated schema against create_all).

A CI gate that actually runs the migrations would have caught it on the PR.

Action items

1. Add a Postgres service container to .github/workflows/ci.yml (the self-hosted runner has Docker) with a throwaway hyrule DB.
2. Add a step that runs the chain as a roundtrip on every PR: alembic upgrade head then alembic downgrade base against that Postgres.
3. (Optional, strong) Assert the migrated head schema matches Base.metadata.create_all — the exact parity check used to validate the 004 fix — so future model/migration drift fails CI.

Related

• .github/workflows/ci.yml
• alembic/versions/*, hyrule_cloud/db.py
• PR fix(alembic): make migration 004 self-contained (create crypto_intents) #8 (the 004 self-contained rewrite + parity verification)

[hyrule-engineering-loop]

Reliability Governor Decision

• role: staff_sre_autonomous_operations
• decision: knowledge_gap
• next_loop: knowledge
• handoff_contract: knowledge_context_pack
• source: human
• intent: tests / tier 0
• capability: none
• knowledge: missing / unknown
• reasons: Knowledge policy result is deny; Knowledge context returned no included_refs

{
  "affected_assets": [
    "AS215932/hyrule-cloud"
  ],
  "affected_customers": [],
  "affected_services": [],
  "allowed_paths": [],
  "authority_text_hash": "f7d2f8b47c4822d2ebf2f4a194d3a4c625d330d7fab3f497feba078a6f32c85b",
  "blast_radius": "test-only",
  "controlled_loops": [
    "engineering",
    "noc",
    "knowledge"
  ],
  "created_at": "2026-06-30T02:31:49.274484+00:00",
  "denial_reasons": [
    "Knowledge policy result is deny",
    "Knowledge context returned no included_refs"
  ],
  "expected_paths": [
    "tests/"
  ],
  "forbidden_paths": [],
  "governor_name": "Reliability Governor",
  "governor_role": "staff_sre_autonomous_operations",
  "handoff_contract": "knowledge_context_pack",
  "intent_type": "tests",
  "issue_id": "AS215932/hyrule-cloud#9",
  "issue_number": 9,
  "issue_text_hash": "415698c0c7a1937246c9cf40201adc463c3ac87b055ff189f01a6837c50d6c80",
  "knowledge_authority_level": "unknown",
  "knowledge_context_pack_id": "ctx_83b77e0525b311a3f8498ce015c0105d",
  "knowledge_export_version": "local-20260623120725",
  "knowledge_status": "missing",
  "labels_to_add": [
    "loop:knowledge-gap"
  ],
  "labels_to_remove": [
    "loop:intake",
    "loop:candidate",
    "loop:approved",
    "loop:needs-context",
    "loop:needs-human"
  ],
  "lhp": null,
  "matched_capability": null,
  "next_loop": "knowledge",
  "policy_rules": [
    "deny stale, contradictory, missing, or errored Knowledge context"
  ],
  "record_id": "260d66d27a48ee7c1d3b",
  "repo": "AS215932/hyrule-cloud",
  "required_checks": [],
  "risk_tier": 0,
  "rollback_plan": "Close the draft PR or revert the docs/test commit before merge.",
  "routing_decision": "knowledge_gap",
  "schema_version": "reliability-governor.cdr.v1",
  "source": "human",
  "storage_path": "/var/lib/engineering-loop/reliability-governor/as215932-hyrule-cloud-9-260d66d27a48ee7c1d3b.json",
  "verification_method": "Use the issue-specified verification: tests/checks/evidence named in the request."
}