feat: complete catalog-driven preprocessing

backend/test/workspace-runtime-config-lease.test.ts

@@ -1,6 +1,5 @@
 import { execFile } from "node:child_process";
 import {
-  chmodSync,
   existsSync,
   mkdtempSync,
   mkdirSync,
@@ -27,6 +26,7 @@ import {
   renderActiveWorkspaceRuntime,
   renderWorkspaceRuntimeFromSnapshotPath,
 } from "../src/workspaces/runtime-config-lease.js";
+import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";
 
 const runFile = promisify(execFile);
 const roots: string[] = [];
@@ -70,11 +70,6 @@ workspaces: [{id: psd-clinical, name: Runtime Lease}]
   id: psd-clinical
   name: Runtime Lease
   language: en
-dwh:
-  engine: postgres
-  database: analytics
-  schema: mart
-  supported_transports: [postgres_direct]
 evidence:
   source:
     type: filesystem
@@ -88,9 +83,6 @@ evidence:
   await git(source, ["push", "origin", "main"]);
 
   mkdirSync(secretRoot);
-  const passwordFile = join(secretRoot, "dwh-password");
-  writeFileSync(passwordFile, "secret", { mode: 0o600 });
-  chmodSync(passwordFile, 0o600);
   mkdirSync(dataRoot);
 
   const registryConfig: WorkspaceRegistryConfig = {
@@ -107,12 +99,31 @@ evidence:
   const registry = new WorkspaceRegistry(registryConfig);
   await registry.bootstrap();
   const revision = (await registry.list())[0];
-
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_TRANSPORT", "postgres_direct");
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse.internal");
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PORT", "5432");
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_USER", "reader");
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE", passwordFile);
+  const workspaceSecretStore = new WorkspaceSecretStore({
+    root: join(root, "vault"),
+    runtimeRoot: join(root, "runtime-secrets"),
+    installationId: "test",
+  });
+  workspaceSecretStore.putMany("psd-clinical", { "catalog.dwh.password": "secret" });
+  const catalogDatabase = {
+    id: "database-1",
+    workspaceId: "psd-clinical",
+    engine: "postgres" as const,
+    databaseName: "analytics",
+    schema: "mart",
+    binding: {
+      transport: "postgres_direct" as const,
+      host: "warehouse.internal",
+      port: 5432,
+      username: "reader",
+    },
+    version: 1,
+    createdAt: "2026-01-01T00:00:00Z",
+    updatedAt: "2026-01-01T00:00:00Z",
+    connectionStatus: "reachable" as const,
+    metadataContentRevision: 1,
+    preprocessingStatus: "failed" as const,
+  };
 
   return {
     dataRoot,
@@ -121,6 +132,8 @@ evidence:
     registry,
     registryConfig,
     revision,
+    workspaceSecretStore,
+    catalogDatabase,
   };
 }
 
@@ -140,6 +153,8 @@ test("active workspace rendering is byte-identical to direct snapshot rendering"
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
   const active = await renderActiveWorkspaceRuntime({
     workspaceId: "psd-clinical",
@@ -150,6 +165,8 @@ test("active workspace rendering is byte-identical to direct snapshot rendering"
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
 
   expect(active.renderedConfig).toBe(direct.renderedConfig);
@@ -158,27 +175,6 @@ test("active workspace rendering is byte-identical to direct snapshot rendering"
   expect(active.catalogBlob).toMatch(/^sha256:[0-9a-f]{64}$/);
 });
 
-test("renders a revision-qualified annotations root for the active revision", async () => {
-  const f = await fixture();
-  const active = await renderActiveWorkspaceRuntime({
-    workspaceId: "psd-clinical",
-    registry: f.registry,
-    registryConfig: f.registryConfig,
-    harnessDir: f.harnessDir,
-    configPath: "config/tht.yaml",
-    dataRoot: f.dataRoot,
-    secretRoots: f.registryConfig.secretRoots,
-    semanticRuntime,
-  });
-  const rendered = parse(active.renderedConfig) as Record<string, any>;
-
-  expect(rendered.paths.annotations_root).toBe(
-    join(f.dataRoot, "sessions", "psd-clinical", "revisions", f.revision.commit, "artifacts"),
-  );
-  expect(rendered.roots.annotations_root).toBe(rendered.paths.annotations_root);
-  expect(rendered.paths.artifacts).toBe(join(f.dataRoot, "sessions", "psd-clinical", "artifacts"));
-});
-
 test("deterministic operator leases are keyed by logical identity and stable across calls", async () => {
   const f = await fixture();
   const first = await publishDeterministicRuntimeConfigLease({
@@ -190,6 +186,8 @@ test("deterministic operator leases are keyed by logical identity and stable acr
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
   const second = await publishDeterministicRuntimeConfigLease({
     workspaceId: "psd-clinical",
@@ -200,6 +198,8 @@ test("deterministic operator leases are keyed by logical identity and stable acr
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
 
   const suffix = first.inputFingerprint.slice(7, 23);
@@ -236,7 +236,11 @@ test("deterministic operator leases are keyed by logical identity and stable acr
     path: first.path,
   });
 
-  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse-two.internal");
+  const changedDatabase = {
+    ...f.catalogDatabase,
+    binding: { ...f.catalogDatabase.binding, host: "warehouse-two.internal" },
+    version: 2,
+  };
   const changed = await publishDeterministicRuntimeConfigLease({
     workspaceId: "psd-clinical",
     registry: f.registry,
@@ -246,6 +250,8 @@ test("deterministic operator leases are keyed by logical identity and stable acr
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: changedDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
   expect(changed.path).not.toBe(first.path);
   expect(changed.inputFingerprint).not.toBe(first.inputFingerprint);
@@ -267,6 +273,8 @@ test("runtime rendering rejects untrusted snapshot paths and symlinks", async ()
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   })).toThrow(/trusted runtime snapshot/i);
   expect(() => renderWorkspaceRuntimeFromSnapshotPath({
     snapshotPath: symlink,
@@ -275,6 +283,8 @@ test("runtime rendering rejects untrusted snapshot paths and symlinks", async ()
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   })).toThrow(/trusted runtime snapshot/i);
 });
 
@@ -288,6 +298,8 @@ test("operator lease and session snapshot produce byte-identical effective DWH b
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
   const lease = await publishDeterministicRuntimeConfigLease({
     workspaceId: "psd-clinical",
@@ -298,6 +310,8 @@ test("operator lease and session snapshot produce byte-identical effective DWH b
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
 
   const sessionCanonical = canonicalEffectiveConfigJson(buildCanonicalEffectiveConfig(parse(session.renderedConfig)));
@@ -319,6 +333,8 @@ test("a content-only Evidence commit keeps the same effective config identity wi
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
   const firstIdentity = firstLease.effectiveConfigIdentity;
 
@@ -341,6 +357,8 @@ test("a content-only Evidence commit keeps the same effective config identity wi
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
+    catalogDatabase: f.catalogDatabase,
+    workspaceSecretStore: f.workspaceSecretStore,
   });
 
   expect(secondLease.workspaceRevision).toBe(current.commit);