feat: complete catalog-driven preprocessing

scripts/fixtures/workspace-registry-smoke.yaml

@@ -5,17 +5,8 @@ workspace:
   description: Isolated workspace registry smoke fixture.
   language: en
 
-dwh:
-  engine: postgres
-  database: postgres
-  schema: public
-  port: 5432
-  timeout_ms: 5000
-  supported_transports:
-    - postgres_direct
-    - rest_api
-
 evidence:
+  schema_version: 1
   source:
     type: filesystem
     uri: local/evidence
@@ -25,12 +16,3 @@ evidence:
   policy:
     max_chunk_chars: 4000
     retain_published_generations: 3
-
-diagnostics:
-  dwh_rest:
-    method: GET
-    path: /health
-    auth: none
-    response:
-      database: database
-      schema: schema

scripts/fixtures/workspace-registry-task13.yaml

@@ -4,14 +4,8 @@ workspace:
   name: Task 13 Smoke
   language: en
 
-dwh:
-  engine: postgres
-  database: warehouse
-  schema: analytics
-  supported_transports:
-    - postgres_direct
-
 evidence:
+  schema_version: 1
   source:
     type: filesystem
     uri: task13-smoke/evidence

scripts/fixtures/workspace-registry-windows.yaml

@@ -4,17 +4,8 @@ workspace:
   name: Task 13 Windows
   language: en
 
-dwh:
-  engine: postgres
-  database: warehouse
-  schema: public
-  port: 5432
-  timeout_ms: 5000
-  supported_transports:
-    - postgres_direct
-    - rest_api
-
 evidence:
+  schema_version: 1
   source:
     type: filesystem
     uri: task13-windows/evidence
@@ -24,12 +15,3 @@ evidence:
   policy:
     max_chunk_chars: 4000
     retain_published_generations: 3
-
-diagnostics:
-  dwh_rest:
-    method: GET
-    path: /health
-    auth: none
-    response:
-      database: database
-      schema: schema

scripts/task13-runtime-fixture-check.ts

@@ -3,6 +3,7 @@ import { basename, dirname, join } from "node:path";
 import { createRequire } from "node:module";
 import { resolveRuntimeBindings } from "../backend/src/workspaces/bindings.js";
 import { renderRuntimeConfig } from "../backend/src/workspaces/runtime-renderer.js";
+import { validateWorkspaceDescriptor } from "../backend/src/workspaces/schema.js";
 
 const requireFromBackend = createRequire(new URL("../backend/package.json", import.meta.url));
 const { parse } = requireFromBackend("yaml") as { parse: (value: string) => any };
@@ -87,6 +88,9 @@ for (const name of [
 
 if (workspace.workspace?.id !== "task13-smoke") throw new Error("fixture workspace id changed");
 if (workspace.workspace?.schema_version !== 4) throw new Error("fixture workspace must use schema v4");
+if (Object.hasOwn(workspace, "dwh")) {
+  throw new Error("authored workspace fixture must not contain database metadata");
+}
 for (const forbidden of ["semantic_index", "llm_policy"]) {
   if (Object.hasOwn(workspace, forbidden)) {
     throw new Error(`fixture workspace must not own installation model configuration: ${forbidden}`);
@@ -176,13 +180,29 @@ for (const [target, localVolume] of [
 const resolverEnvironment = { ...core.environment };
 const runtimePasswordSource = realpathSync(runtimePasswordSourceInput);
 resolverEnvironment.THT_WS_TASK13_SMOKE_DWH_PASSWORD_FILE = runtimePasswordSource;
-const bindings = resolveRuntimeBindings(workspace, resolverEnvironment, [dirname(runtimePasswordSource)]);
+// Production projects the current PostgreSQL Catalog row into an ephemeral runtime descriptor.
+// Keep the authored fixture database-free and reproduce that projection only for this contract check.
+const runtimeWorkspace = validateWorkspaceDescriptor({
+  ...workspace,
+  dwh: {
+    engine: "postgres",
+    database: "warehouse",
+    schema: "datawarehouse",
+    port: 5432,
+    supported_transports: ["postgres_direct"],
+  },
+});
+const bindings = resolveRuntimeBindings(
+  runtimeWorkspace,
+  resolverEnvironment,
+  [dirname(runtimePasswordSource)],
+);
 for (const [role, binding] of Object.entries(bindings)) {
   if ((binding as any).missing.length !== 0) {
     throw new Error(`workspace resolver reports missing ${role} bindings: ${(binding as any).missing.join(",")}`);
   }
 }
-const runtime = parse(renderRuntimeConfig(workspace, bindings, {
+const runtime = parse(renderRuntimeConfig(runtimeWorkspace, bindings, {
   sessions: "/data/sessions",
   artifacts: "/data/artifacts",
   indexes: "/data/indexes",
@@ -193,11 +213,14 @@ const runtime = parse(renderRuntimeConfig(workspace, bindings, {
 }));
 if (runtime.database.host !== expected.THT_WS_TASK13_SMOKE_DWH_HOST
   || runtime.database.user !== expected.THT_WS_TASK13_SMOKE_DWH_USER
-  || runtime.database.password_file !== runtimePasswordSource) {
+  || runtime.database.password_file !== runtimePasswordSource
+  || runtime.database.database !== "warehouse"
+  || runtime.database.schema !== "datawarehouse") {
   throw new Error("workspace resolver produced the wrong DWH runtime");
 }
 if (runtime.resources?.vector?.base_url !== "http://qdrant:6333"
-  || runtime.resources?.vector?.collection !== "task13-smoke") {
+  || runtime.resources?.vector?.collections?.reference !== "task13-smoke-reference"
+  || runtime.resources?.vector?.collections?.memory !== "task13-smoke-memory") {
   throw new Error("workspace resolver produced the wrong qdrant runtime");
 }
 if (runtime.resources?.embeddings?.base_url !== "http://embedding:11434"

scripts/test-default-compose.sh

@@ -11,7 +11,8 @@ grep -q "pg_read_file('/run/secrets/catalog_runtime_password')" docker/catalog-d
 grep -q "CREATE ROLE thothii_catalog_runtime" docker/catalog-db-init.sql
 
 rendered=$(mktemp)
-trap 'rm -f "$rendered"' EXIT HUP INT TERM
+installation_rendered=$(mktemp)
+trap 'rm -f "$rendered" "$installation_rendered"' EXIT HUP INT TERM
 
 docker compose --env-file deploy/env/local.env.example \
   -f compose.yaml -f deploy/compose.local.yaml config --format json >"$rendered"
@@ -131,4 +132,21 @@ if (JSON.stringify(embedding).includes('"devices"')) {
 }
 NODE
 
+THT_WORKSPACE_INSTALLATION_ID=psd-local docker compose \
+  --env-file deploy/env/local.env.example \
+  -f compose.yaml -f deploy/compose.local.yaml \
+  --profile workspace-maintenance config --format json >"$installation_rendered"
+
+node - "$installation_rendered" <<'NODE'
+const fs = require("fs");
+
+const config = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+for (const serviceName of ["core", "workspace-maintenance"]) {
+  const actual = config.services[serviceName]?.environment?.THT_WORKSPACE_INSTALLATION_ID;
+  if (actual !== "psd-local") {
+    throw new Error(`${serviceName} must preserve the configured installation ID, got: ${actual}`);
+  }
+}
+NODE
+
 echo "default Compose contract passed."

scripts/verify-workspace-install-docs.sh

@@ -84,10 +84,9 @@ verify_install_and_workspace_guides() {
     require_text "$install" "$text"
   done
   for text in \
-    'workspace preprocess dwh' \
-    'workspace preprocess evidence' \
+    'workspace inspect' \
     'workspace preprocess run' \
-    'workspace schema accept' \
+    'database in **Database Management**' \
     'write-only runtime secrets' \
     'Runtime sessions support direct PostgreSQL and REST bindings.'; do
     require_text "$workspace" "$text"