Pre 2 foundation hardening complete

Milestone: The Phase 1 foundation is reproducible, runtime-safe, and behaviorally proven before the first API guard or feature-system query is written.

Learning payoff: Database roles, RLS verification, PostgreSQL pooling, migrations, automated security tests, and enforcement through linting and CI.

Completed: October 2026 — walkthrough in Pre-2 walkthrough

Pre-2 Exit Criteria: ✅ All met.

• A fresh environment can create the restricted runtime role and apply database migrations.
• DATABASE_URL uses the verified app_runtime transaction-pool connection; DATABASE_DIRECT_URL remains privileged and migration-only.
• The RLS proof runs automatically and demonstrates both isolation and fail-closed behavior.
• The auth profile trigger and foreign key are versioned migrations.
• CI protects the code and security checks on every change.
• Package, API-route, and database access boundaries are machine-enforced.
• Formatting is applied before every commit and verified in CI.
• main accepts changes only through pull requests that pass CI.

Implementation notes:

• Pre-2.2 was corrected by Pre-2.5. max_pipeline: 0 was added as a precaution and broke every postgres.js transaction (UNSAFE_TRANSACTION), including withRLS. The RLS proof test caught it before any code depended on withRLS. Only prepare: false remains.
• Pre-2.1 deliberately edited an applied migration. 0001 now creates app_runtime NOLOGIN if missing. Safe because Drizzle never re-runs an applied migration and the block is a no-op wherever the role exists.
• Pre-2.3 also pinned search_path = '' on the SECURITY DEFINER profile trigger function.
• Pre-2.5/2.6 pin PostgreSQL 17 (Supabase's major) in tests and CI; tests/with-test-db.sh fails loudly on any other major. Principle recorded in pin-versions.
• Pre-2.9 grew beyond one lint rule: Server Actions, the Pages Router and pageExtensions are banned, and apps/web's build verifies Next.js's endpoint manifests (Server actions, With API guard).
• Pre-2.10 deleted a dead workflow (trigger-arkive-deploy.yml) and runs scripts/setup-docs.mjs on pnpm install.
• Added beyond the original list: an ESLint best-practice rule set with verbatimModuleSyntax (ESLint best practice rules), Vitest as the monorepo test framework (Vitest), and Node 22 pinned through .nvmrc + engineStrict.
• GitHub Pages for the Sidekick repo was publishing docs/ and failing since docs/ became a symlink; it should stay disabled.