Audit hardening: tenant isolation, TLS-enforcing production profile, PG pooling & migrations, hash-pinned supply chain, real SLIs

.dockerignore

@@ -4,6 +4,15 @@
 .env.*
 *.pem
 *.key
+# Secret-bearing config: mirrors pyproject.toml's sdist exclude and
+# scripts/check_release_artifacts.py's FORBIDDEN_MEMBER_PATTERNS (audit
+# P1-4). Dockerfile.api does `COPY config /app/config`; without these entries
+# that copy would bake credential material (bcrypt key hashes, webhook
+# secrets) into an immutable image layer. Runtime supplies the real files via
+# a docker-compose bind mount or a Helm Secret mount, never from the image.
+config/api_keys.yaml
+config/webhooks.yaml
+config/tenants.yaml
 *.duckdb
 *.duckdb.*
 .artifacts

.github/dependabot.yml

@@ -6,9 +6,17 @@ version: 2
 # matches CONTRIBUTING.md, and a grouped minor+patch PR so the review
 # queue does not get spammed. Major bumps stay individual.
 #
-# Security advisories from GitHub bypass the schedule and open
-# immediately regardless of group / interval — that is Dependabot
-# default and is what we want.
+# Dependabot version updates (the schedule below) are a different feature
+# from Dependabot SECURITY updates. Security updates are a separate
+# repo-level toggle, and audit P1-3 (2026-07-11) confirmed via the GitHub
+# API that it is currently DISABLED on this repo — an advisory on any
+# ecosystem below waits for the next scheduled run like any other bump; it
+# does not open a PR "immediately" as an earlier version of this comment
+# claimed. Enabling it is a repo-settings change gated on the repo owner:
+#
+#   gh api --method PUT repos/brownjuly2003-code/agentflow/automated-security-fixes
+#
+# This file cannot flip that toggle by itself.
 
 updates:
   # ── Python: root runtime (agentflow-runtime) ───────────────────────

.github/workflows/backup.yml

@@ -1,5 +1,11 @@
-name: Nightly Backup
+name: Backup/Restore Regression Test
 
+# This does not back up a deployed environment. It builds synthetic DuckDB
+# fixtures on an ephemeral runner, backs *those* up, verifies the manifest,
+# and restores into a scratch directory — a regression test for
+# scripts/backup.py, scripts/verify_backup.py and scripts/restore.py, not a
+# disaster-recovery control (audit P1-2). See docs/disaster-recovery.md for
+# what backup coverage actually exists today.
 on:
   schedule:
     - cron: "0 2 * * *"
@@ -22,11 +28,12 @@ jobs:
       - name: Prepare backup fixture
         run: |
           python - <<'PY'
-          import re
           from pathlib import Path
 
           import duckdb
 
+          from src.serving.backends.duckdb_backend import DuckDBBackend
+
           pipeline_db = Path("agentflow_demo.duckdb")
           usage_db = Path("agentflow_api.duckdb")
           for path in (pipeline_db, usage_db):
@@ -36,36 +43,28 @@ jobs:
               if wal_path.exists():
                   wal_path.unlink()
 
-          tenants_content = Path("config/tenants.yaml").read_text(encoding="utf-8")
-          tenant_schemas = re.findall(
-              r'^\s*duckdb_schema:\s*["\']?([^"\']+)["\']?\s*$',
-              tenants_content,
-              flags=re.MULTILINE,
-          )
-
-          conn = duckdb.connect(str(pipeline_db))
+          # The product's own DDL, not a copy of it. This step used to hand-write
+          # a `CREATE SCHEMA` per tenant, parsed out of the `duckdb_schema` field
+          # of config/tenants.yaml -- the schema-per-tenant model that ADR-004
+          # retired. Nothing in src/ ever created those schemas, so the fixture
+          # was fabricating the very thing the restore smoke test then went
+          # looking for. Two tenants now share one table, keyed by `tenant_id`,
+          # which is what a restored store actually has to bring back.
+          backend = DuckDBBackend(db_path=str(pipeline_db))
+          backend.ensure_schema()
+          conn = backend.connection
           try:
-              for schema in tenant_schemas:
-                  conn.execute(f'CREATE SCHEMA IF NOT EXISTS "{schema}"')
-                  conn.execute(
-                      f'''
-                      CREATE TABLE IF NOT EXISTS "{schema}".orders_v2 (
-                          order_id VARCHAR PRIMARY KEY,
-                          user_id VARCHAR,
-                          status VARCHAR,
-                          total_amount DECIMAL(10,2),
-                          currency VARCHAR,
-                          created_at TIMESTAMP
-                      )
-                      '''
-                  )
-                  conn.execute(
-                      f'''
-                      INSERT INTO "{schema}".orders_v2 VALUES
-                      (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-                      ''',
-                      [f"ORD-{schema.upper()}-001", f"USR-{schema.upper()}", "confirmed", 42.0, "RUB"],
-                  )
+              conn.execute(
+                  """
+                  INSERT OR REPLACE INTO orders_v2
+                      (tenant_id, order_id, user_id, status, total_amount, currency, created_at)
+                  VALUES
+                      ('acme-corp', 'ORD-ACME-001', 'USR-ACME', 'confirmed', 42.00, 'RUB',
+                       CURRENT_TIMESTAMP),
+                      ('demo', 'ORD-DEMO-001', 'USR-DEMO', 'confirmed', 17.00, 'RUB',
+                       CURRENT_TIMESTAMP)
+                  """
+              )
           finally:
               conn.close()
 
@@ -90,7 +89,7 @@ jobs:
           finally:
               conn.close()
           PY
-      - name: Create backup archive
+      - name: Create backup archive (synthetic fixture)
         run: python scripts/backup.py --output backup-artifacts
       - name: Resolve backup path
         id: backup
@@ -105,9 +104,9 @@ jobs:
           python scripts/restore.py \
             --backup "${{ steps.backup.outputs.archive_path }}" \
             --target-root /tmp/agentflow-restore
-      - name: Upload backup artifact
+      - name: Upload regression-test archive
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: agentflow-nightly-backup
+          name: agentflow-backup-restore-regression-fixture
           path: ${{ steps.backup.outputs.archive_path }}
           retention-days: 7

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -24,15 +25,46 @@ jobs:
       - name: Install dependencies
         run: pip install -e ".[dev]"
       - name: Ruff check
-        run: ruff check src/ tests/ scripts/ sdk/
+        run: ruff check src/ tests/ scripts/ sdk/ integrations/ warehouse/
       - name: Ruff format check
-        run: ruff format --check src/ tests/ scripts/ sdk/
+        run: ruff format --check src/ tests/ scripts/ sdk/ integrations/ warehouse/
       - name: Type check
         run: mypy src/ --ignore-missing-imports
 
+  # Audit P1-3: the lock chain stays honest end to end — uv.lock matches
+  # pyproject.toml, requirements-docker.lock (what Dockerfile.api actually
+  # installs) matches uv.lock, and a fresh hash-verified install from it is
+  # a consistent environment per pip check. Runs independently of lint: a
+  # dependency drift should be visible even while lint is red.
+  lock-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        # Exact pin: a newer uv may rewrite the lock format and turn this
+        # gate into noise. Bump deliberately, together with uv.lock.
+        run: pip install uv==0.8.23
+      - name: uv.lock matches pyproject.toml
+        run: uv lock --check
+      - name: requirements-docker.lock matches uv.lock
+        run: |
+          uv export --format requirements-txt --extra cloud --extra postgres \
+            --no-emit-project -o requirements-docker.lock
+          git diff --exit-code requirements-docker.lock
+      - name: Locked install is consistent
+        run: |
+          python -m venv /tmp/lockenv
+          /tmp/lockenv/bin/pip install --quiet --require-hashes -r requirements-docker.lock
+          /tmp/lockenv/bin/pip check
+
   schema-check:
     runs-on: ubuntu-latest
     needs: lint
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -48,6 +80,7 @@ jobs:
   test-unit:
     runs-on: ubuntu-latest
     needs: lint
+    timeout-minutes: 25
     permissions:
       contents: read
       id-token: write
@@ -161,6 +194,7 @@ jobs:
   test-integration:
     runs-on: ubuntu-latest
     needs: lint
+    timeout-minutes: 25
     services:
       kafka:
         image: confluentinc/cp-kafka:7.7.0
@@ -320,6 +354,7 @@ jobs:
 
   terraform-validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
@@ -335,3 +370,31 @@ jobs:
         run: |
           cd infrastructure/terraform
           terraform validate
+
+  sdk-ts:
+    # Audit P1-5: typecheck/tests/build for the TypeScript SDK previously ran
+    # only in publish-npm.yml (tag pushes) and mutation.yml; every PR only got
+    # `npm audit` (security.yml). This job gives PRs the same build-shaped
+    # gate the publish workflow already trusts, so a broken SDK cannot merge.
+    # Branch protection required-context wiring is a repo-settings change the
+    # owner still has to make (gh api repos/{owner}/{repo}/branches/main/protection).
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: sdk-ts
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "20"
+      - name: Install dependencies from lockfile
+        run: npm ci
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Test
+        run: npm test
+      - name: Build
+        run: npm run build
+      - name: Verify package is publishable
+        run: npm pack --dry-run

.github/workflows/container-attestation.yml

@@ -50,6 +50,7 @@ jobs:
     # never blocks docker-free PRs.
     if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -89,6 +90,7 @@ jobs:
   build-push-sign-attest:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.confirm == 'SIGN' && inputs.mode == 'build-and-sign' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     permissions:
       contents: read
       packages: write
@@ -133,6 +135,7 @@ jobs:
   attest-and-sign:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.confirm == 'SIGN' && inputs.mode == 'sign-existing-digest' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
       packages: write

.github/workflows/contract.yml

@@ -35,6 +35,7 @@ jobs:
   contract:
     name: contract
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/dora.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   dora-report:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/pages.yml

@@ -21,6 +21,7 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/publish-npm.yml

@@ -19,6 +19,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 

.github/workflows/publish-pypi.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment: pypi
     permissions:
       id-token: write

.github/workflows/scorecard.yml

@@ -27,6 +27,7 @@ jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       # Upload the result SARIF to the code-scanning dashboard.
       security-events: write