Fix Workflow contracts CI after Activity runtime removal

.github/skills/add-operational-value/references/event-ledger.md

@@ -214,10 +214,6 @@ original ledger, not the computed pulse model, and makes no remote requests:
 ```bash
 node .github/skills/add-operational-value/scripts/export-evidence.mjs \
   ledger.json .cao/gh-aw-logs-shards/workflow-value-evidence.jsonl
-node activity/cao.mjs hash-payloads \
-  --shard-dir .cao/gh-aw-logs-shards --normalized-dir .cao/gh-aw-logs-normalized \
-  --runs-dir .cao/gh-aw-logs-runs --records-dir .cao/gh-aw-logs-records \
-  --output .cao/payload-hashes.json
 ```
 
 Use an existing, appropriately scoped publication directory. Import is not

.github/workflows/cgo.yml

@@ -286,9 +286,9 @@ jobs:
                   }
                 }')"
             test -n "$pattern"
-            go -C server test -p 1 "$GO_TEST_MODE" -run "^($pattern)$" "${packages[@]}"
+            go -C server test -p 1 "$GO_TEST_MODE" -v -run "^($pattern)$" "${packages[@]}"
           else
-            go -C server test -p 1 "$GO_TEST_MODE" "${packages[@]}"
+            go -C server test -p 1 "$GO_TEST_MODE" -v "${packages[@]}"
           fi
 
   server-integration:

.github/workflows/workflow-contracts.yml

@@ -227,26 +227,6 @@ jobs:
           npm run check:svg
           npm run docs:build
 
-  github-issue-query:
-    name: GitHub issue GraphQL integration
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      issues: read
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-      - name: Test issueOrPullRequest query
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: node --test tests/integration/github-issue-or-pull-request.test.mjs
-
   dependabot-operational-value:
     name: Dependabot operational value integration
     if: github.event_name != 'pull_request'

scripts/run-unit-area.mjs

@@ -11,7 +11,7 @@ export const unitTestAreas = {
   dashboard: [/^dashboard-/, /^cli-action-/, /^server-azure-/],
   workflows: [
     /^workflow-contract-/, /^control-/, /^campaign-/, /^contoso-/,
-    /^github-apps\./, /^gh-aw-version-/, /^release-workflow\./, /^build-release\./,
+    /^github-apps\./, /^gh-aw-version-/, /^release-workflow\./, /^release-schedule\./, /^build-release\./,
     /^add-operational-value-skill\./, /^token-intervention-lifecycle\./,
   ],
   tooling: [

server/internal/collect/native_control_process_test.go

@@ -38,7 +38,7 @@ func TestNativeControlRecoveryUsesSeparateProcessAndDurableValueHint(t *testing.
 	// #nosec G204 -- invokes this test executable without external collector tooling.
 	child := exec.CommandContext(t.Context(), executable, "-test.run=^TestNativeControlRecoverySubprocess$", "-test.v")
 	child.Env = append(os.Environ(), "PATH=/nonexistent", "CAO_NATIVE_CONTROL_DSN="+dsn,
-		"CAO_NATIVE_CONTROL_NAMESPACE="+namespace, "CAO_NATIVE_CONTROL_SCHEMA="+config.RuntimeParams["search_path"])
+		"CAO_NATIVE_CONTROL_NAMESPACE="+namespace, "CAO_NATIVE_CONTROL_SCHEMA="+config.RuntimeParams["search_path"], "CAO_NATIVE_CONTROL_CANONICAL_DSN="+config.ConnString())
 	if output, err := child.CombinedOutput(); err != nil {
 		t.Fatalf("separate native control process failed: %v\n%s", err, output)
 	}
@@ -68,7 +68,7 @@ func TestNativeControlRecoverySubprocess(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer func() { _ = store.Close() }()
-	config, err := pgx.ParseConfig(dsn)
+	config, err := pgx.ParseConfig(os.Getenv("CAO_NATIVE_CONTROL_CANONICAL_DSN"))
 	if err != nil {
 		t.Fatal(err)
 	}

server/internal/collect/run_enumeration_process_test.go

@@ -40,6 +40,7 @@ func TestNativeEnumerationResumesAbandonedPageInSeparateProcess(t *testing.T) {
 	child.Env = append(os.Environ(), "PATH=/nonexistent",
 		"CAO_NATIVE_DISCOVERY_DSN="+dsn, "CAO_NATIVE_DISCOVERY_NAMESPACE="+namespace,
 		"CAO_NATIVE_DISCOVERY_SCHEMA="+config.RuntimeParams["search_path"],
+		"CAO_NATIVE_DISCOVERY_CANONICAL_DSN="+config.ConnString(),
 		"CAO_NATIVE_DISCOVERY_BEFORE="+before.Format(time.RFC3339))
 	if output, err := child.CombinedOutput(); err != nil {
 		t.Fatalf("separate native enumeration process failed: %v\n%s", err, output)
@@ -67,7 +68,7 @@ func TestNativeEnumerationRecoverySubprocess(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer func() { _ = store.Close() }()
-	config, err := pgx.ParseConfig(dsn)
+	config, err := pgx.ParseConfig(os.Getenv("CAO_NATIVE_DISCOVERY_CANONICAL_DSN"))
 	if err != nil {
 		t.Fatal(err)
 	}

server/internal/collect/run_worker_test.go

@@ -149,7 +149,7 @@ func TestNativeRunWorkerCrashAfterPublicationRecoversInAnotherProcess(t *testing
 	child := exec.CommandContext(t.Context(), executable, "-test.run=^TestNativeRunWorkerRecoverySubprocess$", "-test.v")
 	child.Env = []string{
 		"PATH=/nonexistent", "CAO_NATIVE_RUN_DSN=" + dsn, "CAO_NATIVE_RUN_NAMESPACE=" + namespace,
-		"CAO_NATIVE_RUN_SCHEMA=" + config.RuntimeParams["search_path"], "CAO_NATIVE_RUN_RECORDED=" + recorded,
+		"CAO_NATIVE_RUN_SCHEMA=" + config.RuntimeParams["search_path"], "CAO_NATIVE_RUN_CANONICAL_DSN=" + config.ConnString(), "CAO_NATIVE_RUN_RECORDED=" + recorded,
 	}
 	output, err := child.CombinedOutput()
 	if err != nil || !strings.Contains(string(output), "historical durable handoff verified") {
@@ -187,7 +187,7 @@ func TestNativeRunWorkerRecoverySubprocess(t *testing.T) {
 	if err != nil || len(leases) != 1 || leases[0].Task.Attempt != 3 || leases[0].Task.Failures != 0 {
 		t.Fatalf("recovered exact historical attempt: %v %v", leases, err)
 	}
-	config, err := pgx.ParseConfig(dsn)
+	config, err := pgx.ParseConfig(os.Getenv("CAO_NATIVE_RUN_CANONICAL_DSN"))
 	if err != nil {
 		t.Fatal(err)
 	}

server/internal/postgresx/acquisition_value_hints.go

@@ -93,7 +93,8 @@ func (a Acquisition) CompleteValueHint(ctx context.Context, scope collectnative.
 	}
 	var retryAt any
 	if !retry.IsZero() {
-		retryAt = retry.UTC()
+		// timestamptz stores microseconds and rounds; truncate so retry_at round-trips exactly.
+		retryAt = retry.UTC().Truncate(time.Microsecond)
 	}
 	result, err := tx.ExecContext(ctx, `UPDATE cao_acquisition_value_hints SET
 		processed=CASE WHEN $6::timestamptz IS NULL THEN greatest(processed,$4) ELSE processed END,

server/internal/postgresx/acquisition_value_hints_test.go

@@ -47,7 +47,7 @@ func TestNativeValueHintsFenceConcurrentInvalidationAndAcknowledgement(t *testin
 	if err := a.InvalidateValue(t.Context(), scope); err != nil {
 		t.Fatal(err)
 	}
-	now := time.Now().UTC()
+	now := time.Now().UTC().Truncate(time.Microsecond)
 	if err := b.CompleteValueHint(t.Context(), scope, hint.Dirty, now, time.Time{}); err != nil {
 		t.Fatal(err)
 	}

server/internal/postgresx/native_test.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/githubnext/gh-cao/server/internal/model"
 	"github.com/githubnext/gh-cao/server/internal/query"
+	"github.com/githubnext/gh-cao/server/internal/testutil/pgtemplate"
 )
 
 func nativeTestStore(t *testing.T) (*Store, *pgx.ConnConfig) {
@@ -23,6 +24,20 @@ func nativeTestStore(t *testing.T) (*Store, *pgx.ConnConfig) {
 	if endpoint == "" {
 		t.Skip("POSTGRES_URL is unset")
 	}
+	if config, ok := pgtemplate.Clone(t, t.Context(), endpoint, func(ctx context.Context, config *pgx.ConnConfig) error {
+		store, err := NewConfig(ctx, config)
+		if err != nil {
+			return err
+		}
+		return store.Close()
+	}); ok {
+		store, err := NewConfig(t.Context(), config)
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = store.Close() })
+		return store, config
+	}
 	config, err := pgx.ParseConfig(endpoint)
 	if err != nil {
 		t.Fatal(err)

server/internal/server/dashboard_sql_corpus_test.go

@@ -16,19 +16,33 @@ import (
 )
 
 func TestDashboardQueryCorpusUsesPostgres(t *testing.T) {
-	assertDashboardQueriesUsePostgres(t, nil)
+	assertDashboardQueriesUsePostgres(t)
 }
 
+// TestRepositoryQueriesUsePostgres guards that repository queries stay in the
+// deployed corpus, which TestDashboardQueryCorpusUsesPostgres executes in full.
 func TestRepositoryQueriesUsePostgres(t *testing.T) {
-	assertDashboardQueriesUsePostgres(t, []string{
+	definitions, _, err := dashboardSQLCorpus()
+	if err != nil {
+		t.Fatal(err)
+	}
+	deployed := make(map[string]bool, len(definitions))
+	for _, definition := range definitions {
+		deployed[definition.Name] = true
+	}
+	for _, name := range []string{
 		"repository-run-statistics", "repository-run-identities",
 		"repository-import-totals", "repository-run-totals",
 		"repository-aic-totals", "repository-activity",
 		"repository-observed-run-counts", "repository-run-inventory",
-	})
+	} {
+		if !deployed[name] {
+			t.Errorf("repository query %q is missing from the deployed dashboard corpus", name)
+		}
+	}
 }
 
-func assertDashboardQueriesUsePostgres(t *testing.T, requested []string) {
+func assertDashboardQueriesUsePostgres(t *testing.T) {
 	t.Helper()
 	store := integrationDatabase(t)
 	definitions, parameters, err := dashboardSQLCorpus()
@@ -41,11 +55,9 @@ func assertDashboardQueriesUsePostgres(t *testing.T, requested []string) {
 	if err := query.Validate(definitions); err != nil {
 		t.Fatalf("validate deployed dashboard query corpus: %v", err)
 	}
-	if requested == nil {
-		requested = make([]string, len(definitions))
-		for index, definition := range definitions {
-			requested[index] = definition.Name
-		}
+	requested := make([]string, len(definitions))
+	for index, definition := range definitions {
+		requested[index] = definition.Name
 	}
 	runtimeSource := func(_ context.Context, name string) (model.Source, error) {
 		return model.Source{

server/internal/server/session_archive_test.go

@@ -223,9 +223,13 @@ func TestSessionArchiveResultBudgetsErrorsAndRevocation(t *testing.T) {
 }
 
 func TestSessionArchiveResponseClosesReader(t *testing.T) {
+	// Outcomes share one app; each subtest restores the credential it may revoke
+	// and installs its own archive service.
+	app, _ := newLocalPostgresTestApp(t, false)
+	accessToken := app.accessToken
 	for _, outcome := range []string{"success", "withdrawn", "oversize", "authorization-revoked", "authorization-revoked-at-delivery", "query-error"} {
 		t.Run(outcome, func(t *testing.T) {
-			app, _ := newLocalPostgresTestApp(t, false)
+			app.accessToken = accessToken
 			reader := &sessionArchiveReadProbe{}
 			delivered := false
 			reader.deliver = func(deliver func() error) error {