[PetrefiedThunder]

Linear: SEL-292
Fixes #100

Coding engine: codex, dispatched by Grok Bot for C.Lee.

What changed

• Confirmed the issue still exists at HEAD 611fdf3: inherited DATABASE_URL reached the shared setup and clean_database committed bulk deletes.
• Added a fail-closed guard before test collection, session database setup, and clean_database cleanup. Routine runs use only the suite's SQLite file; explicitly opted-in PostgreSQL runs must use the existing fixed local test profile with ENVIRONMENT=test.
• Added no-network regression tests for unsafe inherited URLs and fixture rechecks. Updated the existing nested test and PostgreSQL test instructions to match the guard.

How verified

• From gateway: ~/metacode/fleet/heavy env -u DATABASE_URL -u RUN_POSTGRES_CONCURRENCY_TESTS -u RUN_MCP_MULTIPROCESS_TESTS UV_CACHE_DIR=/private/tmp/sel-292-uv-cache uv run --with-requirements requirements.txt pytest tests/test_test_database_safety.py tests/test_action_database_guard.py -q , 50 passed.
• From gateway: ~/metacode/fleet/heavy env -u DATABASE_URL -u RUN_POSTGRES_CONCURRENCY_TESTS -u RUN_MCP_MULTIPROCESS_TESTS UV_CACHE_DIR=/private/tmp/sel-292-uv-cache uv run --with-requirements requirements.txt pytest tests/test_clean_database_coverage.py tests/test_suite_posture_defaults.py tests/test_action_invocation.py -q , 113 passed.
• From gateway: ~/metacode/fleet/heavy env -u DATABASE_URL -u RUN_POSTGRES_CONCURRENCY_TESTS -u RUN_MCP_MULTIPROCESS_TESTS UV_CACHE_DIR=/private/tmp/sel-292-uv-cache uv run --with-requirements requirements.txt --with pytest-xdist pytest tests/test_test_database_safety.py -n 2 -q , 13 passed.
• From worktree root: ruff check gateway/tests/conftest.py gateway/tests/test_action_database_guard.py gateway/tests/test_test_database_safety.py, ruff format --check gateway/tests/conftest.py gateway/tests/test_action_database_guard.py gateway/tests/test_test_database_safety.py, and git diff --check , all passed.
• Initial focused test attempt without UV_CACHE_DIR could not start pytest because the sandbox denied access to the default uv cache; the rerun above passed.

Not done / follow-ups

• No PostgreSQL service was contacted. The opt-in URL check enforces the fixed local test profile but does not prove that the database is empty; those runs still require a fresh disposable database.

---

Note

Medium Risk
Changes when pytest aborts vs runs against Postgres and blocks bulk deletes on unexpected URLs; misconfigured CI or local env could break tier-2 jobs, but the change reduces risk of wiping non-disposable databases.

Overview
Adds a fail-closed test database guard so inherited DATABASE_URL values cannot reach shared setup_database / clean_database destructive cleanup.

require_disposable_test_database() runs at conftest import and is rechecked before session setup and per-test cleanup. Normal runs are limited to the suite’s per-worker SQLite file; PostgreSQL runs need ENVIRONMENT=test plus either the existing opt-in flags (with the fixed local amw_action_* profile) or AMW_TEST_DB_DISPOSABLE=1 for CI disposable Postgres jobs.

CI postgres-concurrency and postgres-proofs now set that env var; TESTING_TIERS.md / Makefile comments are aligned. New test_test_database_safety.py (including no-network subprocess checks) and test_sqlite_backend URL restore logic lock in the behavior without leaking credentials in errors.

^{Reviewed by Cursor Bugbot for commit 19b9431. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:26:26.869671Z	8b1e379	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b1e379933

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".