feat(studio): deploy security audit worker

db-init/00-create-dbs.sql

@@ -12,3 +12,10 @@ CREATE DATABASE IF NOT EXISTS model_registry CHARACTER SET utf8mb4 COLLATE utf8m
 -- entirely until now, breaking billing-service before it ever gets to
 -- app code.
 CREATE DATABASE IF NOT EXISTS omnibioai_billing CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
+
+-- PR-B0: omnibioai-security-audit's api and security-audit-worker
+-- services both connect to AUDIT_DATABASE_URL=.../omnibioai_audit --
+-- identical missing-database gap to omnibioai_billing above. Alembic
+-- (this service's migration tool, unlike billing's create_all) creates
+-- tables within a database, never the database itself either.
+CREATE DATABASE IF NOT EXISTS omnibioai_audit CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;

docker-compose.release.yml

@@ -135,9 +135,20 @@ services:
       # audit/identity.py::validate_identity_token both fell back to the
       # public literal "change-me" instead of the real secret.
       JWT_SECRET: ${AUTH_SECRET_KEY:-change-me-in-production}
+      # PR-B0: same fix as docker-compose.yml -- GET /audit/events was
+      # falling back to an unreachable localhost DB URL. NOTE: this file
+      # intentionally does NOT add a security-audit-worker service (see
+      # docker-compose.yml's comment) -- no worker image is published by
+      # CI yet, and this image-only release file has no build: precedent
+      # to fall back on the way docker-compose.yml's billing-worker does.
+      # Flagged as an explicit follow-up in the PR-B0 report, not silently
+      # left broken.
+      AUDIT_DATABASE_URL: mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-omnibioai}@mysql:3306/omnibioai_audit
     depends_on:
       redis:
         condition: service_healthy
+      mysql:
+        condition: service_healthy
     restart: on-failure
 
   api-gateway:

docker-compose.yml

@@ -912,11 +912,46 @@ services:
     environment:
       PYTHONUNBUFFERED: "1"
       REDIS_URL: redis://redis:6379
+      # PR-B0: previously unset here, so GET /audit/events
+      # (api/routes_audit_events.py, Depends(get_db)) fell back to
+      # audit/config.py's default mysql+pymysql://root:root@localhost:3306/
+      # omnibioai_audit -- unreachable from inside this container. The
+      # write-side routes (/health, /audit/test) never hit this and so
+      # never surfaced it.
+      AUDIT_DATABASE_URL: mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-omnibioai}@mysql:3306/omnibioai_audit
     depends_on:
       redis:
         condition: service_healthy
+      mysql:
+        condition: service_healthy
     restart: on-failure
 
+  # PR-B0: the Redis Streams consumer-group -> audit_events persistence
+  # worker (worker/main.py, Dockerfile.worker) existed in the
+  # omnibioai-security-audit repo but had no compose service of its own --
+  # only the API container above was deployed. audit:events has been
+  # accumulating real traffic from api-gateway/rag with nothing durably
+  # persisting it. Built locally from source (build:, not image:), matching
+  # the billing-worker precedent below rather than pulling a published
+  # image -- no ghcr.io/omnibioai/omnibioai-security-audit-worker image is
+  # published by CI today (.github/workflows/ci.yml's docker job only
+  # builds the default Dockerfile, not Dockerfile.worker); see the PR-B0
+  # report for that flagged follow-up.
+  security-audit-worker:
+    build:
+      context: ${MACHINE_DIR}/omnibioai-security-audit
+      dockerfile: Dockerfile.worker
+    restart: on-failure
+    environment:
+      PYTHONUNBUFFERED: "1"
+      REDIS_URL: redis://redis:6379
+      AUDIT_DATABASE_URL: mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-omnibioai}@mysql:3306/omnibioai_audit
+    depends_on:
+      redis:
+        condition: service_healthy
+      mysql:
+        condition: service_healthy
+
   api-gateway:
     image: ghcr.io/omnibioai/omnibioai-api-gateway:latest
     ports: