Harden API-cost production substrate and deployment gates

[Copilot]

Canonical issue

Outcome

This PR makes the API-cost runtime and migration path explicitly production-safe: it requires a Cloud SQL-backed PostgreSQL substrate, enforces a narrow runtime role, blocks schema drift, and keeps delivery fail-closed when the protected preview/deployment conditions are not satisfied.

Scope

• Included:
  • PostgreSQL-only production validation for API-cost tracking and delivery
  • Cloud SQL Unix socket enforcement and required runtime-role checks
  • separate Alembic migration path plus runtime grant reconciliation for the API-cost tables and sequences
  • schema/privilege contract checks for api_usage, daily_budgets, and webhook_outbox
  • worker readiness gates and deployment/preview safety constraints for production operations
• Explicitly excluded:
  • unrelated product feature work
  • enabling live webhook delivery or mutating production infrastructure
  • any competing implementation or broad redesign outside the API-cost substrate

Risk

• Risk level: medium
• Failure mode: API-cost tracking or delivery could run against an unsafe database or a mis-scoped runtime role, or a migration could leave the worker with broader privileges than intended.
• Rollback: revert the substrate changes and disable API-cost delivery; the runtime is intentionally fail-closed and does not rely on a permissive fallback.

Verification

• Focused tests
  • pytest tests/unit/test_api_cost_database_substrate.py tests/unit/test_api_cost_migrate.py tests/unit/test_api_cost_schema.py tests/unit/test_api_cost_worker.py -q
  • pytest tests/unit -q --no-cov
• Required CI
  • Current-head CI, PostgreSQL substrate, coverage, CodeQL, security, secret scan, and dependency review checks pass.
• Review threads resolved
  • Current-head review threads are closed; no unresolved findings remain.

Production evidence

Production evidence is intentionally limited to runtime policy and deployment gating. The implementation requires a Cloud SQL socket-backed PostgreSQL URL, a non-elevated runtime role with only the API-cost DML grants, and a separate migration path that reconciles grants after alembic upgrade head. Preview delivery remains blocked until the protected bypass secret and exact-head deployment evidence are available; no live production delivery is enabled by this PR.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: prove durable API-cost production substrate (PR #906) #868

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:49pm UTC