create-ailk 0.4.0 → 0.6.0

package/templates/database/__tests__/appointment.db.test.ts

@@ -0,0 +1,106 @@
+/**
+ * @file appointment.db.test.ts
+ *
+ * LIVE-DATABASE proof that `Appointment.noShow` correctly targets the
+ * `no_show` column (#6162). Requires DATABASE_URL pointing at a Postgres with
+ * the migrations applied (`prisma migrate deploy`) — the whole suite SKIPS
+ * when DATABASE_URL is unset, keeping the workspace Jest run DB-free (the
+ * repo convention — see `prefixed-ids.db.test.ts`; the `apps/api Route Tests
+ * (Postgres)` workflow runs this file with a real DB, per its own explicit
+ * `pnpm --filter @working-theory/database test` step's precedent).
+ *
+ * The bug this guards: `Appointment.noShow` carried no `@map("no_show")` —
+ * every sibling field on the model does — while the migration that creates
+ * the table (`20260918120000_add_appointment`) names the column `no_show`.
+ * Prisma's generated client then targets the literal column `noShow`, which
+ * does not exist, and every `prisma.appointment.create()` (or any other
+ * write/read touching this field) fails at runtime.
+ *
+ * Spawns `appointment-create-probe.ts` via `tsx` (a real ESM process) rather
+ * than importing the generated client directly in this file — the generated
+ * client (`generated/client/client.ts`) uses `import.meta.url` and cannot
+ * load under this package's CJS `ts-jest` transform (the same constraint
+ * `prefixed-ids.db.test.ts` documents; see that file's header for why THAT
+ * test uses raw `pg` instead — this one needs the real Prisma runtime
+ * specifically to prove the `@map` targets the right column, which a raw-SQL
+ * probe cannot exercise since it never goes through Prisma's own column-name
+ * resolution).
+ *
+ * RED, reproduced by hand against this exact fixture before the fix (`git
+ * stash` the `@map("no_show")` line, `prisma generate`, re-run):
+ *
+ *   PrismaClientKnownRequestError: The column `noShow of relation
+ *   appointments` does not exist in the current database.
+ *
+ * GREEN, after `@map("no_show")` is restored: the probe's stdout is the
+ * created row, `noShow: true` included, and the process exits 0. Both runs
+ * are logged in this PR's Verification section.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const DATABASE_DIR = join(__dirname, "..");
+const PROBE_SCRIPT = join(__dirname, "fixtures", "appointment-create-probe.ts");
+
+/** Walk up from DATABASE_DIR to find node_modules/.bin/tsx (worktree-safe —
+ * mirrors `database/inbox/__tests__/schema.test.ts`'s own tsx-via-pnpm-exec
+ * invocation, but resolves the binary directly since this call needs a
+ * scoped `env` — including a possibly-overridden DATABASE_URL — that `pnpm
+ * exec` would otherwise have to re-derive). */
+function findTsxBin(): string {
+  let dir = DATABASE_DIR;
+  for (let i = 0; i < 5; i++) {
+    const candidate = join(dir, "node_modules", ".bin", "tsx");
+    if (existsSync(candidate)) return candidate;
+    dir = join(dir, "..");
+  }
+  throw new Error(`tsx binary not found searching up from ${DATABASE_DIR}.`);
+}
+
+describeDb(
+  "Appointment.noShow — live DB round trip via prisma.appointment.create() (#6162)",
+  () => {
+    it("creates and reads back an Appointment row, including noShow", () => {
+      const tsxBin = findTsxBin();
+      const result = spawnSync(tsxBin, [PROBE_SCRIPT], {
+        cwd: DATABASE_DIR,
+        encoding: "utf-8",
+        env: process.env,
+      });
+
+      // Asserting on exit status + a successful parse of stdout — rather
+      // than requiring empty stderr — is the full signal: a stray Node/tsx
+      // diagnostic (an experimental-feature banner, a deprecation warning)
+      // on an otherwise-successful run must not fail this test (code review
+      // on #6162). A genuine failure still surfaces loudly: `status` carries
+      // the exit code and `stderr` the probe's own logged message.
+      if (result.status !== 0) {
+        throw new Error(
+          `probe exited ${result.status}: ${result.stderr || "(no stderr)"}`,
+        );
+      }
+
+      const row = JSON.parse(result.stdout) as {
+        siteId: string;
+        workspaceId: string;
+        attendeeEmail: string;
+        status: string;
+        noShow: boolean;
+        noShowEventAt: string | null;
+      };
+      expect(row.siteId).toBe("wksp_00000000-0000-7000-8000-00000000f1f1");
+      // #6374 — the probe row is fenced like every other appointments row:
+      // `workspace_id` is NOT NULL and must EQUAL `site_id`. A probe that
+      // still wrote the pre-fence free-form site id would be rejected by
+      // `appointments_workspace_id_format` before this assertion ran.
+      expect(row.workspaceId).toBe(row.siteId);
+      expect(row.attendeeEmail).toBe("appointment-probe@example.invalid");
+      expect(row.status).toBe("confirmed");
+      expect(row.noShow).toBe(true);
+      expect(row.noShowEventAt).not.toBeNull();
+    });
+  },
+);

package/templates/database/__tests__/artifact-content-store.db.test.ts

@@ -0,0 +1,316 @@
+/**
+ * @file artifact-content-store.db.test.ts
+ *
+ * LIVE-DATABASE proof of roadmap D1/D7 (#5800) — the generalized `Artifact` and
+ * the workspace-scoped `Asset`. Requires DATABASE_URL pointing at a Postgres
+ * with the migrations applied (`prisma migrate deploy`); the whole suite SKIPS
+ * when DATABASE_URL is unset, matching `prefixed-ids.db.test.ts` and keeping the
+ * workspace Jest run DB-free.
+ *
+ * Raw SQL through `pg` for the same reason that file gives: the generated Prisma
+ * client is ESM-only and cannot load under this package's CJS ts-jest transform,
+ * and raw SQL is the sharper proof anyway — a constraint must hold on the path
+ * no application helper can guard.
+ *
+ * What it proves:
+ *   1. THE SURVIVAL PROPERTY (D1). An artifact produced inside an agent session
+ *      outlives that session: deleting the session sets `session_id` to NULL and
+ *      leaves the row, its versions, and its publish pointer intact. Before this
+ *      migration the FK was `ON DELETE CASCADE` on a NOT NULL column, so the
+ *      same delete destroyed the workspace's content. This is the whole point of
+ *      "the session becomes provenance, the workspace owns the artifact".
+ *   2. The identity of a published page — `(workspace_id, content_type, locale,
+ *      slug)` is unique, while unpublished drafts (slug NULL) are unconstrained,
+ *      because NULLs never collide in a Postgres unique index.
+ *   3. `published_version_id` is an independent pointer: it is NOT `is_current`,
+ *      and appending a newer draft tip does not move it.
+ *   4. `assets` is workspace-scoped with a unique `(workspace_id, key)` and a
+ *      DB-minted `asset_` UUIDv7 id (ADR-0031).
+ */
+import { randomUUID } from "node:crypto";
+
+import { Client } from "pg";
+
+import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const V7_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/** A run-unique suffix so repeated local runs never collide on the unique key. */
+const RUN = randomUUID().slice(0, 8);
+
+describeDb("Artifact content store (roadmap D1/D7, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+  });
+
+  afterAll(async () => {
+    await db.query(
+      `DELETE FROM "artifacts" WHERE "title" LIKE $1`,
+      [`5800-${RUN}%`],
+    );
+    await db.query(`DELETE FROM "agent_sessions" WHERE "title" LIKE $1`, [
+      `5800-${RUN}%`,
+    ]);
+    await db.query(`DELETE FROM "assets" WHERE "key" LIKE $1`, [
+      `5800-${RUN}%`,
+    ]);
+    await db.end();
+  });
+
+  describe("the session is provenance — deleting it never destroys content", () => {
+    it("sets session_id NULL and leaves the artifact, its versions and its publish pointer", async () => {
+      const sessionId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "agent_sessions" ("workspace_id", "title", "updated_at")
+           VALUES ($1, $2, now()) RETURNING "id"`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} session`],
+        )
+      ).rows[0]!.id;
+
+      const artifactId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifacts" ("session_id", "workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, $3, 'text/page', 'en', $4, now()) RETURNING "id"`,
+          [
+            sessionId,
+            DEFAULT_WORKSPACE_ID,
+            `5800-${RUN} page`,
+            `5800-${RUN}-survivor`,
+          ],
+        )
+      ).rows[0]!.id;
+
+      const versionId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"v1"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      await db.query(
+        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
+        [versionId, artifactId],
+      );
+
+      // The act under test: the producing session is deleted outright.
+      await db.query(`DELETE FROM "agent_sessions" WHERE "id" = $1`, [
+        sessionId,
+      ]);
+
+      const { rows } = await db.query<{
+        session_id: string | null;
+        workspace_id: string;
+        published_version_id: string | null;
+      }>(
+        `SELECT "session_id", "workspace_id", "published_version_id"
+         FROM "artifacts" WHERE "id" = $1`,
+        [artifactId],
+      );
+
+      expect(rows).toHaveLength(1);
+      expect(rows[0]!.session_id).toBeNull();
+      expect(rows[0]!.workspace_id).toBe(DEFAULT_WORKSPACE_ID);
+      expect(rows[0]!.published_version_id).toBe(versionId);
+
+      const versions = await db.query(
+        `SELECT "id" FROM "artifact_versions" WHERE "artifact_id" = $1`,
+        [artifactId],
+      );
+      expect(versions.rows).toHaveLength(1);
+    });
+
+    it("accepts an artifact with no session at all — the workspace owns it", async () => {
+      const { rows } = await db.query<{ id: string; session_id: string | null }>(
+        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+         VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id", "session_id"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN} sessionless`],
+      );
+
+      expect(rows[0]!.session_id).toBeNull();
+      expect(rows[0]!.id).toMatch(/^artif_/);
+    });
+  });
+
+  describe("published identity", () => {
+    it("rejects a second artifact with the same (workspace, contentType, locale, slug)", async () => {
+      const slug = `5800-${RUN}-dupe`;
+      await db.query(
+        `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+         VALUES ($1, $2, 'text/page', 'en', $3, now())`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN} first`, slug],
+      );
+
+      await expect(
+        db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', $3, now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} second`, slug],
+        ),
+      ).rejects.toThrow(/duplicate key|unique/i);
+    });
+
+    it("admits many unpublished drafts — a NULL slug never collides", async () => {
+      for (const n of [1, 2, 3]) {
+        await db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} draft ${n}`],
+        );
+      }
+
+      const { rows } = await db.query<{ count: string }>(
+        `SELECT count(*)::text AS count FROM "artifacts"
+         WHERE "title" LIKE $1 AND "slug" IS NULL`,
+        [`5800-${RUN} draft %`],
+      );
+      expect(rows[0]!.count).toBe("3");
+    });
+
+    it("separates the same slug across locales", async () => {
+      const slug = `5800-${RUN}-locale`;
+      for (const locale of ["en", "fr"]) {
+        await db.query(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "slug", "updated_at")
+           VALUES ($1, $2, 'text/page', $3, $4, now())`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} ${locale}`, locale, slug],
+        );
+      }
+
+      const { rows } = await db.query<{ count: string }>(
+        `SELECT count(*)::text AS count FROM "artifacts" WHERE "slug" = $1`,
+        [slug],
+      );
+      expect(rows[0]!.count).toBe("2");
+    });
+  });
+
+  describe("the publish pointer is not the draft tip", () => {
+    it("survives a newer is_current version", async () => {
+      const artifactId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifacts" ("workspace_id", "title", "content_type", "locale", "updated_at")
+           VALUES ($1, $2, 'text/page', 'en', now()) RETURNING "id"`,
+          [DEFAULT_WORKSPACE_ID, `5800-${RUN} pointer`],
+        )
+      ).rows[0]!.id;
+
+      const published = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"published"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      await db.query(
+        `UPDATE "artifacts" SET "published_version_id" = $1 WHERE "id" = $2`,
+        [published, artifactId],
+      );
+
+      // A newer draft tip lands; the publish pointer must NOT follow it.
+      await db.query(
+        `UPDATE "artifact_versions" SET "is_current" = FALSE WHERE "artifact_id" = $1`,
+        [artifactId],
+      );
+      const draft = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "artifact_versions" ("artifact_id", "workspace_id", "content", "is_current")
+           VALUES ($1, $2, '{"body":"draft"}'::jsonb, TRUE) RETURNING "id"`,
+          [artifactId, DEFAULT_WORKSPACE_ID],
+        )
+      ).rows[0]!.id;
+
+      const { rows } = await db.query<{ published_version_id: string | null }>(
+        `SELECT "published_version_id" FROM "artifacts" WHERE "id" = $1`,
+        [artifactId],
+      );
+      expect(rows[0]!.published_version_id).toBe(published);
+      expect(rows[0]!.published_version_id).not.toBe(draft);
+    });
+  });
+
+  describe("Asset (D7)", () => {
+    it("mints an asset_ UUIDv7 id and stores the bytes", async () => {
+      const { rows } = await db.query<{ id: string; size: number }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'logo.png', 'image/png', $3, 4) RETURNING "id", "size"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-logo`, Buffer.from([1, 2, 3, 4])],
+      );
+
+      expect(rows[0]!.id).toMatch(/^asset_/);
+      expect(rows[0]!.id.slice("asset_".length)).toMatch(V7_RE);
+      expect(rows[0]!.size).toBe(4);
+    });
+
+    it("rejects a second asset with the same (workspace, key)", async () => {
+      const key = `5800-${RUN}-dupe-key`;
+      await db.query(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'a.png', 'image/png', $3, 1)`,
+        [DEFAULT_WORKSPACE_ID, key, Buffer.from([1])],
+      );
+
+      await expect(
+        db.query(
+          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+           VALUES ($1, $2, 'b.png', 'image/png', $3, 1)`,
+          [DEFAULT_WORKSPACE_ID, key, Buffer.from([2])],
+        ),
+      ).rejects.toThrow(/duplicate key|unique/i);
+    });
+
+    it("rejects a malformed workspace_id (ADR-0031 CHECK)", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+           VALUES ('not-a-workspace-id', $1, 'a.png', 'image/png', $2, 1)`,
+          [`5800-${RUN}-bad-scope`, Buffer.from([1])],
+        ),
+      ).rejects.toThrow(/assets_workspace_id_format|check constraint/i);
+    });
+
+    // #6092 (S4/D10) — title, description and tags. `tags` stores SLUGS, never
+    // the human labels the lightbox renders (D3): 'ad-creative' and
+    // 'user-uploaded' are the exact pair the demo's first asset carries
+    // (demo.html:357).
+    it("stores and returns two tags", async () => {
+      const { rows } = await db.query<{ tags: string[] }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size", "tags")
+         VALUES ($1, $2, 'tagged.png', 'image/png', $3, 1, $4) RETURNING "tags"`,
+        [
+          DEFAULT_WORKSPACE_ID,
+          `5800-${RUN}-tagged`,
+          Buffer.from([1]),
+          ["ad-creative", "user-uploaded"],
+        ],
+      );
+
+      expect(rows[0]!.tags).toEqual(["ad-creative", "user-uploaded"]);
+      expect(rows[0]!.tags).toHaveLength(2);
+    });
+
+    it("defaults title, description and tags when none of the three columns is named", async () => {
+      const { rows } = await db.query<{
+        title: string | null;
+        description: string | null;
+        tags: string[];
+      }>(
+        `INSERT INTO "assets" ("workspace_id", "key", "filename", "content_type", "bytes", "size")
+         VALUES ($1, $2, 'untagged.png', 'image/png', $3, 1)
+         RETURNING "title", "description", "tags"`,
+        [DEFAULT_WORKSPACE_ID, `5800-${RUN}-untagged`, Buffer.from([1])],
+      );
+
+      expect(rows[0]!.title).toBeNull();
+      expect(rows[0]!.description).toBeNull();
+      expect(rows[0]!.tags).toEqual([]);
+    });
+  });
+});

package/templates/database/__tests__/composite-fence.db.test.ts

@@ -0,0 +1,206 @@
+/**
+ * @file composite-fence.db.test.ts
+ *
+ * LIVE-DATABASE proof of the #6254 keystone constraints (AC-2, AC-5, AC-7).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied
+ * (`prisma migrate deploy`); the whole suite SKIPS when DATABASE_URL is
+ * unset, matching `flow-workspace-key.db.test.ts` / `prefixed-ids.db.test.ts`
+ * and keeping the workspace Jest run DB-free.
+ *
+ * Raw SQL through `pg`, for the same reason those files give: the generated
+ * Prisma client is ESM-only and cannot load under this package's CJS ts-jest
+ * transform.
+ *
+ * This suite proves the CONSTRAINTS database/migrations/
+ * 20260922120000_tenancy_fence adds — it does not re-prove that migration's
+ * own backfill (that is `flow-workspace-key.db.test.ts`'s job for its two
+ * models, and this migration's backfill is largely a defensive re-run of
+ * work the #6155/#6203 precedent migrations already did — see this
+ * migration's own header comment). What it proves (spec § 8.2):
+ *
+ *   1. `Lead` rejects a row whose `workspaceId` disagrees with its `siteId`
+ *      — SQLSTATE 23514 (AC-5's core).
+ *   2. `Lead` accepts a row whose `workspaceId` AGREES with its `siteId` —
+ *      without this, assertion 1 would also pass against a table that
+ *      rejects everything.
+ *   3. `FlowDefinition` rejects the same disagreement — AC-5's "at least
+ *      one retrofit model besides Lead".
+ *   4. NULL is unstorable on `Lead` and `FlowDefinition` — SQLSTATE 23502
+ *      (not_null_violation) — AC-7.
+ *   5. `WorkspaceSiteIdentity` carries the AC-2 composite unique constraint,
+ *      proven at the database, not just in the schema file.
+ *   6. The migration's own literal sentinel id equals `DEFAULT_WORKSPACE_ID`
+ *      — the two cannot drift apart (the #6155/#6203 precedents' own
+ *      technique).
+ */
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { Client } from "pg";
+
+import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+/** A run-unique suffix so repeated local runs never collide. */
+const RUN = randomUUID().slice(0, 8);
+
+const MIGRATION_SQL_PATH = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20260922120000_tenancy_fence",
+  "migration.sql",
+);
+const MIGRATION_SQL = readFileSync(MIGRATION_SQL_PATH, "utf-8");
+
+/** Postgres's own error shape carries `code` as a 5-character SQLSTATE. */
+type PgError = { code?: string };
+
+describeDb("the #6254 tenancy-fence constraints (live DB)", () => {
+  let db: Client;
+  let workspaceAId: string;
+  let workspaceBId: string;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+
+    // Two REAL, distinct workspaces — A and B — so a "disagreement" insert
+    // names two values that both actually exist, not a real one versus
+    // garbage (which the format CHECK, not the equality CHECK, would catch).
+    const org = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ($1, $2, now()) RETURNING "id"`,
+        [`6254 Org ${RUN}`, `6254-org-${RUN}`],
+      )
+    ).rows[0]!;
+
+    workspaceAId = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, $2, $3, now()) RETURNING "id"`,
+        [org.id, `6254 Workspace A ${RUN}`, `6254-ws-a-${RUN}`],
+      )
+    ).rows[0]!.id;
+
+    workspaceBId = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, $2, $3, now()) RETURNING "id"`,
+        [org.id, `6254 Workspace B ${RUN}`, `6254-ws-b-${RUN}`],
+      )
+    ).rows[0]!.id;
+  });
+
+  afterAll(async () => {
+    await db.query(`DELETE FROM "flow_definitions" WHERE "slug" LIKE $1`, [
+      `6254-${RUN}-%`,
+    ]);
+    await db.query(`DELETE FROM "leads" WHERE "source" = $1`, [
+      `6254-test-${RUN}`,
+    ]);
+    await db.query(`DELETE FROM "workspaces" WHERE "slug" LIKE $1`, [
+      `6254-ws-%-${RUN}`,
+    ]);
+    await db.query(`DELETE FROM "organizations" WHERE "slug" = $1`, [
+      `6254-org-${RUN}`,
+    ]);
+    await db.end();
+  });
+
+  describe("AC-5 — the equality CHECK rejects a site<->workspace disagreement", () => {
+    it("Lead: workspace_id disagreeing with site_id raises 23514", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload")
+           VALUES ($1, $2, $3, $4, '{}'::jsonb)`,
+          [workspaceAId, workspaceBId, `6254-test-${RUN}`, "disagree@example.com"],
+        ),
+      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23514" });
+    });
+
+    it("Lead: workspace_id AGREEING with site_id succeeds", async () => {
+      const result = await db.query<{ id: string }>(
+        `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload")
+         VALUES ($1, $1, $2, $3, '{}'::jsonb) RETURNING "id"`,
+        [workspaceAId, `6254-test-${RUN}`, "agree@example.com"],
+      );
+      expect(result.rows).toHaveLength(1);
+    });
+
+    it("FlowDefinition (the second retrofit model, AC-5's own requirement): workspace_id disagreeing with site_id raises 23514", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "flow_definitions"
+             ("site_id", "workspace_id", "slug", "config", "title", "status", "updated_at")
+           VALUES ($1, $2, $3, '{}'::jsonb, 'Test', 'live', now())`,
+          [workspaceAId, workspaceBId, `6254-${RUN}-disagree`],
+        ),
+      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23514" });
+    });
+
+    it("FlowDefinition: workspace_id AGREEING with site_id succeeds", async () => {
+      const result = await db.query<{ id: string }>(
+        `INSERT INTO "flow_definitions"
+           ("site_id", "workspace_id", "slug", "config", "title", "status", "updated_at")
+         VALUES ($1, $1, $2, '{}'::jsonb, 'Test', 'live', now()) RETURNING "id"`,
+        [workspaceAId, `6254-${RUN}-agree`],
+      );
+      expect(result.rows).toHaveLength(1);
+    });
+  });
+
+  describe("AC-7 — NOT NULL: no row can exist with workspace_id IS NULL", () => {
+    it("Lead: omitting workspace_id raises 23502 (not_null_violation)", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "leads" ("site_id", "source", "email", "payload")
+           VALUES ($1, $2, $3, '{}'::jsonb)`,
+          [workspaceAId, `6254-test-${RUN}`, "null@example.com"],
+        ),
+      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23502" });
+    });
+
+    it("FlowDefinition: omitting workspace_id raises 23502 (not_null_violation)", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "flow_definitions" ("site_id", "slug", "config", "title", "status", "updated_at")
+           VALUES ($1, $2, '{}'::jsonb, 'Test', 'live', now())`,
+          [workspaceAId, `6254-${RUN}-null`],
+        ),
+      ).rejects.toMatchObject<{ code: PgError["code"] }>({ code: "23502" });
+    });
+  });
+
+  describe("AC-2 — WorkspaceSiteIdentity's composite unique exists at the database", () => {
+    it("pg_constraint reports a UNIQUE constraint over (id, workspace_id)", async () => {
+      const result = await db.query<{ contype: string; conkey_count: number }>(
+        `SELECT c.contype, array_length(c.conkey, 1) AS conkey_count
+           FROM pg_constraint c
+           JOIN pg_class t ON t.oid = c.conrelid
+          WHERE t.relname = 'workspace_site_identities'
+            AND c.conname = 'workspace_site_identities_id_workspace_id_key'`,
+      );
+      expect(result.rows).toHaveLength(1);
+      expect(result.rows[0]!.contype).toBe("u");
+      expect(result.rows[0]!.conkey_count).toBe(2);
+    });
+  });
+
+  describe("the migration's own literal sentinel id equals DEFAULT_WORKSPACE_ID", () => {
+    it("cannot drift apart — read from the shipped file, not a re-typed copy", () => {
+      // SQL cannot import database/tenancy.ts (spec § 5.3 step 5), so the
+      // migration carries the sentinel as a literal. Pin it against the
+      // exported constant by reading the shipped file, exactly as the
+      // #6155/#6203 precedents do.
+      const occurrences = MIGRATION_SQL.match(/'wksp_[0-9a-f-]+'/g) ?? [];
+      expect(occurrences.length).toBeGreaterThan(0);
+      for (const literal of occurrences) {
+        expect(literal).toBe(`'${DEFAULT_WORKSPACE_ID}'`);
+      }
+    });
+  });
+});