Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715

scripts/backup/tests/test_backup_awoooi_secret_contract.py

@@ -18,8 +18,22 @@ def test_daily_backup_has_no_hardcoded_database_password() -> None:
     assert "pg_dump --no-password" in text
 
 
-def test_daily_backup_fails_closed_without_runtime_credential() -> None:
+def test_daily_backup_resolves_runtime_database_url_and_fails_closed() -> None:
     text = SCRIPT.read_text(encoding="utf-8")
 
-    assert 'if [ -z "${AWOOOI_DB_PASS}" ]; then' in text
-    assert "refusing an unauthenticated or hardcoded fallback" in text
+    assert "resolve_database_url()" in text
+    assert "load_database_config()" in text
+    assert "AWOOOI_BACKUP_DATABASE_URL BACKUP_DATABASE_URL DATABASE_URL" in text
+    assert "無法解析 AWOOOI DATABASE_URL；拒絕使用舊硬編密碼" in text
+    assert "base64 -d" in text
+    assert 'printf \'%s\\n\' "${decoded}"' in text
+
+
+def test_daily_backup_uses_same_rls_safe_pg_dump_contract_as_frequent_lane() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+
+    assert "dump_database_with_rls_guard()" in text
+    assert 'PGOPTIONS="-c statement_timeout=0 -c max_parallel_workers_per_gather=0"' in text
+    assert "ALTER TABLE %I.%I ${mode} ROW LEVEL SECURITY" in text
+    assert "trap restore_force_rls EXIT" in text
+    assert 'dump_database_with_rls_guard \\\n        "awoooi_prod"' in text