fix(security): isolate workload database identities

apps/api/src/services/executor_trust_boundary_readback.py

@@ -82,6 +82,17 @@ def _build_database_identity_boundary(
                     f"{workload_id}_monolithic_secret_env_from_absent"
                 )
             ),
+            "representative_preflight_passed": _truthy(
+                receipt.get(
+                    f"{workload_id}_representative_db_preflight_passed"
+                )
+            ),
+            "table_privilege_gap_count": _int_or_none(
+                receipt.get(f"{workload_id}_table_privilege_gap_count")
+            ),
+            "sequence_privilege_gap_count": _int_or_none(
+                receipt.get(f"{workload_id}_sequence_privilege_gap_count")
+            ),
         }
 
     secret_refs = [
@@ -119,6 +130,15 @@ def _build_database_identity_boundary(
         and workloads[workload_id]["required_connection_budget"] > 0
         for workload_id in _DB_WORKLOAD_IDS
     )
+    representative_preflights_verified = bool(
+        all(
+            workloads[workload_id]["representative_preflight_passed"] is True
+            and workloads[workload_id]["table_privilege_gap_count"] == 0
+            and workloads[workload_id]["sequence_privilege_gap_count"] == 0
+            for workload_id in _DB_WORKLOAD_IDS
+        )
+        and _truthy(receipt.get("representative_db_preflights_verified"))
+    )
     db_identity_isolated = bool(
         distinct_secret_refs
         and distinct_role_fingerprints
@@ -129,6 +149,7 @@ def _build_database_identity_boundary(
         db_identity_isolated
         and null_pool_verified
         and workload_budget_verified
+        and representative_preflights_verified
         and _truthy(receipt.get("connection_budget_verified"))
     )
 
@@ -147,6 +168,14 @@ def _build_database_identity_boundary(
             blockers.append(f"{workload_id}_database_role_fingerprint_unavailable")
         if workload["database_null_pool"] is not True:
             blockers.append(f"{workload_id}_database_null_pool_not_verified")
+        if (
+            workload["representative_preflight_passed"] is not True
+            or workload["table_privilege_gap_count"] != 0
+            or workload["sequence_privilege_gap_count"] != 0
+        ):
+            blockers.append(
+                f"{workload_id}_representative_db_preflight_not_verified"
+            )
         connection_limit = workload["connection_limit"]
         required_budget = workload["required_connection_budget"]
         if (
@@ -170,7 +199,7 @@ def _build_database_identity_boundary(
         for workload_id in _DB_WORKLOAD_IDS
     ]
     return {
-        "schema_version": "awoooi_workload_db_identity_budget_readback_v1",
+        "schema_version": "awoooi_workload_db_identity_budget_readback_v2",
         "status": "verified_ready" if not blockers else "in_progress",
         "receipt_ref": receipt_ref,
         "verifier": receipt.get("db_identity_verifier") or None,
@@ -188,6 +217,9 @@ def _build_database_identity_boundary(
             "distinct_db_role_fingerprints": distinct_role_fingerprints,
             "database_null_pool_verified": null_pool_verified,
             "workload_connection_budgets_verified": workload_budget_verified,
+            "representative_db_preflights_verified": (
+                representative_preflights_verified
+            ),
         },
         "connection_budget": {
             "observed_total": (