fix(security): isolate allowlisted execution broker

apps/api/tests/test_runtime_bootstrap_guards.py

@@ -80,6 +80,7 @@ def test_get_engine_uses_database_pool_budget(monkeypatch):
     monkeypatch.setattr(db_base.settings, "DATABASE_POOL_SIZE", 1)
     monkeypatch.setattr(db_base.settings, "DATABASE_MAX_OVERFLOW", 0)
     monkeypatch.setattr(db_base.settings, "DATABASE_POOL_TIMEOUT_SECONDS", 5.0)
+    monkeypatch.setattr(db_base.settings, "DATABASE_NULL_POOL", False)
     monkeypatch.setattr(db_base, "create_async_engine", fake_create_async_engine)
 
     assert db_base.get_engine() is fake_engine
@@ -89,6 +90,36 @@ def test_get_engine_uses_database_pool_budget(monkeypatch):
     assert captured["pool_timeout"] == 5.0
 
 
+def test_get_engine_uses_null_pool_for_bounded_background_processes(monkeypatch):
+    from sqlalchemy.pool import NullPool
+
+    from src.db import base as db_base
+
+    captured: dict[str, object] = {}
+    fake_engine = object()
+
+    def fake_create_async_engine(database_url: str, **kwargs: object) -> object:
+        captured["database_url"] = database_url
+        captured.update(kwargs)
+        return fake_engine
+
+    monkeypatch.setattr(db_base, "_engine", None)
+    monkeypatch.setattr(db_base, "_session_factory", None)
+    monkeypatch.setattr(
+        db_base.settings,
+        "DATABASE_URL",
+        "postgresql+asyncpg://u:p@localhost/db",
+    )
+    monkeypatch.setattr(db_base.settings, "DATABASE_NULL_POOL", True)
+    monkeypatch.setattr(db_base, "create_async_engine", fake_create_async_engine)
+
+    assert db_base.get_engine() is fake_engine
+    assert captured["poolclass"] is NullPool
+    assert "pool_size" not in captured
+    assert "max_overflow" not in captured
+    assert "pool_timeout" not in captured
+
+
 @pytest.mark.asyncio
 async def test_init_db_serializes_bootstrap_ddl_with_advisory_lock(monkeypatch):
     from src.db import base as db_base