fix(sre): fail closed DB verifier runtime drift

apps/api/tests/test_db_bounded_executor.py

@@ -255,6 +255,7 @@ def test_catalog_precheck_allows_absent_index_but_rejects_drift() -> None:
     assert absent["index_exists"] is False
     assert exact["index_shape_exact"] is True
     assert exact["apply_ready"] is True
+    assert exact["verify_ready"] is True
     assert invalid_exact["index_shape_exact"] is False
     assert invalid_exact["index_definition_exact_except_validity"] is True
     assert invalid_exact["reindex_ready"] is True
@@ -271,6 +272,7 @@ def test_catalog_precheck_allows_absent_index_but_rejects_drift() -> None:
     assert non_owner["apply_ready"] is False
     # CREATE INDEX requires table ownership, not a separate SELECT grant.
     assert select_revoked["apply_ready"] is True
+    assert select_revoked["verify_ready"] is False
     assert partitioned_parent["apply_ready"] is False
 
 
@@ -457,6 +459,32 @@ async def test_verify_is_catalog_only_and_never_takes_the_apply_lock() -> None:
     assert all("advisory_lock" not in sql for sql in connection.statements)
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "runtime_drift",
+    [
+        {"primary_database": False},
+        {"table_select": False},
+        {"schema_usage": False},
+    ],
+)
+async def test_verify_fails_closed_on_runtime_identity_or_read_drift(
+    runtime_drift: dict,
+) -> None:
+    connection = _Connection([{**_exact_catalog(), **runtime_drift}])
+    engine = _Engine(connection)
+
+    receipt = await execute_bounded_db_command(
+        **_contract("verify"),
+        engine=engine,
+    )
+
+    assert receipt["terminal"] == "verification_failed"
+    assert receipt["writes_performed"] is False
+    assert receipt["catalog"]["verify_ready"] is False
+    assert receipt["error_code"] == "catalog_verification_failed"
+
+
 @pytest.mark.asyncio
 async def test_failed_create_reports_unknown_write_state_without_backend_detail() -> (
     None