fix(cd): align verifier with nullpool budget

apps/api/tests/test_executor_trust_boundary_readback.py

@@ -384,8 +384,8 @@ def test_executor_trust_boundary_requires_api_null_pool_concurrency_cap() -> Non
 
 def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
     receipt = _verified_receipt()
-    receipt["worker_active_role_connection_count"] = "3"
-    receipt["worker_available_connection_headroom"] = "5"
+    receipt["worker_active_role_connection_count"] = "7"
+    receipt["worker_available_connection_headroom"] = "1"
 
     readback = build_executor_trust_boundary_readback(
         receipt,
@@ -400,6 +400,24 @@ def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
     )
 
 
+def test_executor_trust_boundary_requires_representative_probe_headroom() -> None:
+    receipt = _verified_receipt()
+    receipt["worker_active_role_connection_count"] = "8"
+    receipt["worker_available_connection_headroom"] = "0"
+
+    readback = build_executor_trust_boundary_readback(
+        receipt,
+        deployed_source_sha="abc123",
+    )
+
+    database_boundary = readback["database_identity_boundary"]
+    assert readback["full_workload_boundary_verified"] is False
+    assert database_boundary["connection_budget_verified"] is False
+    assert "worker_connection_budget_not_verified" in (
+        database_boundary["active_blockers"]
+    )
+
+
 def test_executor_trust_boundary_binds_budget_and_verifier_contract() -> None:
     wrong_budget = _verified_receipt()
     wrong_budget["worker_required_connection_budget"] = "4"

apps/api/tests/test_workload_database_identity_projection.py

@@ -269,12 +269,12 @@ def test_workload_database_bootstrap_keeps_secret_values_off_output() -> None:
     assert "representative_connection_probe_count" in script
     assert "active_role_connection_count" in script
     assert "available_connection_headroom" in script
-    assert "connection_headroom_below_required" in script
+    assert "connection_headroom_below_probe_requirement" in script
     assert "FROM pg_stat_activity" in script
     assert "pid <> pg_backend_pid()" in script
     assert "for preflight_attempt in 1 2 3" in script
     assert "preflight_attempts_exhausted=3" in script
-    assert '"connection_headroom_below_required"' in script
+    assert '"connection_headroom_below_probe_requirement"' in script
     assert 'error_code = "workload_database_preflight_failed"' in script
     assert '"error_code": error_code' in script
     assert 'text("SELECT pg_sleep(0.25)")' in script
@@ -320,30 +320,36 @@ def test_cd_uses_live_spec_rollback_and_non_mutating_post_verifier() -> None:
     assert "workload DB identity attempts exhausted before receipt write" in workflow
     assert "API_PUBLIC_READINESS_ATTEMPTS" in workflow
     assert "API_HTTP_CONCURRENCY_ATTEMPTS" in workflow
+    assert '"API_HTTP_CONCURRENCY_ATTEMPTS", 3, 1, 3' in workflow
     assert "API_HTTP_PROBE_SAFETY_RESERVE=4" in workflow
     assert '"$API_DB_NULL_POOL_CONCURRENCY_LIMIT" -eq 2' in workflow
     assert (
-        '"$API_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
-        '"$API_DB_REQUIRED_CONNECTION_BUDGET"'
-    ) in workflow
-    assert (
-        '"$WORKER_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
-        '"$WORKER_DB_REQUIRED_CONNECTION_BUDGET"'
-    ) in workflow
-    assert (
-        '"$BROKER_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
-        '"$BROKER_DB_REQUIRED_CONNECTION_BUDGET"'
-    ) in workflow
-    assert (
-        "available_connection_headroom >= required_connection_budget"
+        "available_connection_headroom >= representative_probe_count"
         in normalized_workflow
     )
     assert (
-        '"$API_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
-        '"$API_DB_REPRESENTATIVE_PROBE_COUNT"'
-    ) not in workflow
+        "available_connection_headroom >= required_connection_budget"
+        not in normalized_workflow
+    )
+    for workload in ("API", "WORKER", "BROKER"):
+        assert (
+            f'"${workload}_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
+            f'"${workload}_DB_REPRESENTATIVE_PROBE_COUNT"'
+            in workflow
+        )
+        assert (
+            f'"${workload}_DB_AVAILABLE_CONNECTION_HEADROOM" -ge '
+            f'"${workload}_DB_REQUIRED_CONNECTION_BUDGET"'
+            not in workflow
+        )
     assert "api_database_null_pool_concurrency_limit" in workflow
     assert "API_HTTP_CONCURRENCY_WORKERS" in workflow
+    assert (
+        '"$API_HTTP_CONCURRENCY_WORKERS" -gt '
+        '"$API_DB_NULL_POOL_CONCURRENCY_LIMIT"'
+        in workflow
+    )
+    assert "API_HTTP_CONCURRENCY_WORKERS=4" not in workflow
     assert "API sequential readiness permanent HTTP status" in workflow
     assert "api/v1/health/ready" in workflow
     assert "events/dossier/coverage?project_id=awoooi&limit=1" not in workflow