feat(multitenancy): add modular foundation and PostgreSQL persistence (P1-P2)

.env.example

@@ -24,3 +24,10 @@ YANDEX_SEARCH_FOLDER_ID=
 
 # Yandex Metrika read-only token
 YANDEX_METRIKA_OAUTH_TOKEN=
+
+# P2 PostgreSQL isolated development/test placeholders only; never use in production.
+# Inject real database configuration through the deployment secret mechanism.
+DIRECTPILOT_DATABASE_URL=postgresql+psycopg://directpilot_app:REPLACE_WITH_SYNTHETIC_TEST_PASSWORD@127.0.0.1:55432/directpilot_test
+DIRECTPILOT_POSTGRES_DB=directpilot_test
+DIRECTPILOT_POSTGRES_OWNER_PASSWORD=REPLACE_WITH_SYNTHETIC_TEST_PASSWORD
+DIRECTPILOT_POSTGRES_PORT=55432

.github/workflows/p1-quality.yml

@@ -0,0 +1,63 @@
+name: P1 quality
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  p1-quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - uses: astral-sh/setup-uv@v5
+      - name: Install locked dependencies
+        run: uv sync --frozen --python 3.11
+      - name: Run P1 characterization and tracer tests
+        run: >-
+          uv run pytest -q
+          tests/characterization
+          tests/test_application_factory.py
+          tests/test_dependency_seams.py
+          tests/test_request_context.py
+          tests/test_respx_harness.py
+          tests/test_router_decomposition.py
+      - name: Check OpenAPI snapshot
+        run: uv run python scripts/check_openapi_sync.py
+      - name: Lint bounded P1 modules
+        run: >-
+          uv run ruff check
+          app/api/core_router.py
+          app/api/direct_extensions_router.py
+          app/api/direct_router.py
+          app/api/legacy_router.py
+          app/api/metrika_router.py
+          app/api/route_registry.py
+          app/api/wordstat_router.py
+          app/bootstrap/application.py
+          app/bootstrap/dependencies.py
+          app/main.py
+          app/core
+          app/providers
+          app/repositories
+      - name: Type-check bounded P1 modules
+        run: >-
+          uv run mypy
+          app/api/core_router.py
+          app/api/direct_extensions_router.py
+          app/api/direct_router.py
+          app/api/legacy_router.py
+          app/api/metrika_router.py
+          app/api/route_registry.py
+          app/api/wordstat_router.py
+          app/bootstrap/application.py
+          app/bootstrap/dependencies.py
+          app/main.py
+          app/core
+          app/providers
+          app/repositories

.github/workflows/p2-postgresql-migrations.yml

@@ -0,0 +1,68 @@
+name: P2 PostgreSQL migrations
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/p2-postgresql-migrations.yml"
+      - "alembic.ini"
+      - "app/db/**"
+      - "app/modules/**"
+      - "app/repositories/postgres_store.py"
+      - "deploy/compose.test.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "tests/integration/**"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/p2-postgresql-migrations.yml"
+      - "alembic.ini"
+      - "app/db/**"
+      - "app/modules/**"
+      - "app/repositories/postgres_store.py"
+      - "deploy/compose.test.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "tests/integration/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  migration-compatibility:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      DIRECTPILOT_DOCKER_BIN: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+      - name: Install locked dependencies
+        run: uv sync --locked --all-groups
+      - name: Pull the isolated PostgreSQL image
+        run: docker pull postgres:17.7-bookworm
+      - name: Empty database migration and runtime-role proof
+        run: >-
+          uv run pytest
+          tests/integration/test_migrations_and_roles.py::test_owner_migrates_empty_database_and_runtime_role_is_nonowner
+          -q
+      - name: Prior P2 revision to head migration proof
+        run: >-
+          uv run pytest
+          tests/integration/test_migrations_and_roles.py::test_owner_upgrades_from_prior_p2_revision_to_current_head
+          -q
+      - name: PostgreSQL persistence and restore integration
+        run: >-
+          uv run pytest
+          tests/integration/test_postgresql_runtime.py
+          tests/integration/test_schema_compatibility.py
+          tests/integration/test_audit_repository.py
+          tests/integration/test_idempotency_repository.py
+          tests/integration/test_persistent_product_stores.py
+          tests/integration/test_application_persistence_runtime.py
+          tests/integration/test_backup_restore.py
+          -q

.gitignore

@@ -7,5 +7,6 @@ __pycache__/
 .ruff_cache/
 .hermes/
 graphify-out/
+artifacts/
 *.pyc
 .DS_Store

alembic.ini

@@ -0,0 +1,28 @@
+[alembic]
+script_location = app/db/migrations
+prepend_sys_path = .
+path_separator = os
+version_path_separator = os
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys =
+
+[formatters]
+keys =
+
+[logger_root]
+level = WARN
+handlers =
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic

app/api/core_router.py

@@ -0,0 +1,7 @@
+from fastapi import APIRouter
+
+from app.api.legacy_handlers import route_declarations
+from app.api.route_registry import register_domain_routes
+
+router = APIRouter()
+register_domain_routes(router, route_declarations, "core", __name__)

app/api/direct_extensions_router.py

@@ -0,0 +1,7 @@
+from fastapi import APIRouter
+
+from app.api.legacy_handlers import route_declarations
+from app.api.route_registry import register_domain_routes
+
+router = APIRouter()
+register_domain_routes(router, route_declarations, "direct_extensions", __name__)

app/api/direct_router.py

@@ -0,0 +1,7 @@
+from fastapi import APIRouter
+
+from app.api.legacy_handlers import route_declarations
+from app.api.route_registry import register_domain_routes
+
+router = APIRouter()
+register_domain_routes(router, route_declarations, "direct", __name__)