fix(ci): guard each live Postgres contract invocation

CHANGELOG.md

@@ -12,6 +12,14 @@ Releases before `0.2.5` predate the public launch; their notes live in the
 
 ## [Unreleased]
 
+### Fixed
+
+- Guard each live PostgreSQL test invocation independently, including the CLI
+  anchor exit-code contract, and run that CLI contract in both local CI paths.
+  Missing ignore flags, unresolved test filters, missing contract targets and
+  disabled required-database settings now fail the guard. Quoted step labels
+  cannot substitute for the arguments that actually execute (#362).
+
 ## [0.14.0] — 2026-09-07
 
 The middle digit moves because an exit code changed. `sysknife audit checkpoint`

docs/developer-guide.md

@@ -139,6 +139,8 @@ podman run -d --name sysknife-pg -p 55987:5432 \
 export SYSKNIFE_TEST_POSTGRES_URL=postgres://sysknife:sysknife@127.0.0.1:55987/sysknife_test
 export SYSKNIFE_REQUIRE_POSTGRES=1
 cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored
+cargo test -p sysknife-cli --test cli_smoke --locked \
+  audit_verify_exits_with_code_1_when_anchor_is_truncated -- --ignored --exact
 
 podman rm -f sysknife-pg
 ```

scripts/ci-local.sh

@@ -336,7 +336,7 @@ run_security_group() {
 
 run_postgres_contract_group() {
     printf '\n### postgres-contract (optional)\n'
-    local label="postgres-contract: cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored"
+    local label="postgres-contract: live Postgres contract (store + CLI anchor exit code)"
 
     if [[ "$run_postgres" != true ]]; then
         record SKIP "${label} (--no-postgres)"
@@ -345,7 +345,12 @@ run_postgres_contract_group() {
 
     if [[ -n "${SYSKNIFE_TEST_POSTGRES_URL:-}" ]]; then
         SYSKNIFE_REQUIRE_POSTGRES=1 \
-            run_step "$label" cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored
+            run_step "postgres-contract: cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored" \
+            cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored
+        SYSKNIFE_REQUIRE_POSTGRES=1 \
+            run_step "postgres-contract: cargo test -p sysknife-cli --test cli_smoke --locked audit_verify_exits_with_code_1_when_anchor_is_truncated -- --ignored --exact" \
+            cargo test -p sysknife-cli --test cli_smoke --locked \
+            audit_verify_exits_with_code_1_when_anchor_is_truncated -- --ignored --exact
         return
     fi
 
@@ -386,9 +391,16 @@ run_postgres_contract_group() {
         sleep "$POSTGRES_HEALTH_INTERVAL_SECS"
     done
 
-    SYSKNIFE_TEST_POSTGRES_URL="postgres://sysknife:sysknife@127.0.0.1:${POSTGRES_HOST_PORT}/sysknife_test?sslmode=disable" \
+    local container_url="postgres://sysknife:sysknife@127.0.0.1:${POSTGRES_HOST_PORT}/sysknife_test?sslmode=disable"
+    SYSKNIFE_TEST_POSTGRES_URL="$container_url" \
+    SYSKNIFE_REQUIRE_POSTGRES=1 \
+        run_step "postgres-contract: cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored" \
+        cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored
+    SYSKNIFE_TEST_POSTGRES_URL="$container_url" \
     SYSKNIFE_REQUIRE_POSTGRES=1 \
-        run_step "$label" cargo test -p sysknife-daemon --test postgres_store --locked -- --include-ignored
+        run_step "postgres-contract: cargo test -p sysknife-cli --test cli_smoke --locked audit_verify_exits_with_code_1_when_anchor_is_truncated -- --ignored --exact" \
+        cargo test -p sysknife-cli --test cli_smoke --locked \
+        audit_verify_exits_with_code_1_when_anchor_is_truncated -- --ignored --exact
 
     "$runtime" rm -f "$POSTGRES_CONTAINER_NAME" >/dev/null 2>&1 || true
 }