test+arch: unblock production gate (import SSOT + isolated test DSN)

arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.

7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/auth/pg_store_test.go

@@ -16,7 +16,8 @@ func openTestPool(t *testing.T) *pgxpool.Pool {
 	t.Helper()
 	dsn := os.Getenv("TEST_DATABASE_URL")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
+		return nil
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()

internal/ctxmgr/chat_window_test.go

@@ -3,6 +3,7 @@ package ctxmgr_test
 import (
 	"context"
 	"fmt"
+	"os"
 	"testing"
 	"time"
 
@@ -238,7 +239,14 @@ func TestChatWindow_MemoryEquivalenceAndPagination(t *testing.T) {
 }
 
 func TestChatWindow_DatabaseIntegration(t *testing.T) {
-	dsn := "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+	dsn := os.Getenv("CONTEXT_DB_DSN")
+	if dsn == "" {
+		dsn = os.Getenv("TEST_DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("CONTEXT_DB_DSN or TEST_DATABASE_URL must be set (refusing default dev database)")
+		return
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 

internal/ctxmgr/manager_test.go

@@ -130,7 +130,11 @@ func TestContextManager_TimeDecayActivities(t *testing.T) {
 func TestContextManager_DatabaseIntegration(t *testing.T) {
 	dsn := os.Getenv("CONTEXT_DB_DSN")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		dsn = os.Getenv("TEST_DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("CONTEXT_DB_DSN or TEST_DATABASE_URL must be set (refusing default dev database)")
+		return
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)

internal/notification/service_test.go

@@ -16,7 +16,7 @@ func openPool(t *testing.T) *pgxpool.Pool {
 	t.Helper()
 	dsn := os.Getenv("TEST_DATABASE_URL")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()

internal/server/project_members_authz_test.go

@@ -19,7 +19,8 @@ func openPGPool(t *testing.T) *pgxpool.Pool {
 	t.Helper()
 	dsn := os.Getenv("TEST_DATABASE_URL")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
+		return nil
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()

internal/storage/cas_db_test.go

@@ -12,7 +12,11 @@ import (
 func TestCAS_DatabaseIntegration(t *testing.T) {
 	dsn := os.Getenv("CONTEXT_DB_DSN")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		dsn = os.Getenv("TEST_DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("CONTEXT_DB_DSN or TEST_DATABASE_URL must be set (refusing default dev database)")
+		return
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)

internal/taskrun/store_lease_pg_test.go

@@ -16,7 +16,8 @@ func openLeaseTestPool(t *testing.T) *pgxpool.Pool {
 	t.Helper()
 	dsn := os.Getenv("TEST_DATABASE_URL")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
+		return nil
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()