/docs REPO_STATUS: FK inference (FK-less dedorch catalog) + shared Fernet-key gotcha

REPO_STATUS.md

@@ -2,7 +2,7 @@
 
 **Audience:** teammates onboarding onto the Python repo (`Agentic-Service-Data-Eyond-Catalog`).
 **Scope:** what the code does **right now** (branch `pr/4`, ticket KM-652). Describes current state only — no roadmap or to-dos.
-**Snapshot date:** 2026-06-25. **Data-layer reconcile 2026-07-01:** §8/§12 updated — dedorch cutover done, `data_catalog` model reconciled. **Cross-repo update 2026-06-29:** §2/§8/§11/§12 re-verified against
+**Snapshot date:** 2026-06-25. **Data-layer reconcile 2026-07-01:** §8/§12 updated — dedorch cutover done, `data_catalog` model reconciled. **Query-path fix 2026-07-02:** §8/§13 — dedorch catalogs ship no FKs → Python infers them (`fk_inference.py`); shared-Fernet-key gotcha documented. **Cross-repo update 2026-06-29:** §2/§8/§11/§12 re-verified against
 the **Go source** (`Orchestrator-Agent-Service`), not its docs. The Go service has moved well past its
 own (uncommitted, stale) design docs: it now hosts the **dedorch SQL migrations** in-repo and a full
 **`/api/v1/analyses` + `/api/v1/skills`** REST surface. Go does **not** call Python yet — those skills
@@ -199,6 +199,8 @@ unless `SKIP_INIT_DB=true`.
 **Catalog shape** (the jsonb in `data_catalog`):
 `Catalog → Source[ {source_id, source_type ∈ schema|tabular|unstructured, name, location_ref} → Table[ {table_id, name, row_count, foreign_keys[]} → Column[ {column_id, name, data_type, nullable, pii_flag, sample_values|null, stats} ] ] ]`. PII columns have `sample_values: null` so real values never enter prompts.
 
+> ⚠️ **dedorch catalogs ship empty `foreign_keys`** (Go's introspection drops FK constraints), yet the IR validator only allows FK-backed joins — so every cross-table question failed validation until 2026-07-02. `src/catalog/fk_inference.py` (wired into `CatalogStore.get`) now infers the obvious `<base>_id → <table>.id` edges at read time: conservative (single unambiguous target, matching `data_type`, schema sources only) and **self-disabling** once any real FK is present. It's a **stopgap** — the durable fix is Go emitting real FKs during introspection.
+
 **QueryIR shape** (`src/query/ir/models.py`):
 `{ source_id, table_id, joins[], select[], filters[], group_by[], order_by[], limit }`.
 Joins are single-level equi-joins to a related table **in the same source**, FK-backed,
@@ -358,6 +360,13 @@ records-based report; floor: ≥1 `analyze_*` success). Wiring Go → Python is
   values are always parameterized.
 - **Settings aliases:** `.env` uses double-underscore names (`azureai__api_key__4o`); `Settings`
   exposes them as `azureai_api_key_4o`.
+- **Shared Fernet key across repos (gotcha).** User DB credentials in `databases` are written +
+  encrypted by **Go** and decrypted by Python; both read the **same** env var
+  `dataeyond__db__credential__key` (Go: `configs/app.yaml` → `credentials.fernet_key`). The two
+  deployments MUST hold the **identical value** or Python's decrypt throws
+  `cryptography.fernet.InvalidToken` — whose `str()` is **empty**, so it logged as `error=""` and
+  masqueraded as a DB-connection failure (the executor now logs `repr(e)` to expose it). Tell-apart:
+  a valid-but-wrong key → `InvalidToken`; a malformed key → a non-empty `ValueError` at cipher build.
 - **Never-throw seams** are pervasive (tool invoker, query service, executors, state/binding reads,
   record persistence, report summary). Failures degrade into soft output rather than raising — good
   for UX, but they can mask real breakage (e.g. a binding silently fail-opening to the full catalog).