Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "v32 (b47b27c)",
+ "current": "v33 (2b115e5)",
  "releases": [
+  {
+   "version": "v33",
+   "sha": "2b115e5",
+   "date": "2026-08-21",
+   "subject": "W39: stop nonproduction Postgres background egress"
+  },
   {
    "version": "v32",
    "sha": "b47b27c",

VERSION

@@ -1 +1 @@
-v32 (b47b27c)
+v33 (2b115e5)

api/automation_engine.py

@@ -14551,6 +14551,23 @@ def tick(rt, tenant, now=None, log=print):
     return started
 
 
+def _pg_tick_refusal(tenant_slug, backend=None, write_refusal=None):
+    """The Pg write wall, before a background tick reads a tenant's whole workspace.
+
+    A non-production Pg Space may display tenant #0, but its recurring automation work has no
+    durable destination there.  The tick would otherwise fetch ``user_tables`` several times per
+    minute merely to discover that its first update is refused.  This applies to both scheduler
+    and authenticated external-tick callers; HF remains untouched and a granted QA tenant passes.
+    """
+    actual_backend = backend if backend is not None else os.environ.get("STORE_BACKEND", "hf")
+    if str(actual_backend).strip().lower() != "pg":
+        return None
+    if write_refusal is None:
+        import core.store_pg as _pg
+        write_refusal = _pg.write_refusal
+    return write_refusal(str(tenant_slug))
+
+
 def tick_all(now=None, log=print):
     """Every registered tenant. Fail-quiet per tenant: one tenant's broken store must not stop
     the others' schedules."""
@@ -14558,6 +14575,10 @@ def tick_all(now=None, log=print):
     out = {}
     for slug in _rt.known_tenants():
         try:
+            refusal = _pg_tick_refusal(slug)
+            if refusal:
+                log(f"[aios-auto] tick {slug} skipped before runtime read: {refusal}")
+                continue
             out[slug] = tick(_rt.get_runtime(slug), slug, now=now, log=log)
         except Exception as e:                                    # noqa: BLE001
             log(f"[aios-auto] tick {slug} skipped: {type(e).__name__}: {e}")

api/main.py

@@ -603,6 +603,11 @@ def _migrate_env_odoo(why):
     three different operator actions and a blank Keychain page cannot tell them apart.
     """
     try:
+        refusal = _pg_write_refusal("royal-imports")
+        if refusal:
+            print(f"[aios-api] odoo keychain migration skipped ({why}) before user_tables read: "
+                  f"this deployment cannot persist royal-imports ({refusal})")
+            return
         import routes_keychain as _kc_routes
         from harness import runtime as _runtime
         rep = _kc_routes.migrate_env_odoo(_runtime.get_runtime("royal-imports"))
@@ -690,6 +695,49 @@ def _rebuild_meta_relational(why, rt, previous_fingerprint=None, force_relations
                 "changed": True, "applied": False, "written": {}}
 
 
+def _pg_write_refusal(tenant_slug, backend=None, write_refusal=None):
+    """The existing Pg write wall, available *before* a costly runtime read.
+
+    A non-production Pg Space may read tenant #0 so it can display the real workspace, but it
+    may not persist to it.  A relational refresh is a guaranteed write: letting it first call
+    ``rt.get('user_tables')`` transfers the entire document merely to discover the refusal at
+    ``rt.update``.  This is not a new authorisation rule.  It queries the shipping Pg rule before
+    the read, and is intentionally a no-op for the HF backend.
+
+    ``backend`` and ``write_refusal`` are narrow injection seams for the no-network W39 witness;
+    normal callers use the exact deployment environment and ``core.store_pg.write_refusal``.
+    """
+    actual_backend = (backend if backend is not None
+                      else os.environ.get("STORE_BACKEND", "hf"))
+    if str(actual_backend).strip().lower() != "pg":
+        return None
+    if write_refusal is None:
+        import core.store_pg as _pg
+        write_refusal = _pg.write_refusal
+    return write_refusal(str(tenant_slug))
+
+
+_NONPROD_PG_SYNC_EVERY_ENV = "AIOS_NONPROD_PG_SYNC_EVERY"
+
+
+def _nonprod_pg_sync_seconds(preset=None, backend=None, write_refusal=None):
+    """A deployment-only idle cadence for a Pg Space that cannot write tenant #0.
+
+    Staging deliberately reads the real tenant, but its write wall means it must never persist
+    tenant #0's connector setting. Reading that setting every half hour costs a full
+    ``user_tables`` transfer. The opt-in secret therefore accepts exactly ``daily`` and asks the
+    same write wall *before* building a runtime. Production, HF, an unset secret and any typo
+    all retain the shipping tenant-configured cadence.
+    """
+    raw = preset if preset is not None else os.environ.get(_NONPROD_PG_SYNC_EVERY_ENV, "")
+    if str(raw).strip().lower() != "daily":
+        return None
+    if not _pg_write_refusal("royal-imports", backend=backend,
+                             write_refusal=write_refusal):
+        return None
+    return 86400
+
+
 def _sweep_automation_schemas(why):
     """⛔⛔ WAVE 32 · `W32-T07` — MAKE D'S DECLARATIONS REACH TENANTS THAT ALREADY HAVE THE TABLES.
 
@@ -744,6 +792,11 @@ def _sweep_automation_schemas(why):
         return
     for slug in tenants:
         try:
+            refusal = _pg_write_refusal(slug)
+            if refusal:
+                print(f"[aios-api] schema sweep ({why}) {slug}: skipped before user_tables read "
+                      f"because this deployment cannot persist that tenant ({refusal})")
+                continue
             rt = _runtime.get_runtime(slug)
             # ⛔⛔ FIXED 2026-08-13 — THIS SWEEP WAS SPAWNING EIGHT DATABASES IN EVERY TENANT.
             # Owner: *"Database for Royal Imports, why we have fucking IG and TIktok databases."*
@@ -831,6 +884,11 @@ def _rebuild_odoo_relational(why, previous_meta_fingerprint=None, meta_state_out
         from harness import runtime as _runtime
         if not _rel.is_royal("royal-imports"):
             return False
+        refusal = _pg_write_refusal("royal-imports")
+        if refusal:
+            print(f"[aios-api] odoo relational rebuild skipped ({why}) before user_tables read: "
+                  f"this deployment cannot persist royal-imports ({refusal})")
+            return False
         _rt = _runtime.get_runtime("royal-imports")
         counts = _rel.refresh(_rt, "royal-imports")
         # ⭐⭐ AND THEN COMPUTE THE CELLS, which `refresh` does NOT do.
@@ -979,15 +1037,21 @@ def _store_resync_loop():
         _every = 1800
         _manual = False
         try:
-            import odoo_relational as _rel_cad
-            from harness import runtime as _rt_cad
-            # ⚠ D-245, KNOWN AND NOT FIXED HERE: the slug is hardcoded, so this reads TENANT #0's
-            # cadence and applies it to a loop that syncs the shared mirror. Correct while one
-            # tenant has Odoo; wrong the moment a second one does. Out of this ticket's scope and
-            # named rather than silently inherited.
-            _secs = _rel_cad.sync_seconds(_rt_cad.get_runtime("royal-imports"))
-            _manual = _secs is None
-            _every = 1800 if _secs is None else max(int(_secs), 60)
+            _stage_every = _nonprod_pg_sync_seconds()
+            if _stage_every is not None:
+                _every = _stage_every
+                print("[aios-api] resync cadence uses deployment-only daily override for "
+                      "non-production Postgres")
+            else:
+                import odoo_relational as _rel_cad
+                from harness import runtime as _rt_cad
+                # ⚠ D-245, KNOWN AND NOT FIXED HERE: the slug is hardcoded, so this reads TENANT #0's
+                # cadence and applies it to a loop that syncs the shared mirror. Correct while one
+                # tenant has Odoo; wrong the moment a second one does. Out of this ticket's scope and
+                # named rather than silently inherited.
+                _secs = _rel_cad.sync_seconds(_rt_cad.get_runtime("royal-imports"))
+                _manual = _secs is None
+                _every = 1800 if _secs is None else max(int(_secs), 60)
         except Exception:                                     # noqa: BLE001
             pass
         _t.sleep(_every)
@@ -1091,6 +1155,11 @@ def _prewarm():
     import threading as _th
     _th.Thread(target=_seed_and_sync_store, daemon=True, name="store-seed-sync").start()
     try:
+        refusal = _pg_write_refusal("royal-imports")
+        if refusal:
+            print("[aios-api] eager user_tables warm skipped before runtime read: this "
+                  f"deployment cannot persist royal-imports ({refusal})")
+            return
         from harness import runtime as _runtime
         rt = _runtime.get_runtime("royal-imports")
         routes_customers.warm_default(rt)

api/routes_automation.py

@@ -1745,6 +1745,12 @@ async def automation_hook(auto_id: str, token: str, request: Request):
                       "message": "no automation with that id and token"})
         for slug in _rt.known_tenants():
             try:
+                # A non-production Pg Space may display tenant #0 but can never persist an
+                # automation webhook there.  Skip before building its runtime, exactly as the
+                # scheduler/tick path does; a skipped tenant remains indistinguishable from an
+                # unknown hook to this unauthenticated caller.
+                if engine._pg_tick_refusal(slug):
+                    continue
                 rt = _rt.get_runtime(slug)
             except Exception:                                     # noqa: BLE001
                 continue