promote: dev → uat (GRO-2687 /api/readyz DB health check)

Merging dev→uat after QA approval (Lint Roller). All 6 CI checks green.

.mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "gitea": {
-      "type": "http",
-      "url": "https://git-mcp.farh.net/mcp",
-      "headers": {
-        "Authorization": "Bearer ${GITEA_TOKEN}"
-      }
-    }
-  }
-}

AGENTS.md

@@ -0,0 +1,54 @@
+# AGENTS.md
+
+This repository (`groombook/api`) is part of the GroomBook application stack. The
+authoritative process, quality bar, and safety rules live in the shared
+[`groombook/org`](https://git.farh.net/groombook/org) skills repository. Read
+those first; this file is only a pointer.
+
+## Authoritative skills
+
+- **SDLC (branching, PRs, phases, handoffs):**
+  [`groombook/org/skills/sdlc/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/sdlc/SKILL.md)
+- **Coding standards (priority ordering, PR discipline, tests, no-hardcoded-values, CalVer):**
+  [`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md)
+- **Safety (no plaintext secrets, no direct `kubectl apply` to `groombook`, no self-merge, board approval for destructive actions):**
+  [`groombook/org/skills/safety/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/safety/SKILL.md)
+
+For human contributors and humans reviewing agent work, see
+[`CONTRIBUTING.md`](./CONTRIBUTING.md) in this repo for the phase-by-phase PR
+flow and the `uat→main` merge-gate policy summary.
+
+## Non-negotiable operational rules
+
+These mirror the org skills; they are restated here so any agent landing in
+this repo sees them without a cross-repo fetch.
+
+- **All changes go through a PR.** Never push directly to `dev`, `uat`, or `main`.
+- **Branch strategy:** `feature/<name>` → `dev` → `uat` → `main`. Engineers
+  always target `dev` first.
+- **No self-merge contract.** The engineer who opened a PR clicks merge only
+  after the named reviewer (CI / QA / UAT / Security / CTO per phase)
+  approves. Issue-thread QA / UAT / security approvals do **not** clear the
+  Gitea `required_approvals` gate on `uat→main` — only a Gitea **Approve**
+  click from a member of the `approvals_whitelist_username` does. On this
+  repo that whitelist is `["gb_flea", "gb_dogfather"]` (engineer team).
+  Board-level accounts cannot give the Approve click by policy.
+- **Always include `cc @cpfarhood`** at the bottom of every PR body for
+  board visibility (not as a reviewer).
+- **Secrets in code are forbidden.** Use Bitnami Sealed Secrets; never commit
+  plaintext. See the `safety` skill.
+- **Production (`groombook` namespace) is Flux-managed.** Never
+  `kubectl apply` directly. Infrastructure changes go through PRs in
+  `groombook/infra`.
+
+## Local development
+
+See the repo's own README, package scripts, and CI workflow. The
+authoritative pipeline (Gitea Actions, image build, deploy hooks) is the
+shared `groombook/infra` overlay; do not reimplement it here.
+
+## When uncertain
+
+If a task conflicts with the org skills, **the org skills win**. Open an
+issue in `groombook/org` to propose a change rather than encoding a local
+exception.

CONTRIBUTING.md

@@ -0,0 +1,117 @@
+# Contributing to `groombook/api`
+
+Thanks for contributing. This document is the human-facing companion to
+[`AGENTS.md`](./AGENTS.md) and the authoritative
+[`groombook/org`](https://git.farh.net/groombook/org) skills. The org skills
+govern; this file is a quick-reference for the human/agent PR flow in this
+repo.
+
+## Branch strategy
+
+Three long-lived branches; one PR per promotion step.
+
+| Branch  | Environment | Who merges | Prerequisites for merge |
+|---------|-------------|-----------|-------------------------|
+| `dev`   | Dev         | Engineer  | CI passes               |
+| `uat`   | UAT         | Engineer  | QA code review approval |
+| `main`  | Production  | Engineer  | UAT validation + CTO Gitea Approve when the `uat→main` merge-gate policy applies (see below) |
+
+Engineers always target `dev` first. Feature branches: `<agent-name>/<short-description>`.
+
+## Phase-by-phase PR flow
+
+### Phase 1 — Dev
+
+1. Branch from `dev`: `git checkout -b <name>/<short-description> origin/dev`.
+2. Write code + tests. Run unit tests, type check, and lint locally (or rely on CI).
+3. Open a PR against `dev`:
+   ```bash
+   tea pr create --base dev --title "..." --body "..."
+   ```
+   Include `cc @cpfarhood` at the bottom of the body for board visibility.
+4. CI must pass. CI green → engineer self-merges.
+5. CI builds and deploys to Dev automatically.
+
+### Phase 2 — UAT promotion
+
+1. Open a PR from `dev` to `uat`.
+2. CI must pass.
+3. **QA (Lint Roller)** reviews and approves on the Gitea PR.
+4. QA approved → engineer self-merges.
+5. CI builds and deploys to UAT automatically.
+
+### Phase 3 — UAT regression + Security review
+
+1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every
+   feature, old and new, no exceptions.
+2. **Security (Barkley Trimsworth)** reviews the changes.
+3. Failures in either gate bounce back to Phase 1.
+
+### Phase 4 — Production promotion (`uat → main`)
+
+This is the gate the org PR
+[`groombook/org#13`](https://git.farh.net/groombook/org/pulls/13) defines.
+The full rule is in
+[`groombook/org/skills/sdlc/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/sdlc/SKILL.md)
+and
+[`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md);
+the summary is below.
+
+**The CTO Gitea Approve click is NOT the default gate.** Once the four
+pre-gates (QA, UAT deploy, UAT regression, security) are green, the engineer
+self-merges.
+
+**A CTO Gitea Approve click IS required** only for PRs in one of three
+categories:
+
+1. **Novel auth / session paths** — login, OIDC, OOBE, session middleware,
+   token issuance, password reset, MFA, new auth provider integrations.
+   Routine auth-gated UI (button styling, error messages, form layout) is
+   **not** in this category.
+2. **Infra / prod-affecting merges** — deploys, infra manifests, secrets,
+   GitOps overlays, CI/CD, `main` branch protection, production
+   routing/ingress, prod state mutations. All Phase 5 infra overlay PRs in
+   `groombook/infra` require CTO Gitea Approve without exception.
+3. **Risk-flagged merges** — `risk:cto-approve` label, or explicit CTO/CEO
+   sign-off request in the PR or issue thread.
+
+The engineer opens the `uat→main` PR, classifies it against the three
+categories above, and adds `cc @cpfarhood`. If the PR is in scope, the CTO
+clicks Approve; once approved (and the four pre-gates are green), the
+engineer merges.
+
+### Phase 5 — Production deployment
+
+A separate PR in `groombook/infra` bumps the overlay image tag for prod.
+Handed to QA (Lint Roller) for review, then self-merged by the engineer.
+
+## The four pre-gates (uat→main)
+
+A `uat→main` PR is mergeable when **all four** are green:
+
+1. **QA code review** — done on the dev→uat promotion PR.
+2. **UAT deploy** — the UAT image built from the uat tip is live in UAT.
+3. **UAT regression** — Shedward's full-feature UAT pass is green (no
+   pre-existing defects, no new defects).
+4. **Security review** — Barkley's security code review is green.
+
+Issue-thread QA / UAT / security approvals do **not** clear the Gitea
+`required_approvals` gate. Only a Gitea **Approve** click from a member of
+the `approvals_whitelist_username` for `main` clears it. In this repo that
+whitelist is the engineer team (`gb_flea`, `gb_dogfather`).
+
+## Style, tests, and quality bar
+
+See
+[`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md)
+for the engineering priority ordering, test requirements, no-hardcoded-values
+rules, CalVer versioning policy, and the `git.farh.net` container registry
+policy.
+
+## Safety
+
+See
+[`groombook/org/skills/safety/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/safety/SKILL.md)
+for the non-negotiable rules: no plaintext secrets, no `kubectl apply` to
+`groombook`, no self-merge, no direct `tofu` runs, board approval for
+destructive actions, escalation protocol.

UAT_PLAYBOOK.md

@@ -196,7 +196,6 @@ Geocoding turns a client's street address into `latitude`/`longitude` + `geocode
 | TC-API-3.27 | Verify coat_type enum has all seed values | After UAT seed completes, inspect the coat_type enum on the UAT DB — it must contain: short, medium, long, double, wire, silky, curly, hairless | UAT seed jobs (`reset-demo-data`, `seed-test-data`) complete 1/1 with no `enum_in` error; coat_type includes all 8 values used by seed.ts `coatTypePool` |
 | TC-API-3.28 | Verify pet_size_category enum has all seed values | After UAT seed completes, inspect the pet_size_category enum on the UAT DB — it must contain: small, medium, large, extra_large | UAT seed jobs (`reset-demo-data`, `seed-test-data`) complete 1/1 with no `enum_in` error; pet_size_category includes all 4 values used by seed.ts `petSizeCategoryPool` (regression for GRO-1999, mirrors TC-API-3.27) |
 | TC-API-3.29 | Verify `reset-demo-data` CronJob does not fail with FK 23503 on `invoice_tip_splits` (GRO-2123) | Trigger the CronJob manually: `kubectl create job --from=cronjob/reset-demo-data verify-gro2123 -n groombook-uat`. Wait for pod to terminate. Inspect logs: `kubectl logs -n groombook-uat -l job-name=verify-gro2123` | Pod reaches `Completed` state; logs show `✓ Acquired seed advisory lock` and `✓ Released seed advisory lock` from `seed.ts`; no `PostgresError: … violates foreign key constraint "invoice_tip_splits_invoice_id_invoices_id_fk"` (code 23503); final counts unchanged (500 clients, ~4000 invoices) |
-| TC-API-3.30 | Verify `reset-demo-data` CronJob is schema-safe — TRUNCATE only, no DDL drops (GRO-2722) | 1. Trigger: `kubectl -n groombook-uat create job --from=cronjob/reset-demo-data reset-verify-$(date +%s) --dry-run=client -o name \| xargs kubectl -n groombook-uat apply -f -` or simply `kubectl -n groombook-uat create job --from=cronjob/reset-demo-data reset-verify-$(date +%s)`. 2. Wait for job completion: `kubectl -n groombook-uat wait job/reset-verify-<ts> --for=condition=complete --timeout=300s`. 3. Check logs: `kubectl -n groombook-uat logs job/reset-verify-<ts>`. 4. Verify schema survival: `kubectl -n groombook-uat exec deploy/api -- psql $DATABASE_URL -c "\dt public.*"` and `kubectl -n groombook-uat exec deploy/api -- psql $DATABASE_URL -c "\dt drizzle.*"`. 5. Verify readyz: `curl -s https://uat.groombook.dev/api/readyz` | Job reaches `Completed` (exit 0); logs show `✓ All public tables truncated, sequences reset` — no `DROP TABLE`/`DROP TYPE`/`DROP SCHEMA` in output; all `public.*` tables still present after reset; `drizzle.__drizzle_migrations` still populated (row count unchanged); `https://uat.groombook.dev/api/readyz` returns HTTP 200; demo data reseeded (500 clients visible via GET /api/clients) |
 
 ### 4.4 Appointment Scheduling
 

apps/api/src/__tests__/authProvider.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach } from "vitest";
 import { Hono } from "hono";
 import { authProviderRouter } from "../routes/authProvider.js";
 
@@ -227,7 +227,6 @@ describe("PUT /admin/auth-provider", () => {
 
 describe("POST /admin/auth-provider/test", () => {
   beforeEach(resetMock);
-  afterEach(() => vi.restoreAllMocks());
 
   it("returns ok=false for unreachable issuer", async () => {
     const app = makeApp(mockSuperUser);
@@ -243,12 +242,7 @@ describe("POST /admin/auth-provider/test", () => {
     expect(body.error).toBeTruthy();
   }, 15000); // timeout must exceed the 10s fetch timeout in the route handler
 
-  it("returns 200 when clientSecret is omitted (not required by test-connection schema)", async () => {
+  it("returns 400 for missing clientSecret (not required for test)", async () => {
-    // Mock fetch so the route does not make a real network request.
-    vi.spyOn(global, "fetch").mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ issuer: "https://auth.example.com" }),
-    } as Response);
     const app = makeApp(mockSuperUser);
     const { status } = await post(app, "/admin/auth-provider/test", {
       providerId: "authentik",
@@ -256,7 +250,7 @@ describe("POST /admin/auth-provider/test", () => {
       issuerUrl: "https://auth.example.com",
       clientId: "client",
     }, mockSuperUser);
-    expect(status).toBe(200);
+    expect(status).toBe(200); // clientSecret omitted intentionally for test
   });
 });
 

apps/api/src/db/reset.ts

@@ -1,17 +1,10 @@
 /**
- * reset.ts — Truncate all public tables and restart identity sequences.
+ * reset.ts — Drop all application tables and re-run migrations + seed.
  *
- * Schema-safe: never issues destructive DDL against any schema.
+ * Intended for local development only. Never run against production.
- * The drizzle schema and __drizzle_migrations table are preserved so
- * drizzle-kit migrate remains a no-op on an already-migrated DB.
- *
- * NOTE: this file is NOT the deployed reset entrypoint — the reset image
- * builds from packages/db and runs `pnpm --filter @groombook/db reset`.
- * apps/api db:reset delegates there too (see apps/api/package.json).
- * Keep in sync with packages/db/src/reset.ts (GRO-2722).
  *
  * Usage:
- *   DATABASE_URL=postgres://... npx tsx apps/api/src/db/reset.ts
+ *   DATABASE_URL=postgres://... npx tsx packages/db/src/reset.ts
  */
 
 import postgres from "postgres";
@@ -30,30 +23,43 @@ async function reset() {
 
   const client = postgres(url, { max: 1 });
 
-  console.log("Truncating all public tables...\n");
+  console.log("Dropping all application tables...\n");
 
-  // Enumerate all base tables in the public schema dynamically, then
+  // Drop in dependency order (children before parents)
-  // issue a single TRUNCATE with RESTART IDENTITY CASCADE so FK cycles
+  await client`
-  // are not a problem. The drizzle schema and __drizzle_migrations are
+    DO $$ DECLARE
-  // intentionally excluded (different schema) so drizzle-kit migrate
+      r RECORD;
-  // stays a no-op on an already-migrated DB.
+    BEGIN
-  const tables = await client<{ tablename: string }[]>`
+      FOR r IN (
-    SELECT tablename FROM pg_tables
+        SELECT tablename FROM pg_tables
-    WHERE schemaname = 'public'
+        WHERE schemaname = 'public'
+      ) LOOP
+        EXECUTE 'DROP TABLE IF EXISTS public.' || quote_ident(r.tablename) || ' CASCADE';
+      END LOOP;
+    END $$;
   `;
 
-  if (tables.length > 0) {
+  // Drop custom enums
-    // Double-quote each identifier (escaping embedded quotes) to handle
+  await client`
-    // any table name safely without a pg-specific quote_ident helper.
+    DO $$ DECLARE
-    const tableList = tables
+      r RECORD;
-      .map((t) => `"${t.tablename.replace(/"/g, '""')}"`)
+    BEGIN
-      .join(", ");
+      FOR r IN (
-    await client.unsafe(
+        SELECT typname FROM pg_type
-      `TRUNCATE ${tableList} RESTART IDENTITY CASCADE`,
+        WHERE typtype = 'e' AND typnamespace = (
-    );
+          SELECT oid FROM pg_namespace WHERE nspname = 'public'
-  }
+        )
+      ) LOOP
+        EXECUTE 'DROP TYPE IF EXISTS ' || quote_ident(r.typname) || ' CASCADE';
+      END LOOP;
+    END $$;
+  `;
 
-  console.log("✓ All public tables truncated, sequences reset\n");
+  // Drop the drizzle migrations tracking table
+  await client`DROP TABLE IF EXISTS drizzle.__drizzle_migrations CASCADE`;
+  await client`DROP SCHEMA IF EXISTS drizzle CASCADE`;
+
+  console.log("✓ All tables and enums dropped\n");
 
   await client.end();
 }

packages/db/src/reset.ts

@@ -1,14 +1,15 @@
 /**
- * reset.ts — Truncate all public tables and restart identity sequences.
+ * reset.ts — Drop all application tables, re-run migrations, and re-seed.
  *
- * Schema-safe: never issues destructive DDL against any schema.
+ * Intended for local development only. Never run against production.
- * The drizzle schema and __drizzle_migrations table are preserved so
- * drizzle-kit migrate remains a no-op on an already-migrated DB.
  *
- * GRO-2139: the entire truncate→migrate→seed chain runs inside a single
+ * Usage:
+ *   DATABASE_URL=postgres://... npx tsx packages/db/src/reset.ts
+ *
+ * GRO-2139: the entire drop→migrate→seed chain runs inside a single
  * Postgres advisory lock (SEED_ADVISORY_LOCK_KEY) so a concurrent
  * `seed.ts` (e.g. the dev `seed-test-data-*` Job being recreated at
- * the top of the hour) cannot interleave between `reset.ts` (TRUNCATE)
+ * the top of the hour) cannot interleave between `reset.ts` (DROP)
  * and `seed.ts` (TRUNCATE+insert) and collide on `invoices_pkey`.
  *
  * Why this matters: `seed.ts` derives every primary key from a single
@@ -21,14 +22,10 @@
  * GRO-2123 added the advisory lock around `runSeedBody` but left
  * `reset.ts` and `drizzle-kit migrate` outside the lock. This script
  * now wraps the *whole* chain in the same lock: `withSeedAdvisoryLock`
- * pins the lock to one reserved session and the TRUNCATE → migrate → seed
+ * pins the lock to one reserved session and the DROP → migrate → seed
  * work runs on the rest of the pool, so the lock guarantees mutual
  * exclusion against any concurrent seeder for the entire chain.
  *
- * For a full local schema teardown (nuke tables, enums, drizzle schema)
- * use `pnpm --filter @groombook/db db:nuke` instead — never change this
- * script to be destructive (GRO-2722 / GRO-2678 prod incident).
- *
  * See: groombook/infra `apps/base/reset-cronjob.yaml` (CronJob) and
  * `apps/base/seed-job.yaml` (one-shot Job) — both invoke the same
  * `seed.ts` code path on the same database in `groombook-dev`.
@@ -70,7 +67,7 @@ async function reset() {
   // Pool sizing is load-bearing here. `withSeedAdvisoryLock` does
   // `pool.reserve()` to pin the advisory lock to one dedicated session
   // (a session-level lock released on a *different* pooled connection is
-  // a no-op), and the TRUNCATE / migrate / seed work then runs on the
+  // a no-op), and the DROP / migrate / seed work then runs on the
   // *remaining* pooled connections. The lock provides mutual exclusion
   // across processes regardless of how many connections the work uses —
   // it does NOT require the work to share the lock's session.
@@ -85,30 +82,43 @@ async function reset() {
 
   try {
     await withSeedAdvisoryLock(client, async () => {
-      console.log("Truncating all public tables...\n");
+      console.log("Dropping all application tables...\n");
 
-      // Enumerate all base tables in the public schema dynamically, then
+      // Drop dependencies (tables) first
-      // issue a single TRUNCATE with RESTART IDENTITY CASCADE so FK cycles
+      await client`
-      // are not a problem. The drizzle schema and __drizzle_migrations are
+        DO $$ DECLARE
-      // intentionally excluded (different schema) so drizzle-kit migrate
+          r RECORD;
-      // stays a no-op on an already-migrated DB.
+        BEGIN
-      const tables = await client<{ tablename: string }[]>`
+          FOR r IN (
-        SELECT tablename FROM pg_tables
+            SELECT tablename FROM pg_tables
-        WHERE schemaname = 'public'
+            WHERE schemaname = 'public'
+          ) LOOP
+            EXECUTE 'DROP TABLE IF EXISTS public.' || quote_ident(r.tablename) || ' CASCADE';
+          END LOOP;
+        END $$;
       `;
 
-      if (tables.length > 0) {
+      // Drop custom enums
-        // Double-quote each identifier (escaping embedded quotes) to handle
+      await client`
-        // any table name safely without a pg-specific quote_ident helper.
+        DO $$ DECLARE
-        const tableList = tables
+          r RECORD;
-          .map((t) => `"${t.tablename.replace(/"/g, '""')}"`)
+        BEGIN
-          .join(", ");
+          FOR r IN (
-        await client.unsafe(
+            SELECT typname FROM pg_type
-          `TRUNCATE ${tableList} RESTART IDENTITY CASCADE`,
+            WHERE typtype = 'e' AND typnamespace = (
-        );
+              SELECT oid FROM pg_namespace WHERE nspname = 'public'
-      }
+            )
+          ) LOOP
+            EXECUTE 'DROP TYPE IF EXISTS ' || quote_ident(r.typname) || ' CASCADE';
+          END LOOP;
+        END $$;
+      `;
 
-      console.log("✓ All public tables truncated, sequences reset\n");
+      // Drop the drizzle migrations tracking table
+      await client`DROP TABLE IF EXISTS drizzle.__drizzle_migrations CASCADE`;
+      await client`DROP SCHEMA IF EXISTS drizzle CASCADE`;
+
+      console.log("✓ All tables and enums dropped\n");
 
       console.log("Running migrations...");
       // GRO-2672: drizzle-orm's migrate() has a high-water-mark bug that skips

src/__tests__/authProvider.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach } from "vitest";
 import { Hono } from "hono";
 import { authProviderRouter } from "../routes/authProvider.js";
 
@@ -227,7 +227,6 @@ describe("PUT /admin/auth-provider", () => {
 
 describe("POST /admin/auth-provider/test", () => {
   beforeEach(resetMock);
-  afterEach(() => vi.restoreAllMocks());
 
   it("returns ok=false for unreachable issuer", async () => {
     const app = makeApp(mockSuperUser);
@@ -243,12 +242,7 @@ describe("POST /admin/auth-provider/test", () => {
     expect(body.error).toBeTruthy();
   }, 15000); // timeout must exceed the 10s fetch timeout in the route handler
 
-  it("returns 200 when clientSecret is omitted (not required by test-connection schema)", async () => {
+  it("returns 400 for missing clientSecret (not required for test)", async () => {
-    // Mock fetch so the route does not make a real network request.
-    vi.spyOn(global, "fetch").mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ issuer: "https://auth.example.com" }),
-    } as Response);
     const app = makeApp(mockSuperUser);
     const { status } = await post(app, "/admin/auth-provider/test", {
       providerId: "authentik",
@@ -256,7 +250,7 @@ describe("POST /admin/auth-provider/test", () => {
       issuerUrl: "https://auth.example.com",
       clientId: "client",
     }, mockSuperUser);
-    expect(status).toBe(200);
+    expect(status).toBe(200); // clientSecret omitted intentionally for test
   });
 });
 

src/__tests__/health-ready.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { Hono } from "hono";
+
+// ─── Mock db module ───────────────────────────────────────────────────────────
+
+let selectImpl: () => Promise<unknown>;
+
+vi.mock("@groombook/db", () => {
+  const staff = new Proxy(
+    { _name: "staff" },
+    {
+      get(_target, prop) {
+        if (prop === "_name") return "staff";
+        return { table: "staff", column: prop };
+      },
+    }
+  );
+
+  return {
+    getDb: () => ({
+      select: (_fields: unknown) => ({
+        from: (_table: unknown) => ({
+          limit: (_n: number) => selectImpl(),
+        }),
+      }),
+    }),
+    staff,
+  };
+});
+
+// ─── Build test app ───────────────────────────────────────────────────────────
+
+async function makeApp() {
+  const { getDb, staff } = await import("@groombook/db");
+
+  const app = new Hono();
+  app.get("/health/ready", async (c) => {
+    try {
+      await getDb().select({ id: staff.id }).from(staff).limit(1);
+      return c.json({ status: "ready" }, 200);
+    } catch (err) {
+      const pgCode = (err as Record<string, unknown>).code ?? "unknown";
+      console.error("[health/ready] DB check failed:", pgCode);
+      return c.json({ status: "degraded" }, 503);
+    }
+  });
+  return app;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("GET /health/ready", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("returns 200 {status:'ready'} when DB query succeeds", async () => {
+    selectImpl = () => Promise.resolve([{ id: "staff-1" }]);
+
+    const app = await makeApp();
+    const res = await app.request("/health/ready", { method: "GET" });
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(200);
+    expect(body.status).toBe("ready");
+  });
+
+  it("returns 503 {status:'degraded'} when DB query throws (schema dropped)", async () => {
+    const schemaErr = Object.assign(new Error("relation \"staff\" does not exist"), { code: "42P01" });
+    selectImpl = () => Promise.reject(schemaErr);
+
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    const app = await makeApp();
+    const res = await app.request("/health/ready", { method: "GET" });
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(503);
+    expect(body.status).toBe("degraded");
+
+    // Must not leak SQL error details in the response body
+    expect(JSON.stringify(body)).not.toContain("42P01");
+    expect(JSON.stringify(body)).not.toContain("relation");
+
+    consoleSpy.mockRestore();
+  });
+
+  it("returns 503 {status:'degraded'} on any DB connection error", async () => {
+    selectImpl = () => Promise.reject(new Error("ECONNREFUSED"));
+
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    const app = await makeApp();
+    const res = await app.request("/health/ready", { method: "GET" });
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(503);
+    expect(body.status).toBe("degraded");
+
+    consoleSpy.mockRestore();
+  });
+});

src/__tests__/readyz-auth-bypass.test.ts

@@ -1,44 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { Hono } from "hono";
-
-// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
-vi.mock("../lib/auth.js", () => ({
-  getAuth: () => {
-    throw new Error("auth not configured");
-  },
-  initAuth: vi.fn(),
-  getActiveProviders: vi.fn(() => []),
-}));
-
-describe("authMiddleware bypass: /api/readyz", () => {
-  it("serves /api/readyz without auth (bypass before auth check)", async () => {
-    // Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));
-
-    const res = await app.request("/api/readyz", { method: "GET" });
-    expect(res.status).toBe(200);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-
-  it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/staff", (c) => c.json({ ok: true }, 200));
-
-    const res = await app.request("/api/staff", { method: "GET" });
-    expect(res.status).toBe(503);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-});

src/index.ts

@@ -65,6 +65,17 @@ app.use(
 app.get("/health", (c) => c.json({ status: "ok" }));
 // /api/health: used by Gateway HTTPRoute (/api/* → API pod)
 app.get("/api/health", (c) => c.json({ status: "ok" }));
+// /health/ready: DB-touching readiness probe — K8s removes pod from endpoints when schema is dropped (GRO-2689)
+app.get("/health/ready", async (c) => {
+  try {
+    await getDb().select({ id: staff.id }).from(staff).limit(1);
+    return c.json({ status: "ready" }, 200);
+  } catch (err) {
+    const pgCode = (err as Record<string, unknown>).code ?? "unknown";
+    console.error("[health/ready] DB check failed:", pgCode);
+    return c.json({ status: "degraded" }, 503);
+  }
+});
 // /api/readyz: DB-touching deep health check consumed by monitoring (not K8s probes)
 // Distinct from /health so a dropped schema triggers an alert without cycling pods (GRO-2678)
 app.get("/api/readyz", async (c) => {

src/middleware/auth.ts

@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health" || c.req.path === "/api/readyz") {
+  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
     await next();
     return;
   }