chore: regenerate SQLx/cache artifacts and harden local Postgres workflows

.cargo/config.toml

@@ -4,7 +4,7 @@
 target-dir = "target"
 incremental = true
 pipelining = true
-# Use all available CPU cores for compilation
+# Use all available CPU cores for compilation (override locally if needed)
 jobs = 24
 rustc-workspace-wrapper = "scripts/rustc_wrapper.sh"
 
@@ -19,7 +19,7 @@ rustflags = [
   "-C",
   "link-arg=-fuse-ld=mold",     # Fastest linker available
   "-C",
-  "codegen-units=256",          # Maximum parallelism
+  "codegen-units=256",          # Maximize parallelism
   "--check-cfg=cfg(rust_analyzer)",
 ]
 
@@ -57,12 +57,15 @@ cf = [
 # Environment variables for coverage and testing
 [env]
 CARGO_LLVM_COV_TARGET_DIR = { value = "target/llvm-cov", relative = true }
+PGHOST = "/run/postgresql"
+PGUSER = "sinity"
+PGDATABASE = "sinex_dev"
+DATABASE_URL = "postgresql:///sinex_dev?host=/run/postgresql"
 
 # Speed optimizations via environment variables
 CARGO_INCREMENTAL = "1"                # Enable incremental compilation
 RUST_BACKTRACE = "0"                   # Disable backtraces for speed
 # RUSTC_WRAPPER set dynamically in nix shell for sccache
-CARGO_BUILD_JOBS = "0"                 # Use all CPU cores
 CARGO_NET_GIT_FETCH_WITH_CLI = "false" # Faster git operations
 
 

.config/nextest.toml

@@ -65,8 +65,8 @@ slow-timeout = { period = "60s", terminate-after = 1 }
 
 # CI parallel profile - balanced for reliability with good parallelism
 [profile.ci-parallel]
-# Use 75% of CPUs to leave headroom for system
-test-threads = 18
+# Use num-cpus and let runners size themselves (set NEXTEST_TEST_THREADS if you need to reserve headroom).
+test-threads = "num-cpus"
 failure-output = "immediate-final"
 success-output = "never"
 # One retry for flaky tests

.env.example

@@ -0,0 +1,14 @@
+# Sinex Development Environment Variables
+# Copy this file to `.env` (which stays untracked) and customize as needed.
+
+# Database connection (matches what's set in flake.nix devShell)
+DATABASE_URL=postgresql:///sinex_dev?host=/run/postgresql
+PGHOST=/run/postgresql
+PGUSER=sinity
+PGDATABASE=sinex_dev
+
+# Optional overrides
+# DATABASE_NAME=sinex_dev
+# REDIS_URL=redis://localhost:6379
+# RUST_LOG=debug
+# SINEX_WORK_DIR=/tmp/sinex

.github/pull_request_template.md

@@ -15,35 +15,29 @@
 
 - [ ] I have added tests that prove my fix is effective or that my feature works
 - [ ] All new and existing tests pass locally
-- [ ] I have run `just test-fast` to verify basic functionality
+- [ ] I have run `cargo nextest run --profile fast` to verify basic functionality
 
 ## Abstraction Compliance Checklist
 
 ### Database Operations
-- [ ] All database queries use QueryBuilder from sinex-db
-- [ ] No raw `sqlx::query!` or `sqlx::query_as!` calls
-- [ ] ULID fields are handled by QueryBuilder (no manual `.to_uuid()`)
+- [ ] Database access flows through `sinex-core` repositories/query helpers (no ad-hoc `PgPool` usage).
+- [ ] SQL uses `sqlx::query!`/`query_as!` (compile-time checked) or `sqlx::QueryBuilder` for dynamic clauses—never raw string concatenation.
+- [ ] ULIDs/UUIDs rely on the conversion helpers in `sinex-core::db` (no manual `.to_uuid()` / `.parse()` chains).
 
 ### Error Handling
-- [ ] All errors use CoreError from sinex-error
-- [ ] No `anyhow!` or `bail!` in production code
-- [ ] Errors include proper context via `.context()`
-- [ ] No `.unwrap()` or `.expect()` outside of tests
+- [ ] Workspace crates return typed errors (`sinex_core::CoreError` or component-specific enums) rather than `anyhow!` in production paths.
+- [ ] `.context()` (or equivalent) is used to enrich fallible operations.
+- [ ] No `.unwrap()` / `.expect()` outside tests and intentional crash points.
 
-### String Constants
-- [ ] Event types use constants from `sinex_events::constants::event_types`
-- [ ] Sources use constants from `sinex_events::constants::sources`
-- [ ] Service names use constants from `sinex_events::constants::services`
-- [ ] No hardcoded strings like `"process.heartbeat"` or `"core.events"`
-
-### Validation
-- [ ] Input validation uses ValidationChain from sinex-validation
-- [ ] No manual validation logic for common patterns
+### Validation & Constants
+- [ ] Inputs go through the shared validation / sanitization helpers (`sinex_core::validation`, path sanitizers, etc.) instead of bespoke logic.
+- [ ] Event/source/service identifiers reuse existing constants when available—avoid sprinkling string literals such as `"process.heartbeat"` throughout the codebase.
 
 ## Code Quality
 
 - [ ] I have run `cargo fmt` to format my code
 - [ ] I have run `cargo clippy` and addressed all warnings
+- [ ] If schema definitions changed, I ran `./scripts/schema-dev.sh generate` and committed the updated `schemas/` artifacts
 - [ ] I have added/updated documentation as needed
 - [ ] My code follows the project's style guidelines
 
@@ -63,4 +57,4 @@
 - [ ] No anti-patterns introduced (raw SQL, anyhow, hardcoded strings)
 - [ ] Tests follow the same abstraction standards
 - [ ] Documentation is clear and up-to-date
-- [ ] Performance impact has been considered
+- [ ] Performance impact has been considered

.github/workflows/README.md

@@ -29,25 +29,12 @@ This directory contains CI/CD workflows for the Sinex project.
 - Updates schema registry in database
 - Maintains schema version history
 
-### `abstractions.yml` - Code Quality Checks
-- Runs additional linting and analysis
-- Checks for code abstractions and patterns
-- Enforces architectural guidelines
-
 ## Local Testing
 
-Run workflows locally using `act`:
-
-```bash
-# Install act
-nix develop  # Includes act
-
-# Run CI workflow
-act -W .github/workflows/ci.yml
-
-# Run specific job
-act -j build_and_test_linux
-```
+Workflows are designed to run inside the `nix develop` environment. If you want to execute
+them locally with [`act`](https://github.com/nektos/act), install `act` separately and point
+it at the desired workflow (for example: `act -W .github/workflows/ci.yml`). There is no
+first-class wrapper in the dev shell today.
 
 ## Nix Integration
 
@@ -99,4 +86,4 @@ All workflows use Nix for reproducible builds:
 - **PR Previews**: Live preview of changes
 - **Test Coverage Reports**: Automated coverage tracking
 - **Performance Reports**: Benchmark comparisons in PRs
-- **Documentation Preview**: Build and preview docs changes
+- **Documentation Preview**: Build and preview docs changes

.github/workflows/ci.yml

@@ -54,6 +54,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Install ripgrep
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ripgrep
+
     - name: Enforce forbidden pattern guards
       run: bash scripts/check_forbidden_patterns.sh
 
@@ -112,7 +117,7 @@ jobs:
       env:
         DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
         RUST_LOG: debug
-      run: cargo nextest run --all-features --workspace
+      run: cargo nextest run --all-features --workspace --profile reliable
 
   coverage:
     name: Code Coverage
@@ -136,6 +141,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Install ripgrep
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ripgrep
+
     - name: Enforce forbidden pattern guards
       run: bash scripts/check_forbidden_patterns.sh
 
@@ -186,7 +196,7 @@ jobs:
     - name: Generate code coverage
       env:
         DATABASE_URL: postgres://sinex_test:test_password@localhost/sinex_test
-      run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+      run: cargo llvm-cov --all-features --workspace --profile reliable --lcov --output-path lcov.info
 
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v3

.github/workflows/sqlx-cache.yml

@@ -19,7 +19,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:16
+        image: timescale/timescaledb:2.15.2-pg16  # Keep in sync with main CI runs
         env:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: sinex_test

.github/workflows/sqlx-check.yml

@@ -19,7 +19,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:16
+        image: timescale/timescaledb:2.15.2-pg16  # Align with main CI image
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres

.gitignore

@@ -60,6 +60,7 @@ result-*
 /spec/combo/
 .claude-outputs/
 .direnv/
+.devenv/
 compilation*log
 
 # Rust compiler ICE dumps