Repair
Three changes, landed on 6 and 7 October 2026.
1. A database per run. A script, run-db.sh up, pulls postgres:17.11-alpine, starts a container named after the run, waits for the TCP port to answer, and writes the connection string to db.env in the run’s artifacts folder. run-db.sh down removes the container and its volume. Vault commits cfa561f, 14a06ab and eb25463.
2. Export before anything. The validate node’s first line now exports db.env into the environment. Bun and Next’s env loader never override a variable that is already set, so the file in the checkout loses every time. We proved it with loadEnvConfig('apps/cms') after the export: the worktree’s .env.local could not win.
3. A second net. A Claude Code mod watches every shell call the agent makes. A call that could reach the production database is held and the operator is asked; when there is no operator (a headless run) it is refused. It is a guard, not the fix: the fix is that the gate no longer knows the production address.
What it costs, measured on 7 October, five rounds
| Step | Time | How often |
|---|---|---|
| up (pull, start, wait for TCP) | 12.8 to 14.7 s | once per run, beside the research nodes |
load db.env |
about 0 | every iteration |
| full migrate on the empty database | 72 s | once per run; 55 of 55 migrations |
| down | 0.9 s | once per run |
The up step overlaps work that runs anyway, so the wall clock of a run barely moves. The 72 seconds are real and paid once.