feat(email-writing): persist privacy-minimized review evidence

.github/workflows/email-writing-evidence-tdd.yml

@@ -0,0 +1,106 @@
+name: Email Writing Evidence TDD
+
+on:
+  push:
+    branches:
+      - feat/llm-email-writing-review-evidence-task3
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: email-writing-evidence-tdd-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  review-evidence:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: backend/requirements-hashes.txt
+      - run: python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-hashes.txt
+      - name: Install hash-verified coverage tool
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/coverage-wheel
+          cat >/tmp/coverage-lock.txt <<'EOF'
+          coverage==7.15.2 --hash=sha256:eb6bcae8d1a9d305351ecb108232441d11c5cfe9de840a04388ba5d2db8d735c
+          EOF
+          python -m pip download \
+            --disable-pip-version-check \
+            --require-hashes \
+            --no-deps \
+            --only-binary=:all: \
+            --platform any \
+            --python-version 3.14 \
+            --implementation py \
+            --abi none \
+            --dest /tmp/coverage-wheel \
+            -r /tmp/coverage-lock.txt
+          python -m pip install --disable-pip-version-check --no-deps /tmp/coverage-wheel/coverage-7.15.2-py3-none-any.whl
+      - name: Run privacy-minimized model and migration tests
+        env:
+          PYTHONWARNINGS: error
+          DISABLE_BACKGROUND_WORKERS: "1"
+        run: |
+          set -euo pipefail
+          cd backend
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          set +e
+          python -m pytest -q \
+            tests/test_email_writing_models.py \
+            tests/test_email_writing_migration.py 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Eiq '(^|[^[:alnum:]_])(Timeout|Fatal|Warn|Denied)([^[:alnum:]_]|$)' "$output_file"; then
+            echo "::error::Backend tests emitted prohibited stability output."
+            exit 1
+          fi
+          exit "$test_status"
+      - name: Verify migration statement and branch coverage
+        env:
+          PYTHONWARNINGS: error
+          DISABLE_BACKGROUND_WORKERS: "1"
+        run: |
+          set -euo pipefail
+          cd backend
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          python -m coverage erase
+          set +e
+          python -m coverage run --branch \
+            --include='alembic/versions/20260812_0001_add_email_writing_review_evidence.py' \
+            -m pytest -q tests/test_email_writing_migration.py 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Eiq '(^|[^[:alnum:]_])(Timeout|Fatal|Warn|Denied)([^[:alnum:]_]|$)' "$output_file"; then
+            echo "::error::Coverage tests emitted prohibited stability output."
+            exit 1
+          fi
+          if [[ "$test_status" -ne 0 ]]; then
+            exit "$test_status"
+          fi
+          python -m coverage report --show-missing --fail-under=100 \
+            alembic/versions/20260812_0001_add_email_writing_review_evidence.py
+      - name: Lint evidence implementation and tests
+        run: |
+          cd backend
+          python -m ruff check \
+            db/email_writing_evidence.py \
+            alembic/env.py \
+            alembic/versions/20260812_0001_add_email_writing_review_evidence.py \
+            tests/test_email_writing_models.py \
+            tests/test_email_writing_migration.py

backend/alembic/env.py

@@ -7,14 +7,14 @@
 from sqlalchemy.ext.asyncio import async_engine_from_config
 
 from core.config import settings
-from db.models import Base
+from db.email_writing_evidence import EmailReviewSession
 
 config = context.config
 
 if config.config_file_name is not None:
     fileConfig(config.config_file_name)
 
-target_metadata = Base.metadata
+target_metadata = EmailReviewSession.__table__.metadata
 
 
 def _database_url() -> str: