fix: create workspace_entities/workspace_documents registry and provision Workspace rows - #1503

#!/bin/bash
set -euo pipefail

git status --short
git show --no-ext-diff --format=fuller --stat 37bcd6e38dd26c4aaf9af5837d8f920328bcca16
git diff --no-ext-diff 37bcd6e38dd26c4aaf9af5837d8f920328bcca16^ 37bcd6e38dd26c4aaf9af5837d8f920328bcca16 -- backend

printf '\n--- Python file outlines affected by the commit ---\n'
git diff --name-only 37bcd6e38dd26c4aaf9af5837d8f920328bcca16^ 37bcd6e38dd26c4aaf9af5837d8f920328bcca16 -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '\n--- Workspace/document query candidates ---\n'
rg -n -C 4 --glob 'backend/**/*.py' \
  '(Document\.workspace_id|workspace_id\s*==|workspace_id\s*=' backend

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Scoped helper and document endpoints ---'
sed -n '2470,2520p' backend/api/data.py
sed -n '3150,3395p' backend/api/data.py
sed -n '3900,3985p' backend/api/data.py

printf '%s\n' '--- Mock session query emulation ---'
sed -n '55,205p' backend/tests/test_data_api.py

printf '%s\n' '--- Changed document-scope regression test and neighboring listing test ---'
sed -n '2520,2740p' backend/tests/test_data_api.py

printf '%s\n' '--- Direct Document query statements in data API ---'
ast-grep run --lang python \
  --pattern 'select(Document)' \
  backend/api/data.py || true
ast-grep run --lang python \
  --pattern 'update(Document)' \
  backend/api/data.py || true
ast-grep run --lang python \
  --pattern 'delete(Document)' \
  backend/api/data.py || true

printf '%s\n' '--- Callers of the scoped document helper ---'
rg -n -C 3 '\b_get_workspace_document\s*\(' backend/api/data.py

printf '%s\n' '--- Document workspace and organization predicates ---'
rg -n -C 3 'Document\.(workspace_id|organization_id)\s*==' backend/api/data.py backend/tests/test_data_api.py

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Document model and registry migration ---'
rg -n -C 10 'class Document\b|organization_id.*(Column|mapped_column)' backend/db/models.py
sed -n '1,280p' backend/alembic/versions/0018_workspace_registry.py

printf '%s\n' '--- All backend Document query and write candidates ---'
rg -n -C 4 --glob 'backend/**/*.py' \
  '(select\(Document\)|update\(Document\)|delete\(Document\)|query\(Document\)|Document\))' \
  backend

printf '%s\n' '--- Organization-collision coverage in document and migration tests ---'
rg -n -i -C 5 \
  '(other_organization|org-rival|organization_id|quality-surface|workspace-org-acme)' \
  backend/tests/test_data_api.py backend/tests/test_workspace_document_migration.py

printf '%s\n' '--- Exact-head test-file changes since the parent commit ---'
git diff --no-ext-diff --check 37bcd6e38dd26c4aaf9af5837d8f920328bcca16^ 37bcd6e38dd26c4aaf9af5837d8f920328bcca16

#!/bin/bash
set -euo pipefail

head="909dacce1366101bc76a19b3cc329725323cc244"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and source-order diff ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Migration chain and workspace organization migration ---'
rg -n -C 4 --glob 'backend/alembic/versions/*.py' \
  '^(revision|down_revision|branch_labels|depends_on)\s*=' backend/alembic/versions
fd -a '0020_workspace_organization_binding.py' backend/alembic/versions -x sh -c '
  echo "--- $1 ---"
  cat -n "$1"
' sh {}

printf '%s\n' '--- Workspace model, bound provisioning, and API callers ---'
rg -n -C 15 --glob 'backend/**/*.py' \
  'class Workspace\b|def get_or_create_(bound_)?workspace\b|get_or_create_(bound_)?workspace\s*\(|Workspace\.(workspace_id|organization_id)|insert\(Workspace\)|select\(Workspace\)' \
  backend

printf '%s\n' '--- Document authorization filters and access call sites ---'
rg -n -C 10 --glob 'backend/api/data.py' \
  'def (_get_workspace_document|_auth_context_owns_its_workspace|_document_organization_filter)|_document_organization_filter\(|_get_workspace_document\(|Document\.(workspace_id|organization_id)|Workspace\.(workspace_id|organization_id)' \
  backend/api/data.py

printf '%s\n' '--- New and related PostgreSQL acceptance tests ---'
git diff --name-only "$parent" "$head" -- 'backend/tests/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  cat -n "$file"
done

printf '%s\n' '--- All opaque-workspace and binding references in tests ---'
rg -n -C 8 --glob 'backend/tests/**/*.py' \
  'opaque|bound_workspace|organization_binding|tenant-space|workspace_entities|organization_id|concurr|conflict' \
  backend/tests

printf '%s\n' '--- Static syntax parse for exact changed Python files ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
xargs -r python -m py_compile

#!/bin/bash
set -euo pipefail

head="909dacce1366101bc76a19b3cc329725323cc244"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact changed paths ---'
git diff --name-status "$parent" "$head"

printf '%s\n' '--- Exact migration ---'
fd -a '0020_workspace_organization_binding.py' backend/alembic/versions -x sh -c 'cat -n "$1"' sh {}

printf '%s\n' '--- Workspace model ---'
rg -n -A80 -B10 'class Workspace\b' backend/db/models.py

printf '%s\n' '--- Workspace provisioning service ---'
fd -a 'workspace_scope.py' backend/services -x sh -c 'cat -n "$1"' sh {}

printf '%s\n' '--- Bound provisioning callers ---'
rg -n -C 10 --glob 'backend/**/*.py' \
  '\bget_or_create_bound_workspace\s*\(|\bget_or_create_workspace\s*\(' backend

printf '%s\n' '--- New exact-head acceptance test files ---'
git diff --name-only "$parent" "$head" -- 'backend/tests/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  echo "--- $file ---"
  cat -n "$file"
done

printf '%s\n' '--- Current document scope implementation ---'
sed -n '2460,2555p' backend/api/data.py
sed -n '3935,4010p' backend/api/data.py

printf '%s\n' '--- All direct Workspace database operations ---'
rg -n -C 8 --glob 'backend/**/*.py' \
  '(insert\(Workspace\)|select\(Workspace\)|update\(Workspace\)|delete\(Workspace\)|Workspace\()' \
  backend

printf '%s\n' '--- Migration test references for 0020 ---'
rg -n -C 10 --glob 'backend/tests/**/*.py' \
  '0020_workspace_organization_binding|workspace organization binding|workspace_entities.*organization_id|organization_id.*workspace_entities' \
  backend/tests

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Complete bound-workspace PostgreSQL acceptance test ---'
cat -n backend/tests/test_workspace_scope_binding_postgres.py

printf '%s\n' '--- Workspace-related PostgreSQL test candidates ---'
fd -a --type f . backend/tests |
grep -E 'workspace|document.*scope|migration.*postgres' |
sort

printf '%s\n' '--- Exact 0020 migration acceptance references and surrounding functions ---'
rg -n -C 25 --glob 'backend/tests/*.py' \
  '0020_workspace_organization_binding|workspace organization binding|unambiguous.*binding|ambiguous.*workspace|workspace_entities.*organization_id' \
  backend/tests

printf '%s\n' '--- Service SQL operation shapes ---'
ast-grep run --lang python --pattern 'await session.execute($STMT)' backend/services/workspace_scope.py
ast-grep run --lang python --pattern '$STMT.on_conflict_do_nothing($$$ARGS)' backend/services/workspace_scope.py
ast-grep run --lang python --pattern '$STMT.values($$$ARGS)' backend/services/workspace_scope.py

printf '%s\n' '--- Migration operation shapes ---'
ast-grep run --lang python --pattern 'connection.execute($STMT)' backend/alembic/versions/0020_workspace_organization_binding.py
ast-grep run --lang python --pattern 'op.$METHOD($$$ARGS)' backend/alembic/versions/0020_workspace_organization_binding.py

printf '%s\n' '--- Revision 0020 files and changed-line check ---'
git show --stat --oneline 909dacce1366101bc76a19b3cc329725323cc244
git diff --check 909dacce1366101bc76a19b3cc329725323cc244^ 909dacce1366101bc76a19b3cc329725323cc244

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Complete workspace-organization migration PostgreSQL acceptance test ---'
cat -n backend/tests/test_workspace_organization_binding_migration_postgres.py

printf '%s\n' '--- Migration runner revision selection and 0019/0020 relationship ---'
fd -a 'migrate_db.py' backend/scripts -x sh -c 'cat -n "$1"' sh {}
rg -n -C 8 --glob 'backend/alembic/versions/*.py' \
  'revision = "(0018_workspace_registry|0019_email_read_state_repair|0020_workspace_organization_binding)"|down_revision =' \
  backend/alembic/versions

printf '%s\n' '--- Workspace-table foreign keys and organization indexes from migration history ---'
rg -n -C 8 --glob 'backend/alembic/versions/*.py' \
  'workspace_entities|workspace_documents|ix_workspace_entities_organization_id' \
  backend/alembic/versions

printf '%s\n' '--- Test file syntax parse and exact test definitions ---'
python -m py_compile backend/tests/test_workspace_scope_binding_postgres.py backend/tests/test_workspace_organization_binding_migration_postgres.py
ast-grep outline backend/tests/test_workspace_scope_binding_postgres.py --items all --view expanded
ast-grep outline backend/tests/test_workspace_organization_binding_migration_postgres.py --items all --view expanded

#!/bin/bash
set -euo pipefail

head="e204ea75d324809215c57de1fb389376039dc817"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and diff ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Revision graph and 0021 migration ---'
rg -n -C 4 --glob 'backend/alembic/versions/*.py' \
  '^(revision|down_revision|branch_labels|depends_on)\s*=' backend/alembic/versions
fd -a '0021_workspace_personal_owner_binding.py' backend/alembic/versions -x sh -c '
  echo "--- $1 ---"
  cat -n "$1"
' sh {}

printf '%s\n' '--- Workspace model and scoped provisioning service ---'
rg -n -C 20 --glob 'backend/db/models.py' \
  'class Workspace\b|organization_id|owner|personal' backend/db/models.py
fd -a 'workspace_scope.py' backend/services -x sh -c '
  echo "--- $1 ---"
  cat -n "$1"
' sh {}

printf '%s\n' '--- Scoped provisioning call sites and workspace database operations ---'
rg -n -C 10 --glob 'backend/**/*.py' \
  '\bget_or_create_scoped_workspace\s*\(|\bget_or_create_bound_workspace\s*\(|\bget_or_create_workspace\s*\(|(insert|select|update)\(Workspace\)|Workspace\.(workspace_id|organization_id|owner)' \
  backend

printf '%s\n' '--- Changed and related PostgreSQL acceptance files ---'
git diff --name-only "$parent" "$head" -- 'backend/tests/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  cat -n "$file"
done
rg -n -C 12 --glob 'backend/tests/**/*.py' \
  'personal.*workspace|personal_owner|scoped_workspace|get_or_create_scoped_workspace|opaque|concurr|CAS|owner' \
  backend/tests

printf '%s\n' '--- Syntax parse of exact changed Python files ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
xargs -r python -m py_compile

#!/bin/bash
set -euo pipefail

head="e204ea75d324809215c57de1fb389376039dc817"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact changed-path list ---'
git diff --name-status "$parent" "$head"

printf '%s\n' '--- Exact patch only ---'
git diff --no-ext-diff --unified=60 "$parent" "$head" -- \
  backend/alembic/versions \
  backend/db/models.py \
  backend/services/workspace_scope.py \
  backend/tests/test_workspace_personal_scope_binding_postgres.py \
  backend/tests/test_workspace_personal_owner_binding_migration_postgres.py \
  backend/tests/test_workspace_scope_binding_postgres.py \
  backend/tests/test_workspace_organization_binding_migration_postgres.py

printf '%s\n' '--- 0021 migration ---'
fd -a '0021_workspace_personal_owner_binding.py' backend/alembic/versions -x cat -n {}

printf '%s\n' '--- Workspace model ---'
sed -n '/^class Workspace\b/,/^class /p' backend/db/models.py

printf '%s\n' '--- Workspace provisioning service ---'
cat -n backend/services/workspace_scope.py

printf '%s\n' '--- Personal ownership acceptance ---'
cat -n backend/tests/test_workspace_personal_scope_binding_postgres.py

printf '%s\n' '--- 0021 migration acceptance candidate ---'
fd -a --type f 'test_*personal*binding*postgres.py' backend/tests -x sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}

printf '%s\n' '--- SQLAlchemy mutation shapes ---'
ast-grep run --lang python --pattern 'update(Workspace).where($$$WHERE).values($$$VALUES)' backend/services/workspace_scope.py || true
ast-grep run --lang python --pattern 'insert(Workspace).values($$$VALUES)' backend/services/workspace_scope.py || true
ast-grep run --lang python --pattern 'select(Workspace).where($$$WHERE)' backend/services/workspace_scope.py || true

#!/bin/bash
set -euo pipefail

head="a74db4ea4e16d066502817f028d1710dc8d507be"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Changed paths and exact delta ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Opaque organization regression and related acceptance tests ---'
fd -a --type f . backend/tests |
grep -E '(legacy_document_scope|workspace.*scope.*binding|workspace.*organization.*binding|personal.*scope)' |
sort |
while IFS= read -r file; do
  printf '\n### %s\n' "$file"
  rg -n -C 12 'opaque|tenant-space|_expected_organization_filter|organization_id|owner_user_id|Workspace|_document_organization_filter' "$file" || true
done

printf '%s\n' '--- Current authorization helpers and document queries ---'
sed -n '2460,2560p' backend/api/data.py
sed -n '3935,4020p' backend/api/data.py
rg -n -C 8 --glob 'backend/api/data.py' \
  'def (_get_workspace_document|_auth_context_owns_its_workspace|_document_organization_filter)|_document_organization_filter\(|Document\.(workspace_id|organization_id)|Workspace\.(workspace_id|organization_id|owner_user_id)' \
  backend/api/data.py

printf '%s\n' '--- Workspace model, migration chain, and provisioning service ---'
rg -n -A100 -B10 'class Workspace\b' backend/db/models.py
fd -a '0020_workspace_organization_binding.py|0021_workspace_personal_owner_binding.py' backend/alembic/versions -x sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}
fd -a 'workspace_scope.py' backend/services -x sh -c 'cat -n "$1"' sh {}

printf '%s\n' '--- All document-filter call sites and workspace persistence paths ---'
rg -n -C 6 --glob 'backend/**/*.py' \
  '_document_organization_filter\s*\(|get_or_create_scoped_workspace\s*\(|get_or_create_bound_workspace\s*\(|(insert|select|update)\(Workspace\)|Workspace\.(workspace_id|organization_id|owner_user_id)' \
  backend

printf '%s\n' '--- Static syntax parse and full PR whitespace check ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' | xargs -r python -m py_compile
base="$(git merge-base "$head" origin/develop 2>/dev/null || true)"
if [ -n "$base" ]; then git diff --check "$base...$head"; fi

#!/bin/bash
set -euo pipefail

head="6d801e5c671366267c40c5346f547cf87fd8c45e"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and source-order delta ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Workspace ORM mapping and migration chain ---'
rg -n -C 18 --glob 'backend/db/models.py' \
  'class Workspace\b|class Document\b|organization_id|owner_user_id' backend/db/models.py
rg -n -C 4 --glob 'backend/alembic/versions/*.py' \
  '^(revision|down_revision|branch_labels|depends_on)\s*=' backend/alembic/versions
fd -a '0020_workspace_organization_binding.py|0021_workspace_personal_owner_binding.py' backend/alembic/versions -x sh -c '
  echo "--- $1 ---"
  cat -n "$1"
' sh {}

printf '%s\n' '--- Workspace provisioning and API ownership mapping ---'
fd -a 'workspace_scope.py' backend/services -x sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}
sed -n '2440,2585p' backend/api/data.py
sed -n '3120,3420p' backend/api/data.py
sed -n '3920,4035p' backend/api/data.py
rg -n -C 8 --glob 'backend/**/*.py' \
  'get_or_create_scoped_workspace\s*\(|get_or_create_bound_workspace\s*\(|_document_organization_filter\s*\(|_get_workspace_document\s*\(|Workspace\.(workspace_id|organization_id|owner_user_id)|Document\.(workspace_id|organization_id)' \
  backend

printf '%s\n' '--- Changed PostgreSQL tests ---'
git diff --name-only "$parent" "$head" -- 'backend/tests/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  cat -n "$file"
done

printf '%s\n' '--- Related endpoint and legacy document test contracts ---'
fd -a --type f . backend/tests |
grep -E '(legacy_document_scope|workspace.*scope.*binding|personal.*scope|data_api)' |
sort |
while IFS= read -r file; do
  printf '\n### %s\n' "$file"
  rg -n -C 10 'opaque|tenant-space|owner_user_id|organization_id|Workspace|workspace_id|quality_surface|reparse|documents' "$file" || true
done

printf '%s\n' '--- Static syntax parse and exact whitespace check ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' | xargs -r python -m py_compile
git diff --check "$parent" "$head"

#!/bin/bash
set -euo pipefail

head="602c1447d781583d70ae7f96846810e89e93e5ad"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and source-order delta ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Workspace model and provisioning service ---'
sed -n '/^class Workspace\b/,/^class /p' backend/db/models.py
fd -a 'workspace_scope.py' backend/services -x sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}

printf '%s\n' '--- Data API authorization and document endpoint paths ---'
sed -n '2440,2590p' backend/api/data.py
sed -n '3120,3440p' backend/api/data.py
sed -n '3920,4045p' backend/api/data.py
rg -n -C 8 --glob 'backend/api/data.py' \
  'def (_document_organization_filter|_get_workspace_document)|Workspace\.(workspace_id|organization_id|owner_user_id)|Document\.(workspace_id|organization_id)|WorkspaceOrganizationConflict|HTTPException.*403|get_or_create_scoped_workspace' \
  backend/api/data.py

printf '%s\n' '--- Exact changed tests and related acceptance contracts ---'
git diff --name-only "$parent" "$head" -- 'backend/tests/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  cat -n "$file"
done
fd -a --type f . backend/tests |
grep -E '(legacy_document_scope|workspace.*scope.*binding|personal.*scope|workspace.*organization.*binding|data_api)' |
sort |
while IFS= read -r file; do
  printf '\n### Contract references: %s\n' "$file"
  rg -n -C 8 'opaque|owner_user_id|organization_id|HMAC|forbidden|403|WorkspaceOrganizationConflict|workspace_id|quality_surface|reparse' "$file" || true
done

printf '%s\n' '--- Migration chain and workspace migrations ---'
rg -n -C 4 --glob 'backend/alembic/versions/*.py' \
  '^(revision|down_revision|branch_labels|depends_on)\s*=' backend/alembic/versions
fd -a '0020_workspace_organization_binding.py|0021_workspace_personal_owner_binding.py' backend/alembic/versions -x sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}

printf '%s\n' '--- Workspace and document database operation candidates ---'
rg -n -C 6 --glob 'backend/**/*.py' \
  '(insert|select|update)\(Workspace\)|Workspace\.(workspace_id|organization_id|owner_user_id)|get_or_create_scoped_workspace\s*\(|_document_organization_filter\s*\(' \
  backend

printf '%s\n' '--- Static syntax and exact whitespace checks ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' | xargs -r python -m py_compile
git diff --check "$parent" "$head"

#!/bin/bash
set -euo pipefail

head="602c1447d781583d70ae7f96846810e89e93e5ad"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- AuthContext definition and construction paths ---'
ast-grep outline backend/api/auth.py --items all --view expanded
rg -n -C 12 --glob 'backend/api/auth.py' \
  'class AuthContext\b|session_verifier|AuthContext\(|def get_auth_context|def get_current_user|hmac|oidc|override|server' \
  backend/api/auth.py

printf '%s\n' '--- Every Data API document route and scoped-workspace invocation ---'
rg -n -C 10 --glob 'backend/api/data.py' \
  '`@router`\.(get|post|put|patch|delete)\("/documents|`@router`\.(get|post|put|patch|delete)\("/quality-surface|_require_scoped_workspace\(|_get_workspace_document\(' \
  backend/api/data.py

printf '%s\n' '--- Exact changed-line source with line numbers ---'
git diff --unified=12 "$parent" "$head" -- backend/api/data.py | cat

printf '%s\n' '--- Verifier provenance contracts and API tests that exercise 403 ---'
rg -n -C 10 --glob 'backend/tests/**/*.py' \
  'session_verifier|Workspace access denied|status_code == 403|WorkspaceOrganizationBindingRequired|WorkspaceOrganizationConflict|upload_data_document|pdf-dom-recognition' \
  backend/tests

printf '%s\n' '--- Test fixture workspace setup and mock update support ---'
sed -n '55,185p' backend/tests/test_data_api.py
sed -n '300,430p' backend/tests/test_data_api.py
sed -n '2520,3025p' backend/tests/test_data_api.py

printf '%s\n' '--- Changed module syntax and whitespace ---'
python -m py_compile backend/api/data.py
git diff --check "$parent" "$head"

#!/bin/bash
set -euo pipefail

head="f7bdcf11c0ddf0bdfb04a28da18d2d06aa710d67"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and source-order delta ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Test fixture binding and dependent test fixtures ---'
fd -a 'conftest.py' backend/tests -x sh -c '
  echo "--- $1 ---"
  rg -n -C 16 "workspace|Workspace|organization_id|owner_user_id|AuthContext|session_verifier|HMAC|hmac" "$1" || true
' sh {}

printf '%s\n' '--- Workspace model and provisioning service ---'
rg -n -C 18 --glob 'backend/db/models.py' \
  'class Workspace\b|organization_id|owner_user_id' backend/db/models.py
fd -a 'workspace_scope.py' backend/services -x sh -c '
  echo "--- $1 ---"
  cat -n "$1"
' sh {}

printf '%s\n' '--- API authorization and provisioning call sites ---'
rg -n -C 10 --glob 'backend/api/data.py' \
  'def (_require_scoped_workspace|_document_organization_filter|_get_workspace_document)|get_or_create_scoped_workspace|WorkspaceOrganization|Workspace\.(workspace_id|organization_id|owner_user_id)|Document\.(workspace_id|organization_id)' \
  backend/api/data.py

printf '%s\n' '--- Auth verifier provenance and AuthContext construction ---'
rg -n -C 12 --glob 'backend/api/auth.py' \
  'class AuthContext\b|AuthContext\(|session_verifier|HMAC|hmac|organization_id|owner_user_id|user_id' \
  backend/api/auth.py

printf '%s\n' '--- Persisted workspace binding operations and test coverage ---'
rg -n -C 8 --glob 'backend/**/*.py' \
  'get_or_create_scoped_workspace\s*\(|WorkspaceOrganizationBindingRequired|WorkspaceOrganizationConflict|WorkspaceOwner|owner_user_id|organization_id.*workspace_entities|workspace_entities.*organization_id' \
  backend

printf '%s\n' '--- Relevant API and PostgreSQL test contracts ---'
fd -a --type f . backend/tests |
grep -E '(data_api|workspace.*scope|personal.*scope|legacy_document_scope)' |
sort |
while IFS= read -r file; do
  printf '\n### %s\n' "$file"
  rg -n -C 8 'HMAC|hmac|opaque|owner_user_id|organization_id|Workspace|workspace_id|403|binding|session_verifier' "$file" || true
done

printf '%s\n' '--- Static syntax and whitespace checks ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' | xargs -r python -m py_compile
git diff --check "$parent" "$head"

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- mock_db fixture definition and nearby fixture scopes ---'
rg -n -A40 -B8 --glob 'backend/tests/test_data_api.py' \
  'def mock_db\b|`@pytest`\.fixture.*mock_db|MockAsyncSession\(' backend/tests/test_data_api.py

printf '%s\n' '--- First target HMAC upload test ---'
rg -n -A70 -B12 --glob 'backend/tests/test_data_api.py' \
  '^def test_data_document_upload_creates_workspace_scoped_document\b' backend/tests/test_data_api.py

printf '%s\n' '--- Second target HMAC upload test ---'
rg -n -A75 -B12 --glob 'backend/tests/test_data_api.py' \
  '^def test_data_pdf_dom_upload_persists_signed_organization_scope\b' backend/tests/test_data_api.py

printf '%s\n' '--- All tests that use each endpoint with signed HMAC setup ---'
rg -n -C 5 --glob 'backend/tests/test_data_api.py' \
  '_with_signed_auth\(|/api/data/documents"|/api/data/documents/' backend/tests/test_data_api.py

printf '%s\n' '--- Fixture resolution order references ---'
rg -n -C 4 --glob 'backend/tests/**/*.py' \
  'persisted_hmac_workspace_for_document_uploads|dev_auth_dependency_overrides|mock_db' backend/tests

#!/bin/bash
set -euo pipefail

head="9151c75568c582c8147cfee6757cd00a9b4d60b7"
parent="$(git rev-parse "${head}^")"

printf '%s\n' '--- Exact revision identity ---'
git rev-parse HEAD
git show -s --format='commit=%H%nparent=%P%nsubject=%s%n%n%B' "$head"
test "$(git rev-parse HEAD)" = "$head"

printf '%s\n' '--- Exact changed paths and source-order delta ---'
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --no-ext-diff --unified=100 "$parent" "$head"

printf '%s\n' '--- Changed Python outlines ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' |
while IFS= read -r file; do
  [ -n "$file" ] || continue
  printf '\n### %s\n' "$file"
  ast-grep outline "$file" --items all --view expanded || true
done

printf '%s\n' '--- Target action test and compatibility fixture selection ---'
rg -n -A110 -B18 --glob 'backend/tests/test_data_api.py' \
  'test_data_document_actions_are_workspace_scoped_and_intent_only|_HMAC_DOCUMENT_UPLOAD_COMPATIBILITY_TESTS|persisted_hmac_workspace_for_document_uploads|MockAsyncSession|def mock_db\b' \
  backend/tests/test_data_api.py

printf '%s\n' '--- Shared fixture binding ---'
fd -a 'conftest.py' backend/tests -x sh -c '
  echo "--- $1 ---"
  rg -n -C 25 "persisted_hmac_workspace_for_document_uploads|HMAC_DOCUMENT|workspace_entities|Workspace\\(|workspace_id|organization_id|owner_user_id" "$1" || true
' sh {}

printf '%s\n' '--- Production authorization and workspace model ---'
sed -n '2450,2575p' backend/api/data.py
sed -n '/^class Workspace\b/,/^class /p' backend/db/models.py
fd -a 'workspace_scope.py' backend/services -x sh -c 'cat -n "$1"' sh {}

printf '%s\n' '--- Relevant query emulation and all fixture consumers ---'
rg -n -C 12 --glob 'backend/tests/**/*.py' \
  'Document\.organization_id|Workspace\.organization_id|Workspace\.owner_user_id|persisted_hmac_workspace_for_document_uploads|_HMAC_DOCUMENT_UPLOAD_COMPATIBILITY_TESTS' \
  backend/tests

printf '%s\n' '--- Static syntax and whitespace checks ---'
git diff --name-only "$parent" "$head" -- 'backend/**/*.py' | xargs -r python -m py_compile
git diff --check "$parent" "$head"