Align test and staging databases with their Terraform stacks (#172 follow-up)

infra/terraform-test and infra/terraform-staging create te_test and
te_staging for server admin pgadmin, while the deployer built te_mgmt_test
and te_mgmt_staging owned by postgres: the same three-way disagreement #172
fixed for prod. They are code only (#31), so nothing was deployed; this lands
before #31 resumes.

- env_test/env_staging.example.sql: db_name te_test/te_staging, db_owner
  pgadmin. deploy_all.sh already reads both from the launcher.
- infra/terraform-test, -staging: Key Vault secret and job wiring for
  APP_USER_PASSWORD, as for prod (entrypoint.sh refuses to deploy without it).
- CI creates te_test, te_staging and te_prod owned by pgadmin, dev by postgres.
- Consumers of the old names follow: evals Tier E, parity and env tests,
  run_tests.sh, config examples, provisioning script, README, docs.
- tests/test_prod_db_naming.py becomes tests/test_azure_db_naming.py and its
  static checks run for prod, test and staging, so one test covers every stack.
  Dev stays te_mgmt_dev / postgres and is pinned as unchanged.
- Decision record extended.

Stacked on #172: it needs the launcher-driven deployer and the runtime
launcher generation from that change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011T6WqjTEDRRQGLEYPPFVXx

Author: claude

.github/workflows/quality-gate.yml

@@ -113,9 +113,9 @@ jobs:
           PG_SUPERUSER_PASSWORD="postgres"
           PG_DB_DEV="te_mgmt_dev"
           PG_SCHEMA_DEV="te_dev"
-          PG_DB_TEST="te_mgmt_test"
+          PG_DB_TEST="te_test"
           PG_SCHEMA_TEST="te_test"
-          PG_DB_STAGING="te_mgmt_staging"
+          PG_DB_STAGING="te_staging"
           PG_SCHEMA_STAGING="te_staging"
           PG_DB_PROD="te_prod"
           PG_SCHEMA_PROD="te_prod"
@@ -133,14 +133,15 @@ jobs:
           done
           ls -1 build/environments/
 
-      # Prod's database is te_prod owned by pgadmin, as in Azure (#172); the
-      # others are te_mgmt_<env> owned by postgres. The owners must match each
-      # build/environments/env_<env>.example.sql, or deploy_all.sh warns.
+      # Test, staging and prod databases are named and owned as in Azure
+      # (te_<env>, owner pgadmin; #172); dev stays te_mgmt_dev owned by postgres.
+      # The owners must match each build/environments/env_<env>.example.sql, or
+      # deploy_all.sh warns.
       - name: Create environment databases
         run: |
           psql -v ON_ERROR_STOP=1 -d postgres -c "CREATE ROLE pgadmin NOLOGIN"
-          for db in te_mgmt_dev te_mgmt_test te_mgmt_staging te_prod; do
-            owner=postgres; [ "$db" = te_prod ] && owner=pgadmin
+          for db in te_mgmt_dev te_test te_staging te_prod; do
+            owner=pgadmin; [ "$db" = te_mgmt_dev ] && owner=postgres
             if [ -z "$(psql -d postgres -tA -c "SELECT 1 FROM pg_database WHERE datname = '$db'")" ]; then
               psql -v ON_ERROR_STOP=1 -d postgres -c \
                 "CREATE DATABASE \"$db\" WITH OWNER = $owner ENCODING = 'UTF8' TEMPLATE = template0 CONNECTION LIMIT = -1"

DECISIONS/2026-11-09-prod-db-naming.md

@@ -1,4 +1,4 @@
-# Decision: Production database is `te_prod`, owned by `pgadmin`
+# Decision: Azure databases are `te_<env>`, owned by `pgadmin`
 
 Status:  Decided and applied
 Date:    2026-11-09
@@ -10,6 +10,10 @@ The production database is **`te_prod`** and its owner is **`pgadmin`**, in all
 artefacts that describe it: `infra/terraform-prod/main.tf`, `build/deploy_all.sh` and
 `infra/entrypoint.sh`. Option (a) of #172. The schema inside it stays `te_prod`.
 
+**Extended to test and staging (9 Nov 2026, same day):** `te_test` and `te_staging`, also
+owned by `pgadmin`, matching `infra/terraform-test` and `infra/terraform-staging`. Dev
+stays `te_mgmt_dev` owned by `postgres`: it is local-only and has no stack.
+
 `build/environments/env_prod.example.sql` is the single place that states the name and
 owner (`db_name`, `db_owner`). The deployer reads them from the launcher it is about to
 run instead of keeping its own copy.
@@ -36,8 +40,9 @@ canonical name on 9 Nov 2026.
 
 ## Trade-offs accepted
 
-- Prod now differs from dev, test and staging (`te_mgmt_<env>`, owner `postgres`). The
-  reading code does not care; the asymmetry is in the data.
+- The Azure environments (`te_<env>`, owner `pgadmin`) now differ from dev
+  (`te_mgmt_dev`, owner `postgres`). The reading code does not care; the asymmetry is in
+  the data, and it is the difference between a local database and a managed one.
 - Where `pgadmin` does not exist (CI, a dev server, the offline install), `deploy_all.sh`
   creates it as `NOLOGIN`. It owns the database and nothing else, so it adds no credential,
   but a stray role appears on those servers.
@@ -47,14 +52,16 @@ canonical name on 9 Nov 2026.
 - `deploy` now requires `APP_USER_PASSWORD`. Without it the application role would be
   created with the template's placeholder password.
 
-## Not decided here
+## Test and staging
 
-`infra/terraform-test` and `infra/terraform-staging` create `te_test` and `te_staging`,
-while the deployer builds `te_mgmt_test` and `te_mgmt_staging`: the same disagreement.
-Those stacks are code only (#31). Settle their names before #31 resumes.
+`infra/terraform-test` and `infra/terraform-staging` already created `te_test` and
+`te_staging`, while the deployer built `te_mgmt_test` and `te_mgmt_staging`: the same
+disagreement as prod. Those stacks are code only (#31), so nothing was deployed. They are
+aligned now, before #31 resumes, with the same launcher-driven deployer and the same
+`APP_USER_PASSWORD` wiring as prod.
 
 ## Reopen trigger
 
-Reconsider if test and staging are given the Azure-style names (then prod no longer
-stands apart and the `te_mgmt_` prefix may be dropped everywhere), or if the application
-is ever to run as a role other than the database owner in Azure.
+Reconsider if dev is given an Azure stack (then it should follow `te_dev`/`pgadmin` and the
+`te_mgmt_` prefix can go), or if the application is ever to run as a role other than the
+database owner in Azure.

README.md

@@ -332,7 +332,7 @@ organisations ──< personnel
 
 | Setting | Dev | Test | Staging | Prod |
 |---|---|---|---|---|
-| Database | `te_mgmt_dev` | `te_mgmt_test` | `te_mgmt_staging` | `te_prod` |
+| Database | `te_mgmt_dev` | `te_test` | `te_staging` | `te_prod` |
 | Schema | `te_dev` | `te_test` | `te_staging` | `te_prod` |
 | App User | `te_dev_user` | `te_test_user` | `te_stg_user` | `te_prod_user` |
 | Connection Limit | 10 | 15 | 25 | 50 |

build/config.env.example

@@ -26,13 +26,13 @@ PG_APP_USER_DEV="te_dev_user"
 PG_APP_PASSWORD_DEV=""
 PG_CONN_LIMIT_DEV="10"
 
-PG_DB_TEST="te_mgmt_test"
+PG_DB_TEST="te_test"
 PG_SCHEMA_TEST="te_test"
 PG_APP_USER_TEST="te_test_user"
 PG_APP_PASSWORD_TEST=""
 PG_CONN_LIMIT_TEST="15"
 
-PG_DB_STAGING="te_mgmt_staging"
+PG_DB_STAGING="te_staging"
 PG_SCHEMA_STAGING="te_staging"
 PG_APP_USER_STAGING="te_stg_user"
 PG_APP_PASSWORD_STAGING=""

build/environments/env_staging.example.sql

@@ -1,8 +1,10 @@
 -- env_staging.example.sql  (TEMPLATE - safe to commit; no real secrets)
 -- Copy to env_staging.sql (gitignored) and fill in, or inject app_password at deploy.
+-- db_name and db_owner are read by build/deploy_all.sh and must match infra/terraform-staging
+-- (database te_staging, server admin pgadmin). #172; DECISIONS/2026-11-09-prod-db-naming.md.
 \set env_label          STAGING
-\set db_name            te_mgmt_staging
-\set db_owner           postgres
+\set db_name            te_staging
+\set db_owner           pgadmin
 \set schema_name        te_staging
 \set app_user           te_stg_user
 \set app_password       '__INJECT_AT_DEPLOY__'

build/environments/env_test.example.sql

@@ -1,8 +1,10 @@
 -- env_test.example.sql  (TEMPLATE - safe to commit; no real secrets)
 -- Copy to env_test.sql (gitignored) and fill in, or inject app_password at deploy.
+-- db_name and db_owner are read by build/deploy_all.sh and must match infra/terraform-test
+-- (database te_test, server admin pgadmin). #172; DECISIONS/2026-11-09-prod-db-naming.md.
 \set env_label          TEST
-\set db_name            te_mgmt_test
-\set db_owner           postgres
+\set db_name            te_test
+\set db_owner           pgadmin
 \set schema_name        te_test
 \set app_user           te_test_user
 \set app_password       '__INJECT_AT_DEPLOY__'

docs/DATABASE_ENVIRONMENTS.md

@@ -12,16 +12,17 @@ for names: `build/config.env.example` (template) / `build/config.local.env`
 | Environment | Database | Schema | App user | Conn limit | Seeded? |
 |---|---|---|---|---|---|
 | **dev** | `te_mgmt_dev` | `te_dev` | `te_dev_user` | 10 | yes (`SEED_DEV=true`) |
-| **test** | `te_mgmt_test` | `te_test` | `te_test_user` | 15 | yes (`SEED_TEST=true`) |
-| **staging** | `te_mgmt_staging` | `te_staging` | `te_stg_user` | 25 | no (`SEED_STAGING=false`) |
+| **test** | `te_test` | `te_test` | `te_test_user` | 15 | yes (`SEED_TEST=true`) |
+| **staging** | `te_staging` | `te_staging` | `te_stg_user` | 25 | no (`SEED_STAGING=false`) |
 | **prod** | `te_prod` | `te_prod` | `te_prod_user` | 50 | no (`SEED_PROD=false`) |
 
 The database name and owner come from `build/environments/env_<env>.sql` (`db_name`,
 `db_owner`), which `deploy_all.sh` reads; nothing else keeps its own copy. Prod's
-database is `te_prod`, owned by `pgadmin`, to match `infra/terraform-prod` (#172;
+database is `te_prod`, and test and staging are `te_test` and `te_staging`: each owned
+by `pgadmin`, to match its `infra/terraform-<env>` stack (#172;
 `DECISIONS/2026-11-09-prod-db-naming.md`). Where `pgadmin` does not exist yet (a dev
 server, CI, the offline install) `deploy_all.sh` creates it `NOLOGIN`: it owns the
-database and nothing else. Dev, test and staging keep `te_mgmt_<env>` owned by `postgres`.
+database and nothing else. Dev is local-only and keeps `te_mgmt_dev` owned by `postgres`.
 
 Every environment also gets a `csv_uploads` schema in its own database
 (same name across environments — no collision, since each environment is a

docs/ENV_VARIABLES.md

@@ -60,7 +60,7 @@ the environment SQL templates. Copy `build/config.env.example` to
 
 | Variable | Dev | Test | Staging | Prod |
 |---|---|---|---|---|
-| `PG_DB_*` | `te_mgmt_dev` | `te_mgmt_test` | `te_mgmt_staging` | `te_prod` |
+| `PG_DB_*` | `te_mgmt_dev` | `te_test` | `te_staging` | `te_prod` |
 | `PG_SCHEMA_*` | `te_dev` | `te_test` | `te_staging` | `te_prod` |
 | `PG_APP_USER_*` | `te_dev_user` | `te_test_user` | `te_stg_user` | `te_prod_user` |
 | `PG_APP_PASSWORD_*` | _(empty)_ | _(empty)_ | _(empty)_ | _(empty)_ |

evals/runner.py

@@ -557,8 +557,8 @@ def _run_fresh_deploy_then_tests(
 
 ENV_TARGETS = [
     ("dev",     "te_mgmt_dev",     "te_dev"),
-    ("test",    "te_mgmt_test",    "te_test"),
-    ("staging", "te_mgmt_staging", "te_staging"),
+    ("test",    "te_test",    "te_test"),
+    ("staging", "te_staging", "te_staging"),
     ("prod",    "te_prod",    "te_prod"),
 ]
 

infra/terraform-prod/main.tf

@@ -295,7 +295,7 @@ resource "azurerm_postgresql_flexible_server" "pg" {
 # The production database. Its name and the server admin ("pgadmin", the job's
 # PGUSER and the database owner) must equal db_name and db_owner in
 # build/environments/env_prod.example.sql: that file is what build/deploy_all.sh
-# reads. tests/test_prod_db_naming.py fails if they drift (RV-S1, #172;
+# reads. tests/test_azure_db_naming.py fails if they drift (RV-S1, #172;
 # DECISIONS/2026-11-09-prod-db-naming.md).
 resource "azurerm_postgresql_flexible_server_database" "te_prod" {
   name      = "te_prod"