test(query): add integration tests for per-tenant AGE graph routing

.gitignore

@@ -11,6 +11,7 @@ agent-notes/
 agent-memory/
 ess/
 .hyperloop/state/
+.hyperloop/intake/
 # ignore ai-generated scratchpad
 src/api/docs
 

.hyperloop/agents/kustomization.yaml

@@ -1,5 +1,5 @@
 resources:
-  - github.com/jsell-rh/hyperloop//base?ref=v0.50.0
+  - github.com/jsell-rh/hyperloop//base?ref=v0.50.2
   - spec-reviewer.yaml
 
 patches:

.hyperloop/agents/process/implementer-overlay.yaml

@@ -110,3 +110,7 @@ guidelines: |
   - The three-step rebase sequence is a pre-submission ritual, not a pre-work ritual: run `git fetch origin && git branch -f alpha origin/alpha && git rebase alpha` as the LAST git action before executing `bash .hyperloop/checks/check-run-backend-suite.sh`; write worker-result.yaml ONLY after the suite outputs "RESULT: ALL PASS"; a branch that was current at the start of the session may be stale by submission time if other tasks merged to alpha during implementation — this is the sole root cause for both task-099 and task-100 FAILs where quality checks passed but submission was rejected due to a 7–8 commit gap with alpha.
   - When `check-no-test-regressions.sh` fails in pass 1 (vs merge-base) due to net line removal in test files where the removed lines FIXED incorrect assertions (e.g. changing a sentinel from `__all__` to `''` and removing an outdated explanatory comment), do NOT restore the broken assertions; instead restore line neutrality by adding compensating documentation comments that explain WHY the prior assertion was incorrect — e.g. "# Previously asserted '__all__' but source now uses '' as the unscoped sentinel" — so the net line count vs merge-base is zero or positive; this is the pass 1 analogue of the alpha-drift false positive: the test was already failing at merge-base, so no passing coverage was lost (root cause of task-141 FAIL: five frontend test files had net negative line count after fixing __all__ → '' assertions, triggering a false positive; the verifier confirmed the removed lines were from already-failing tests).
   - When `check-no-foreign-task-commits.sh` reports a foreign `Task-Ref: task-NNN` commit (not `process-improvement`) and `git show <sha>` produces no source diff against the affected files (content already incorporated into the merge base), remediate with `git rebase -i $(git merge-base HEAD alpha)` and explicitly mark the foreign commit SHA as `drop`; do NOT use the three-step `git rebase alpha` sequence for this case — `git rebase alpha` cannot auto-drop task-NNN commits the way it drops process-improvement commits already on alpha's lineage; after the rebase, run `check-no-foreign-task-commits.sh`, `check-task-owns-branch-commits.sh`, and `check-all-commits-have-task-ref.sh` in sequence before re-running the backend suite (root cause of task-150 FAIL 2: no-op task-146 commit present on branch; interactive rebase drop was the required fix, not `git rebase alpha`).
+  - Run `bash .hyperloop/checks/check-no-state-file-commits.sh` before every `git commit` — not only pre-submission: any `.hyperloop/state/` file staged or present in branch history fails this check; the `.git/info/exclude` rule prevents untracked state files from appearing in `git status`, but git will still stage them if you run `git add <path>` explicitly or if a sub-agent writes them into a tracked directory; run the check before committing so violations are caught while the offending commit is still amendable rather than requiring interactive rebase across multiple commits (root cause of task-099 FAIL: nine sub-task state files task-150.md through task-158.md were committed to the branch and required a full cherry-pick rebuild to excise).
+  - When `check-no-foreign-task-commits.sh` reports commits carrying `Task-Ref: intake` (the pre-task intake phase) or any other non-delivery, non-`process-improvement` Task-Ref value, treat them identically to `process-improvement` foreign commits: inspect each commit with `git show <sha> --name-only` to determine whether it adds new files; if it adds files, the only safe remediation is the clean cherry-pick path — `git checkout -b hyperloop/task-NNN-clean alpha && git cherry-pick <delivery-sha-1> [<delivery-sha-2> ...]`; if it is a no-op (no source diff), use `git rebase -i $(git merge-base HEAD alpha)` with an explicit `drop` of the foreign SHA; `git rebase alpha` cannot auto-drop intake or other non-process-improvement commits because they are not already on alpha's lineage.
+  - After building a clean cherry-pick branch (`git checkout -b hyperloop/task-NNN-clean alpha && git cherry-pick ...`), run the three-step sequence immediately before executing any check script: `git fetch origin && git branch -f alpha origin/alpha && git rebase alpha`; a cherry-pick branch starts at alpha's HEAD at construction time but alpha may advance many commits during or after construction — a branch that was current when built can be 20+ commits stale by submission time if other tasks merged to alpha in the interim; do not assume the -clean branch is still current just because it was recently created (root cause of task-099 FAIL round 2: hyperloop/task-099-clean had correct implementation content but was 24 commits behind alpha at submission, causing check-run-backend-suite.sh to halt entirely).
+  - The backend check suite is mandatory for ALL tasks, including those that modify only frontend files (.vue, .ts): run `bash .hyperloop/checks/check-run-backend-suite.sh` and confirm "RESULT: ALL PASS" before writing worker-result.yaml regardless of the task's domain; `check-frontend-tests-pass.sh` covers only test execution and does NOT run the commit integrity checks (check-all-commits-have-task-ref.sh, check-commit-msg-hook-has-guard.sh, check-task-owns-branch-commits.sh) that apply to every branch; skipping the backend suite for a "frontend task" is what allowed task-149's broken trailer block to reach the verifier undetected.

.hyperloop/agents/process/process-improvement-overlay.yaml

@@ -17,3 +17,7 @@ guidelines: |
   - Run `bash .hyperloop/checks/install-process-agent-pre-commit-hook.sh` as the ABSOLUTE FIRST action in every session — BEFORE branch creation and BEFORE any other command: this installs a git pre-commit hook that mechanically runs check-process-improvement-commit-is-clean.sh for every subsequent `git commit` without any per-commit manual step; the hook is idempotent and safe to re-run; installing it BEFORE branch creation ensures the gate is active even if the checkout fails or the orchestrator has already placed you on the wrong branch — the task-035 recurrence (four process-improvement commits landing directly on the task branch despite overlay rules) was caused by missing this mechanical backstop.
   - Never include a task-specific identifier (e.g. `(task-035)`, `for task-019`) in a process-improvement commit subject: process rules are broadly applicable and a task-scoped subject is a diagnostic signal that the commit was authored while the process agent was running on the wrong branch (a task branch) — any commit whose subject references a specific task number should be treated as contaminated and must not be pushed to alpha.
   - After installing the pre-commit hook, verify it is active by running `cat "$(git rev-parse --git-dir)/hooks/pre-commit" 2>/dev/null | grep -q check-process-improvement-commit-is-clean && echo "hook active" || echo "HOOK MISSING — re-run install-process-agent-pre-commit-hook.sh"`: if the hook is missing despite the install step, the git directory may have changed (e.g., due to a worktree switch) — re-run the install script from the current working directory before proceeding.
+  - When writing any check script that uses `grep -r`, `grep -rn`, or `grep --include=`, always include `--exclude-dir=.venv` in the same grep invocation: recursive grep without this exclusion scans third-party packages in the virtual environment and produces false positives on pattern matches inside installed libraries; run `bash .hyperloop/checks/check-no-check-script-deletions.sh` after writing every new `.sh` file and confirm exit 0 before committing — the sabotage-detection section of that script will FAIL if the new check omits the exclusion (root cause of task-099 FAIL: `string-constants-match-spec.sh` used `grep -r` without `--exclude-dir=.venv` and was flagged as a sabotaged script).
+  - Never commit source code files (any file outside `.hyperloop/`) even when a code defect is discovered during analysis: if you identify a bug while reviewing findings, document it as an observation and stop — creating a `fix(...)` commit touching source files with `Task-Ref: process-improvement` produces the most severe contamination pattern (source-code change + wrong Task-Ref on a task branch) and requires orchestrator-level branch reconstruction to remediate; instead, include the bug description in your process-improvement commit message body so the orchestrator can open a dedicated task for it (root cause of task-145 contamination: commit `457680c9e` changed `services.py` with `Task-Ref: process-improvement`, which check-process-improvement-commit-is-clean.sh invariant (b) should have blocked — the pre-commit hook was not active).
+  - After running `install-process-agent-pre-commit-hook.sh`, immediately verify the hook is actually present and active by running `cat "$(git rev-parse --git-dir)/hooks/pre-commit" 2>/dev/null | grep -c "check-process-improvement-commit-is-clean" | grep -q "^[1-9]" && echo "HOOK ACTIVE" || echo "HOOK MISSING — abort and diagnose"`: if the output is not "HOOK ACTIVE", do NOT proceed — the git directory may have changed due to a worktree switch or session restart; re-run the install script from the current working directory and re-verify; committing without a confirmed-active hook means invariant [2] (no staged files outside .hyperloop/) has NO mechanical enforcement and source-code changes can bypass the check silently (root cause of task-145: hook not verified as active → source code commit slipped through).
+  - Before every `git add` or `git commit`, run `git diff --cached --name-only | grep -v "^\.hyperloop/" | head -5` and confirm empty output: if any path is printed, that file is staged outside .hyperloop/ — unstage it immediately with `git restore --staged <file>` and do NOT commit; this is a manual backstop for the pre-commit hook and catches the case where the hook fails to fire due to a misconfigured git directory; the hook is primary but this manual check is the fallback that the hook cannot provide if it isn't running.