FN-8274: fix compound-engineering PostgreSQL test URL derivation

Use the shared PostgreSQL test base URL across Compound Engineering's test harnesses.

- Import the core PostgreSQL URL configuration for admin and integration test connections.
- Add a credential-safe source guard for base URL derivation.
- Declare the shared URL export for Compound Engineering tests.

Files changed:
 .../src/__tests__/_harness.ts                      | 15 ++++----
 .../src/__tests__/base-url-derivation.test.ts      | 42 ++++++++++++++++++++++
 .../src/__tests__/pg-test-harness.d.ts             |  1 +
 .../src/__tests__/pipeline-store.pg.test.ts        | 12 +++----
 4 files changed, 57 insertions(+), 13 deletions(-)

Fusion-Task-Id: FN-8274

Fusion-Task-Lineage: 84921b47-4275-4357-9e3a-be025863dbb3

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>

plugins/fusion-plugin-compound-engineering/src/__tests__/_harness.ts

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { execSync } from "node:child_process";
 import { afterAll, vi } from "vitest";
 import { applySchemaBaseline, createAsyncDataLayer, createConnectionSetFromUrl, type AsyncDataLayer, type ResolvedBackend } from "@fusion/core";
-import { PG_AVAILABLE, pgDescribe } from "@fusion/test-utils/pg-test-harness";
+import { PG_AVAILABLE, PG_TEST_URL_BASE, pgDescribe } from "@fusion/test-utils/pg-test-harness";
 export { PG_AVAILABLE, pgDescribe };
 import type {
   CreateInteractiveAiSessionFactory,
@@ -24,12 +24,13 @@ export interface TestHarness {
 const dbName = `ce_harness_${process.pid}_${process.env.VITEST_POOL_ID ?? "0"}_${Math.random().toString(36).slice(2, 8)}`.replace(/[^a-zA-Z0-9_]/g, "_");
 let connections: Awaited<ReturnType<typeof createConnectionSetFromUrl>> | null = null;
 let setupPromise: Promise<void> | null = null;
-// FNXC:PgTestAuthFix 2026-07-14-07:40:
-// The inline admin used process.env.USER for the psql -U flag, which is 'runner' on
-// GitHub Actions (not 'postgres'). Use the PG_TEST_URL_BASE connection string instead.
-// FNXC:PgTestAuthFix 2026-07-18-04:45: default credentials match full-suite.yml service container.
-const PG_TEST_URL_BASE =
-  process.env.FUSION_PG_TEST_URL_BASE ?? "postgresql://postgres:postgres@localhost:5432";
+/*
+FNXC:PgTestAuthFix 2026-07-18-07:40:
+The credentialed local default made embedded Fusion PostgreSQL runs fail because
+that database has no `postgres` role, cascading CI shard 4 failures. Derive all
+CE admin and test URLs from the shared PG_TEST_URL_BASE: its credential-free
+local default works with the current OS role and retains the CI override.
+*/
 function admin(statement: string): void {
   execSync(`psql "${PG_TEST_URL_BASE}/postgres" -v ON_ERROR_STOP=1 -c "${statement}"`, { stdio: "pipe" });
 }

plugins/fusion-plugin-compound-engineering/src/__tests__/base-url-derivation.test.ts

@@ -0,0 +1,42 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { PG_TEST_URL_BASE } from "@fusion/test-utils/pg-test-harness";
+
+const harnessSourcePath = fileURLToPath(new URL("./_harness.ts", import.meta.url));
+const pipelineStoreSourcePath = fileURLToPath(new URL("./pipeline-store.pg.test.ts", import.meta.url));
+
+function readSource(path: string): string {
+  return readFileSync(path, "utf8");
+}
+
+/*
+FNXC:PgTestAuthFix 2026-07-18-07:40:
+CE PostgreSQL tests must use the core harness's configured connection, rather
+than introducing a postgres:postgres local fallback. This source guard runs
+without PostgreSQL so embedded-database and CI credential regressions fail
+before the PG-gated integration suites are reached.
+*/
+describe("CE PostgreSQL test base URL derivation", () => {
+  it("uses the shared configured base URL and its credential-free local default", () => {
+    expect(PG_TEST_URL_BASE).toBe(
+      process.env.FUSION_PG_TEST_URL_BASE ?? "postgresql://localhost:5432",
+    );
+
+    if (process.env.FUSION_PG_TEST_URL_BASE === undefined) {
+      expect(PG_TEST_URL_BASE).not.toContain("postgres:postgres@");
+    }
+  });
+
+  it.each([
+    ["shared CE harness", harnessSourcePath],
+    ["pipeline-store PG integration test", pipelineStoreSourcePath],
+  ])("keeps %s on the shared configured connection", (_name, sourcePath) => {
+    const source = readSource(sourcePath);
+
+    expect(source).toMatch(
+      /import\s*\{[^}]*\bPG_TEST_URL_BASE\b[^}]*\}\s*from\s*["']@fusion\/test-utils\/pg-test-harness["']/s,
+    );
+    expect(source).not.toContain("postgres:postgres@localhost");
+  });
+});

plugins/fusion-plugin-compound-engineering/src/__tests__/pg-test-harness.d.ts

@@ -2,5 +2,6 @@ declare module "@fusion/test-utils/pg-test-harness" {
   import type { describe } from "vitest";
 
   export const PG_AVAILABLE: boolean;
+  export const PG_TEST_URL_BASE: string;
   export const pgDescribe: typeof describe;
 }

plugins/fusion-plugin-compound-engineering/src/__tests__/pipeline-store.pg.test.ts

@@ -34,17 +34,17 @@ import {
 import { CeSessionStore, PlanHandoffClaimError } from "../session/session-store.js";
 import {
   PG_AVAILABLE,
+  PG_TEST_URL_BASE,
   pgDescribe,
 } from "@fusion/test-utils/pg-test-harness";
 
 /*
-FNXC:PgTestAuthFix 2026-07-18-04:45:
-Do not use process.env.USER for psql -U: on GitHub Actions USER is "runner" and
-the service container only has POSTGRES_USER=postgres. Always admin via
-FUSION_PG_TEST_URL_BASE (CI sets postgresql://postgres:postgres@localhost:5432).
+FNXC:PgTestAuthFix 2026-07-18-07:40:
+The credentialed local default made embedded Fusion PostgreSQL runs fail because
+that database has no `postgres` role, cascading CI shard 4 failures. Derive all
+CE admin and test URLs from the shared PG_TEST_URL_BASE: its credential-free
+local default works with the current OS role and retains the CI override.
 */
-const PG_TEST_URL_BASE =
-  process.env.FUSION_PG_TEST_URL_BASE ?? "postgresql://postgres:postgres@localhost:5432";
 
 function adminExec(statement: string): void {
   // Single short psql DDL call (CREATE/DROP DATABASE can't run in a tx). This