Align mementos cloud runtime diagnostics

[andrei-hasna]

Summary

• adds an explicit mementos cloud-runtime status contract for local SQLite, unsupported local file sync, PostgreSQL/RDS remote sync, and unsupported S3/AWS mutation
• makes remote PostgreSQL/RDS configuration fail closed for missing, invalid, or non-Postgres URLs and redacts credential-bearing URL parts in CLI/MCP diagnostics
• adds safe PostgreSQL/RDS migration dry-run diagnostics in CLI and MCP without live network/AWS mutation
• updates README and regression coverage for env precedence, redaction, fail-closed behavior, CLI/MCP parity, and storage adapter sync

Validation

• TMPDIR=/tmp BUN_TMPDIR=/tmp HOME=/tmp/mementos-task-73f1b846-home BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache XDG_CACHE_HOME=$PWD/.cache bun test src/lib/storage-sync.test.ts src/cli/index.test.ts src/mcp/index-help.test.ts src/no-cloud-boundary.test.ts -> 72 pass, 0 fail
• TMPDIR=/tmp BUN_TMPDIR=/tmp HOME=/tmp/mementos-task-73f1b846-home BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache XDG_CACHE_HOME=$PWD/.cache bun run typecheck -> passed
• TMPDIR=/tmp BUN_TMPDIR=/tmp HOME=/tmp/mementos-task-73f1b846-home BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache XDG_CACHE_HOME=$PWD/.cache bun run build -> passed
• TMPDIR=/tmp BUN_TMPDIR=/tmp HOME=/tmp/mementos-task-73f1b846-home BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache XDG_CACHE_HOME=$PWD/.cache bun test --isolate --timeout=10000 -> 2090 pass, 0 fail
• git diff --check -> passed
• staged secrets scan via git diff --cached | todos redaction scan -> no secret-like values detected
• manual probes confirmed sqlite:/// remote URLs fail closed and migration dry-run redacts access_token, client_secret, and aws_secret_access_key values

Review

• Independent adversarial reviewer cleared the follow-up commit after verifying invalid URL fail-closed behavior, named query-secret redaction, and storage MCP dry-run parity.

Notes

• No live AWS/RDS mutation, deploy, data migration, spend increase, secret creation, or terraform apply was performed.
• Local commit hooks reported lefthook missing from PATH, but validation and staged secret scan were run explicitly.
• Worker could not post canonical Conversations/Mementos evidence from the isolated worktree because /home/hasna/.hasna/conversations/messages.db and /home/hasna/.hasna/mementos/mementos.db were not writable in the sandbox; this blocker is recorded on the Todos task.

Task: 73f1b846-6f73-4265-a6af-0f08c83aeaff

[andrei-hasna]

Worker update for PR merge queue:

• Added commit 5811f29792cb44d7d9baf71545efe303ceb5648b to fail closed on explicit live migration connection strings before constructing the Postgres adapter.
• Local validation passed: typecheck, focused storage/CLI/MCP tests, full suite with writable test HOME (2091 tests), and build.
• GitHub CI test passed on the updated head at 2026-07-05T19:22:32Z.
• Merge remains blocked by policy: GitHub reviews are still empty and a non-author review/approval is required. Current worker GitHub auth is the PR author, so it cannot provide the required non-author approval.

Follow-up routed for selected non-author reviewer kriptoburak.