chore: remove live dataset guards and broken tests

Author: zinic

AGENTS.md

@@ -16,7 +16,6 @@ These instructions apply to the entire repository.
 - Always format after code edits. Use `make format` unless a narrower formatting command is clearly sufficient for the touched files.
 - `make test_all` is the default validation command. It runs unit tests and all integration suites.
 - Integration suites consume `CONNECTION_STRING`. If `CONNECTION_STRING` is not present in the LLM context, ask the user to add it before running `make test_all`.
-- Destructive integration suites also require `DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1` and an exact credential-free target in `DAWGS_INTEGRATION_DISPOSABLE_TARGETS`. Never add the live benchmark database to that allowlist.
 - Run `make test_all` only for the backend selected by the scheme in `CONNECTION_STRING`. Tests for other backends should skip themselves.
 - Core integration cases in `integration/testdata/cases` and `integration/testdata/templates` must be backend-equivalent. Do not add driver-specific skips or driver-specific expected assertions to these suites. If a backend capability needs dedicated coverage, put it in a clearly driver-scoped test that is skipped unless `CONNECTION_STRING` selects that backend.
 - `make test` is available for unit tests only.

Makefile

@@ -129,7 +129,6 @@ test_all: test test_integration test_bdd_integration
 
 test_integration:
 	@echo "Running all integration tests..."
-	@$(GO_CMD) run ./cmd/integrationguard
 	@$(GO_CMD) test -tags 'manual_integration integration' -race -cover -count=1 -p=1 -parallel=1 $(MAIN_PACKAGES)
 test_bdd_integration:
 	@echo "Running all BDD integration tests..."
@@ -144,12 +143,10 @@ bench_diff:
 
 test_neo4j:
 	@echo "Running Neo4j integration tests..."
-	@$(GO_CMD) run ./cmd/integrationguard
 	@$(GO_CMD) test -tags integration -race -cover -count=1 -p=1 -parallel=1 $(MAIN_PACKAGES)
 
 test_pg:
 	@echo "Running PostgreSQL integration tests..."
-	@$(GO_CMD) run ./cmd/integrationguard
 	@$(GO_CMD) test -tags manual_integration -race -cover -count=1 -p=1 -parallel=1 $(MAIN_PACKAGES)
 
 test_update:
@@ -304,8 +301,6 @@ quality_backend: test
 		echo "PG_CONNECTION_STRING and NEO4J_CONNECTION_STRING are required."; \
 		exit 1; \
 	fi
-	@CONNECTION_STRING="$(PG_CONNECTION_STRING)" $(GO_CMD) run ./cmd/integrationguard
-	@CONNECTION_STRING="$(NEO4J_CONNECTION_STRING)" $(GO_CMD) run ./cmd/integrationguard
 	@set +e; \
 	CONNECTION_STRING="$(PG_CONNECTION_STRING)" $(GO_CMD) test -json -tags 'manual_integration integration' -race -cover -count=1 -p=1 -parallel=1 $(MAIN_PACKAGES) > $(BACKEND_PG_REPORT); \
 	pg_status=$$?; \

README.md

@@ -89,8 +89,6 @@ Export the `CONNECTION_STRING` environment variable for the PostgreSQL or Neo4j
 
 ```bash
 export CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:65432/dawgs"
-export DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1
-export DAWGS_INTEGRATION_DISPOSABLE_TARGETS="postgresql://localhost:65432/dawgs"
 make test_integration
 ```
 
@@ -99,10 +97,9 @@ export CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:654
 make test_bdd_integration
 ```
 
-Integration suites and fixture-loading GraphBench runs delete graph data. The
-acknowledgement and credential-free target allowlist above are both required;
-an absent or mismatched target is rejected before testing. Existing-graph
-GraphBench runs reject mutating cases and do not require destructive
+Integration suites and fixture-loading GraphBench runs delete graph data.
+Existing-graph GraphBench runs reject mutating cases and do not require
+fixture loading.
 acknowledgement. PostgreSQL sessions remain read-write so temporary traversal
 workspaces use the same reset strategy as production.
 
@@ -128,9 +125,7 @@ measures real driver batch APIs. It reloads or clears its fixture outside the
 timed region and validates post-state after every iteration:
 
 ```bash
-DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1 \
-DAWGS_INTEGRATION_DISPOSABLE_TARGETS="postgresql://localhost:65432/dawgs" \
-  CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:65432/dawgs" \
+CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:65432/dawgs" \
   go test -tags manual_integration ./integration -run '^$' \
   -bench BenchmarkMutationSafeDirectWrites -benchtime=1x
 ```
@@ -160,9 +155,7 @@ edge-kind-selective, and multi-path shortest-path scenarios before recording tim
 `make plan_corpus` captures plan diagnostics for the shared Cypher integration corpus. It accepts either
 `CONNECTION_STRING` for one backend or `PG_CONNECTION_STRING` and `NEO4J_CONNECTION_STRING` for both backends, then
 writes JSONL captures and markdown/JSON summaries under `.coverage/`. Captures record the DAWGS source version, which
-can be overridden with a command flag when needed. Because it reloads fixtures, it also requires
-`DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1` and every selected credential-free target in
-`DAWGS_INTEGRATION_DISPOSABLE_TARGETS`.
+can be overridden with a command flag when needed. It reloads fixtures for each selected backend.
 
 `go run ./cmd/graphbench` captures runtime diagnostics for the scale corpus under `benchmark/testdata/scale`. The
 implemented execution modes are `postgres_sql` and `neo4j`; `local_traversal` is an explicit, non-gating
@@ -362,9 +355,7 @@ cardinality, and checks stable mutation-target and anchored edge-index
 invariants. Run it directly with:
 
 ```bash
-DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1 \
-DAWGS_INTEGRATION_DISPOSABLE_TARGETS="postgresql://localhost:65432/dawgs" \
-  CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:65432/dawgs" \
+CONNECTION_STRING="postgresql://dawgs:weneedbetterpasswords@localhost:65432/dawgs" \
   go test -tags manual_integration ./cmd/graphbench \
   -run 'Test(PostgreSQLScalePlanInvariants|ScaleCorpusRequiredRepresentativesDeclareCardinality)' \
   -count=1

cmd/benchmark/main_integration_test.go

@@ -30,7 +30,6 @@ import (
 	"github.com/specterops/dawgs/cypher/frontend"
 	"github.com/specterops/dawgs/cypher/models/pgsql/optimize"
 	"github.com/specterops/dawgs/cypher/models/pgsql/translate"
-	"github.com/specterops/dawgs/databaseguard"
 	"github.com/specterops/dawgs/drivers/pg"
 	"github.com/specterops/dawgs/graph"
 	"github.com/specterops/dawgs/util/size"
@@ -47,9 +46,6 @@ func postgresBenchmarkIntegrationConnection(t *testing.T) string {
 	if !strings.HasPrefix(normalized, "postgres://") && !strings.HasPrefix(normalized, "postgresql://") {
 		t.Skip("CONNECTION_STRING is not a PostgreSQL connection string")
 	}
-	if err := databaseguard.ValidateEnvironment(connection); err != nil {
-		t.Fatalf("integration database safety check failed: %v", err)
-	}
 	return connection
 }
 

cmd/graphbench/README.md

@@ -50,12 +50,9 @@ malformed, duplicated, mismatched, or unchecksummed untracked entries/copies.
 
 GraphBench clears and reloads fixtures. A non-blocking local lock at
 `.coverage/graphbench.lock` prevents overlapping processes; override it with
-`-destructive-lock`. Runners on different hosts must use distinct disposable
-databases because a filesystem lock cannot coordinate across machines.
-Fixture-loading runs also require `DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1` and
-an exact credential-free target in `DAWGS_INTEGRATION_DISPOSABLE_TARGETS`, for
-example `postgresql://localhost:65432/dawgs`. Non-mutating `-existing-graph`
-runs do not require this acknowledgement; their PostgreSQL sessions remain
+`-destructive-lock`. Runners on different hosts must use distinct databases
+because a filesystem lock cannot coordinate across machines. Non-mutating
+`-existing-graph` runs reject writes; their PostgreSQL sessions remain
 read-write so temporary workspace behavior matches production.
 
 ## Examples
@@ -1814,9 +1811,7 @@ uses rollback isolation for writes and runs automatically under
 Run only the scale-plan gate with:
 
 ```bash
-DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE=1 \
-DAWGS_INTEGRATION_DISPOSABLE_TARGETS="postgresql://localhost:65432/dawgs" \
-  CONNECTION_STRING="$PG_CONNECTION_STRING" \
+CONNECTION_STRING="$PG_CONNECTION_STRING" \
   go test -tags manual_integration ./cmd/graphbench \
   -run 'Test(PostgreSQLScalePlanInvariants|ScaleCorpusRequiredRepresentativesDeclareCardinality)' \
   -count=1

cmd/graphbench/destructive_guard_test.go

@@ -29,7 +29,6 @@ import (
 	"time"
 
 	"github.com/specterops/dawgs/cypher/models/pgsql/optimize"
-	"github.com/specterops/dawgs/databaseguard"
 	"github.com/specterops/dawgs/testutil"
 )
 
@@ -1495,9 +1494,6 @@ func main() {
 		if pgConnection == "" {
 			fatal("P5 adjacency feasibility capture requires -pg-connection, -connection, PG_CONNECTION_STRING, or CONNECTION_STRING")
 		}
-		if err := databaseguard.ValidateEnvironment(pgConnection); err != nil {
-			fatal("refuse destructive P5 adjacency feasibility target: %v", err)
-		}
 		runLock, err := acquireDestructiveRunLock(cfg.DestructiveLock)
 		if err != nil {
 			fatal("acquire destructive run lock: %v", err)
@@ -1895,9 +1891,6 @@ func main() {
 			if connection == "" {
 				continue
 			}
-			if err := databaseguard.ValidateEnvironment(connection); err != nil {
-				fatal("refuse destructive GraphBench target: %v", err)
-			}
 		}
 
 		runLock, err := acquireDestructiveRunLock(cfg.DestructiveLock)

cmd/graphbench/main.go

@@ -25,7 +25,6 @@ import (
 
 	neo4jcore "github.com/neo4j/neo4j-go-driver/v5/neo4j"
 	"github.com/specterops/dawgs"
-	"github.com/specterops/dawgs/databaseguard"
 	dawgsneo4j "github.com/specterops/dawgs/drivers/neo4j"
 	"github.com/specterops/dawgs/graph"
 	"github.com/specterops/dawgs/opengraph"
@@ -46,10 +45,6 @@ type neo4jRunner struct {
 
 // newNeo4jRunner opens a Neo4j driver and selects the optional database encoded in the URI.
 func newNeo4jRunner(ctx context.Context, datasetDir, connection string, corpus ScaleCorpus) (*neo4jRunner, error) {
-	if err := databaseguard.ValidateEnvironment(connection); err != nil {
-		return nil, fmt.Errorf("refuse destructive Neo4j GraphBench target: %w", err)
-	}
-
 	db, err := dawgs.Open(ctx, dawgsneo4j.DriverName, dawgs.Config{
 		GraphQueryMemoryLimit: size.Gibibyte,
 		ConnectionString:      connection,

cmd/graphbench/neo4j.go

@@ -19,7 +19,6 @@ import (
 	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/specterops/dawgs"
-	"github.com/specterops/dawgs/databaseguard"
 	"github.com/specterops/dawgs/drivers/pg"
 	pgquery "github.com/specterops/dawgs/drivers/pg/query"
 	"github.com/specterops/dawgs/graph"
@@ -190,9 +189,6 @@ type p5AdjacencyRowQueryer interface {
 // deliberately separate from the normal corpus runner and does not load,
 // translate, or execute any Cypher query.
 func runP5AdjacencyFeasibilityCapture(ctx context.Context, cfg config, connection string, args []string) (_ P5AdjacencyFeasibilityReport, err error) {
-	if err := databaseguard.ValidateEnvironment(connection); err != nil {
-		return P5AdjacencyFeasibilityReport{}, err
-	}
 	if cfg.PoolSize != 1 {
 		return P5AdjacencyFeasibilityReport{}, fmt.Errorf("P5 adjacency feasibility capture requires pool-size 1")
 	}

cmd/graphbench/p5_adjacency_feasibility.go

@@ -10,25 +10,27 @@ package main
 import (
 	"context"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/specterops/dawgs/databaseguard"
 	"github.com/stretchr/testify/require"
 )
 
+func isPostgreSQLConnection(connection string) bool {
+	normalized := strings.ToLower(connection)
+	return strings.HasPrefix(normalized, "postgres://") || strings.HasPrefix(normalized, "postgresql://")
+}
+
 func TestP5AdjacencyTaggedPGXStatementVisibleToPGStatStatements(t *testing.T) {
 	connection := os.Getenv("CONNECTION_STRING")
 	if connection == "" {
 		t.Skip("CONNECTION_STRING env var is not set")
 	}
-	target, err := databaseguard.Target(connection)
-	require.NoError(t, err)
-	if len(target) < len("postgresql://") || target[:len("postgresql://")] != "postgresql://" {
+	if !isPostgreSQLConnection(connection) {
 		t.Skip("CONNECTION_STRING is not a PostgreSQL connection string")
 	}
-	require.NoError(t, databaseguard.ValidateEnvironment(connection))
 
 	ctx := context.Background()
 	graphState, err := openP5AdjacencyGraph(ctx, connection)
@@ -67,12 +69,9 @@ func TestP5AdjacencyCalibrationAttributesTaggedStatementWAL(t *testing.T) {
 	if connection == "" {
 		t.Skip("CONNECTION_STRING env var is not set")
 	}
-	target, err := databaseguard.Target(connection)
-	require.NoError(t, err)
-	if len(target) < len("postgresql://") || target[:len("postgresql://")] != "postgresql://" {
+	if !isPostgreSQLConnection(connection) {
 		t.Skip("CONNECTION_STRING is not a PostgreSQL connection string")
 	}
-	require.NoError(t, databaseguard.ValidateEnvironment(connection))
 
 	ctx := context.Background()
 	resetP5AdjacencyTestState(t, ctx, connection)