From a0a0697ff5d9d0fe95337ea14dd68284a67dc071 Mon Sep 17 00:00:00 2001
From: Aleksey Safonov <55020240+safal207@users.noreply.github.com>
Date: Fri, 14 Aug 2026 14:49:35 +0700
Subject: [PATCH 1/3] ci: add canonical FCRP credential boundary caller

---
 .github/workflows/fcrp-credential-boundary.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/fcrp-credential-boundary.yml

diff --git a/.github/workflows/fcrp-credential-boundary.yml b/.github/workflows/fcrp-credential-boundary.yml
new file mode 100644
index 0000000..a895d3c
--- /dev/null
+++ b/.github/workflows/fcrp-credential-boundary.yml
@@ -0,0 +1,18 @@
+name: FCRP Credential Boundary
+
+on:
+  push:
+    branches: [main, master, develop]
+  pull_request:
+    branches: [main, master, develop]
+
+permissions:
+  contents: read
+
+jobs:
+  credential-boundary:
+    uses: safal207/ContractGraph-QA/.github/workflows/credential-boundary-reusable.yml@783fd3e09d3ba30dc9eef3c74272d4d2b6874acb
+    permissions:
+      contents: read
+    with:
+      scanner-ref: 783fd3e09d3ba30dc9eef3c74272d4d2b6874acb

From 745c59d67889ce62b2c143a25ab8692a8f64338a Mon Sep 17 00:00:00 2001
From: Aleksey Safonov <55020240+safal207@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:01:45 +0700
Subject: [PATCH 2/3] fix: make local credential boundary fail closed

---
 deploy/docker-compose.mvp1.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/docker-compose.mvp1.yml b/deploy/docker-compose.mvp1.yml
index 3c7c1cf..2d172a7 100644
--- a/deploy/docker-compose.mvp1.yml
+++ b/deploy/docker-compose.mvp1.yml
@@ -7,7 +7,7 @@ services:
     container_name: liminal-postgres
     environment:
       POSTGRES_USER: liminal
-      POSTGRES_PASSWORD: liminal
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
       POSTGRES_DB: liminal
     ports:
       - "5432:5432"
@@ -29,8 +29,8 @@ services:
       dockerfile: liminalqa-ingest/Dockerfile
     container_name: liminal-ingest
     environment:
-      LIMINAL_PG_URL: postgres://liminal:liminal@pg:5432/liminal
-      LIMINAL_API_TOKEN: devtoken
+      LIMINAL_PG_URL: ${LIMINAL_PG_URL:?Set LIMINAL_PG_URL}
+      LIMINAL_API_TOKEN: ${LIMINAL_API_TOKEN:?Set LIMINAL_API_TOKEN}
       RUST_LOG: info
       LIMINAL_BIND_ADDR: 0.0.0.0:8088
     ports:

From 0a437219332b4f80a3057e8967c00b6458299d8a Mon Sep 17 00:00:00 2001
From: Aleksey Safonov <55020240+safal207@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:01:47 +0700
Subject: [PATCH 3/3] fix: make local credential boundary fail closed

---
 .github/workflows/fcrp-credential-boundary.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/fcrp-credential-boundary.yml b/.github/workflows/fcrp-credential-boundary.yml
index a895d3c..59f9c29 100644
--- a/.github/workflows/fcrp-credential-boundary.yml
+++ b/.github/workflows/fcrp-credential-boundary.yml
@@ -11,8 +11,8 @@ permissions:
 
 jobs:
   credential-boundary:
-    uses: safal207/ContractGraph-QA/.github/workflows/credential-boundary-reusable.yml@783fd3e09d3ba30dc9eef3c74272d4d2b6874acb
+    uses: safal207/ContractGraph-QA/.github/workflows/credential-boundary-reusable.yml@cc1d1e227bbb1a25776819e6f2829bfb7a66ee58
     permissions:
       contents: read
     with:
-      scanner-ref: 783fd3e09d3ba30dc9eef3c74272d4d2b6874acb
+      scanner-ref: cc1d1e227bbb1a25776819e6f2829bfb7a66ee58