Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- The highway lock shall install auth==3.5.0 (wheel sha256 3e0a7ba8e7ebdce1d8095691fe88debf1eda1faaa5ee2570ac0f751ba08a54dd).
- When initialize_auth_schema runs, it shall call auth.check_schema(engine) once, after create_tables(raise_on_error=True) and after the fixed required-table check.
- If check_schema raises SchemaMismatchError, then initialize_auth_schema shall re-raise it and the migrations container shall exit non-zero.
- If any of the seven required auth_rbac tables is absent, then initialize_auth_schema shall raise naming them, even when the installed auth models declare no tables (check_schema alone passes that case vacuously).
- check_schema shall not run on a request path (one catalog read per process start; auth measured 467 ms over TLS).

TECHNICAL PROBLEMS:
1. Schema drift detection between an embedded ORM's models and the live catalog.

SOLUTION DOMAINS:
- auth library's own check_schema (house tool, auth #37, 3.5.0). Diff 3.4.0 -> 3.5.0: new auth/schema_check.py, create_tables calls check_schema, two exports; nothing else.

ALTERNATIVES:
- auth.check_schema [CHOSEN]: maintained with the models by their owner, covers missing tables too.
- keep missing_model_columns [REJECTED]: duplicates the library, drifts when auth changes schemas.
- defer to after the first CI deploy [REJECTED]: batch is unpushed; one auth bump instead of two.

Follows #1045.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1052