Feat v0.7.2 package runners ci gate (#56)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/packages_bundled.go

@@ -51,6 +51,10 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 		return
 	}
 
+	// Resolve first admin user ID for FK-constrained writes (default_surface,
+	// workflow creation).  Falls back to empty string if no admin exists yet.
+	adminUserID := resolveFirstAdminID(stores)
+
 	// Parse allowlist: "" → curated defaults, "*" → all, "a,b" → explicit list
 	allowed := parseBundleAllowlist(allowlist)
 	if allowed != nil {
@@ -78,7 +82,7 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 		}
 
 		pkgPath := filepath.Join(bundledDir, entry.Name())
-		result, err := installBundledPackage(pkgPath, packagesDir, stores, runner)
+		result, err := installBundledPackage(pkgPath, packagesDir, stores, runner, adminUserID)
 		if err != nil {
 			log.Printf("[bundled] ⚠️ Failed to install %s: %v", entry.Name(), err)
 			continue
@@ -125,7 +129,7 @@ func parseBundleAllowlist(s string) map[string]bool {
 
 // installBundledPackage installs a single .pkg archive if its package ID
 // doesn't already exist in the database. Returns "installed" or "skipped".
-func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, runner *sandbox.Runner) (string, error) {
+func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, runner *sandbox.Runner, adminUserID string) (string, error) {
 	ctx := context.Background()
 
 	// Open as zip
@@ -197,8 +201,12 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 		}
 	}
 
-	// Sync permissions — use a minimal gin.Context for the functions that need it
+	// Sync permissions — use a minimal gin.Context for the functions that need it.
+	// Set user_id so FK-constrained writes (workflow creation) reference a real user.
 	fakeCtx := newBackgroundGinContext()
+	if adminUserID != "" {
+		fakeCtx.Set("user_id", adminUserID)
+	}
 	declaredPerms := SyncManifestPermissions(fakeCtx, stores, pkgID, manifest)
 
 	// Bundled packages are trusted — auto-grant all declared permissions
@@ -250,7 +258,7 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 	if (pkgType == "surface" || pkgType == "full") {
 		if raw, err := stores.GlobalConfig.Get(ctx, "default_surface"); err != nil || raw == nil {
 			dflt := models.JSONMap{"id": pkgID}
-			if setErr := stores.GlobalConfig.Set(ctx, "default_surface", dflt, ""); setErr != nil {
+			if setErr := stores.GlobalConfig.Set(ctx, "default_surface", dflt, adminUserID); setErr != nil {
 				log.Printf("[bundled] failed to auto-set default_surface to %s: %v", pkgID, setErr)
 			}
 		}
@@ -324,6 +332,18 @@ func extractPackageAssets(zr *zip.ReadCloser, packagesDir, pkgID string) error {
 	return nil
 }
 
+// resolveFirstAdminID looks up the first user (the bootstrap admin).
+// BootstrapAdmin always runs before InstallBundledPackages, so the
+// first user by creation order is the admin. Returns "" if no users exist.
+func resolveFirstAdminID(stores store.Stores) string {
+	ctx := context.Background()
+	users, _, err := stores.Users.List(ctx, store.ListOptions{Limit: 1})
+	if err != nil || len(users) == 0 {
+		return ""
+	}
+	return users[0].ID
+}
+
 // newBackgroundGinContext creates a minimal gin.Context backed by a
 // background context. Used by startup code that calls functions
 // originally designed for HTTP handlers.