Gate deploys on backend tests and frontend typecheck; record Phase 1

The new test job runs the 55-test pytest suite and pnpm typecheck
before the deploy job (needs: test) — a red suite now blocks prod.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -5,8 +5,29 @@ on:
     branches: [main]
 
 jobs:
+  test:
+    runs-on: self-hosted
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Backend tests
+        run: |
+          cd backend
+          python3 -m venv /tmp/test-venv
+          /tmp/test-venv/bin/pip install --quiet -r requirements.txt -r requirements-dev.txt
+          /tmp/test-venv/bin/python -m pytest tests/ -q
+
+      - name: Frontend typecheck
+        run: |
+          cd frontend
+          corepack enable
+          pnpm install --frozen-lockfile
+          pnpm typecheck
+
   deploy:
     runs-on: self-hosted
+    needs: test
 
     steps:
       - uses: actions/checkout@v4

codebase-review/PROGRESS.md

@@ -35,11 +35,27 @@ Tracking execution of [07-improvement-plan.md](07-improvement-plan.md). Newest e
 
 ---
 
-## Phase 1 — Foundations: Tests, Migrations, Time 🔄 IN PROGRESS
+## Phase 1 — Foundations: Tests, Migrations, Time ✅ DONE
 
-Started 2026-06-09. Scope per plan: pytest harness + CI gate (1.1), billing-cycle characterization tests resolving BE-06/BE-07 (1.2), Alembic adoption (1.3), datetime sweep (1.4), Decimal-equivalence baseline (1.5).
+Completed 2026-06-09.
 
-_Entries added as work lands — see git history for detail._
+| Plan item | Status | Commit |
+|---|---|---|
+| 1.1 pytest harness, 55-test suite (no network, SQLite fixtures) | ✅ | `c725c14` |
+| 1.1 CI gate: test job (pytest + typecheck) blocks deploy | ✅ | (workflow) |
+| 1.2 Cycle-math characterization + month validation (BE-07) | ✅ | `0a4c3e9`, `c725c14` |
+| 1.3 Alembic adoption: autogen baseline + stamp-or-upgrade startup | ✅ | `9a25c4b` |
+| 1.4 Datetime sweep: 29 utcnow sites → `app.timeutil.utcnow()` | ✅ | `996bd43` |
+| 1.5 Decimal-equivalence baseline (float behavior pinned by tests) | ✅ | `c725c14` |
+| Pre-req: all 20 frontend type errors fixed, typecheck green | ✅ | `49b96ed` |
+
+**Key findings & decisions:**
+- **BE-06 is a FALSE POSITIVE.** `get_cycle_range(Y,M)` returns the cycle *starting* M/18; budget month M composes `get_previous_cycle` → `[(M-1)/18, M/18)`, exactly as the code comment and the frontend convention state. Empirically validated against prod: May 2026 budget's credit-card figure reproduced by independent SQL over the cycle window (95 transactions exactly, refunds to the colón, 0.13% residual from a single EUR transaction the simplified SQL can't convert). Convention now pinned by `tests/test_cycle_math.py` and the docstring.
+- **Datetime strategy:** all DB columns are naive `TIMESTAMP`, so the sweep deliberately keeps naive-UTC semantics via a shared `app/timeutil.py::utcnow()` (non-deprecated API, zero behavior change). Going tz-aware would have poisoned naive/aware comparisons. TIMESTAMPTZ migration deferred to Phase 2 — now a one-line change.
+- **Alembic baseline** (`c3da001a0eb3`) autogenerated against empty Postgres, then schema-diffed against the live schema until column-identical. Two model fixes fell out: `deferred_to_next_cycle` now declares its `server_default` (live DBs have it from the legacy ALTER), `usersettings.data` is JSONB on Postgres (matching live) via a dialect variant. Startup stamps pre-Alembic DBs, upgrades fresh ones, under a pg advisory lock (prod uvicorn runs 2 workers → lifespan runs twice).
+- Verified locally: adoption + idempotent re-run on dev DB, fresh 13-table build on empty DB, full dev-container boot through the Alembic path, 55/55 tests, typecheck 0 errors, production vite build.
+
+**Dev environment note:** backend dev tooling lives in `backend/.venv` (gitignored); `pytest` and `alembic` run from there. See CLAUDE.md for the migration workflow.
 
 ---