feat(integration): wire v2 workstreams together (engine policy/budget, sandbox, tenant checks, order route, docs)

Engine honours org policy and monthly budget, legacy runner skips engine tasks,
sandbox session provisioned on demand, project fallback for threads, reviewer
fallback, tenant checks on project ids, memory reflection respects grants,
expiry worker, MCP pipeline_status, login redirect, sharing settings, e2e smoke.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/tests/test_mcp.py

@@ -20,6 +20,8 @@ rules are ours.
 
 from __future__ import annotations
 
+import json
+
 import pytest
 from httpx import AsyncClient
 from sqlalchemy import select
@@ -38,8 +40,14 @@ from app.infrastructure.db.models import (
     AuditEventRow,
     MembershipRow,
     OrganizationRow,
+    ProjectRow,
     UserRow,
 )
+from app.infrastructure.db.models_delivery import (
+    AppRuntimeRow,
+    PipelineRunRow,
+    ProductionDeployRow,
+)
 from app.infrastructure.db.models_org import McpTokenRow
 from app.interfaces.mcp.gateway import McpGateway
 from tests.conftest import auth_header, signup
@@ -273,12 +281,70 @@ async def test_knowledge_and_pipeline_tools(session_factory, seeded):
     assert empty.ok is True
     assert empty.payload["results"] == []
 
-    # Delivery is another workstream's table; the tool exists and says so.
+    # No app yet: the honest answer is "not available", never an empty delivery state.
     status = await _call(gateway, token, "pipeline_status")
     assert status.ok is True
     assert status.payload["available"] is False
 
 
+async def test_pipeline_status_reports_the_delivery_state_and_no_host_details(
+    session_factory, seeded
+):
+    org_id, user_id = await _org(session_factory, "pipeline-org")
+    project_id = new_id()
+    async with session_factory() as session:
+        session.add(
+            ProjectRow(
+                id=project_id, organization_id=org_id, name="اپ", slug="app",
+                created_by_user_id=user_id,
+            )
+        )
+        await session.flush()
+        session.add(
+            AppRuntimeRow(
+                project_id=project_id, organization_id=org_id,
+                demo_host="pipeline-org.preview.example", host_port=18080,
+                demo_container_id="ctr-secret-42", status="live",
+            )
+        )
+        session.add(
+            PipelineRunRow(
+                id=new_id(), organization_id=org_id, project_id=project_id,
+                trigger="engine", branch="dev", sha="0123456789abcdef", status="succeeded",
+            )
+        )
+        session.add(
+            ProductionDeployRow(
+                id=new_id(), organization_id=org_id, project_id=project_id,
+                kind="deploy", host="deploy-host.internal", status="succeeded",
+                log_tail="token=super-secret-log-line",
+            )
+        )
+        await session.commit()
+    gateway = await _gateway(session_factory)
+    token = await _token(
+        session_factory, gateway, org_id, scopes=["delivery:read"], user_id=user_id
+    )
+
+    status = await _call(gateway, token, "pipeline_status")
+
+    assert status.ok is True
+    payload = status.payload
+    assert payload["available"] is True
+    assert payload["demo_url"] == "https://pipeline-org.preview.example"
+    assert payload["runtime_status"] == "live"
+    assert [run["status"] for run in payload["runs"]] == ["succeeded"]
+    assert payload["runs"][0]["sha"] == "0123456789ab"
+    assert set(payload["last_production_deploy"]) == {"status", "created_at"}
+    assert payload["last_production_deploy"]["status"] == "succeeded"
+    # Rule 7: no port, container id, deploy-target host or log tail leaves the gateway.
+    text = json.dumps(payload, ensure_ascii=False)
+    for hidden in (
+        "host_port", "18080", "ctr-secret-42", "deploy-host.internal", "super-secret-log-line",
+    ):
+        assert hidden not in text
+
+
 async def test_a_task_created_through_a_token_is_attributed_to_its_minter(
     session_factory, seeded
 ):