feat(P02): complete integration + tech-debt + NFR measurement phase — v0.1.12 tagged

Phase 2 (Integration + Tech-Debt + NFR Measurement) complete.
4 slices, 2 waves, 9 tasks. 4 REQs covered. 60 new tests (469 total).
8 v0.4 P1+ tech-debt findings addressed. Verify: APPROVE_WITH_NOTES.

NFR measurement (p95 latency + guardrail FP/FN), cohort aggregation
assist metrics (5 new metrics, no schema change), assist cost tracking
+ C-3 budget check, tech-debt wave (argon2id offload, cookie-secret
validation, credential enum, f-string SQL, cache persistence, zoneinfo,
audit log, 429 mock).

---ci---
project: praxis
phase: 2
milestone: v0.5
status: complete
requirements:
  covered: [REQ-NFR-ASSIST-01, REQ-IDEATE-04, REQ-IDEATE-06, REQ-IDEATE-07]
  partial: []
---/ci---

db/pg_store.py

@@ -221,13 +221,34 @@ class PgStore:
             return dict(row) if row else None
 
     async def set_credential_status(self, cred_id: str, status: str) -> None:
-        extra = ", revoked_at = now()" if status == "revoked" else ""
+        """Set a credential's status (TASK-12-03, P1+ #4/#8 from v0.4 REVIEW).
+
+        Validates `status` against the allowed enum ('active', 'revoked') +
+        uses two explicit parameterized queries (no f-string interpolation in
+        SQL — P1+ #8 code smell fix). 'revoked' sets revoked_at=now(); 'active'
+        clears revoked_at=NULL (re-activation).
+
+        P1+ #4: the status field is now validated (raises ValueError on invalid
+        status — previously accepted any string).
+        P1+ #8: the f-string interpolation (`, revoked_at = now()` or empty)
+        is replaced with two explicit parameterized queries.
+        """
+        if status not in ("active", "revoked"):
+            raise ValueError(f"Invalid credential status: {status!r}")
         async with self.pool.acquire() as conn:
-            await conn.execute(
-                f"UPDATE issued_credentials SET status = $1{extra} WHERE id = $2",
-                status,
-                cred_id,
-            )
+            if status == "revoked":
+                await conn.execute(
+                    "UPDATE issued_credentials SET status = $1, revoked_at = now() "
+                    "WHERE id = $2",
+                    status, cred_id,
+                )
+            else:
+                # 'active' clears revoked_at (re-activation).
+                await conn.execute(
+                    "UPDATE issued_credentials SET status = $1, revoked_at = NULL "
+                    "WHERE id = $2",
+                    status, cred_id,
+                )
 
     async def list_credentials(self, operator_id: str | None = None) -> list[dict]:
         async with self.pool.acquire() as conn: