fix: treat dev cd artifact audits as non-blocking

scripts/src/dev-cd-apply.test.mjs

@@ -762,7 +762,7 @@ test("dev-cd status degrades artifact merge provenance when catalog does not mat
   assertNoReadOnlySideEffects(commandLog);
 });
 
-test("apply stops before lock acquisition when artifact merge provenance mismatches deploy-json promotion", async () => {
+test("apply treats artifact audit mismatch as non-blocking when deploy-json promotion desired state passes", async () => {
   const repoRoot = await makeRepo({ commitId: "abc1234" });
   await writeFile(
     artifactReportFixturePath,
@@ -788,7 +788,8 @@ test("apply stops before lock acquisition when artifact merge provenance mismatc
     "--owner-task-id",
     "task-provenance",
     "--kubeconfig",
-    "/etc/rancher/k3s/k3s.yaml"
+    "/etc/rancher/k3s/k3s.yaml",
+    "--full-output"
   ], {
     repoRoot,
     env: {},
@@ -810,10 +811,59 @@ test("apply stops before lock acquisition when artifact merge provenance mismatc
     stdout: { write: (chunk) => { output += chunk; } }
   });
 
+  const summary = JSON.parse(output);
+  assert.equal(code, 0);
+  assert.equal(summary.status, "pass");
+  assert.equal(summary.devCdApply.target.promotionSource, "deploy-json");
+  assert.equal(summary.devCdApply.target.publishRequired, false);
+  assert.equal(summary.devCdApply.target.desiredStateCheck.status, "pass");
+  assert.equal(summary.devCdApply.target.artifactBoundary.status, "degraded");
+  assert.equal(summary.devCdApply.target.artifactBoundary.reportStatus, "stale_or_unrelated");
+  assert.equal(summary.devCdApply.target.artifactBoundary.reportIsReleaseGate, false);
+  assert.equal(commandLog.some((entry) => entry.args.includes("scripts/dev-artifact-publish.mjs")), false);
+  assert.equal(commandLog.some((entry) => entry.args.includes("scripts/refresh-artifact-catalog.mjs")), false);
+  assert.equal(commandLog.some((entry) => entry.args.includes("scripts/deploy-desired-state-plan.mjs")), true);
+  assert.equal(commandLog.some((entry) => entry.args.includes("scripts/dev-deploy-apply.mjs")), true);
+});
+
+test("apply stops before lock acquisition when deploy-json promotion desired-state check fails", async () => {
+  const repoRoot = await makeRepo({ commitId: "abc1234" });
+  const commandLog = [];
+  let output = "";
+  const code = await runDevCdApply([
+    "--apply",
+    "--confirm-dev",
+    "--confirmed-non-production",
+    "--owner-task-id",
+    "task-promotion-check-failed",
+    "--kubeconfig",
+    "/etc/rancher/k3s/k3s.yaml"
+  ], {
+    repoRoot,
+    env: {},
+    runCommand: makeRunCommand({
+      commandLog,
+      targetCommitId: laterControlCommit,
+      headCommitId: laterControlCommit,
+      extraGitRefs: {
+        abc1234: publishedCommit
+      },
+      desiredStatePromotionStatus: "blocked",
+      latestArtifactMergeCommit: artifactMergeCommit,
+      commitParents: {
+        [artifactMergeCommit]: [laterControlCommit, artifactReportCommit],
+        [artifactReportCommit]: [laterControlCommit]
+      }
+    }),
+    httpGetJson: makeHttpGetJson(),
+    now: () => new Date(iso(100000)),
+    stdout: { write: (chunk) => { output += chunk; } }
+  });
+
   const summary = JSON.parse(output);
   assert.equal(code, 2);
   assert.equal(summary.status, "blocked");
-  assert.equal(summary.blockers.some((blocker) => blocker.scope === "artifact-boundary"), true);
+  assert.equal(summary.blockers.some((blocker) => blocker.scope === "desired-state-promotion"), true);
   assert.equal(commandLog.some((entry) => entry.command.includes("kubectl")), false);
   assert.equal(commandLog.some((entry) => entry.args.includes("scripts/dev-artifact-publish.mjs")), false);
   assert.equal(commandLog.some((entry) => entry.args.includes("scripts/dev-deploy-apply.mjs")), false);