fix: 校验 Code Agent Codex home 挂载契约

scripts/deploy-desired-state-plan.test.mjs

@@ -39,6 +39,8 @@ async function makeFixture({
   workloadEnvMirrors = true,
   workloadSkillsCommitId = null,
   workloadCodeAgentProviderEnv = true,
+  workloadCodexHomeVolumeMounts = true,
+  workloadCodexHomeVolumes = true,
   workloadDbEnv = true,
   workloadDbSslMode = "disable"
 } = {}) {
@@ -184,7 +186,7 @@ async function makeFixture({
                         ...workloadProviderEnv
                       ]
                     : [],
-                  ...(serviceId === "hwlab-cloud-api" && workloadCodeAgentProviderEnv
+                  ...(serviceId === "hwlab-cloud-api" && workloadCodeAgentProviderEnv && workloadCodexHomeVolumeMounts
                     ? {
                         volumeMounts: [
                           { name: "hwlab-code-agent-codex-home", mountPath: "/codex-home" },
@@ -195,7 +197,7 @@ async function makeFixture({
                     : {})
                 }
               ],
-              ...(serviceId === "hwlab-cloud-api" && workloadCodeAgentProviderEnv
+              ...(serviceId === "hwlab-cloud-api" && workloadCodeAgentProviderEnv && workloadCodexHomeVolumes
                 ? {
                     volumes: [
                       { name: "hwlab-code-agent-codex-home", emptyDir: {} },
@@ -248,11 +250,48 @@ test("passes when cloud-api preserves provider env and DEV egress contract", asy
   assert.equal(plan.codeAgentProvider.secretRef.present, true);
   assert.equal(plan.codeAgentProvider.egress.deployMatchesDevProxy, true);
   assert.equal(plan.codeAgentProvider.codexHome.present, true);
+  assert.equal(plan.codeAgentProvider.codexHome.writableHomeMountPresent, true);
+  assert.equal(plan.codeAgentProvider.codexHome.emptyDirPresent, true);
   assert.equal(plan.codeAgentProvider.codexHome.configMapPresent, true);
   assert.equal(plan.codeAgentProvider.codexHome.authSecretPresent, true);
   assert.deepEqual(plan.diagnostics, []);
 });
 
+test("blocks when cloud-api CODEX_HOME mount is missing its writable emptyDir volume", async () => {
+  const repoRoot = await makeFixture({ workloadCodexHomeVolumes: false });
+  const plan = await buildDesiredStatePlan({ repoRoot });
+  const diagnostic = plan.diagnostics.find((entry) => entry.code === "code_agent_provider_contract_mismatch");
+
+  assert.equal(plan.status, "blocked");
+  assert.equal(plan.codeAgentProvider.ready, false);
+  assert.equal(plan.codeAgentProvider.codexHome.present, false);
+  assert.equal(plan.codeAgentProvider.codexHome.writableHomeMountPresent, true);
+  assert.equal(plan.codeAgentProvider.codexHome.emptyDirPresent, false);
+  assert.ok(diagnostic);
+  assert.ok(diagnostic.actual.missingCodexHomeContract.includes("/codex-home must be backed by emptyDir"));
+});
+
+test("blocks when cloud-api CODEX_HOME mount is read-only", async () => {
+  const repoRoot = await makeFixture();
+  const workloadsPath = path.join(repoRoot, "deploy/k8s/base/workloads.yaml");
+  const workloads = JSON.parse(await readFile(workloadsPath, "utf8"));
+  workloads.items[0].spec.template.spec.containers[0].volumeMounts.find((entry) =>
+    entry.name === "hwlab-code-agent-codex-home"
+  ).readOnly = true;
+  await writeFile(workloadsPath, `${JSON.stringify(workloads, null, 2)}\n`);
+
+  const plan = await buildDesiredStatePlan({ repoRoot });
+  const diagnostic = plan.diagnostics.find((entry) => entry.code === "code_agent_provider_contract_mismatch");
+
+  assert.equal(plan.status, "blocked");
+  assert.equal(plan.codeAgentProvider.ready, false);
+  assert.equal(plan.codeAgentProvider.codexHome.present, false);
+  assert.equal(plan.codeAgentProvider.codexHome.writableHomeMountPresent, false);
+  assert.equal(plan.codeAgentProvider.codexHome.emptyDirPresent, true);
+  assert.ok(diagnostic);
+  assert.ok(diagnostic.actual.missingCodexHomeContract.includes("/codex-home must be a writable volumeMount"));
+});
+
 test("blocks when cloud-api DB SSL mode drifts back to require", async () => {
   const repoRoot = await makeFixture({
     deployDbSslMode: "require",

scripts/src/deploy-desired-state-plan.mjs

@@ -304,7 +304,9 @@ function inspectCodeAgentProviderDesiredState(ctx, deployService, workloadRecord
         deployMismatches: inspection.deployMismatches.map((entry) => entry.name),
         workloadMismatches: inspection.workloadMismatches.map((entry) => entry.name),
         missingSecretRefs: inspection.missingSecretRefs,
-        missingEgressContract: inspection.missingEgressContract
+        missingEgressContract: inspection.missingEgressContract,
+        missingCodexHomeContract: inspection.missingCodexHomeContract,
+        missingNoProxyContract: inspection.missingNoProxyContract
       },
       secretMaterialRead: false,
       valuesRedacted: true