fix: derive workbench smoke report identity

scripts/validate-dev-gate-report.mjs

@@ -1311,6 +1311,8 @@ async function validateDevCloudWorkbenchLiveReport(report, label) {
     "url",
     "evidenceLevel",
     "devLive",
+    "sourceIdentity",
+    "runtimeIdentity",
     "sourceContract",
     "validationCommands",
     "localSmoke",
@@ -1339,6 +1341,7 @@ async function validateDevCloudWorkbenchLiveReport(report, label) {
   assert.equal(report.url, "http://74.48.78.17:16666/", `${label}.url`);
   assert.equal(report.evidenceLevel, report.status === "pass" ? "DEV-LIVE-BROWSER" : "BLOCKED", `${label}.evidenceLevel`);
   assert.equal(report.devLive, report.status === "pass", `${label}.devLive`);
+  assertDevCloudWorkbenchIdentity(report, label);
 
   assertObject(report.sourceContract, `${label}.sourceContract`);
   assertStatus(report.sourceContract.status, `${label}.sourceContract.status`);
@@ -1455,6 +1458,61 @@ async function validateDevCloudWorkbenchLiveReport(report, label) {
   assertString(report.safety.statement, `${label}.safety.statement`);
 }
 
+function assertDevCloudWorkbenchIdentity(report, label) {
+  assertObject(report.sourceIdentity, `${label}.sourceIdentity`);
+  for (const field of ["status", "source", "commitId", "shortCommitId", "ref", "worktreeState", "reportCommitId", "summary"]) {
+    assert.ok(Object.hasOwn(report.sourceIdentity, field), `${label}.sourceIdentity missing ${field}`);
+    assertString(report.sourceIdentity[field], `${label}.sourceIdentity.${field}`);
+  }
+  assert.ok(["observed", "unknown"].includes(report.sourceIdentity.status), `${label}.sourceIdentity.status`);
+  assert.ok(["git-head", "environment", "unknown"].includes(report.sourceIdentity.source), `${label}.sourceIdentity.source`);
+  assert.match(report.sourceIdentity.commitId, /^([a-f0-9]{7,40}|unknown)$/, `${label}.sourceIdentity.commitId`);
+  assert.match(report.sourceIdentity.shortCommitId, /^([a-f0-9]{7,40}|unknown)$/, `${label}.sourceIdentity.shortCommitId`);
+  assert.ok(["clean", "dirty", "unknown"].includes(report.sourceIdentity.worktreeState), `${label}.sourceIdentity.worktreeState`);
+  if (report.sourceIdentity.source === "environment") {
+    assertString(report.sourceIdentity.environmentKey, `${label}.sourceIdentity.environmentKey`);
+  }
+  if (report.sourceIdentity.worktreeState === "clean" && report.sourceIdentity.commitId !== "unknown") {
+    assert.match(report.sourceIdentity.reportCommitId, /^[a-f0-9]{7,40}$/, `${label}.sourceIdentity.reportCommitId`);
+    assert.equal(report.commitId, report.sourceIdentity.reportCommitId, `${label}.commitId must match clean source reportCommitId`);
+  } else {
+    assert.equal(report.sourceIdentity.reportCommitId, "unknown", `${label}.sourceIdentity.reportCommitId`);
+    assert.equal(report.commitId, "unknown", `${label}.commitId must be unknown when source worktree identity is dirty or unknown`);
+  }
+  if (report.sourceIdentity.dirty !== null) {
+    assertBoolean(report.sourceIdentity.dirty, `${label}.sourceIdentity.dirty`);
+    assert.equal(report.sourceIdentity.dirty, report.sourceIdentity.worktreeState === "dirty", `${label}.sourceIdentity.dirty`);
+  }
+
+  assertObject(report.runtimeIdentity, `${label}.runtimeIdentity`);
+  for (const field of ["status", "source", "endpoint", "serviceId", "environment", "healthStatus", "commitId", "commitSource", "imageTag", "observedAt", "summary"]) {
+    assert.ok(Object.hasOwn(report.runtimeIdentity, field), `${label}.runtimeIdentity missing ${field}`);
+    assertString(report.runtimeIdentity[field], `${label}.runtimeIdentity.${field}`);
+  }
+  assert.ok(["observed", "not_observed"].includes(report.runtimeIdentity.status), `${label}.runtimeIdentity.status`);
+  assert.equal(report.runtimeIdentity.source, "health-live", `${label}.runtimeIdentity.source`);
+  assert.equal(report.runtimeIdentity.endpoint, "http://74.48.78.17:16667/health/live", `${label}.runtimeIdentity.endpoint`);
+  assertTimestamp(report.runtimeIdentity.observedAt, `${label}.runtimeIdentity.observedAt`);
+  assert.match(report.runtimeIdentity.commitId, /^([a-f0-9]{7,40}|unknown|not_observed)$/, `${label}.runtimeIdentity.commitId`);
+  if (report.runtimeIdentity.status === "not_observed") {
+    assert.equal(report.runtimeIdentity.commitId, "not_observed", `${label}.runtimeIdentity.commitId`);
+    assertString(report.runtimeIdentity.reason, `${label}.runtimeIdentity.reason`);
+  } else {
+    assert.ok(
+      ["hwlab-cloud-api", "unknown"].includes(report.runtimeIdentity.serviceId),
+      `${label}.runtimeIdentity.serviceId`
+    );
+    assert.ok(["dev", "unknown"].includes(report.runtimeIdentity.environment), `${label}.runtimeIdentity.environment`);
+  }
+  assert.ok(
+    report.sourceIdentity.commitId === "unknown" ||
+      report.runtimeIdentity.commitId === "unknown" ||
+      report.runtimeIdentity.commitId === "not_observed" ||
+      report.runtimeIdentity.commitSource !== "source-git-head",
+    `${label}.runtimeIdentity must not present source git HEAD as the deployed live revision`
+  );
+}
+
 async function validateDevM3Report(report, label) {
   for (const field of [
     "$schema",