fix: keep deploy manifest human-authored

scripts/deploy-desired-state-plan.test.mjs

@@ -28,7 +28,7 @@ async function makeFixture({
   deployEnvCommitId = commitId,
   deployEnvImageTag = commitId,
   deployEnvImage = null,
-  deployEnvMirrors = true,
+  deployEnvMirrors = false,
   deploySkillsCommitId = null,
   deployCodeAgentProviderEnv = true,
   deployDbEnv = true,
@@ -123,25 +123,25 @@ async function makeFixture({
   const deploy = {
     manifestVersion: "v1",
     environment: "dev",
-    commitId,
     services: [
       {
         serviceId,
-        image,
         namespace: "hwlab-dev",
         healthPath: "/health/live",
         profile: "dev",
         replicas: 1,
-        env: deployEnvMirrors
-          ? {
+        env: {
+          ...(deployEnvMirrors
+            ? {
               HWLAB_COMMIT_ID: deployEnvCommitId,
               HWLAB_IMAGE: deployEnvImage ?? image,
               HWLAB_IMAGE_TAG: deployEnvImageTag,
-              ...(deploySkillsCommitId ? { HWLAB_SKILLS_COMMIT_ID: deploySkillsCommitId } : {}),
-              ...dbEnv,
-              ...providerEnv
+              ...(deploySkillsCommitId ? { HWLAB_SKILLS_COMMIT_ID: deploySkillsCommitId } : {})
             }
-          : {}
+            : {}),
+          ...dbEnv,
+          ...providerEnv
+        }
       }
     ]
   };
@@ -256,19 +256,16 @@ test("passes internally consistent desired-state", async () => {
   const plan = await buildDesiredStatePlan({ repoRoot });
   assert.equal(plan.status, "pass");
   assert.equal(plan.summary.desiredCommitId, "abc1234");
-  assert.equal(plan.summary.presentMirrorCount, 6);
+  assert.equal(plan.summary.presentMirrorCount, 3);
   assert.deepEqual(plan.diagnostics, []);
 });
 
 test("passes mixed desired-state when unchanged services reuse service-level artifact tags", async () => {
   const repoRoot = await makeFixture({
     commitId: "803ba22",
-    deployImageTag: "6a84959",
     catalogCommitId: "803ba22",
     catalogServiceCommitId: "6a84959",
     catalogImageTag: "6a84959",
-    deployEnvCommitId: "6a84959",
-    deployEnvImageTag: "6a84959",
     workloadTag: "6a84959",
     workloadEnvCommitId: "6a84959",
     workloadEnvImageTag: "6a84959"
@@ -278,16 +275,16 @@ test("passes mixed desired-state when unchanged services reuse service-level art
 
   assert.equal(plan.status, "pass");
   assert.equal(plan.summary.desiredCommitId, "803ba22");
-  assert.equal(plan.services[0].deploy.imageTag, "6a84959");
+  assert.equal(plan.services[0].deploy.artifactIdentity, "human-authored-config");
   assert.equal(plan.services[0].catalog.commitId, "6a84959");
   assert.deepEqual(plan.diagnostics, []);
 });
 
-test("passes when cloud-web owns runtime identity mirrors", async () => {
-  const repoRoot = await makeFixture({ serviceId: "hwlab-cloud-web" });
+test("passes when cloud-web relies on render-generated runtime identity mirrors", async () => {
+  const repoRoot = await makeFixture({ serviceId: "hwlab-cloud-web", workloadEnvMirrors: false });
   const plan = await buildDesiredStatePlan({ repoRoot });
   assert.equal(plan.status, "pass");
-  assert.equal(plan.summary.presentMirrorCount, 6);
+  assert.equal(plan.summary.presentMirrorCount, 0);
   assert.deepEqual(plan.diagnostics, []);
 });
 
@@ -362,21 +359,21 @@ test("blocks when cloud-api DB SSL mode drifts back to require", async () => {
   assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "cloud_api_db_contract_mismatch"));
 });
 
-test("blocks when cloud-web runtime identity mirrors are missing", async () => {
+test("blocks when generated runtime identity leaks into deploy.json", async () => {
   const repoRoot = await makeFixture({
     serviceId: "hwlab-cloud-web",
-    deployEnvMirrors: false,
+    deployEnvMirrors: true,
     workloadEnvMirrors: false
   });
   const plan = await buildDesiredStatePlan({ repoRoot });
   assert.equal(plan.status, "blocked");
-  assert.equal(plan.summary.blockers, 6);
+  assert.equal(plan.summary.blockers, 3);
   assert.ok(plan.diagnostics.some((diagnostic) =>
-    diagnostic.code === "missing_mirror" &&
+    diagnostic.code === "generated_artifact_identity" &&
     diagnostic.path === "deploy/deploy.json.services.hwlab-cloud-web.env.HWLAB_COMMIT_ID"
   ));
   assert.ok(plan.diagnostics.some((diagnostic) =>
-    diagnostic.code === "missing_mirror" &&
+    diagnostic.code === "generated_artifact_identity" &&
     diagnostic.path.endsWith(".env.HWLAB_IMAGE_TAG")
   ));
 });
@@ -410,7 +407,8 @@ test("target tag review is read-only promotion_pending when current state is uni
   assert.equal(plan.status, "planned");
   assert.equal(plan.target.convergence.state, "promotion_pending");
   assert.equal(plan.summary.blockers, 0);
-  assert.match(plan.services[0].promotion.deployImage, /:def5678$/u);
+  assert.equal(plan.services[0].promotion.deployImage, null);
+  assert.match(plan.services[0].promotion.catalogImage, /:def5678$/u);
 });
 
 test("target check blocks when current desired-state is uniformly older", async () => {
@@ -421,7 +419,7 @@ test("target check blocks when current desired-state is uniformly older", async
   assert.equal(plan.target.convergenceRequirement, "target-check");
   assert.ok(plan.diagnostics.some((diagnostic) =>
     diagnostic.code === "target_desired_state_mismatch" &&
-    diagnostic.message.includes("stale desired-state is not pinned")
+    diagnostic.message.includes("stale artifact catalog is not pinned")
   ));
 });
 
@@ -490,31 +488,28 @@ test("promotion commit check blocks an explicit non-matching target tag", async
   assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "promotion_tag_mismatch"));
 });
 
-test("blocks on mirror drift", async () => {
+test("ignores generated workload mirror drift because render owns runtime identity", async () => {
   const repoRoot = await makeFixture({ workloadEnvImageTag: "badcafe" });
   const plan = await buildDesiredStatePlan({ repoRoot });
-  assert.equal(plan.status, "blocked");
-  assert.equal(plan.summary.blockers, 1);
-  assert.equal(plan.diagnostics[0].code, "mirror_mismatch");
-  assert.match(plan.diagnostics[0].path, /HWLAB_IMAGE_TAG/u);
+  assert.equal(plan.status, "pass");
+  assert.deepEqual(plan.diagnostics, []);
 });
 
-test("blocks on skills commit mirror drift", async () => {
-  const repoRoot = await makeFixture({ deploySkillsCommitId: "badcafe" });
+test("blocks on skills commit mirror leak in deploy.json", async () => {
+  const repoRoot = await makeFixture({ deployEnvMirrors: true, deploySkillsCommitId: "badcafe" });
   const plan = await buildDesiredStatePlan({ repoRoot });
   assert.equal(plan.status, "blocked");
   assert.ok(plan.diagnostics.some((diagnostic) =>
-    diagnostic.code === "mirror_mismatch" &&
+    diagnostic.code === "generated_artifact_identity" &&
     diagnostic.path.endsWith("HWLAB_SKILLS_COMMIT_ID")
   ));
 });
 
-test("blocks on workload image drift", async () => {
+test("ignores workload image drift because catalog is artifact truth", async () => {
   const repoRoot = await makeFixture({ workloadTag: "badcafe" });
   const plan = await buildDesiredStatePlan({ repoRoot });
-  assert.equal(plan.status, "blocked");
-  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_tag_mismatch"));
-  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_mismatch"));
+  assert.equal(plan.status, "pass");
+  assert.deepEqual(plan.diagnostics, []);
 });
 
 test("reports partial target drift when catalog top-level commit moves but services stay old", async () => {