diff --git a/deploy/README.md b/deploy/README.md index cf138517..62418206 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -61,8 +61,8 @@ Desired-state commit/image convergence review: ```sh node scripts/deploy-desired-state-plan.mjs --plan --pretty -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty +node scripts/deploy-desired-state-plan.mjs --check +node scripts/deploy-desired-state-plan.mjs --target-ref origin/G14 --pretty node scripts/deploy-desired-state-plan.mjs --target-tag --pretty node scripts/deploy-desired-state-plan.mjs --promotion-commit --check ``` @@ -80,9 +80,10 @@ The plan blocks if generated artifact identity leaks back into `deploy.json`, or if `hwlab-cloud-api` loses the Code Agent provider Secret ref `hwlab-code-agent-provider/openai-api-key`, the `OPENAI_API_KEY` env name, or the DEV egress proxy base-url env. Promotion updates must refresh only the -workspace catalog from a publish report before render; Tekton writes the -refreshed catalog to `G14-gitops`, not back to the source branch. Report files -are contextual evidence only and must not override human-authored source truth. +workspace catalog from a publish report before render; Tekton writes that +catalog to `G14-gitops`, not back to the source branch. Human operators should +not run catalog refresh as a source update. Report files are contextual evidence +only and must not override human-authored source truth. This is source/dry-run support only. It does not prove a registry image exists, does not build, pull, push, apply, restart, or touch PROD, and must not be used diff --git a/docs/artifact-catalog.md b/docs/artifact-catalog.md index 8dbeaec0..a84f98d8 100644 --- a/docs/artifact-catalog.md +++ b/docs/artifact-catalog.md @@ -39,7 +39,7 @@ metadata, then be copied into the catalog by the refresh command below. | `deploy/deploy.json` | Human-authored DEV runtime config such as service topology, env, health, profile, replicas, and endpoints. | | `scripts/g14-gitops-render.mjs` | Declares the Tekton primitive CI tasks and minimal guardrails that generate the G14 CI/CD control plane. | | `scripts/deploy-desired-state-plan.mjs` | Read-only planner/checker for catalog artifact identity, generated identity leakage into deploy config, and deploy/runtime config contracts. | -| `scripts/refresh-artifact-catalog.mjs` | Refreshes source/artifact commit tags and records either blocked `not_published` state or proven publish digests. | +| `scripts/refresh-artifact-catalog.mjs` | Previews artifact catalog identity by default; only G14 Tekton promotion uses `--write` to update `deploy/artifact-catalog.dev.json` before committing generated state to `G14-gitops`. | | `scripts/validate-artifact-catalog.mjs` | Local static validator for the catalog and deploy manifest skeleton. | | `scripts/preflight-dev-base-image.mjs` | Local DEV builder base-image preflight for future artifact publish. | | `docs/dev-base-image-preflight.md` | Operator contract for interpreting preflight readiness and blockers. | @@ -76,8 +76,8 @@ Use the read-only planner before refreshing or reviewing deploy desired-state: ```sh node scripts/deploy-desired-state-plan.mjs --plan --pretty -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty +node scripts/deploy-desired-state-plan.mjs --check +node scripts/deploy-desired-state-plan.mjs --target-ref origin/G14 --pretty node scripts/deploy-desired-state-plan.mjs --target-tag --pretty node scripts/deploy-desired-state-plan.mjs --promotion-commit --check ``` @@ -91,11 +91,10 @@ render because render overwrites them from the catalog. `--check` exits non-zero when the source files are missing or invalid, generated artifact identity leaks into `deploy.json`, an explicit target tag is invalid or -mutable, or catalog artifact identity does not match the requested target. A uniform older -state under `--target-ref` is only allowed in read-only plan mode; with -`--target-ref origin/main --check` it is a blocker because applying it would keep -DEV pinned to stale artifacts. The optional report snapshot is contextual -evidence only and is not an authoritative desired-state source. +mutable, or catalog artifact identity does not match the requested target. The +source branch catalog is only a seed contract; published artifact identity is +stored on `G14-gitops`. The optional report snapshot is contextual evidence only +and is not an authoritative desired-state source. For PR review or CI/CD promotion handoff, use `--promotion-commit --check`. That mode is stricter than a `--target-ref` plan: the catalog @@ -108,42 +107,40 @@ M3 DEV-LIVE. Only real DEV observation of `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` with operation, trace, audit, and evidence records can be called M3 DEV-LIVE. -## Refresh Workflow +## Refresh Boundary -When the source commit changes and no publish report proves digests, refresh the -catalog in blocked mode: +Human source work must not refresh artifact identity into the source branch. To +preview what a blocked catalog would look like, use read-only mode: ```sh -node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check +node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write +node scripts/deploy-desired-state-plan.mjs --check ``` -This updates `deploy/deploy.json`, `deploy/artifact-catalog.dev.json`, and -`deploy/k8s/base/workloads.yaml` to the selected commit tag. It keeps -`artifactState: "contract-skeleton"`, `ciPublished=false`, -`registryVerified=false`, and every service digest as `not_published`. +This prints the planned catalog state and does not modify any repository file. +Blocked skeleton refresh is intentionally preview-only. -After a successful DEV artifact publish, record digests only from the publish -report: +After a successful DEV artifact publish, only the G14 Tekton promotion path may +record digests from the publish report: ```sh -node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check +node scripts/refresh-artifact-catalog.mjs --target-ref --publish-report /workspace/source/dev-artifacts.json --write ``` The publish-report mode refuses to update the catalog unless the report says `artifactPublish.status="published"`, covers every frozen service in the v2 publish plan, matches the target source commit, and contains a valid `sha256` digest for each required service. Disabled services remain `skeleton-only` with -`digest: "not_published"`. +`digest: "not_published"`. The written catalog is committed only to +`G14-gitops`; `deploy/deploy.json` remains human-authored source truth. ## Relationship To `deploy/deploy.json` -`deploy/deploy.json` remains the deploy manifest skeleton. The artifact catalog -does not replace it and must not be consumed as proof that a release was built. -The catalog explains the artifact identity that `deploy/deploy.json` currently -claims, then adds stricter DEV-only rules around commit pinning, image tags, -health paths, forbidden profiles, and publish state. +`deploy/deploy.json` remains the human-authored deploy manifest. The artifact +catalog does not replace it and must not be consumed as proof that a release was +built. GitOps render combines human config from `deploy.json` with generated +artifact identity from the catalog; artifact identity must not be copied back +into `deploy.json`. If a future CI workflow publishes real images, it should update or generate a publish result that includes registry digests and provenance. That publish @@ -177,7 +174,7 @@ Run the local static validator: node --check scripts/deploy-desired-state-plan.mjs node --check scripts/src/deploy-desired-state-plan.mjs node --test scripts/deploy-desired-state-plan.test.mjs -node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check +node scripts/deploy-desired-state-plan.mjs --check node --check scripts/validate-artifact-catalog.mjs node --check scripts/refresh-artifact-catalog.mjs node --check scripts/preflight-dev-base-image.mjs @@ -185,7 +182,8 @@ node --check scripts/src/dev-base-image-preflight.mjs node scripts/validate-artifact-catalog.mjs ``` -The validator and refresh command read only local repository files and optional -publish reports. The desired-state planner has the same read-only boundary. +The validator and refresh command read local repository files and optional +publish reports; refresh is read-only unless `--write` is explicitly supplied. +The desired-state planner has the same read-only boundary. These commands do not contact a registry, read secrets, build images, push images, deploy to DEV, or deploy to PROD. diff --git a/docs/dev-gate-preflight.md b/docs/dev-gate-preflight.md index 50c52917..7dfbd4ea 100644 --- a/docs/dev-gate-preflight.md +++ b/docs/dev-gate-preflight.md @@ -136,7 +136,7 @@ commit changed but publish is still blocked: ```sh node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty -node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked +node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked --no-write ``` Only use the published refresh path after `/tmp/hwlab-dev-gate/dev-artifacts.json` @@ -144,7 +144,7 @@ proves every frozen service has a registry digest for that same source commit: ```sh node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty -node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json +node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json --no-write ``` Committed DEV artifact reports can prove required service digests only for the diff --git a/docs/reference/g14-gitops-cicd.md b/docs/reference/g14-gitops-cicd.md index 491ee043..93723c43 100644 --- a/docs/reference/g14-gitops-cicd.md +++ b/docs/reference/g14-gitops-cicd.md @@ -69,9 +69,9 @@ HWLAB 是 monorepo，G14 CI/CD 加速必须按组件输入判断构建和滚动 - 服务清单兼容顺序固定为：显式 `--services`、`deploy.services[]`、`deploy.k3s.serviceMappings[]`、`internal/protocol.SERVICE_IDS`。因此旧 `deploy/deploy.json` 形态和当前完整 `deploy.services[]` 形态都必须能被 planner 识别。 - 组件边界固定由 `scripts/src/g14-ci-plan-lib.mjs` 的内建 service-path model 定义；如需新增或调整 `componentPaths`、`sharedPaths`、`runtimeDeps` 或 `buildSystemPaths`，直接修改 planner 库和对应测试，不再额外维护 repo-local commands/forbidden skeleton。 - `scripts/g14-artifact-publish.mjs` 默认启用组件级 lazy build：先运行 planner，再只构建/推送 `affectedServices`，`reusedServices` 从 `deploy/artifact-catalog.dev.json` 复用已有 sha256 digest；如果 catalog 没有可验证 digest，planner 直接把该服务列为 affected 并重新发布，不能用旧 guard 阻塞，也不能退回 Docker 或 legacy full-build 路线。 -- `scripts/g14-artifact-publish.mjs` 的 publish report 必须携带 planner 的 per-service 元数据；`scripts/refresh-artifact-catalog.mjs` 只把生成的 `commitId`、`image`、`imageTag`、`digest`、`publishState` 和 component provenance 字段复制进当前 workspace 的 `deploy/artifact-catalog.dev.json`。Tekton promotion 只把刷新后的 catalog 写入 `G14-gitops`；`deploy/deploy.json` 是人写的 runtime config 真相源，不得被 promotion 回写镜像身份字段。 +- `scripts/g14-artifact-publish.mjs` 的 publish report 必须携带 planner 的 per-service 元数据；`scripts/refresh-artifact-catalog.mjs` 默认只预览，只有 G14 Tekton promotion 显式传 `--write` 时，才把生成的 `commitId`、`image`、`imageTag`、`digest`、`publishState` 和 component provenance 字段写进当前 workspace 的 `deploy/artifact-catalog.dev.json`，随后只提交到 `G14-gitops`。`deploy/deploy.json` 是人写的 runtime config 真相源，不得被 promotion、refresh 脚本或人工发布流程回写镜像身份字段。 - `scripts/g14-gitops-render.mjs` 只支持混合 desired state：workload 的 container image、`HWLAB_IMAGE`、`HWLAB_IMAGE_TAG` 和 pod template `source-commit` 来自 `deploy/artifact-catalog.dev.json` 的 per-service artifact identity；普通 env、replica、healthPath、profile 等配置来自 `deploy/deploy.json`。全局 GitOps metadata 仍记录本次 source commit。`--legacy-source-images` 与 `HWLAB_G14_USE_DEPLOY_IMAGES=0` 已废弃，不得把所有 workload image 回退渲染为同一个 source commit tag。 -- G14 Tekton promotion 在推送 `G14-gitops` 前，必须用 publish report 刷新 workspace 内的 `deploy/artifact-catalog.dev.json`，然后把刷新后的 catalog 和 rendered GitOps desired state 一起提交到 `G14-gitops`。promotion 不得自动修改或推送 `G14` source branch，也不得自动修改 `deploy/deploy.json` 或 `deploy/k8s/base/workloads.yaml`，这样人写配置不会和 CI 生成身份反复冲突。 +- G14 Tekton promotion 在推送 `G14-gitops` 前，必须用 publish report 显式 `--write` 刷新 workspace 内的 `deploy/artifact-catalog.dev.json`，然后把刷新后的 catalog 和 rendered GitOps desired state 一起提交到 `G14-gitops`。promotion 不得自动修改或推送 `G14` source branch，也不得自动修改 `deploy/deploy.json` 或 `deploy/k8s/base/workloads.yaml`，这样人写配置不会和 CI 生成身份反复冲突。 - Tekton 并发化只能以 planner 输出作为输入；每个 service 都有独立 TaskRun，changed service 启动 BuildKit，unchanged service 只写 reuse result 并复用 catalog digest，且不能改 pod template，避免无意义 rollout。没有完整 per-service desired state 证据时，必须修复 planner/catalog 证据，不能使用 `--full-build`、`--legacy-source-images`、DIND 或 Docker fallback 回退。 ## 加速判定与当前瓶颈 diff --git a/package.json b/package.json index c2e93ef7..6df5a553 100644 --- a/package.json +++ b/package.json @@ -18,7 +18,7 @@ "deploy:contract:plan": "node scripts/deploy-contract-plan.mjs --pretty", "deploy:contract:check": "node scripts/deploy-contract-plan.mjs --check", "deploy:desired-state:plan": "node scripts/deploy-desired-state-plan.mjs --pretty", - "deploy:desired-state:check": "node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check", + "deploy:desired-state:check": "node scripts/deploy-desired-state-plan.mjs --check", "cli:health": "node tools/hwlab-cli/bin/hwlab-cli.mjs health", "cli:dry-run": "node tools/hwlab-cli/bin/hwlab-cli.mjs test e2e --env dev --mvp", "cli:projects": "node tools/hwlab-cli/bin/hwlab-cli.mjs project list", @@ -28,7 +28,7 @@ "web:m3-control-panel": "node web/hwlab-cloud-web/scripts/m3-control-panel-guard.mjs", "web:check": "node web/hwlab-cloud-web/scripts/check.mjs && node --test web/hwlab-cloud-web/message-markdown.test.mjs web/hwlab-cloud-web/scripts/trace-scroll.test.mjs", "web:build": "node web/hwlab-cloud-web/scripts/build.mjs", - "artifact-catalog:refresh-blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked", + "artifact-catalog:preview-blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write", "g14:gitops:render": "node scripts/g14-gitops-render.mjs", "cicd:jobs": "node tools/hwlab-cli/bin/hwlab-cli.mjs cicd jobs", "docs:validate:m3-rollout": "node scripts/validate-m3-rollout-runbook.mjs", diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs index 99cf8b5a..93d61713 100644 --- a/scripts/g14-gitops-render.mjs +++ b/scripts/g14-gitops-render.mjs @@ -914,7 +914,7 @@ check_source_head before-render git config --global user.name "HWLAB G14 GitOps Bot" git config --global user.email "hwlab-g14-gitops-bot@users.noreply.github.com" if [ -s /workspace/source/dev-artifacts.json ]; then - node scripts/refresh-artifact-catalog.mjs --target-ref "$(params.revision)" --publish-report /workspace/source/dev-artifacts.json + node scripts/refresh-artifact-catalog.mjs --target-ref "$(params.revision)" --publish-report /workspace/source/dev-artifacts.json --write fi node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)" --use-deploy-images node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)" --use-deploy-images --check diff --git a/scripts/refresh-artifact-catalog.mjs b/scripts/refresh-artifact-catalog.mjs index cc6a1b53..fdb74181 100644 --- a/scripts/refresh-artifact-catalog.mjs +++ b/scripts/refresh-artifact-catalog.mjs @@ -29,7 +29,7 @@ function parseArgs(argv) { targetRef: "HEAD", publishReportPath: null, blocked: false, - write: true + write: false }; for (let index = 0; index < argv.length; index += 1) { @@ -40,6 +40,8 @@ function parseArgs(argv) { args.publishReportPath = readOption(argv, ++index, arg); } else if (arg === "--blocked") { args.blocked = true; + } else if (arg === "--write") { + args.write = true; } else if (arg === "--no-write") { args.write = false; } else if (arg === "--help" || arg === "-h") { @@ -52,6 +54,7 @@ function parseArgs(argv) { if (!args.help) { assert.notEqual(args.blocked && Boolean(args.publishReportPath), true, "--blocked and --publish-report are mutually exclusive"); assert.ok(args.blocked || args.publishReportPath, `choose --blocked or --publish-report ${defaultPublishReportPath}`); + assert.ok(!args.write || args.publishReportPath, "--write requires --publish-report; blocked skeleton refresh must stay preview-only"); } return args; @@ -67,13 +70,15 @@ function readOption(argv, index, name) { function usage() { return [ - "usage: node scripts/refresh-artifact-catalog.mjs --target-ref REF (--blocked|--publish-report PATH) [--no-write]", + "usage: node scripts/refresh-artifact-catalog.mjs --target-ref REF (--blocked|--publish-report PATH) [--write|--no-write]", "", - "Refresh DEV deploy/catalog artifact identity without faking digest evidence.", + "Preview or explicitly write DEV artifact catalog identity without faking digest evidence.", + "Default mode is read-only. --write is reserved for G14 Tekton GitOps promotion and never writes deploy/deploy.json.", "", "examples:", - " node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked", - ` node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report ${defaultPublishReportPath}` + " node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write", + ` node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --publish-report ${defaultPublishReportPath} --no-write`, + ` node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --publish-report ${defaultPublishReportPath} --write` ].join("\n"); } diff --git a/scripts/refresh-artifact-catalog.test.mjs b/scripts/refresh-artifact-catalog.test.mjs index cf4be29d..0baeb9d0 100644 --- a/scripts/refresh-artifact-catalog.test.mjs +++ b/scripts/refresh-artifact-catalog.test.mjs @@ -93,6 +93,63 @@ test("refresh accepts an absolute publish report path", async () => { assert.equal(payload.services[0].componentInputHash, `${String(1).padStart(64, "a")}`); }); +test("refresh is read-only by default", async () => { + const commitId = await git(["rev-parse", "HEAD"]); + const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]); + const tempDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-refresh-default-readonly-")); + const reportPath = path.join(tempDir, "dev-artifacts.json"); + await writeFile(reportPath, `${JSON.stringify({ + reportVersion: "v1", + taskId: "g14-artifact-publish", + commitId: shortCommitId, + artifactPublish: { + status: "published", + mode: "publish", + sourceCommitId: commitId, + registryPrefix: "127.0.0.1:5000/hwlab", + serviceCount: SERVICE_IDS.length, + requiredServiceCount: SERVICE_IDS.length, + disabledServiceCount: 0, + publishedCount: SERVICE_IDS.length, + publishPlan: { + version: "v2", + services: SERVICE_IDS.map((serviceId, index) => ({ + serviceId, + required: true, + digest: digestFor(index), + image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`, + imageTag: shortCommitId + })) + }, + services: SERVICE_IDS.map((serviceId, index) => ({ + serviceId, + status: "published", + artifactRequired: true, + image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`, + imageTag: shortCommitId, + digest: digestFor(index), + repositoryDigest: `127.0.0.1:5000/hwlab/${serviceId}@${digestFor(index)}` + })) + } + }, null, 2)}\n`); + + const result = await execFileAsync(process.execPath, [ + "scripts/refresh-artifact-catalog.mjs", + "--target-ref", + "HEAD", + "--publish-report", + reportPath + ], { + cwd: repoRoot, + timeout: 15000, + maxBuffer: 10 * 1024 * 1024 + }); + const payload = JSON.parse(result.stdout); + assert.equal(payload.status, "published"); + assert.deepEqual(payload.wrote, []); + assert.equal(payload.deployTruthPolicy, "deploy.json is human-authored runtime config; artifact promotion must not rewrite it"); +}); + test("refresh keeps reused service image tags from the publish report", async () => { const commitId = await git(["rev-parse", "HEAD"]); const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]); diff --git a/scripts/src/artifact-runtime-readiness-guard.mjs b/scripts/src/artifact-runtime-readiness-guard.mjs index ec9bcdb5..205fd6d6 100644 --- a/scripts/src/artifact-runtime-readiness-guard.mjs +++ b/scripts/src/artifact-runtime-readiness-guard.mjs @@ -98,7 +98,7 @@ export function evaluateArtifactRuntimeReadiness({ pass: commitsMatch(catalog.commitId, target.commitId), type: "observability_blocker", summary: `Artifact catalog commit=${catalog.shortCommitId}; target=${target.shortCommitId}.`, - nextTask: "Refresh desired-state and artifact catalog identity to latest origin/main before apply." + nextTask: "Do not refresh source desired-state. Let G14 Tekton promotion write artifact catalog identity to G14-gitops, then verify Argo/runtime revision." }); addCheck(checks, { id: "artifact-report-catalog-match", @@ -119,7 +119,7 @@ export function evaluateArtifactRuntimeReadiness({ pass: desiredState.matchesTarget, type: "observability_blocker", summary: `Desired-state deploy=${desiredState.deployCommitId}; target=${target.shortCommitId}; convergence=${desiredState.targetConvergence.state}; pending=${desiredState.targetConvergence.pendingTargetFields}.`, - nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check after refreshing desired-state for latest origin/main.` + nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check as a read-only review, then rely on G14 Tekton promotion for catalog writes.` }); addCheck(checks, { id: "rollout-read-access", @@ -140,7 +140,7 @@ export function evaluateArtifactRuntimeReadiness({ pass: apiRuntime.observed && commitsMatch(apiRuntime.commitId, target.commitId), type: "runtime_blocker", summary: `API /health/live commit=${apiRuntime.shortCommitId}; target=${target.shortCommitId}.`, - nextTask: "After publish and desired-state refresh, run the authorized DEV rollout path and re-observe /health/live." + nextTask: "After publish and GitOps promotion, verify Argo DEV rollout and re-observe /health/live." }); addCheck(checks, { id: "api-runtime-artifact-match", diff --git a/scripts/src/deploy-desired-state-plan.mjs b/scripts/src/deploy-desired-state-plan.mjs index 1358d346..c86aaef0 100644 --- a/scripts/src/deploy-desired-state-plan.mjs +++ b/scripts/src/deploy-desired-state-plan.mjs @@ -709,8 +709,8 @@ function targetCommands(target) { if (target.targetRef) { commands.push( `node scripts/deploy-desired-state-plan.mjs --target-ref ${target.targetRef} --pretty`, - `node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked`, - `node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath}` + `node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked --no-write`, + `node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath} --no-write` ); } return commands; @@ -971,7 +971,7 @@ export async function buildDesiredStatePlan(options = {}) { humanAuthoredTruth: [deployPath, workloadsPath], artifactIdentityTruth: [catalogPath], nonAuthoritativeEvidence: [artifactReportPath], - note: "This planner reviews source desired-state only. deploy.json is human-authored config; artifact-catalog carries generated image identity. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence." + note: "This planner is read-only. deploy.json is human-authored config; artifact-catalog carries generated image identity and is written by G14 Tekton promotion only to G14-gitops. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence." }, cloudApiDb: cloudApiDb ?? { status: "blocked", diff --git a/scripts/src/dev-gate-preflight.mjs b/scripts/src/dev-gate-preflight.mjs index 5fbc9aaf..539d2ff3 100644 --- a/scripts/src/dev-gate-preflight.mjs +++ b/scripts/src/dev-gate-preflight.mjs @@ -465,8 +465,8 @@ async function artifactIdentityFor({ deploy, catalog, artifactReport, targetComm matchesSource: targetCoverage.covered && catalogMatchesSource && servicesMatchSource, publishVerified, refreshCommands: { - blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked`, - published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath}` + blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked --no-write`, + published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath} --no-write` } }; }