Merge pull request #2754 from pikasTech/fix/2721-platform-db-secret-status

fix: 将平台数据库 Endpoints 并存降级为 warning

.agents/skills/unidesk-cicd/SKILL.md

@@ -392,6 +392,10 @@ bun scripts/cli.ts hwlab nodes control-plane legacy-cicd --help
 - 一旦发现 CI/CD CLI 被误用且可能写入错误状态、产生伪证据或绕过目标运行面，必须立刻先把用法改成更符合直觉的公开入口并更新本 skill/reference，再继续验证或交付；不要只靠口头记忆、隐藏 flag、手动约定或后续小心来避免复发。内部 in-cluster 模式必须只由目标 k8s Job/Pod 调用，操作者从本机只能用公开入口提交目标侧 Job 或读取目标侧摘要。
 - PaC migrated consumer 的旧手动 publish/debug 命令不得作为正式 closeout 引导；调查命令默认只能指向只读的 `platform-infra pipelines-as-code status|history`。`closeout` 仅保留只读兼容能力，不得作为主代理、子代理或操作者的 PR 合并后步骤。需要保留的旧 mutation 命令只能属于 YAML 明确的 legacy authority 或独立平台维护，不得标记或引导 manual recovery；单步确认的自动链缺陷必须回到 YAML/controller/源码修复。
 - Secret 只通过 YAML sourceRef/targetKey 和受控 CLI 下发；输出只披露 presence/fingerprint。
+- 平台 PostgreSQL Secret 状态判定：
+  - YAML 声明的 Service 存在，且 EndpointSlice 或 ExternalName 路径有效时，连接桥即成立；
+  - 同名 Endpoints 与 EndpointSlice 并存只能作为 `blocking=false` warning，禁止据此把已对齐的 Secret、OpenFGA 或 cloud-api 判为失败；
+  - Secret、host、database 和 role 已对齐时不得继续输出 `ensure` 写入引导，动态 `next` 只保留必要的只读下钻。
 - D601 独立 k3s 集群：
   - CI/CD、业务 renderer、PipelineRun 和 GitOps 不得写 k3s systemd unit，
     不得把 D601 注册为 NC01 agent，也不得创建跨地域 CNI 或共享 datastore。

scripts/src/hwlab-node/secret-scripts.ts

@@ -1679,6 +1679,13 @@ export function cloudApiDbSecretScript(options: NodeSecretOptions, spec: Runtime
 
 export function secretStatusFromText(text: string, commandOk: boolean, exitCode: number | null, stderr: string, spec: RuntimeSecretSpec): Record<string, unknown> {
   const fields = keyValueLinesFromText(text);
+  const platformBridgeWarnings = fields.platformEndpointsExists === "yes" && fields.platformEndpointSliceExists === "yes"
+    ? [{
+        code: "platform-service-endpoints-coexists",
+        blocking: false,
+        message: "同名 Endpoints 与 EndpointSlice 并存，不影响平台数据库连接桥判定",
+      }]
+    : [];
   if (fields.preset === "owned-postgres-cleanup") {
     const absent = fields.afterStatefulSetExists !== "yes" &&
       fields.afterServiceExists !== "yes" &&
@@ -1956,7 +1963,6 @@ export function secretStatusFromText(text: string, commandOk: boolean, exitCode:
         fields.afterDatabaseUrlPresent === "yes" &&
         typeof afterUrlBytes === "number" && afterUrlBytes > 0;
       const platformBridgeHealthy = fields.platformServiceExists === "yes" &&
-        fields.platformEndpointsExists !== "yes" &&
         (fields.platformEndpointSliceExists === "yes" || fields.platformExternalNameMatches === "yes");
       const uriHealthy = fields.dbHostMatchesPlatform === "yes" &&
         fields.dbNameMatchesExpected === "yes" &&
@@ -1997,6 +2003,7 @@ export function secretStatusFromText(text: string, commandOk: boolean, exitCode:
         dbHostMatchesPlatform: fields.dbHostMatchesPlatform === "yes",
         dbNameMatchesExpected: fields.dbNameMatchesExpected === "yes",
         dbUserMatchesExpected: fields.dbUserMatchesExpected === "yes",
+        warnings: platformBridgeWarnings,
         exitCode,
         stderr: commandOk ? "" : stderr.trim().slice(0, 2000),
         valuesRedacted: true,
@@ -2098,7 +2105,6 @@ export function secretStatusFromText(text: string, commandOk: boolean, exitCode:
       typeof afterAuthnBytes === "number" && afterAuthnBytes > 0 &&
       typeof afterUriBytes === "number" && afterUriBytes > 0;
     const platformBridgeHealthy = fields.platformServiceExists === "yes" &&
-      fields.platformEndpointsExists !== "yes" &&
       (fields.platformEndpointSliceExists === "yes" || fields.platformExternalNameMatches === "yes");
     const uriHealthy = fields.dbHostMatchesPlatform === "yes" &&
       fields.dbNameMatchesExpected === "yes" &&
@@ -2140,6 +2146,7 @@ export function secretStatusFromText(text: string, commandOk: boolean, exitCode:
       dbHostMatchesPlatform: fields.dbHostMatchesPlatform === "yes",
       dbNameMatchesExpected: fields.dbNameMatchesExpected === "yes",
       dbUserMatchesExpected: fields.dbUserMatchesExpected === "yes",
+      warnings: platformBridgeWarnings,
       exitCode,
       stderr: commandOk ? "" : stderr.trim().slice(0, 2000),
       valuesRedacted: true,