@starci/skills 1.1.0 → 1.2.0

package/operators/release-deploy/self-test.mjs

@@ -1,235 +1,235 @@
-// Proves validate.mjs on a synthetic session branch: one steady deployment, one that took the
-// recovery fallback, one that took both fallbacks and ended rolled back, one blocked on an unproven
-// steady state, and one mutation per law, each of which must fail with a line that names the defect.
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { validateReleaseStep } from './validate.mjs';
-
-const RELEASE = 'release:2026.01.10-1';
-const PREVIOUS = 'release:2026.01.03-2';
-const DIGEST = `sha256:${'1'.repeat(64)}`;
-const SAFE_DIGEST = `sha256:${'2'.repeat(64)}`;
-const TARGET = 'production/api';
-const APPROVAL = '@worktrees/businesses/features/release/model.json#deploy-grant';
-const MANIFEST = '.stacks/production/api.manifest.json';
-const ARTIFACT = '@remote/ghcr/starci/academy-api';
-const DEADLINE = 600;
-const PROBES = [
-  { probeId: 'public-graphql-typename', kind: 'public', endpointRef: 'https://api.example/graphql', expectStatus: 200 },
-];
-const ROLLBACK = { releaseId: PREVIOUS, artifactRef: ARTIFACT, digest: SAFE_DIGEST, dataCompatible: true };
-
-const observation = (at, condition, status = 'pass') => ({
-  observedAt: at, condition, activeReleaseIds: [RELEASE], activeDigest: DIGEST, availableTargets: 1,
-  probeResults: [{ probeId: 'public-graphql-typename', status, observedStatus: status === 'pass' ? 200 : 502, observedAt: at }],
-});
-
-const probesJson = ({ observations = [observation('2026-01-10T00:01:00.000Z', 'progressing'), observation('2026-01-10T00:07:00.000Z', 'steady')], finalCondition = 'steady', deadlineSeconds = DEADLINE, elapsedSeconds = 420, backoffSeconds = 30 } = {}) => ({
-  deadlineSeconds, elapsedSeconds, backoffSeconds, observations, finalCondition,
-});
-
-const NL = String.fromCharCode(10);
-const STEPS = [
-  ['`authorize`', 'applied', '—', '—', 'the declared grant covers this project, environment and target'],
-  ['`rollout`', 'applied', '4', '5', 'the target moved to the immutable digest'],
-  ['`monitor`', 'applied', '—', '—', 'the window was observed to its end'],
-];
-
-function responseMd({
-  release = RELEASE, digest = DIGEST, target = TARGET, approval = APPROVAL, deadline = DEADLINE,
-  rollbackId = PREVIOUS, outcome = 'deployed', branch = 'none', steps = STEPS,
-  monitoring = { Deadline: DEADLINE, Elapsed: 420, Backoff: 30, 'Final condition': 'steady' },
-  steady = { 'Active digest': DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' },
-  fallbacksTaken = [],
-} = {}) {
-  return `# release-deployment — ${release}
-
-The immutable release reached its declared target under the declared grant, and the steady state
-rests on the observed digest, the available targets and every declared probe across the window.
-
-## Binding
-
-| Field | Value |
-| --- | --- |
-| Operator | \`release.deploy\` |
-| Step | \`step-1/parallel-1\` |
-| Project | \`starci-academy\` |
-| Release | ${release} |
-| Artifact | \`${ARTIFACT}\` |
-| Digest | \`${digest}\` |
-| Target | ${target} |
-| Environment | production |
-| Replaced release | \`${PREVIOUS}\` |
-| Approval | ${approval} |
-| Manifest | \`${MANIFEST}\` |
-| Steady deadline | ${deadline} |
-| Rollback identity | ${rollbackId} |
-
-## Outcome
-
-| Field | Value |
-| --- | --- |
-| Outcome | ${outcome} |
-| Branch | ${branch} |
-
-## Steps
-
-| Step | State | Revision before | Revision after | Statement |
-| --- | --- | --- | --- | --- |
-${steps.map((s) => `| ${s[0]} | ${s[1]} | ${s[2]} | ${s[3]} | ${s[4]} |`).join('\n')}
-
-## Monitoring
-
-| Field | Value |
-| --- | --- |
-| Deadline | ${monitoring.Deadline} |
-| Elapsed | ${monitoring.Elapsed} |
-| Backoff | ${monitoring.Backoff} |
-| Final condition | ${monitoring['Final condition']} |
-
-## Steady state
-
-| Metric | Value |
-| --- | --- |
-${Object.entries(steady).map(([k, v]) => `| ${k} | ${/^sha256:/.test(String(v)) ? `\`${v}\`` : v} |`).join('\n')}
-
-## Findings
-
-| Code | Step | Statement |
-| --- | --- | --- |
-| \`IDEMPOTENT_NO_OP\` | \`host-prepare\` | the host already matched the declaration |
-
-## Fallbacks taken
-
-| Code | Action |
-| --- | --- |
-${fallbacksTaken.map((c) => `| \`${c}\` | the branch was taken and recorded |`).join(NL)}
-`;
-}
-
-const requestJson = ({ release = RELEASE, target = TARGET, approval = APPROVAL, probes = PROBES, deadline = DEADLINE, rollbackIdentity = ROLLBACK, extra = {} } = {}) => ({
-  schemaVersion: 9, operatorId: 'release.deploy', step: 1, parallel: 1, sessionId: 's-test',
-  contexts: [{ alias: '@remote/ghcr/starci/academy-api', head: null }],
-  requirements: { release, target, approval, probes, steadyDeadline: deadline, rollbackIdentity, resume: null, ...extra },
-  inputs: { 'quality-verification': 'step-1/parallel-1/response/quality.md' }, resume: null,
-});
-
-const responseJson = ({ status = 'done', stop, fallbacks = [], next = ['platform.operate'] } = {}) => ({
-  schemaVersion: 9, operatorId: 'release.deploy', step: 1, parallel: 1, status, ...(stop ? { stop } : {}),
-  fallbacks,
-  fields: status === 'blocked' ? {} : { 'release-deployment': 'response/response.md', probes: 'response/data/probes.json' },
-  commits: [], next,
-});
-
-function writeBranch(files) {
-  const session = mkdtempSync(path.join(tmpdir(), 'release-session-'));
-  const branch = path.join(session, 'step-1', 'parallel-1');
-  for (const d of ['request', 'response/data', 'response/artifacts']) mkdirSync(path.join(branch, d), { recursive: true });
-  writeFileSync(path.join(session, 'state.json'), JSON.stringify({ id: 's-test', chain: [['1/1']], steps: { '1/1': 'release.deploy' }, current: '1/1', status: 'running' }));
-  writeFileSync(path.join(branch, 'response', 'quality.md'), '# quality\n');
-  for (const [name, content] of Object.entries(files)) {
-    if (content === null) continue;
-    writeFileSync(path.join(branch, name), typeof content === 'string' ? content : JSON.stringify(content, null, 2));
-  }
-  return { branch, session };
-}
-
-const baseline = (over = {}) => ({
-  'request/request.json': requestJson(),
-  'response/response.json': responseJson(),
-  'response/response.md': responseMd(),
-  'response/data/probes.json': probesJson(),
-  ...over,
-});
-
-
-// The recovery fallback: two failing observations, then steady again on the same release.
-const recovered = () => baseline({
-  'response/response.json': responseJson({ fallbacks: ['ROLLOUT_FAILED'] }),
-  'response/data/probes.json': probesJson({
-    observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:03:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:07:00.000Z', 'steady')],
-  }),
-  'response/response.md': responseMd({
-    branch: 'recover',
-    steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'the approved reversible action restored the target']],
-    fallbacksTaken: ['ROLLOUT_FAILED'],
-  }),
-});
-
-// Both fallbacks in order: the recovery ran out and the safe release was restored by digest.
-const rolledBack = () => baseline({
-  'response/response.json': responseJson({ fallbacks: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'] }),
-  'response/data/probes.json': probesJson({
-    observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:03:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:09:00.000Z', 'steady')],
-  }),
-  'response/response.md': responseMd({
-    outcome: 'rolled-back', branch: 'rollback',
-    steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'the approved actions ran out'], ['`rollback`', 'applied', '6', '7', 'the safe release was restored by digest']],
-    steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' },
-    fallbacksTaken: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'],
-  }),
-});
-
-async function expectValid(files, label) {
-  const { branch, session } = writeBranch(files);
-  const { errors } = await validateReleaseStep(branch);
-  rmSync(session, { recursive: true, force: true });
-  assert.deepEqual(errors, [], `${label} should be valid`);
-}
-async function expectError(files, needle, label) {
-  const { branch, session } = writeBranch(files);
-  const { errors } = await validateReleaseStep(branch);
-  rmSync(session, { recursive: true, force: true });
-  assert.ok(errors.some((e) => e.includes(needle)), `${label}: expected an error containing "${needle}", got:\n${errors.join('\n') || '(none)'}`);
-}
-
-await expectValid(baseline(), 'a steady deployment of the immutable release');
-await expectValid(recovered(), 'the recovery fallback taken after a persistent failure');
-await expectValid(rolledBack(), 'both fallbacks in order, ending in a restored release');
-await expectValid({
-  'request/request.json': requestJson(),
-  'response/response.json': responseJson({ status: 'blocked', stop: 'STEADY_STATE_UNPROVEN', next: [] }),
-  'response/response.md': null, 'response/data/probes.json': null,
-}, 'blocked because the steady window never closed');
-
-await expectError(baseline({ 'response/response.json': { ...responseJson(), stop: 'ROLLOUT_FAILED' } }), 'only a blocked response carries a stop', 'done with a stop');
-await expectError(baseline({ 'response/response.json': responseJson({ status: 'blocked', stop: 'ROLLOUT_FAILED', next: [] }) }), 'has disposition fallback under these requirements', 'a fallback code used to block the branch');
-await expectError(baseline({ 'response/response.json': responseJson({ fallbacks: ['STEADY_STATE_UNPROVEN'] }) }), 'cannot be taken as a fallback', 'a terminate code taken as a fallback');
-await expectError(baseline({
-  'response/response.json': responseJson({ fallbacks: ['RECOVERY_EXHAUSTED'] }),
-  'response/response.md': responseMd({ outcome: 'rolled-back', branch: 'rollback', steps: [...STEPS, ['`rollback`', 'applied', '6', '7', 'restored']], steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' }, fallbacksTaken: ['RECOVERY_EXHAUSTED'] }),
-}), 'reached only through an exhausted recovery', 'a rollback that skipped the recovery branch');
-await expectError(baseline({ 'request/request.json': requestJson({ extra: { strategy: 'rolling' } }) }), 'requirements.strategy is not a field', 'a field the operator no longer declares');
-await expectError(baseline({ 'request/request.json': requestJson({ approval: null }) }), 'required field approval has no value', 'a production deploy nobody approved');
-await expectError(baseline({ 'request/request.json': requestJson({ probes: [{ probeId: 'container-health', kind: 'internal', endpointRef: 'unix:///health', expectStatus: 200 }] }), 'response/data/probes.json': probesJson({ observations: [{ ...observation('2026-01-10T00:01:00.000Z', 'progressing'), probeResults: [{ probeId: 'container-health', status: 'pass', observedStatus: 200, observedAt: '2026-01-10T00:01:00.000Z' }] }, { ...observation('2026-01-10T00:07:00.000Z', 'steady'), probeResults: [{ probeId: 'container-health', status: 'pass', observedStatus: 200, observedAt: '2026-01-10T00:07:00.000Z' }] }] }) }), 'at least one declared probe is public', 'a run proving only container health');
-await expectError(baseline({ 'request/request.json': requestJson({ rollbackIdentity: { ...ROLLBACK, digest: 'v1.4.0' } }) }), 'a rollback by tag restores whatever the tag now points at', 'a rollback identity named by tag');
-await expectError(baseline({ 'request/request.json': requestJson({ extra: { release: RELEASE }, target: TARGET, approval: 'ghp_abcdefghijklmnopqrstuvwxyz' }) }), 'looks like a resolved credential value', 'a token where a handle belongs');
-await expectError(baseline({ 'request/request.json': requestJson({ deadline: 120 }) }), 'but the request pinned 120s', 'monitoring measured against another deadline');
-await expectError(baseline({ 'response/data/probes.json': probesJson({ elapsedSeconds: 900 }) }), 'ran past its own bounded deadline', 'monitoring that outran its deadline');
-await expectError(baseline({ 'response/data/probes.json': probesJson({ backoffSeconds: 900 }) }), 'backoff cannot exceed the deadline', 'a backoff wider than the window');
-await expectError({
-  ...recovered(),
-  'response/data/probes.json': probesJson({ observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:07:00.000Z', 'steady')] }),
-}, 'one transient probe is not a persistent failure', 'recovery entered on a single failing probe');
-await expectError(baseline({ 'response/data/probes.json': probesJson({ finalCondition: 'deadline-exceeded' }) }), 'which is STEADY_STATE_UNPROVEN, not a deployment', 'a deployment over an exceeded deadline');
-await expectError(baseline({ 'response/response.md': responseMd({ release: 'release:someone-elses' }) }), 'but the request bound', 'a receipt for another release');
-await expectError(baseline({ 'response/response.md': responseMd({ digest: 'latest' }) }), 'identified by its digest, never by a tag', 'a release named by tag');
-await expectError(baseline({ 'response/response.md': responseMd({ approval: '`someone-elses-grant`' }) }), 'names an approval the request did not bind', 'a grant borrowed from another deployment');
-await expectError(baseline({ 'response/response.md': responseMd({ branch: 'recover' }) }), 'but the fallbacks taken say none', 'a branch the fallbacks never recorded');
-await expectError({
-  ...rolledBack(),
-  'response/response.md': responseMd({ outcome: 'deployed', branch: 'rollback', steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'x'], ['`rollback`', 'applied', '6', '7', 'y']], fallbacksTaken: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'] }),
-}, 'a restored release is its own terminal', 'a rollback reported as delivery');
-await expectError(baseline({ 'response/response.md': responseMd({ steps: [['`authorize`', 'applied', '—', '—', 'x'], ['`rollout`', 'applied', '4', '4', 'y'], ['`monitor`', 'applied', '—', '—', 'z']] }) }), 'claims it applied without moving a revision', 'an application that moved nothing');
-await expectError(baseline({ 'response/response.md': responseMd({ steps: [['`authorize`', 'applied', '2', '3', 'x'], ['`rollout`', 'applied', '4', '5', 'y'], ['`monitor`', 'applied', '—', '—', 'z']] }) }), 'reports a revision for a boundary it never touched', 'a reading step inventing a revision');
-await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' } }) }), 'while another digest is active', 'a deployment over the old digest');
-await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': DIGEST, 'Available targets': '1 of 2', 'Superseded active': '0', 'Window elapsed': '300' } }) }), 'a partly available target set is not steady state', 'one target absorbing the load for two');
-await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': DIGEST, 'Available targets': '1 of 1', 'Superseded active': '1', 'Window elapsed': '300' } }) }), 'still serving traffic', 'a superseded target left active');
-await expectError(baseline({ 'response/data/probes.json': probesJson({ observations: [observation('2026-01-10T00:07:00.000Z', 'steady')] }) }), 'claimed from a single observation', 'steady state read off one probe');
-await expectError(baseline({ 'response/response.md': responseMd({ monitoring: { Deadline: DEADLINE, Elapsed: 420, Backoff: 30, 'Final condition': 'progressing' } }) }), 'but the series ended steady', 'a receipt disagreeing with its own series');
-await expectError(baseline({ 'response/data/probes.json': { ...probesJson(), finalCondition: 'nope' } }), 'finalCondition', 'probes schema');
-await expectError(baseline({ 'response/response.md': responseMd().replace('## Steady state', '## Stable state') }), 'missing section ^## Steady state$', 'receipt section renamed');
-
-process.stdout.write('release.deploy self-test: 4 valid branches, 26 rejected mutations\n');
+// Proves validate.mjs on a synthetic session branch: one steady deployment, one that took the
+// recovery fallback, one that took both fallbacks and ended rolled back, one blocked on an unproven
+// steady state, and one mutation per law, each of which must fail with a line that names the defect.
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { validateReleaseStep } from './validate.mjs';
+
+const RELEASE = 'release:2026.01.10-1';
+const PREVIOUS = 'release:2026.01.03-2';
+const DIGEST = `sha256:${'1'.repeat(64)}`;
+const SAFE_DIGEST = `sha256:${'2'.repeat(64)}`;
+const TARGET = 'production/api';
+const APPROVAL = '@worktrees/businesses/features/release/model.json#deploy-grant';
+const MANIFEST = '.stacks/production/api.manifest.json';
+const ARTIFACT = '@remote/ghcr/starci/academy-api';
+const DEADLINE = 600;
+const PROBES = [
+  { probeId: 'public-graphql-typename', kind: 'public', endpointRef: 'https://api.example/graphql', expectStatus: 200 },
+];
+const ROLLBACK = { releaseId: PREVIOUS, artifactRef: ARTIFACT, digest: SAFE_DIGEST, dataCompatible: true };
+
+const observation = (at, condition, status = 'pass') => ({
+  observedAt: at, condition, activeReleaseIds: [RELEASE], activeDigest: DIGEST, availableTargets: 1,
+  probeResults: [{ probeId: 'public-graphql-typename', status, observedStatus: status === 'pass' ? 200 : 502, observedAt: at }],
+});
+
+const probesJson = ({ observations = [observation('2026-01-10T00:01:00.000Z', 'progressing'), observation('2026-01-10T00:07:00.000Z', 'steady')], finalCondition = 'steady', deadlineSeconds = DEADLINE, elapsedSeconds = 420, backoffSeconds = 30 } = {}) => ({
+  deadlineSeconds, elapsedSeconds, backoffSeconds, observations, finalCondition,
+});
+
+const NL = String.fromCharCode(10);
+const STEPS = [
+  ['`authorize`', 'applied', '—', '—', 'the declared grant covers this project, environment and target'],
+  ['`rollout`', 'applied', '4', '5', 'the target moved to the immutable digest'],
+  ['`monitor`', 'applied', '—', '—', 'the window was observed to its end'],
+];
+
+function responseMd({
+  release = RELEASE, digest = DIGEST, target = TARGET, approval = APPROVAL, deadline = DEADLINE,
+  rollbackId = PREVIOUS, outcome = 'deployed', branch = 'none', steps = STEPS,
+  monitoring = { Deadline: DEADLINE, Elapsed: 420, Backoff: 30, 'Final condition': 'steady' },
+  steady = { 'Active digest': DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' },
+  fallbacksTaken = [],
+} = {}) {
+  return `# release-deployment — ${release}
+
+The immutable release reached its declared target under the declared grant, and the steady state
+rests on the observed digest, the available targets and every declared probe across the window.
+
+## Binding
+
+| Field | Value |
+| --- | --- |
+| Operator | \`release.deploy\` |
+| Step | \`step-1/parallel-1\` |
+| Project | \`starci-academy\` |
+| Release | ${release} |
+| Artifact | \`${ARTIFACT}\` |
+| Digest | \`${digest}\` |
+| Target | ${target} |
+| Environment | production |
+| Replaced release | \`${PREVIOUS}\` |
+| Approval | ${approval} |
+| Manifest | \`${MANIFEST}\` |
+| Steady deadline | ${deadline} |
+| Rollback identity | ${rollbackId} |
+
+## Outcome
+
+| Field | Value |
+| --- | --- |
+| Outcome | ${outcome} |
+| Branch | ${branch} |
+
+## Steps
+
+| Step | State | Revision before | Revision after | Statement |
+| --- | --- | --- | --- | --- |
+${steps.map((s) => `| ${s[0]} | ${s[1]} | ${s[2]} | ${s[3]} | ${s[4]} |`).join('\n')}
+
+## Monitoring
+
+| Field | Value |
+| --- | --- |
+| Deadline | ${monitoring.Deadline} |
+| Elapsed | ${monitoring.Elapsed} |
+| Backoff | ${monitoring.Backoff} |
+| Final condition | ${monitoring['Final condition']} |
+
+## Steady state
+
+| Metric | Value |
+| --- | --- |
+${Object.entries(steady).map(([k, v]) => `| ${k} | ${/^sha256:/.test(String(v)) ? `\`${v}\`` : v} |`).join('\n')}
+
+## Findings
+
+| Code | Step | Statement |
+| --- | --- | --- |
+| \`IDEMPOTENT_NO_OP\` | \`host-prepare\` | the host already matched the declaration |
+
+## Fallbacks taken
+
+| Code | Action |
+| --- | --- |
+${fallbacksTaken.map((c) => `| \`${c}\` | the branch was taken and recorded |`).join(NL)}
+`;
+}
+
+const requestJson = ({ release = RELEASE, target = TARGET, approval = APPROVAL, probes = PROBES, deadline = DEADLINE, rollbackIdentity = ROLLBACK, extra = {} } = {}) => ({
+  schemaVersion: 9, operatorId: 'release.deploy', step: 1, parallel: 1, sessionId: 's-test',
+  contexts: [{ alias: '@remote/ghcr/starci/academy-api', head: null }],
+  requirements: { release, target, approval, probes, steadyDeadline: deadline, rollbackIdentity, resume: null, ...extra },
+  inputs: { 'quality-verification': 'step-1/parallel-1/response/quality.md' }, resume: null,
+});
+
+const responseJson = ({ status = 'done', stop, fallbacks = [], next = ['platform.operate'] } = {}) => ({
+  schemaVersion: 9, operatorId: 'release.deploy', step: 1, parallel: 1, status, ...(stop ? { stop } : {}),
+  fallbacks,
+  fields: status === 'blocked' ? {} : { 'release-deployment': 'response/response.md', probes: 'response/data/probes.json' },
+  commits: [], next,
+});
+
+function writeBranch(files) {
+  const session = mkdtempSync(path.join(tmpdir(), 'release-session-'));
+  const branch = path.join(session, 'step-1', 'parallel-1');
+  for (const d of ['request', 'response/data', 'response/artifacts']) mkdirSync(path.join(branch, d), { recursive: true });
+  writeFileSync(path.join(session, 'state.json'), JSON.stringify({ id: 's-test', project: 'starci-academy', startedAt: '2026-09-03T00:00:00Z', requestHashes: {}, chain: [['1/1']], steps: { '1/1': 'release.deploy' }, current: '1/1', status: 'running' }));
+  writeFileSync(path.join(branch, 'response', 'quality.md'), '# quality\n');
+  for (const [name, content] of Object.entries(files)) {
+    if (content === null) continue;
+    writeFileSync(path.join(branch, name), typeof content === 'string' ? content : JSON.stringify(content, null, 2));
+  }
+  return { branch, session };
+}
+
+const baseline = (over = {}) => ({
+  'request/request.json': requestJson(),
+  'response/response.json': responseJson(),
+  'response/response.md': responseMd(),
+  'response/data/probes.json': probesJson(),
+  ...over,
+});
+
+
+// The recovery fallback: two failing observations, then steady again on the same release.
+const recovered = () => baseline({
+  'response/response.json': responseJson({ fallbacks: ['ROLLOUT_FAILED'] }),
+  'response/data/probes.json': probesJson({
+    observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:03:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:07:00.000Z', 'steady')],
+  }),
+  'response/response.md': responseMd({
+    branch: 'recover',
+    steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'the approved reversible action restored the target']],
+    fallbacksTaken: ['ROLLOUT_FAILED'],
+  }),
+});
+
+// Both fallbacks in order: the recovery ran out and the safe release was restored by digest.
+const rolledBack = () => baseline({
+  'response/response.json': responseJson({ fallbacks: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'] }),
+  'response/data/probes.json': probesJson({
+    observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:03:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:09:00.000Z', 'steady')],
+  }),
+  'response/response.md': responseMd({
+    outcome: 'rolled-back', branch: 'rollback',
+    steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'the approved actions ran out'], ['`rollback`', 'applied', '6', '7', 'the safe release was restored by digest']],
+    steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' },
+    fallbacksTaken: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'],
+  }),
+});
+
+async function expectValid(files, label) {
+  const { branch, session } = writeBranch(files);
+  const { errors } = await validateReleaseStep(branch);
+  rmSync(session, { recursive: true, force: true });
+  assert.deepEqual(errors, [], `${label} should be valid`);
+}
+async function expectError(files, needle, label) {
+  const { branch, session } = writeBranch(files);
+  const { errors } = await validateReleaseStep(branch);
+  rmSync(session, { recursive: true, force: true });
+  assert.ok(errors.some((e) => e.includes(needle)), `${label}: expected an error containing "${needle}", got:\n${errors.join('\n') || '(none)'}`);
+}
+
+await expectValid(baseline(), 'a steady deployment of the immutable release');
+await expectValid(recovered(), 'the recovery fallback taken after a persistent failure');
+await expectValid(rolledBack(), 'both fallbacks in order, ending in a restored release');
+await expectValid({
+  'request/request.json': requestJson(),
+  'response/response.json': responseJson({ status: 'blocked', stop: 'STEADY_STATE_UNPROVEN', next: [] }),
+  'response/response.md': null, 'response/data/probes.json': null,
+}, 'blocked because the steady window never closed');
+
+await expectError(baseline({ 'response/response.json': { ...responseJson(), stop: 'ROLLOUT_FAILED' } }), 'only a blocked response carries a stop', 'done with a stop');
+await expectError(baseline({ 'response/response.json': responseJson({ status: 'blocked', stop: 'ROLLOUT_FAILED', next: [] }) }), 'has disposition fallback under these requirements', 'a fallback code used to block the branch');
+await expectError(baseline({ 'response/response.json': responseJson({ fallbacks: ['STEADY_STATE_UNPROVEN'] }) }), 'cannot be taken as a fallback', 'a terminate code taken as a fallback');
+await expectError(baseline({
+  'response/response.json': responseJson({ fallbacks: ['RECOVERY_EXHAUSTED'] }),
+  'response/response.md': responseMd({ outcome: 'rolled-back', branch: 'rollback', steps: [...STEPS, ['`rollback`', 'applied', '6', '7', 'restored']], steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' }, fallbacksTaken: ['RECOVERY_EXHAUSTED'] }),
+}), 'reached only through an exhausted recovery', 'a rollback that skipped the recovery branch');
+await expectError(baseline({ 'request/request.json': requestJson({ extra: { strategy: 'rolling' } }) }), 'requirements.strategy is not a field', 'a field the operator no longer declares');
+await expectError(baseline({ 'request/request.json': requestJson({ approval: null }) }), 'required field approval has no value', 'a production deploy nobody approved');
+await expectError(baseline({ 'request/request.json': requestJson({ probes: [{ probeId: 'container-health', kind: 'internal', endpointRef: 'unix:///health', expectStatus: 200 }] }), 'response/data/probes.json': probesJson({ observations: [{ ...observation('2026-01-10T00:01:00.000Z', 'progressing'), probeResults: [{ probeId: 'container-health', status: 'pass', observedStatus: 200, observedAt: '2026-01-10T00:01:00.000Z' }] }, { ...observation('2026-01-10T00:07:00.000Z', 'steady'), probeResults: [{ probeId: 'container-health', status: 'pass', observedStatus: 200, observedAt: '2026-01-10T00:07:00.000Z' }] }] }) }), 'at least one declared probe is public', 'a run proving only container health');
+await expectError(baseline({ 'request/request.json': requestJson({ rollbackIdentity: { ...ROLLBACK, digest: 'v1.4.0' } }) }), 'a rollback by tag restores whatever the tag now points at', 'a rollback identity named by tag');
+await expectError(baseline({ 'request/request.json': requestJson({ extra: { release: RELEASE }, target: TARGET, approval: 'ghp_abcdefghijklmnopqrstuvwxyz' }) }), 'looks like a resolved credential value', 'a token where a handle belongs');
+await expectError(baseline({ 'request/request.json': requestJson({ deadline: 120 }) }), 'but the request pinned 120s', 'monitoring measured against another deadline');
+await expectError(baseline({ 'response/data/probes.json': probesJson({ elapsedSeconds: 900 }) }), 'ran past its own bounded deadline', 'monitoring that outran its deadline');
+await expectError(baseline({ 'response/data/probes.json': probesJson({ backoffSeconds: 900 }) }), 'backoff cannot exceed the deadline', 'a backoff wider than the window');
+await expectError({
+  ...recovered(),
+  'response/data/probes.json': probesJson({ observations: [observation('2026-01-10T00:01:00.000Z', 'failing', 'fail'), observation('2026-01-10T00:07:00.000Z', 'steady')] }),
+}, 'one transient probe is not a persistent failure', 'recovery entered on a single failing probe');
+await expectError(baseline({ 'response/data/probes.json': probesJson({ finalCondition: 'deadline-exceeded' }) }), 'which is STEADY_STATE_UNPROVEN, not a deployment', 'a deployment over an exceeded deadline');
+await expectError(baseline({ 'response/response.md': responseMd({ release: 'release:someone-elses' }) }), 'but the request bound', 'a receipt for another release');
+await expectError(baseline({ 'response/response.md': responseMd({ digest: 'latest' }) }), 'identified by its digest, never by a tag', 'a release named by tag');
+await expectError(baseline({ 'response/response.md': responseMd({ approval: '`someone-elses-grant`' }) }), 'names an approval the request did not bind', 'a grant borrowed from another deployment');
+await expectError(baseline({ 'response/response.md': responseMd({ branch: 'recover' }) }), 'but the fallbacks taken say none', 'a branch the fallbacks never recorded');
+await expectError({
+  ...rolledBack(),
+  'response/response.md': responseMd({ outcome: 'deployed', branch: 'rollback', steps: [...STEPS, ['`recover`', 'applied', '5', '6', 'x'], ['`rollback`', 'applied', '6', '7', 'y']], fallbacksTaken: ['ROLLOUT_FAILED', 'RECOVERY_EXHAUSTED'] }),
+}, 'a restored release is its own terminal', 'a rollback reported as delivery');
+await expectError(baseline({ 'response/response.md': responseMd({ steps: [['`authorize`', 'applied', '—', '—', 'x'], ['`rollout`', 'applied', '4', '4', 'y'], ['`monitor`', 'applied', '—', '—', 'z']] }) }), 'claims it applied without moving a revision', 'an application that moved nothing');
+await expectError(baseline({ 'response/response.md': responseMd({ steps: [['`authorize`', 'applied', '2', '3', 'x'], ['`rollout`', 'applied', '4', '5', 'y'], ['`monitor`', 'applied', '—', '—', 'z']] }) }), 'reports a revision for a boundary it never touched', 'a reading step inventing a revision');
+await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': SAFE_DIGEST, 'Available targets': '1 of 1', 'Superseded active': '0', 'Window elapsed': '300' } }) }), 'while another digest is active', 'a deployment over the old digest');
+await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': DIGEST, 'Available targets': '1 of 2', 'Superseded active': '0', 'Window elapsed': '300' } }) }), 'a partly available target set is not steady state', 'one target absorbing the load for two');
+await expectError(baseline({ 'response/response.md': responseMd({ steady: { 'Active digest': DIGEST, 'Available targets': '1 of 1', 'Superseded active': '1', 'Window elapsed': '300' } }) }), 'still serving traffic', 'a superseded target left active');
+await expectError(baseline({ 'response/data/probes.json': probesJson({ observations: [observation('2026-01-10T00:07:00.000Z', 'steady')] }) }), 'claimed from a single observation', 'steady state read off one probe');
+await expectError(baseline({ 'response/response.md': responseMd({ monitoring: { Deadline: DEADLINE, Elapsed: 420, Backoff: 30, 'Final condition': 'progressing' } }) }), 'but the series ended steady', 'a receipt disagreeing with its own series');
+await expectError(baseline({ 'response/data/probes.json': { ...probesJson(), finalCondition: 'nope' } }), 'finalCondition', 'probes schema');
+await expectError(baseline({ 'response/response.md': responseMd().replace('## Steady state', '## Stable state') }), 'missing section ^## Steady state$', 'receipt section renamed');
+
+process.stdout.write('release.deploy self-test: 4 valid branches, 26 rejected mutations\n');

package/operators/uat-verify/operator.md

@@ -14,7 +14,20 @@ a shared runtime and leaves a permanent run record behind, so the trigger is a p
 schedule, a chain default or another agent's convenience. `runId` and `lease` are not questions for a
 person either: the orchestrator generates the run identifier and grants the exclusive lease on the
 flow directory before the branch starts, and an invocation that arrives without them is
-`INVALID_INPUT` rather than a prompt.
+`INVALID_INPUT` at step 1 rather than a prompt. Their Default is therefore `—`: a Default that reads
+"the orchestrator's run id" is prose, not a value the gate can use, and a gate that accepts prose
+accepts an empty field. `LEASE_INVALID` is a different failure and keeps its own place: it is the
+lease that exists and is expired, foreign, or bound to another run, noticed at step 6 against the
+flow directory this run holds.
+
+## The endpoint is the bound one, never a re-derived one
+
+The flow is driven against the endpoint the `route` Input carries, the one the `workspace.bind` branch
+of this chain observed and closed. This operator does not re-derive readiness from the runtime
+registry: a registry that advertises `ready` while nothing listens is exactly the source that sends a
+browser at a dead port, and the bind step already refused a merely listening port on this chain's
+behalf. When the bound endpoint does not answer, the stop is `RUNTIME_UNAVAILABLE` against a named
+endpoint rather than a guess about which origin was meant.
 
 ## The password is a name, never a value
 
@@ -81,8 +94,8 @@ anything outside its own fixture namespace.
 | Alias | Bind | Required |
 | --- | --- | --- |
 | `@worktrees/uat/<flow>/<case>` | the flow directory: `flow.md`, `account.json`, `seed/`, the append-only `runs/<runId>/` history and the `latest` pointer, bound by fingerprint per file and written only under the exclusive lease | yes |
-| `@worktrees/_templates` | the UAT flow template a new flow directory is created from; consumed, never modified | yes |
-| `@worktrees/sessions/central-runtime` | the ready runtime owner, its generation and its exact origins; readiness is proved, not assumed | yes |
+| `@worktrees/_templates` | the UAT flow template a new flow directory is created from, which is exactly the three things step 4 reads: `uat/flow.md` with the cases and their named assertions, `uat/account.json` with a username, a role, a credential name and the sealed file's path and no field that could hold a secret, and `uat/seed/` with the records a run namespaces; consumed, never modified | yes |
+| `@worktrees/sessions/central-runtime` | the runtime owner's generation behind the bound endpoint; readiness is proved by the `route` Input, never re-derived from this registry | yes |
 | `@workspaces/device-state` | the sealed credential roster; the shared UAT password is resolved by name here at login and read nowhere else | yes |
 | `@workspaces/be` | the routed backend checkout at the pinned commit, whose behaviour the flow verifies and whose store holds the namespaced records | yes |
 
@@ -92,6 +105,7 @@ anything outside its own fixture namespace.
 | --- | --- | --- |
 | `frontend-surface-audit` | the surface audit that found the frontend clean, taken at the pinned commit | yes |
 | `quality-verification` | the quality gate that passed, taken at the same pinned commit | yes |
+| `route` | `workspace.bind` on the fe role; the bound route whose endpoint this run drives | yes |
 
 ## Requirements
 
@@ -101,8 +115,8 @@ anything outside its own fixture namespace.
 | `feature` | id | — | The feature key that addresses the flow directory |
 | `flow` | id | — | The one product flow this invocation verifies |
 | `cases` | list of `caseId` | every case of the flow | Which frozen cases to run; the default is every case `flow.md` declares, in its order |
-| `runId` | id | the orchestrator's run id | Not asked of a person: the orchestrator generates it and it namespaces every record this run writes |
-| `lease` | token | the orchestrator's lease | Not asked of a person: the orchestrator grants the exclusive lease on the flow directory before the branch starts |
+| `runId` | id | — | Not asked of a person: the orchestrator fills it, and it namespaces every record this run writes |
+| `lease` | token | — | Not asked of a person: the orchestrator fills it, granting the exclusive lease on the flow directory before the branch starts |
 | `resume` | token | null | The blocked branch's token when re-entering after a stop |
 
 ## Steps
@@ -114,7 +128,7 @@ anything outside its own fixture namespace.
 | 3 | Preflight the runtime: the sealed credential resolves by name, the account exists, the store answers | — | @workspaces/device-state for the credential named by `account.json`, @worktrees/sessions/central-runtime for the generation and origins, @tools/secrets, @tools/http | — | `PROVISIONING_UNAVAILABLE` |
 | 4 | Freeze the snapshot from `flow.md`, `account.json` and `seed/` | `feature`, `flow`, `cases` | @worktrees/uat/<flow>/<case>, @worktrees/_templates for the flow template | @worktrees/uat/<flow>/<case> (snapshot), `response/data/snapshot.json`, @tools/sourcewrite | `CANONICAL_WRITE_DENIED` |
 | 5 | Seed the frozen records into the run namespace | `runId` | `response/data/snapshot.json`, @workspaces/be | @tools/database | `FIXTURE_VIOLATION` |
-| 6 | Execute the frozen cases in order on the session worktree at the pinned commit | — | `response/data/snapshot.json`, @worktrees/sessions/central-runtime for the origin and generation, @workspaces/device-state for the credential at login only, @tools/browsercontrol, @tools/websearch | — | `LEASE_INVALID`, `RUNTIME_UNAVAILABLE` |
+| 6 | Execute the frozen cases in order against the endpoint the bound route carries, at the pinned commit | — | `response/data/snapshot.json`, input `route` for the endpoint this run drives, @worktrees/sessions/central-runtime for the generation behind that endpoint, @workspaces/device-state for the credential at login only, @tools/browsercontrol, @tools/websearch | — | `LEASE_INVALID`, `RUNTIME_UNAVAILABLE` |
 | 7 | Capture at each named assertion with the login field masked, and stitch the sheet | — | `response/data/snapshot.json`, @worktrees/sessions/central-runtime for the most direct runtime evidence | `response/data/captures/<case>.json`, `response/artifacts/<case>.png`, `response/artifacts/sheet.png`, @tools/visualize | `EVIDENCE_UNAVAILABLE` |
 | 8 | Judge the three lanes apart | — | `response/data/captures/<case>.json` | `response/data/verdicts.json` | — |
 | 9 | Verify read-only, then delete the run namespace and nothing else | `runId` | @workspaces/be for the records carrying `is_uat=true` and this namespace, `response/data/verdicts.json` | @tools/database | — |