refactor: share registry runtime configuration leases

backend/test/workspace-runtime-config-lease.test.ts

@@ -0,0 +1,85 @@
+import { test, expect } from "vitest";
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { WorkspaceRuntimeConfigLeaseFactory } from "../src/workspaces/runtime-config-lease.js";
+
+const commit = "a".repeat(40);
+const workspace = "abc";
+const descriptor = `workspace:
+  schema_version: 3
+  id: ${workspace}
+  name: Lease
+  language: en
+dwh:
+  engine: postgres
+  database: analytics
+  schema: mart
+  supported_transports: [postgres_direct]
+semantic_index:
+  vector_store:
+    engine: qdrant
+    collection: abc
+    dimensions: 1024
+    distance: cosine
+  embedding:
+    provider: ollama_internal
+    model: qwen3-embedding:0.6b
+    dimensions: 1024
+llm_policy:
+  allowed: [zai/glm-5.2]
+`;
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "runtime-config-lease-"));
+  const snapshots = join(root, "snapshots");
+  const snapshotPath = join(snapshots, commit, `${workspace}.yaml`);
+  const dataRoot = join(root, "data");
+  const harness = join(root, "harness");
+  mkdirSync(join(snapshots, commit), { recursive: true, mode: 0o700 });
+  chmodSync(snapshots, 0o700);
+  mkdirSync(harness);
+  writeFileSync(snapshotPath, descriptor, { mode: 0o400 });
+  const secret = join(root, "password");
+  writeFileSync(secret, "secret", { mode: 0o600 });
+  const configPath = join(harness, "config.yaml");
+  writeFileSync(configPath, "profile: test\n");
+  const factory = new WorkspaceRuntimeConfigLeaseFactory({
+    dataRoot, runtimeSnapshotRoot: snapshots, harnessDir: harness, configPath,
+    env: {
+      THT_WS_ABC_DWH_TRANSPORT: "postgres_direct", THT_WS_ABC_DWH_HOST: "dwh",
+      THT_WS_ABC_DWH_PORT: "5432", THT_WS_ABC_DWH_USER: "reader",
+      THT_WS_ABC_DWH_PASSWORD_FILE: secret,
+    }, secretRoots: [root], semanticRuntime: {
+      internalQdrantUrl: "http://qdrant:6333", internalEmbeddingUrl: "http://embedding:11434",
+      internalEmbeddingModel: "qwen3-embedding:0.6b", internalEmbeddingDimensions: 1024,
+    },
+  });
+  return { root, snapshotPath, factory };
+}
+
+test("session and maintenance share deterministic bytes and path", () => {
+  const f = fixture();
+  try {
+    const session = f.factory.acquireSession(f.snapshotPath);
+    const maintenance = f.factory.acquireMaintenance({ snapshotPath: f.snapshotPath });
+    expect(session.path).toBe(maintenance.path);
+    expect(readFileSync(session.path, "utf8")).toBe(readFileSync(maintenance.path, "utf8"));
+    expect(lstatSync(session.path).mode & 0o777).toBe(0o400);
+    expect(existsSync(join(dirname(session.path), `${commit}.manifest.json`))).toBe(true);
+    session.release(); maintenance.release();
+    expect(existsSync(session.path)).toBe(false);
+  } finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test("same revision changed bytes are refused", () => {
+  const f = fixture();
+  try {
+    const first = f.factory.acquireSession(f.snapshotPath);
+    chmodSync(first.path, 0o600);
+    writeFileSync(first.path, "changed", { mode: 0o600 });
+    chmodSync(first.path, 0o400);
+    expect(() => f.factory.acquireSession(f.snapshotPath)).toThrow(/changed|mismatch|trusted/i);
+    first.release();
+  } finally { rmSync(f.root, { recursive: true, force: true }); }
+});

backend/test/workspace-runtime-handoff.test.ts

@@ -180,7 +180,7 @@ test("separate runtime leases hand off byte-identical revision Evidence configs
   );
 
   try {
-    expect(first.path).not.toBe(second.path);
+    expect(first.path).toBe(second.path);
     const firstYaml = readFileSync(first.path, "utf8");
     const secondYaml = readFileSync(second.path, "utf8");
     expect(secondYaml).toBe(firstYaml);
@@ -212,7 +212,7 @@ test("separate runtime leases hand off byte-identical revision Evidence configs
     }
 
     first.release();
-    expect(existsSync(first.path)).toBe(false);
+    expect(existsSync(first.path)).toBe(true);
     expect(existsSync(second.path)).toBe(true);
     second.release();
     expect(existsSync(second.path)).toBe(false);