feat: P3 effective configuration, memory root, and revision-scoped records

backend/test/workspace-runtime-config-lease.test.ts

@@ -14,7 +14,13 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, expect, test, vi } from "vitest";
+import { parse } from "yaml";
 import { WorkspaceRegistry } from "../src/workspaces/registry.js";
+import {
+  buildCanonicalEffectiveConfig,
+  canonicalEffectiveConfigJson,
+  effectiveConfigIdentity,
+} from "../src/workspaces/effective-config.js";
 import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
 import {
   publishDeterministicRuntimeConfigLease,
@@ -123,6 +129,7 @@ evidence:
   return {
     dataRoot,
     harnessDir,
+    source,
     registry,
     registryConfig,
     revision,
@@ -163,7 +170,7 @@ test("active workspace rendering is byte-identical to direct snapshot rendering"
   expect(active.catalogBlob).toMatch(/^sha256:[0-9a-f]{64}$/);
 });
 
-test("deterministic operator leases publish one revision-bound protected config and refuse changed same-revision bytes", async () => {
+test("deterministic operator leases are keyed by logical identity and stable across calls", async () => {
   const f = await fixture();
   const first = await publishDeterministicRuntimeConfigLease({
     workspaceId: "psd-clinical",
@@ -186,6 +193,7 @@ test("deterministic operator leases publish one revision-bound protected config
     semanticRuntime,
   });
 
+  const suffix = first.inputFingerprint.slice(7, 23);
   expect(second.path).toBe(first.path);
   expect(first.path).toBe(join(
     f.dataRoot,
@@ -193,15 +201,34 @@ test("deterministic operator leases publish one revision-bound protected config
     "psd-clinical",
     "preprocessing",
     "runtime-config",
-    `${f.revision.commit}.yaml`,
+    `${f.revision.commit}-${suffix}.yaml`,
   ));
   expect(statSync(first.path).mode & 0o777).toBe(0o400);
   expect(statSync(first.manifestPath).mode & 0o777).toBe(0o600);
   expect(readFileSync(first.path, "utf8")).toContain("collection_lifecycle: require_existing");
+  expect(readFileSync(first.path, "utf8")).toContain("memory:");
   expect(existsSync(first.manifestPath)).toBe(true);
+  expect(first.effectiveConfigIdentity).toMatch(/^workspace:\/\/psd-clinical@v1:[0-9a-f]{64}$/);
+  expect(first.configFingerprint).toMatch(/^sha256:[0-9a-f]{64}$/);
+  expect(first.inputFingerprint).toMatch(/^sha256:[0-9a-f]{64}$/);
+  expect(first.inputFingerprint).not.toBe(first.configFingerprint);
+  const manifest = JSON.parse(readFileSync(first.manifestPath, "utf8"));
+  expect(manifest).toMatchObject({
+    schemaVersion: 1,
+    workspaceId: "psd-clinical",
+    workspaceRevision: f.revision.commit,
+    descriptorBlob: first.descriptorBlob,
+    catalogBlob: first.catalogBlob,
+    configDigest: first.configDigest,
+    bindingDigest: first.bindingDigest,
+    effectiveConfigIdentity: first.effectiveConfigIdentity,
+    configFingerprint: first.configFingerprint,
+    inputFingerprint: first.inputFingerprint,
+    path: first.path,
+  });
 
   vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse-two.internal");
-  await expect(publishDeterministicRuntimeConfigLease({
+  const changed = await publishDeterministicRuntimeConfigLease({
     workspaceId: "psd-clinical",
     registry: f.registry,
     registryConfig: f.registryConfig,
@@ -210,7 +237,11 @@ test("deterministic operator leases publish one revision-bound protected config
     dataRoot: f.dataRoot,
     secretRoots: f.registryConfig.secretRoots,
     semanticRuntime,
-  })).rejects.toMatchObject({ code: "effective_config_mismatch" });
+  });
+  expect(changed.path).not.toBe(first.path);
+  expect(changed.inputFingerprint).not.toBe(first.inputFingerprint);
+  expect(changed.configFingerprint).not.toBe(first.configFingerprint);
+  expect(readFileSync(changed.path, "utf8")).toContain("warehouse-two.internal");
 });
 
 test("runtime rendering rejects untrusted snapshot paths and symlinks", async () => {
@@ -237,3 +268,74 @@ test("runtime rendering rejects untrusted snapshot paths and symlinks", async ()
     semanticRuntime,
   })).toThrow(/trusted runtime snapshot/i);
 });
+
+
+test("operator lease and session snapshot produce byte-identical effective DWH bindings", async () => {
+  const f = await fixture();
+  const session = renderWorkspaceRuntimeFromSnapshotPath({
+    snapshotPath: f.revision.snapshotPath,
+    harnessDir: f.harnessDir,
+    configPath: "config/tht.yaml",
+    dataRoot: f.dataRoot,
+    secretRoots: f.registryConfig.secretRoots,
+    semanticRuntime,
+  });
+  const lease = await publishDeterministicRuntimeConfigLease({
+    workspaceId: "psd-clinical",
+    registry: f.registry,
+    registryConfig: f.registryConfig,
+    harnessDir: f.harnessDir,
+    configPath: "config/tht.yaml",
+    dataRoot: f.dataRoot,
+    secretRoots: f.registryConfig.secretRoots,
+    semanticRuntime,
+  });
+
+  const sessionCanonical = canonicalEffectiveConfigJson(buildCanonicalEffectiveConfig(parse(session.renderedConfig)));
+  const operatorCanonical = canonicalEffectiveConfigJson(lease.effectiveConfig);
+  expect(operatorCanonical).toBe(sessionCanonical);
+  expect(lease.effectiveConfigIdentity).toBe(
+    effectiveConfigIdentity("psd-clinical", parse(session.renderedConfig)),
+  );
+});
+
+test("a content-only Evidence commit keeps the same effective config identity with a new revision lease", async () => {
+  const f = await fixture();
+  const firstLease = await publishDeterministicRuntimeConfigLease({
+    workspaceId: "psd-clinical",
+    registry: f.registry,
+    registryConfig: f.registryConfig,
+    harnessDir: f.harnessDir,
+    configPath: "config/tht.yaml",
+    dataRoot: f.dataRoot,
+    secretRoots: f.registryConfig.secretRoots,
+    semanticRuntime,
+  });
+  const firstIdentity = firstLease.effectiveConfigIdentity;
+
+  writeFileSync(
+    join(f.source, "psd-clinical", "evidence", "guide.md"),
+    "# updated content only\n",
+  );
+  await git(f.source, ["add", "psd-clinical/evidence/guide.md"]);
+  await git(f.source, ["commit", "-m", "Evidence content only"]);
+  await git(f.source, ["push", "origin", "main"]);
+  await f.registry.pull();
+  const current = (await f.registry.list())[0];
+
+  const secondLease = await publishDeterministicRuntimeConfigLease({
+    workspaceId: "psd-clinical",
+    registry: f.registry,
+    registryConfig: f.registryConfig,
+    harnessDir: f.harnessDir,
+    configPath: "config/tht.yaml",
+    dataRoot: f.dataRoot,
+    secretRoots: f.registryConfig.secretRoots,
+    semanticRuntime,
+  });
+
+  expect(secondLease.workspaceRevision).toBe(current.commit);
+  expect(secondLease.workspaceRevision).not.toBe(firstLease.workspaceRevision);
+  expect(secondLease.effectiveConfigIdentity).toBe(firstIdentity);
+  expect(secondLease.path).not.toBe(firstLease.path);
+});