feat: deploy portable workspace registry

backend/test/e2e-f1.test.ts

@@ -43,11 +43,12 @@ test("loop F1: crea sessione → SSE riceve il widget → risponde → il modell
   const base = `http://127.0.0.1:${(app.server.address() as any).port}`;
 
   // 1. Create session — spawns fake-pi, sends prompt, fake-pi emits widget
-  await fetch(`${base}/sessions`, {
+  const created = await fetch(`${base}/sessions`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({ workspace: "w", question: "q" }),
   });
+  expect(created.status).toBe(200);
 
   // 2. Small delay to let fake-pi process the prompt and fill pendingWidget
   await new Promise((r) => setTimeout(r, 50));

backend/test/workspaces-migrate-legacy.test.ts

@@ -0,0 +1,65 @@
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, test } from "vitest";
+import {
+  migrateLegacyWorkspace,
+  writeMigratedWorkspace,
+} from "../src/workspaces/migrate-legacy.js";
+import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+
+const temporaryRoots: string[] = [];
+
+afterEach(() => {
+  temporaryRoots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true }));
+});
+
+function readFixture(name: string): string {
+  return readFileSync(new URL(`../../harness/workspaces/${name}`, import.meta.url), "utf8");
+}
+
+test("migrates the current local PSD descriptor without copying secret values", () => {
+  const result = migrateLegacyWorkspace(readFixture("local.yaml"), { id: "local" });
+
+  expect(result.workspace.workspace).toMatchObject({ id: "local", schema_version: 1, language: "it" });
+  expect(result.state).toBe("migration_required");
+  expect(JSON.stringify(result)).not.toMatch(/password:|api_key:|\$\{THT_/i);
+});
+
+test("keeps an incomplete legacy vector identity readable and explicitly migration-required", () => {
+  const result = migrateLegacyWorkspace(readFixture("tht.example.yaml"), { id: "example" });
+
+  expect(result.state).toBe("migration_required");
+  expect(result.workspace.workspace.schema_version).toBe(1);
+  expect(parseWorkspaceYaml(result.source).workspace.schema_version).toBe(1);
+});
+
+test("writes versioned repository artifacts atomically without replacing a prior migration", async () => {
+  const root = await mkdtemp(join(tmpdir(), "thoth-workspace-migrate-"));
+  temporaryRoots.push(root);
+  const migration = migrateLegacyWorkspace(readFixture("local.yaml"), { id: "local" });
+
+  const destination = await writeMigratedWorkspace(migration, root);
+
+  expect(destination).toBe(join(root, "workspaces", "local.yaml"));
+  expect(parseWorkspaceYaml(readFileSync(destination, "utf8"))).toMatchObject({ workspace: { id: "local" } });
+  await expect(writeMigratedWorkspace(migration, root)).rejects.toThrow(/already exists/i);
+  expect(existsSync(destination)).toBe(true);
+});
+
+test("declares a durable isolated registry volume and only read-only Git credential mounts", () => {
+  const compose = readFileSync(new URL("../../compose.yaml", import.meta.url), "utf8");
+  const development = readFileSync(new URL("../../docker-compose.dev.yml", import.meta.url), "utf8");
+  const dockerfile = readFileSync(new URL("../../docker/core.Dockerfile", import.meta.url), "utf8");
+
+  for (const source of [compose, development]) {
+    expect(source).toContain("THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry");
+    expect(source).toContain("workspace-registry:/data/workspace-registry");
+    expect(source).toMatch(/workspace-registry-git-credentials:ro/);
+    expect(source).toMatch(/workspace-registry-git-ca:ro/);
+    expect(source).toMatch(/workspace-registry-git-ssh-key:ro/);
+    expect(source).toMatch(/workspace-registry-git-known-hosts:ro/);
+  }
+  expect(dockerfile).toMatch(/mkdir -p \/data\/workspace-registry && chown -R thoth:thoth \/data\/workspace-registry/);
+});