feat(deploy): add typed command transport releases

infra/deploy-runner/test_device_edge_vps_artifact.py

@@ -81,6 +81,22 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             with self.subTest(phase=phase), self.assertRaises(RUNNER.DeployError):
                 RUNNER.preflight({"phase": phase})
 
+    def test_accepted_shared_source_phases_cannot_be_rebuilt(self):
+        for phase in ("core-channel", "tracker-ingress"):
+            with self.subTest(phase=phase), tempfile.TemporaryDirectory(
+                prefix=f"nodedc-vps-frozen-{phase}-"
+            ) as directory:
+                result = self.build(
+                    Path(directory),
+                    phase,
+                    f"device-edge-vps-{phase}-frozen-001",
+                )
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn(
+                    f"accepted_vps_phase_rebuild_frozen:{phase}:ADR-0001",
+                    result.stderr,
+                )
+
     def require_runtime_cache(self):
         for name, digest in (
             (RUNNER.NODE_ARCHIVE, RUNNER.NODE_ARCHIVE_SHA256),
@@ -93,13 +109,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
     def test_builders_are_deterministic_narrow_and_secret_free(self):
         self.require_runtime_cache()
         for phase in (
-            "foundation",
-            "runtime-reconciliation",
-            "backhaul",
-            "relay",
-            "core-channel",
-            "tailscale-retirement",
-            "tracker-ingress",
+            "command-transport",
         ):
             with self.subTest(phase=phase), tempfile.TemporaryDirectory(
                 prefix=f"nodedc-vps-{phase}-"
@@ -173,13 +183,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             RUNNER.INBOX_ROOT = inbox
             try:
                 for phase in (
-                    "foundation",
-                    "runtime-reconciliation",
-                    "backhaul",
-                    "relay",
-                    "core-channel",
-                    "tailscale-retirement",
-                    "tracker-ingress",
+                    "command-transport",
                 ):
                     result = self.build(
                         inbox,
@@ -233,6 +237,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             self.assertIn("b2_routes=unchanged", rendered)
             self.assertIn("command_transport=disabled", rendered)
 
+    @unittest.skip("accepted core-channel builder generation is frozen")
     def test_core_channel_plan_is_exact_and_keeps_tracker_ingress_closed(self):
         with tempfile.TemporaryDirectory(prefix="nodedc-vps-channel-plan-") as directory:
             inbox = Path(directory) / "inbox"
@@ -363,6 +368,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             self.assertIn("command_transport=disabled", rendered)
             self.assertIn("gelios=untouched", rendered)
 
+    @unittest.skip("accepted tracker-ingress builder generation is frozen")
     def test_tracker_ingress_plan_is_single_process_bounded_and_command_free(self):
         with tempfile.TemporaryDirectory(prefix="nodedc-vps-ingress-plan-") as directory:
             inbox = Path(directory) / "inbox"
@@ -402,6 +408,40 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             self.assertIn("command_transport=disabled", rendered)
             self.assertIn("gelios=untouched", rendered)
 
+    def test_command_transport_plan_is_typed_single_process_and_bounded(self):
+        with tempfile.TemporaryDirectory(prefix="nodedc-vps-command-plan-") as directory:
+            inbox = Path(directory) / "inbox"
+            inbox.mkdir()
+            result = self.build(
+                inbox,
+                "command-transport",
+                "device-edge-vps-command-transport-plan-001",
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            artifact = Path(json.loads(result.stdout)["artifact"])
+            old_inbox = RUNNER.INBOX_ROOT
+            RUNNER.INBOX_ROOT = inbox
+            try:
+                with patch.object(RUNNER, "assert_root"), patch.object(
+                    RUNNER,
+                    "preflight",
+                    return_value={"predecessor": "accepted-tracker-ingress-012"},
+                ), patch("builtins.print") as output:
+                    RUNNER.plan_artifact(str(artifact))
+            finally:
+                RUNNER.INBOX_ROOT = old_inbox
+            rendered = "\n".join(
+                " ".join(str(arg) for arg in call.args)
+                for call in output.call_args_list
+            )
+            self.assertIn("phase=command-transport", rendered)
+            self.assertIn("predecessor=accepted-tracker-ingress-012", rendered)
+            self.assertIn("command_transport=typed-service-ping-v1", rendered)
+            self.assertIn("command_catalog=allowlisted-adapter-typed-commands-only", rendered)
+            self.assertIn("runtime_composition=single-non-root-process", rendered)
+            self.assertIn("public_b2_ingress=155.212.211.15:9921/tcp:bidirectional-session", rendered)
+            self.assertIn("gelios=untouched-legacy-only", rendered)
+
     def test_publish_payload_preserves_unselected_executable_modes(self):
         with tempfile.TemporaryDirectory(prefix="nodedc-vps-publish-scope-") as directory:
             root = Path(directory)