fix(deploy): transition node intelligence source atomically

infra/deploy-runner/build-engine-provider-authority-diagnostics-artifact.mjs

@@ -14,6 +14,14 @@ const engineRoot = resolve(
 const artifactRoot = resolve(
   process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(here, "../deploy-artifacts"),
 );
+const baselineArtifact = resolve(
+  here,
+  "../deploy-artifacts/nodedc-engine-mcp-control-plane-20260718-003.tgz",
+);
+const baselineArtifactSha256 =
+  "249aef9527666c562e9648b15737e66cc5c1dc7c0788b58ea714da270b5eb4ba";
+const projectionRel = "nodedc-source/server/nodeIntelligence/upstreamProjection.js";
+const descriptorRel = "nodedc-source/services/node-intelligence/activation.json";
 const [patchId = "", ...extra] = process.argv.slice(2);
 if (extra.length || !/^engine-provider-authority-diagnostics-\d{8}-\d{3}$/.test(patchId)) {
   throw new Error(
@@ -23,21 +31,32 @@ if (extra.length || !/^engine-provider-authority-diagnostics-\d{8}-\d{3}$/.test(
 }
 
 const targetSha256 = Object.freeze({
-  "nodedc-source/server/nodeIntelligence/upstreamProjection.js":
+  [projectionRel]:
     "2dfa6b4f37d9bfa8b92a8109d4060d02dd2634ceb8f7924504b83ccf3fdd1523",
+  [descriptorRel]:
+    "a8adb8c03e1a82ff683c99a8c6482c78eca1b63422e7e7e417424363b995079e",
 });
 const entries = Object.freeze(Object.keys(targetSha256));
 const artifact = join(artifactRoot, `nodedc-${patchId}.tgz`);
 
 await assertFresh(artifact);
 await assertExactSources();
+const descriptorText = await buildTargetDescriptor();
 const stage = await mkdtemp(join(tmpdir(), "nodedc-engine-provider-authority-diagnostics-"));
 try {
   const payload = join(stage, "payload");
   for (const relativePath of entries) {
     const destination = join(payload, relativePath);
     await mkdir(dirname(destination), { recursive: true });
-    await copyFile(join(engineRoot, relativePath), destination);
+    if (relativePath === descriptorRel) {
+      await writeFile(destination, descriptorText, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 0o644,
+      });
+    } else {
+      await copyFile(join(engineRoot, relativePath), destination);
+    }
   }
   await writeFile(
     join(stage, "manifest.env"),
@@ -71,6 +90,7 @@ try {
 
 async function assertExactSources() {
   for (const [relativePath, expected] of Object.entries(targetSha256)) {
+    if (relativePath === descriptorRel) continue;
     const sourcePath = join(engineRoot, relativePath);
     const info = await lstat(sourcePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -97,6 +117,44 @@ async function assertExactSources() {
   }
 }
 
+async function buildTargetDescriptor() {
+  const baselineBytes = await readFile(baselineArtifact);
+  if (digest(baselineBytes) !== baselineArtifactSha256) {
+    throw new Error("engine_node_intelligence_baseline_artifact_sha256_mismatch");
+  }
+  const result = run("python3", [
+    "-c",
+    [
+      "import pathlib,sys,tarfile",
+      "p=pathlib.Path(sys.argv[1]); name=sys.argv[2]",
+      "with tarfile.open(p,'r:gz') as t:",
+      " m=t.getmember(name)",
+      " if not m.isfile(): raise SystemExit('member-not-file')",
+      " f=t.extractfile(m)",
+      " if f is None: raise SystemExit('member-unreadable')",
+      " sys.stdout.buffer.write(f.read())",
+    ].join("\n"),
+    baselineArtifact,
+    `payload/${descriptorRel}`,
+  ]);
+  const descriptor = JSON.parse(result.stdout);
+  if (
+    descriptor?.schemaVersion !== "nodedc.engine-node-intelligence-transition/v1"
+    || descriptor?.action !== "activate"
+    || descriptor?.releaseId !== "2.33.2-974a9fb3492f"
+    || descriptor?.source?.upstreamProjectionSha256
+      !== "761a874b102a938bc6018159ddacdaac71ad6ae08e9f0f8d7f3b58a0165a5131"
+  ) {
+    throw new Error("engine_node_intelligence_baseline_descriptor_mismatch");
+  }
+  descriptor.source.upstreamProjectionSha256 = targetSha256[projectionRel];
+  const text = `${JSON.stringify(descriptor, null, 2)}\n`;
+  if (digest(Buffer.from(text, "utf8")) !== targetSha256[descriptorRel]) {
+    throw new Error("engine_node_intelligence_target_descriptor_sha256_mismatch");
+  }
+  return text;
+}
+
 async function assertFresh(path) {
   try {
     await lstat(path);
@@ -136,4 +194,5 @@ function run(command, args) {
   if (result.status !== 0) {
     throw new Error(`${command}_failed:${result.stderr || result.stdout}`);
   }
+  return result;
 }