fix(cd): coalesce stale carriers and harden verifiers

apps/api/tests/test_cd_post_deploy_source_link_gate.py

@@ -42,10 +42,67 @@ def test_cd_source_link_gate_uses_current_deploy_canary() -> None:
     assert "codex-sentry-20260513-t15b-v3" not in text
 
 
-def test_cd_main_pushes_queue_without_canceling_active_deploys() -> None:
+def test_cd_main_pushes_use_gitea_125_executable_inclusive_carrier() -> None:
     text = _workflow_text()
-    concurrency = text.split("concurrency:", 1)[1].split("env:", 1)[0]
 
-    assert "group: cd-deploy-${{ github.ref }}" in concurrency
-    assert "cancel-in-progress: false" in concurrency
-    assert "cancel-in-progress: true" not in concurrency
+    assert "\nconcurrency:" not in text
+    assert "Gitea 1.25 ignores the workflow concurrency key" in text
+    assert "select-latest-carrier:" in text
+    assert "needs: [select-latest-carrier]" in text
+    assert "revalidate-deploy-carrier:" in text
+    assert "needs: [select-latest-carrier, tests]" in text
+    assert "needs: [select-latest-carrier, tests, revalidate-deploy-carrier]" in text
+    assert "revalidate-post-deploy-carrier:" in text
+    assert "needs: [build-and-deploy, revalidate-post-deploy-carrier]" in text
+    assert "needs.revalidate-deploy-carrier.outputs.selected == 'true'" in text
+    assert "needs.revalidate-post-deploy-carrier.outputs.selected == 'true'" in text
+    assert "deploy_applied: ${{ steps.deploy.outputs.applied }}" in text
+    assert "AWOOOI_BUILD_COALESCED=" in text
+    assert "AWOOOI_DEPLOY_COALESCED_AFTER_PREREQUISITES=" in text
+    assert "select-latest-inclusive-cd-carrier.py" in text
+    assert "--debounce-seconds 20" in text
+
+
+def test_deploy_revalidates_lineage_after_final_main_fetch() -> None:
+    text = _workflow_text()
+    build_job = text.split("  build-and-deploy:", 1)[1].split(
+        "  revalidate-post-deploy-carrier:", 1
+    )[0]
+    deploy = text.split("- name: Deploy to K8s (ArgoCD GitOps)", 1)[1].split(
+        "- name: Apply Runtime Image Mirror Policy", 1
+    )[0]
+
+    production_gate = build_job.index(
+        "- name: Revalidate carrier before production mutations"
+    )
+    first_database_mutation = build_job.index(
+        "- name: Reconcile Asset Inventory Type Constraint"
+    )
+    secret_mutation = build_job.index("- name: Inject K8s Secrets")
+    deploy_step = build_job.index("- name: Deploy to K8s (ArgoCD GitOps)")
+    prewrite_revalidate = deploy.index("PREWRITE_CARRIER_JSON=")
+    first_production_write = deploy.index(
+        "if ! cat k8s/awoooi-prod/02-network-policy.yaml"
+    )
+    final_fetch = deploy.index("git fetch gitea main", first_production_write)
+    revalidate = deploy.index("CARRIER_JSON=$(python3", final_fetch)
+    marker_commit = deploy.index('git commit -m "chore(cd): deploy', revalidate)
+    normal_push = deploy.index("git push gitea main", marker_commit)
+    assert production_gate < first_database_mutation < secret_mutation < deploy_step
+    assert build_job.count(
+        "if: ${{ steps.preproduction-carrier.outputs.selected == 'true' }}"
+    ) >= 6
+    assert prewrite_revalidate < first_production_write
+    assert final_fetch < revalidate < marker_commit < normal_push
+    assert 'echo "applied=false" >> "$GITHUB_OUTPUT"' in deploy
+    assert "AWOOOI_DEPLOY_COALESCED_AFTER_PREREQUISITES=" in deploy
+    late_supersession = deploy.split(
+        "AWOOOI_DEPLOY_SUPERSEDED_AFTER_WRITE=", 1
+    )[1].split('git commit -m "chore(cd): deploy', 1)[0]
+    assert "restore_deploy_controls" in late_supersession
+    assert "AWOOOI_DEPLOY_SUPERSEDED_ROLLBACK=" in late_supersession
+    assert "exit 1" in late_supersession
+    assert "restore_deploy_configmaps" in deploy
+    assert "awoooi-config service-registry" in deploy
+    assert 'echo "applied=true" >> "$GITHUB_OUTPUT"' in deploy
+    assert "git push --force" not in deploy

apps/api/tests/test_executor_network_policy_boundary.py

@@ -208,7 +208,11 @@ def test_cd_ssh_denial_probe_targets_ready_pod_and_classifies_transport() -> Non
     assert "for attempt in 1 2 3; do" in probe
     assert "--field-selector=status.phase=Running" in probe
     assert "--sort-by=.metadata.creationTimestamp" in probe
-    assert '--for=condition=Ready "$ready_pod_ref"' in probe
+    assert "candidate_pod_refs=" in probe
+    assert "while IFS= read -r candidate_pod_ref; do" in probe
+    assert '--for=condition=Ready "$candidate_pod_ref"' in probe
+    assert 'ready_pod_ref="$candidate_pod_ref"' in probe
+    assert "| tac)" in probe
     assert "status.containerStatuses" in probe
     assert '$KUBECTL exec -i "$ready_pod_ref"' in probe
     assert '$KUBECTL exec -i "deployment/$workload"' not in probe

apps/api/tests/test_workload_database_identity_projection.py

@@ -297,6 +297,9 @@ def test_workload_database_bootstrap_keeps_secret_values_off_output() -> None:
 def test_cd_uses_live_spec_rollback_and_non_mutating_post_verifier() -> None:
     workflow = (REPO_ROOT / ".gitea/workflows/cd.yaml").read_text()
     normalized_workflow = " ".join(workflow.split())
+    workload_rollback = workflow.split("WORKLOAD_DB_ROLLBACK_FILE", 1)[1].split(
+        "# The two directly applied ConfigMaps", 1
+    )[0]
 
     assert "WORKLOAD_DB_ROLLBACK_FILE" in workflow
     assert "WORKLOAD_DB_SECRET_PREEXISTENCE_FILE" in workflow
@@ -305,7 +308,7 @@ def test_cd_uses_live_spec_rollback_and_non_mutating_post_verifier() -> None:
     assert "bash -s -- verify" in workflow
     assert workflow.index("bash -s -- apply") < workflow.index("bash -s -- verify")
     assert '"spec": item["spec"]' in workflow
-    assert '"data": item' not in workflow
+    assert '"data": item' not in workload_rollback
     assert "get secret '${secret_name}' -n awoooi-prod -o jsonpath" not in workflow
     assert "get secret awoooi-api-db -n awoooi-prod -o jsonpath" not in workflow
     assert "HEAD^" not in workflow