feat(hlcc): dispatch approved deployments by explicit signal

server-tools/lake-lamp-authz/deployment-event.js

@@ -0,0 +1,36 @@
+"use strict";
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+// A push can request deployment, but it can never execute deployment itself.
+// The separate resident deployment agent consumes these immutable event files.
+function enqueueDeploymentEvent(intent, push, queueDir) {
+  if (!intent) return { state: "not_requested" };
+  const invalid = validateIntent(intent, push);
+  if (invalid) return { state: "rejected", diagnostic_code: invalid };
+  fs.mkdirSync(queueDir, { recursive: true, mode: 0o750 });
+  const event = {
+    schema: "guanghu.deployment-event/v1",
+    event_id: crypto.randomUUID(),
+    created_at: Date.now() / 1000,
+    state: "queued_for_resident_agent",
+    repo: push.repo, branch: push.branch, commit_sha: push.commit_sha,
+    workorder_id: String(intent.workorder_id || ""),
+    resource: intent.resource, action: "provision-approved-architecture",
+    manifest: intent.manifest,
+  };
+  const target = path.join(queueDir, `${event.created_at}-${event.event_id}.json`);
+  const temporary = `${target}.${process.pid}.tmp`;
+  fs.writeFileSync(temporary, JSON.stringify(event), { mode: 0o640 });
+  fs.renameSync(temporary, target);
+  return { state: event.state, event_id: event.event_id };
+}
+function validateIntent(intent, push) {
+  if (intent.schema !== "guanghu.deployment-intent/v1") return "deployment_intent_schema_invalid";
+  if (String(intent.repo || "").toLowerCase() !== push.repo || intent.branch !== push.branch || String(intent.commit_sha || "").toLowerCase() !== push.commit_sha) return "deployment_intent_binding_mismatch";
+  if (!/^[A-Z0-9][A-Z0-9._-]{5,119}@[0-9a-f]{40}$/.test(String(intent.resource || "")) || !String(intent.resource).endsWith(`@${push.commit_sha}`)) return "deployment_intent_resource_invalid";
+  if (!/^deployment\/requests\/[A-Za-z0-9._/-]{1,180}\.json$/.test(String(intent.manifest || ""))) return "deployment_intent_manifest_invalid";
+  return "";
+}
+module.exports = { enqueueDeploymentEvent, validateIntent };