fix: separate Fifth Domain source deployment identities

server-tools/lake-lamp-authz/deployment-event-worker.test.js

@@ -14,3 +14,60 @@ test("resident deployment agent consumes only an explicit immutable event and wr
     assert.equal(JSON.parse(fs.readFileSync(path.join(receipts, "event-1.json"))).diagnostic_code, "deployment_succeeded");
   } finally { fs.rmSync(root, { recursive: true, force: true }); }
 });
+test("resident agent rechecks source ownership before deployment", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-source-policy-"));
+  const queue = path.join(root, "queue"), receipts = path.join(root, "receipts"), sha = "b".repeat(40);
+  fs.mkdirSync(queue);
+  fs.writeFileSync(path.join(queue, "event.json"), JSON.stringify({
+    schema: "guanghu.deployment-event/v1",
+    event_id: "event-personal-source",
+    state: "queued_for_resident_agent",
+    repo: "bingshuo/hololake-platform",
+    branch: "main",
+    commit_sha: sha,
+    workorder_id: "order-2",
+    resource: `HLP-PERSONAL-DEPLOY@${sha}`,
+    manifest: "deployment/requests/HLP-PERSONAL.json",
+    authorizer_id: "ICE-GL∞",
+    persona_id: "AGE-TEAM-001",
+    execution_runtime_id: "SYS-GLW-ZY-EXEC-0001",
+    target: "JD-FD-PRIMARY",
+    deployment_source: {
+      repository_id: "REPO-008",
+      channel_id: "HLP-CHANNEL-0001",
+      distribution: "personal",
+      owner_id: "ICE-GL∞",
+    },
+  }));
+  let provisioned = false;
+  try {
+    const result = await processOne({
+      queueDir: queue,
+      receiptsDir: receipts,
+      registry: {
+        "bingshuo/hololake-platform": {
+          repo_url: "https://example.invalid/hololake-platform.git",
+          deployment_policy: {
+            profiles: [{
+              repository_id: "REPO-008",
+              channel_id: "HLP-CHANNEL-0001",
+              distribution: "personal",
+              source_owner_id: "ICE-GL∞",
+              allowed_authorizers: ["ICE-GL∞"],
+              allowed_personas: ["ICE-GL-ZY001"],
+              allowed_execution_runtimes: ["SYS-GLW-ZY-EXEC-0001"],
+              allowed_targets: ["JD-FD-PRIMARY"],
+            }],
+          },
+        },
+      },
+      provisionFn: async () => {
+        provisioned = true;
+        return { ok: true };
+      },
+    });
+    assert.equal(result.state, "REJECTED");
+    assert.equal(result.receipt.diagnostic_code, "deployment_persona_not_allowed");
+    assert.equal(provisioned, false);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});