fix: separate Fifth Domain source deployment identities

server-tools/lake-lamp-authz/deployment-event.js

@@ -2,12 +2,13 @@
 const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
+const { validateDeploymentSource } = require("./deployment-source-policy");
 
 // A push can request deployment, but it can never execute deployment itself.
 // The separate resident deployment agent consumes these immutable event files.
-function enqueueDeploymentEvent(intent, push, queueDir) {
+function enqueueDeploymentEvent(intent, push, queueDir, context = {}) {
   if (!intent) return { state: "not_requested" };
-  const invalid = validateIntent(intent, push);
+  const invalid = validateIntent(intent, push, context);
   if (invalid) return { state: "rejected", diagnostic_code: invalid };
   fs.mkdirSync(queueDir, { recursive: true, mode: 0o750 });
   const event = {
@@ -19,6 +20,11 @@ function enqueueDeploymentEvent(intent, push, queueDir) {
     workorder_id: String(intent.workorder_id || ""),
     resource: intent.resource, action: "provision-approved-architecture",
     manifest: intent.manifest,
+    authorizer_id: String(context.authorizer_id || ""),
+    persona_id: String(context.persona_id || ""),
+    execution_runtime_id: String(context.execution_runtime_id || ""),
+    target: String(context.target || ""),
+    deployment_source: intent.deployment_source || null,
   };
   const target = path.join(queueDir, `${event.created_at}-${event.event_id}.json`);
   const temporary = `${target}.${process.pid}.tmp`;
@@ -26,11 +32,21 @@ function enqueueDeploymentEvent(intent, push, queueDir) {
   fs.renameSync(temporary, target);
   return { state: event.state, event_id: event.event_id };
 }
-function validateIntent(intent, push) {
+function validateIntent(intent, push, context = {}) {
   if (intent.schema !== "guanghu.deployment-intent/v1") return "deployment_intent_schema_invalid";
   if (String(intent.repo || "").toLowerCase() !== push.repo || intent.branch !== push.branch || String(intent.commit_sha || "").toLowerCase() !== push.commit_sha) return "deployment_intent_binding_mismatch";
   if (!/^[A-Z0-9][A-Z0-9._-]{5,119}@[0-9a-f]{40}$/.test(String(intent.resource || "")) || !String(intent.resource).endsWith(`@${push.commit_sha}`)) return "deployment_intent_resource_invalid";
   if (!/^deployment\/requests\/[A-Za-z0-9._/-]{1,180}\.json$/.test(String(intent.manifest || ""))) return "deployment_intent_manifest_invalid";
+  if (context.registry) {
+    return validateDeploymentSource({
+      repo: push.repo,
+      authorizer_id: String(context.authorizer_id || ""),
+      persona_id: String(context.persona_id || ""),
+      execution_runtime_id: String(context.execution_runtime_id || ""),
+      target: String(context.target || ""),
+      deployment_source: intent.deployment_source || null,
+    }, context.registry);
+  }
   return "";
 }
 module.exports = { enqueueDeploymentEvent, validateIntent };