feat: reveal saved server deployment inputs

2026-07-27 09:24:44 +08:00
parent e5c94be1db
commit 6c5b74b915
19 changed files with 345 additions and 31 deletions
@@ -0,0 +1,27 @@
+## Why
+
+Operators cannot inspect the exact protected deployment paths and commands that Platform will send to Run. The current configured-only editor makes it impossible to verify an existing deployment or investigate whether Run used the intended inputs.
+
+## What Changes
+
+- Add an authorized, explicit read path for a server manager to reveal that server's saved deployment inputs.
+- Prefill the deployment editor from this reveal path only after the operator deliberately asks to show the configuration.
+- Keep ordinary deployment reads, server lists, job summaries, logs, audits, and plugin-facing reads redacted.
+- Add a safe deployment-input diagnostic that proves whether the Platform job dispatched to Run carried the saved deployment revision without putting raw values into job/status views.
+
+## Capabilities
+
+### New Capabilities
+
+- `server-deployment-input-reveal`: Authorized, explicit inspection of a server's saved deployment inputs and their Run-dispatch state.
+
+### Modified Capabilities
+
+- None.
+
+## Impact
+
+- Affected API: server deployment routes and DTOs.
+- Affected platform code: deployment service, repository-backed deployment data, lifecycle dispatch diagnostics, and API tests.
+- Affected frontend: the shared server deployment workflow and API types/client.
+- Affected external integration: Run job-input verification remains based on the existing leased deployment contract; no Run source or protocol expansion is required.