separate server run bindings from deployment targets

2026-07-25 19:48:26 +08:00
parent cea7472517
commit e5c94be1db
28 changed files with 465 additions and 104 deletions
@@ -0,0 +1,20 @@
+## 1. Server binding contract
+
+- [x] 1.1 Add deployment-target and dedicated-Run ownership fields to domain, persistence, DTO, and safe server projections.
+- [x] 1.2 Validate exclusive dedicated endpoint ownership and draft/deployment state transitions.
+
+## 2. Secure lifecycle and control behavior
+
+- [x] 2.1 Create target-bound drafts, reserve their dedicated Run identity, and dispatch deployment only to a registered dedicated Run.
+- [x] 2.2 Build Run distributions through the deployment target while recording the reserved dedicated endpoint identity.
+- [x] 2.3 Constrain component hello and revocation to the matching server-owned endpoint.
+
+## 3. Management console workflow
+
+- [x] 3.1 Update API types and the creation workflow to label deployment targets and save target-bound drafts.
+- [x] 3.2 Guide draft operators through dedicated Run registration before deployment and update focused UI tests.
+
+## 4. Verification
+
+- [x] 4.1 Add backend tests for exclusive ownership, registration mismatch rejection, scoped revocation, and draft deployment gating.
+- [x] 4.2 Run formatting, focused tests, full structural validation, strict OpenSpec validation, and build/type checks.