feat: confirm run deployment execution

2026-07-27 10:08:51 +08:00
parent 6c5b74b915
commit f2cc6b12e1
14 changed files with 241 additions and 18 deletions
@@ -0,0 +1,19 @@
+## ADDED Requirements
+
+### Requirement: Local raw startup diagnostics
+When explicitly enabled in Run configuration, Run SHALL print the raw server root, effective working directory, shell, and exact start command to its local process logger immediately before executing a valid start job.
+
+#### Scenario: Enabled diagnostics print local start context
+- **WHEN** an enabled Run begins a valid custom-command start job
+- **THEN** its local process logger SHALL contain the configured root, effective directory, shell, and command
+
+#### Scenario: Disabled diagnostics remain silent
+- **WHEN** local startup diagnostics are not enabled
+- **THEN** Run SHALL not print raw deployment values
+
+### Requirement: Raw diagnostics remain local
+Run SHALL NOT include raw deployment values in log-batch uploads, job progress, terminal results, artifacts, audits, or plugin-facing payloads.
+
+#### Scenario: Local diagnostics do not enter remote channels
+- **WHEN** enabled Run diagnostics are emitted during a start job
+- **THEN** the corresponding uploaded log events and terminal result SHALL contain no raw directory or command text
@@ -0,0 +1,34 @@
+## ADDED Requirements
+
+### Requirement: Frozen deployment execution
+Platform SHALL send a typed, versioned deployment definition with every lifecycle job for a configured server, and Run SHALL reject a definition it cannot validate or execute for the requested lifecycle action.
+
+#### Scenario: Start uses the leased revision
+- **WHEN** Run receives a valid `process.start` job with deployment revision 7
+- **THEN** it SHALL execute only the fields in that leased revision and SHALL not fetch a mutable replacement definition
+
+#### Scenario: Incompatible Run is rejected
+- **WHEN** a selected Run does not advertise deployment-execution support
+- **THEN** Platform SHALL reject dispatch before assigning a lifecycle job
+
+### Requirement: Execution revision receipt
+Run SHALL include a non-sensitive deployment execution receipt in each terminal deployment-aware lifecycle result, and Platform SHALL validate the receipt against the job's leased definition before projecting confirmation.
+
+#### Scenario: Matching receipt is projected
+- **WHEN** Run succeeds a start job and returns the job's deployment revision and action
+- **THEN** Platform SHALL show that Run confirmed execution of that revision
+
+#### Scenario: Mismatched receipt is rejected
+- **WHEN** Run reports a deployment revision or lifecycle action different from the lease
+- **THEN** Platform SHALL reject the terminal result and SHALL not mark the job successful
+
+### Requirement: Explicit deployment field clearing
+Platform SHALL preserve a deployment value when an update omits it and SHALL clear an optional field only when the update explicitly names that field for clearing.
+
+#### Scenario: Omitted shell remains unchanged
+- **WHEN** an editor saves a deployment update without a shell value
+- **THEN** Platform SHALL preserve the saved shell selection
+
+#### Scenario: Optional command is cleared
+- **WHEN** an editor submits `stopCommand` in its explicit clear list
+- **THEN** Platform SHALL store no stop command for the next deployment revision