fix: 收敛 PaC 自动交付提示

scripts/src/hwlab-node-help.ts

@@ -3,7 +3,38 @@
 // Responsibility: Help payloads for HWLAB node/lane and web-probe CLI entries.
 import { hwlabRuntimeLaneConfigPath } from "./hwlab-node-lanes";
 
-export function hwlabNodeHelp(): Record<string, unknown> {
+export function hwlabNodeHelp(scope: "legacy-cicd" | "platform-maintenance" | null = null): Record<string, unknown> {
+  if (scope === "legacy-cicd") {
+    return {
+      ok: true,
+      command: "hwlab nodes control-plane legacy-cicd",
+      description: "仅用于 owning YAML 明确解析为 legacy-manual 的旧交付入口。PaC 或 unknown authority 会 fail-closed。",
+      examples: [
+        "bun scripts/cli.ts hwlab nodes control-plane trigger-current --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes control-plane refresh --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes control-plane sync --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes control-plane source-workspace sync --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes git-mirror sync --node <node> --lane <lane> --confirm --wait",
+        "bun scripts/cli.ts hwlab nodes git-mirror flush --node <node> --lane <lane> --confirm --wait",
+      ],
+      valuesPrinted: false,
+    };
+  }
+  if (scope === "platform-maintenance") {
+    return {
+      ok: true,
+      command: "hwlab nodes control-plane platform-maintenance",
+      description: "YAML 声明的平台配置、Secret 与容量维护；不得作为 PaC 源码交付的补偿或恢复入口。",
+      examples: [
+        "bun scripts/cli.ts hwlab nodes control-plane apply --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes control-plane public-exposure --node <node> --lane <lane> --confirm",
+        "bun scripts/cli.ts hwlab nodes control-plane cleanup-runs --node <node> --lane <lane> --min-age-minutes 30 --limit 200 --dry-run",
+        "bun scripts/cli.ts hwlab nodes control-plane cleanup-released-pvs --node <node> --lane <lane> --limit 200 --dry-run",
+        "bun scripts/cli.ts hwlab nodes secret status --node <node> --lane <lane> --name <secret>",
+      ],
+      valuesPrinted: false,
+    };
+  }
   return {
     ok: true,
     command: "hwlab nodes",
@@ -13,12 +44,8 @@ export function hwlabNodeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts hwlab nodes control-plane infra plan --node <node> --lane <lane>",
       "bun scripts/cli.ts hwlab nodes control-plane status --node <node> --lane <lane>",
       "bun scripts/cli.ts hwlab nodes control-plane status --node <node> --lane <lane> --json",
-      "bun scripts/cli.ts hwlab nodes control-plane source-workspace sync --node JD01 --lane v03 --confirm",
-      "bun scripts/cli.ts hwlab nodes control-plane cleanup-runs --node JD01 --lane v03 --min-age-minutes 30 --limit 200 --dry-run",
-      "bun scripts/cli.ts hwlab nodes control-plane cleanup-released-pvs --node JD01 --lane v03 --limit 200 --dry-run",
-      "bun scripts/cli.ts hwlab nodes control-plane cleanup-legacy-docker-images --node JD01 --lane v03 --dry-run",
-      "bun scripts/cli.ts hwlab nodes control-plane cleanup-legacy-docker-registry-volume --node JD01 --lane v03 --dry-run",
       "bun scripts/cli.ts hwlab nodes git-mirror status --node <node> --lane <lane>",
+      "bun scripts/cli.ts platform-infra pipelines-as-code history --target <node> --consumer <consumer>",
       "bun scripts/cli.ts hwlab nodes hwpod-preinstall plan --node <node> --lane <lane> --dry-run",
       "bun scripts/cli.ts hwlab nodes hwpod-node plan --node G14-WSL --lane v03",
       "bun scripts/cli.ts hwlab nodes fake-model-provider plan --node D518 --lane v03 --provider fake-echo",
@@ -26,14 +53,16 @@ export function hwlabNodeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts hwlab nodes test-accounts status --node <node> --lane <lane>",
       "bun scripts/cli.ts hwlab nodes observability performance-summary --node <node> --lane <lane>",
       "bun scripts/cli.ts web-probe --help",
+      "bun scripts/cli.ts hwlab nodes control-plane platform-maintenance --help",
+      "bun scripts/cli.ts hwlab nodes control-plane legacy-cicd --help",
     ],
     actions: {
-      "control-plane": "YAML-first node-local CI/CD, git-mirror, source-workspace sync, public exposure, runtime-image, Argo, PipelineRun and CI workspace retention operations.",
+      "control-plane": "YAML-first node-local CI/CD status, public exposure, runtime-image, Argo, PipelineRun and CI workspace retention domains; delivery writes are documented only by scoped help.",
       "git-mirror": "Inspect or operate the selected node/lane source mirror.",
       "hwpod-preinstall": "Render YAML-first HWPOD preinstall configRefs, runtime mount targets, PM MDTODO source, and gateway profile status.",
       "hwpod-node": "通过 YAML 和 trans 部署、查询 Windows 原生 Python HWPOD 节点。",
       "fake-model-provider": "Materialize and operate YAML-declared fake Responses model providers for HWLAB/AgentRun sentinel checks.",
-      secret: "Inspect and sync YAML-declared runtime Secrets without printing secret values.",
+      secret: "Inspect YAML-declared runtime Secrets without printing secret values; writes are documented only by platform-maintenance help.",
       "test-accounts": "Prepare YAML-declared HWLAB admin/test account API keys with redacted sourceRef/fingerprint output.",
       observability: "Read runtime metrics and authenticated Web Performance summaries.",
     },
@@ -43,7 +72,8 @@ export function hwlabNodeHelp(): Record<string, unknown> {
       "control-plane cleanup-runs deletes terminal PipelineRuns; cleanup-released-pvs deletes only orphaned hwlab-ci PipelineRun PVCs with no active pod mounts and Released local-path/Delete PVs.",
       "cleanup-legacy-docker-images is a transitional legacy-cache GC for Docker images matching YAML allowlisted repositories; it protects container-referenced images, does not run prune, and does not touch Docker volumes.",
       "cleanup-legacy-docker-registry-volume removes only an exited legacy Docker registry container and its unique /var/lib/registry volume after the YAML-declared k8s node-local-registry is ready.",
-      "`trigger-current --confirm --wait` is the one-command CICD path for current node/lane runtime publish.",
+      "PaC consumer 只由 GitHub PR merge 触发；默认帮助只给只读 status/history，自动链故障必须修 owning YAML、controller 或源码。",
+      "旧交付与平台维护写入口分别只在 legacy-cicd、platform-maintenance scoped help 中展示。",
       "control-plane status reads its total budget, heartbeat cadence, termination grace period, and probe switches from config/hwlab-node-control-plane.yaml; --json keeps stdout as one compact JSON document while progress remains on stderr.",
     ],
   };
@@ -86,8 +116,8 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts web-probe observe gc --node JD01 --lane v03 --keep-hours 24 --confirm",
       "bun scripts/cli.ts web-probe sentinel plan --node <node> --lane <lane> --dry-run",
       "bun scripts/cli.ts web-probe sentinel plan --node <node> --lane <lane> --sentinel workbench-auth-session-switch-2users",
-      "bun scripts/cli.ts platform-infra pipelines-as-code closeout --target JD01 --consumer sentinel-jd01-v03 --source-commit <sha> --wait",
       "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer sentinel-jd01-v03",
+      "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --consumer sentinel-jd01-v03 --limit 10",
       "bun scripts/cli.ts web-probe sentinel dashboard verify --node <node> --lane <lane> --sentinel workbench-dsflash-go-tool-call-10x",
       "bun scripts/cli.ts web-probe sentinel dashboard screenshot --node <node> --lane <lane> --sentinel workbench-auth-session-switch-2users",
       "bun scripts/cli.ts web-probe sentinel dashboard trigger --node JD01 --lane v03 --sentinel jd01-web-probe-sentinel",
@@ -103,7 +133,7 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       script: "Run caller-provided Playwright JS after CLI-managed /auth/login; scripts must not handle secrets themselves.",
       screenshot: "Capture a page through the selected YAML semantic origin and node/lane remote browser, then download PNG artifacts to the caller /tmp by default.",
       observe: "Start, inspect, control, stop, collect, analyze, and garbage-collect raw artifacts for long-running observers.",
-      sentinel: "Render and operate the YAML-first web-probe sentinel wrapper, image, GitOps, dashboard verification, maintenance and report views; migrated JD01 formal closeout uses platform-infra pipelines-as-code, while publish-current is debug/recovery only.",
+      sentinel: "Render and operate the YAML-first web-probe sentinel wrapper, image, GitOps, dashboard verification, maintenance and report views; migrated consumers are delivered only by the automatic PR-merge chain.",
     },
     notes: [
       "Named internal/public origins, default origin, per-origin browser proxy mode, observe/analyze thresholds, and project-management command allowlist come from config/hwlab-node-lanes.yaml webProbe.",