fix: move sub2api runtime to PK01 host docker

scripts/src/platform-infra/policy.ts

@@ -18,7 +18,8 @@ import type { Sub2ApiConfig, Sub2ApiTargetConfig } from "./entry";
 import type { DisclosureOptions, PolicyCheck } from "./options";
 import { readSub2ApiConfig } from "./config";
 import { serviceName } from "./entry";
-import { isExternalTarget, resolveTarget } from "./manifest";
+import { hostDockerValidateScript } from "./host-docker";
+import { isExternalTarget, isHostDockerTarget, resolveTarget, targetHasSentinel } from "./manifest";
 import { escapeRegExp, hasAllowAllNetworkPolicy, hasDeploymentReplicas } from "./secrets-and-egress";
 import { boolField, validateExternalPendingScript } from "./utils";
 import { validateExternalActiveScript, validateScript } from "./validate-script";
@@ -26,7 +27,9 @@ import { validateExternalActiveScript, validateScript } from "./validate-script"
 export async function validate(config: UniDeskConfig, options: DisclosureOptions): Promise<Record<string, unknown>> {
   const sub2api = readSub2ApiConfig();
   const target = resolveTarget(sub2api, options.targetId);
-  const script = target.databaseMode === "external-pending"
+  const script = isHostDockerTarget(target)
+    ? hostDockerValidateScript(sub2api, target)
+    : target.databaseMode === "external-pending"
     ? validateExternalPendingScript(sub2api, target)
     : target.databaseMode === "external-active"
       ? validateExternalActiveScript(sub2api, target)
@@ -60,6 +63,35 @@ export async function validate(config: UniDeskConfig, options: DisclosureOptions
 }
 
 export function policyChecks(sub2api: Sub2ApiConfig, yaml: string, target: Sub2ApiTargetConfig): PolicyCheck[] {
+  if (isHostDockerTarget(target)) {
+    return [
+      {
+        name: "host-docker-no-kubernetes-manifest",
+        ok: yaml.trim().length === 0,
+        detail: "PK01 host-Docker Sub2API must not render or apply Kubernetes manifests.",
+      },
+      {
+        name: "host-docker-config-present",
+        ok: target.hostDocker !== null,
+        detail: "PK01 host-Docker Sub2API must be fully declared in config/platform-infra/sub2api.yaml.",
+      },
+      {
+        name: "host-docker-no-egress-proxy",
+        ok: target.egressProxy === null || !target.egressProxy.enabled,
+        detail: "PK01 Sub2API exits directly from PK01/api.pikapython.com and does not deploy the D601 egress proxy.",
+      },
+      {
+        name: "host-docker-no-sentinel",
+        ok: !targetHasSentinel(sub2api, target),
+        detail: "PK01 bare Docker deployment must not deploy the codex-pool sentinel.",
+      },
+      {
+        name: "host-docker-public-exposure-local",
+        ok: target.publicExposure?.enabled === true && target.publicExposure.mode === "pk01-local",
+        detail: "PK01 public exposure must be Caddy to local Docker, not FRP.",
+      },
+    ];
+  }
   const cleanup = sub2api.defaults.cleanup;
   const redisService = sub2api.runtime.redis.serviceName;
   const checks: PolicyCheck[] = [