fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>

scripts/src/platform-infra-observability/actions.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. actions module for scripts/src/platform-infra-observability.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/platform-infra-observability.ts:515-623 for #903.
 
@@ -119,6 +120,7 @@ export async function status(config: UniDeskConfig, options: CommonOptions): Pro
     action: "platform-infra-observability-status",
     mutation: false,
     target: targetSummary(target),
+    config: configSummary(observability, target),
     summary,
     remote: options.raw ? parsed : compactStatus(parsed, options.full) ?? compactCapture(result, { full: true }),
     next: {
@@ -146,6 +148,7 @@ export async function validate(config: UniDeskConfig, options: CommonOptions): P
     action: "platform-infra-observability-validate",
     mutation: false,
     target: targetSummary(target),
+    config: configSummary(observability, target),
     summary,
     validation: {
       readiness: ready ? "passed" : "failed",

scripts/src/platform-infra-observability/config.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. config module for scripts/src/platform-infra-observability.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/platform-infra-observability.ts:370-514 for #903.
 
@@ -22,6 +23,7 @@ import {
 import type { ImageSpec, ObservabilityConfig, ObservabilityTarget, OtlpPorts, ServiceConnection } from "./types";
 import { assertKnownEnabledTarget, parseStatusEndpoint } from "./actions";
 import { apiPathField, arrayOfRecords, asRecord, booleanField, configFile, configLabel, enumField, integerField, kubernetesNameField, numberArrayField, objectField, portField, stringArrayField, stringField } from "./types";
+import { configRefGraph, resolveConfigRefString } from "../ops/config-refs";
 
 export function readObservabilityConfig(): ObservabilityConfig {
   const parsed = Bun.YAML.parse(readFileSync(configFile, "utf8")) as unknown;
@@ -134,12 +136,33 @@ export function parseOtlpPorts(record: Record<string, unknown>, path: string): O
 
 export function parseServiceConnection(record: Record<string, unknown>, index: number): ServiceConnection {
   const path = `instrumentation.serviceConnections[${index}]`;
+  const refs = record.configRefs === undefined ? null : objectField(record, "configRefs", path);
+  const configRefs = refs === null
+    ? {}
+    : {
+        targetNode: stringField(refs, "targetNode", `${path}.configRefs`),
+        lane: stringField(refs, "lane", `${path}.configRefs`),
+        namespace: stringField(refs, "namespace", `${path}.configRefs`),
+      };
   return {
     serviceName: stringField(record, "serviceName", path),
     owningRepo: stringField(record, "owningRepo", path),
-    targetNode: stringField(record, "targetNode", path),
-    lane: stringField(record, "lane", path),
-    namespace: kubernetesNameField(record, "namespace", path),
+    targetNode: refs === null ? stringField(record, "targetNode", path) : resolveConfigRefString(configRefs.targetNode, `${path}.configRefs.targetNode`),
+    lane: refs === null ? stringField(record, "lane", path) : resolveConfigRefString(configRefs.lane, `${path}.configRefs.lane`),
+    namespace: refs === null ? kubernetesNameField(record, "namespace", path) : kubernetesNameValue(resolveConfigRefString(configRefs.namespace, `${path}.configRefs.namespace`), `${path}.configRefs.namespace`),
+    configRefs,
+    configRefGraph: refs === null
+      ? []
+      : configRefGraph([
+          { id: `${path}.targetNode`, ref: configRefs.targetNode },
+          { id: `${path}.lane`, ref: configRefs.lane },
+          { id: `${path}.namespace`, ref: configRefs.namespace },
+        ]),
     requiredSpans: stringArrayField(record, "requiredSpans", path),
   };
 }
+
+function kubernetesNameValue(value: string, path: string): string {
+  if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/u.test(value)) throw new Error(`${configLabel}.${path} must resolve to a Kubernetes name`);
+  return value;
+}

scripts/src/platform-infra-observability/summary.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. summary module for scripts/src/platform-infra-observability.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/platform-infra-observability.ts:3031-4400 for #903.
 
@@ -35,6 +36,17 @@ export function configSummary(observability: ObservabilityConfig, target: Observ
     collector: observability.collector,
     traceBackend: observability.traceBackend,
     sampling: observability.sampling,
+    serviceConnections: observability.instrumentation.serviceConnections.map((item) => ({
+      serviceName: item.serviceName,
+      owningRepo: item.owningRepo,
+      resolved: {
+        targetNode: item.targetNode,
+        lane: item.lane,
+        namespace: item.namespace,
+      },
+      configRefs: item.configRefGraph,
+      requiredSpans: item.requiredSpans,
+    })),
   };
 }
 

scripts/src/platform-infra-observability/types.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. types module for scripts/src/platform-infra-observability.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/platform-infra-observability.ts:1-149 for #903.
 
@@ -112,6 +113,8 @@ export interface ServiceConnection {
   targetNode: string;
   lane: string;
   namespace: string;
+  configRefs: Record<string, string>;
+  configRefGraph: Array<Record<string, unknown>>;
   requiredSpans: string[];
 }