test: add deploy json executor drift preflight

scripts/issue-60-cicd-drift-contract-test.ts

@@ -49,11 +49,18 @@ const plannedDeployJsonFields = [
   "consumer.dev.enabled",
   "consumer.prod.enabled",
   "consumer.supportLevel",
+  "consumer.targetRef",
   "consumer.noRuntimeSourceBuild",
+  "runtime.containerPort",
+  "runtime.healthPath",
+  "runtime.memory.request",
+  "runtime.memory.limit",
   "health.deployMetadataRequired",
   "runtime.requiredSecretKeys",
 ];
 
+const phaseTwoExecutorContractServices = new Set(["dev/mdtodo"]);
+
 function assertCondition(condition: unknown, message: string, detail: unknown = {}): void {
   if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
 }
@@ -107,13 +114,16 @@ function assertDeployJsonReleaseIntent(deploy: JsonRecord): Array<{ environment:
   const services: Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }> = [];
   for (const environment of ["dev", "prod"] as const) {
     for (const service of deployServicesByEnvironment(deploy, environment)) {
-      const keys = Object.keys(service).sort();
-      assertCondition(keys.join(",") === "commitId,id,repo", "phase-one deploy.json service entries must remain only id/repo/commitId until schema migration lands", { environment, service, keys });
       const serviceId = stringField(service.id, `${environment} service id`);
+      const key = serviceKey(environment, serviceId);
+      const keys = Object.keys(service).sort();
+      const allowedKeys = phaseTwoExecutorContractServices.has(key)
+        ? ["artifact", "commitId", "consumer", "id", "repo", "runtime"]
+        : ["commitId", "id", "repo"];
+      assertCondition(keys.join(",") === allowedKeys.join(","), "deploy.json service entries must stay in the reviewed phase-one/phase-two schema set", { environment, service, keys, allowedKeys });
       const repo = stringField(service.repo, `${environment}/${serviceId}.repo`);
       const commitId = stringField(service.commitId, `${environment}/${serviceId}.commitId`).toLowerCase();
       assertCondition(isFullSha(commitId), "deploy.json phase-one commit pins must be full 40-character SHAs", { environment, serviceId, commitId });
-      const key = serviceKey(environment, serviceId);
       assertCondition(!seen.has(key), "deploy.json service must not be duplicated within an environment", { key });
       seen.add(key);
       services.push({ environment, serviceId, repo, commitId });
@@ -203,6 +213,9 @@ function assertDocsContract(): void {
   const docs = readFileSync(rootPath("docs/reference/cicd-standardization.md"), "utf8");
   for (const phrase of [
     "Phase-One Deploy.json Consolidation Contract",
+    "dev/mdtodo",
+    "deploy-json-drift",
+    "bun scripts/issue-60-deploy-json-executor-preflight-contract-test.ts",
     "Current duplicated configuration surfaces",
     "Fields that stay outside `deploy.json` during phase one",
     "The drift contract is:",