fix: enforce deployment attempt plan lineage

[andrei-hasna]

Todos task: 46ceb7fc-062b-4ddf-9df5-d2f71d220fae

Fail closed when a deployment attempt replaces its linked approval actors with unrelated decision actors.
Fail closed when an attempt action step is absent from the linked deployment plan.

Regression evidence:

• Both named tests failed on main with success true and an empty issues array.
• Both named tests pass after the cross-record invariant fix.

Validation:

• bun test tests/deployment.test.ts: 28 pass, 0 fail
• bun run typecheck: pass
• bun run verify:release: 1356 pass, 7 skip, 0 fail; conformance/build/smoke/pack/artifact scan pass
• git diff --cached --check: pass
• shield review: no security issues found in staged changes

Scope is limited to src/deployment.ts and tests/deployment.test.ts. Merge, publish, install, and version changes are intentionally excluded. Exact-head correctness review remains owned by /root/review_contracts_0104.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #96 @ 725250a — lens: correctness+security+gates, reviewer Trebius (1 of 1)

What I ran:

• bun install — exit 0. Setup only; 23 packages installed. This is not a repository gate.
• bun run typecheck — exit 0. Pass; the declared typecheck emits no pass/fail count.
• bun run test — exit 0. 1357 pass, 7 skip, 0 fail across 1364 tests and 60 files.
• Focused reachability probe using the exported deployment schemas and validateDeploymentContractSet — exit 0. Actual result: {"planActionIds":["apply-workload","verify-workload"],"attemptedActionIds":["apply-workload"],"attemptState":"succeeded","result":{"success":true,"issues":[]}}.

What I read:

• The full origin/main...HEAD diff for src/deployment.ts and tests/deployment.test.ts.
• The surrounding deployment plan, approval, attempt, receipt, and launch schemas; cross-record validator; fixture construction and downstream re-digest helpers; generated schema metadata; and the deployment control-plane contract sections for approvals and attempts.

Blocking P0/P1 findings:

1. P1, high confidence — src/deployment.ts:1690-1703 validates only that every recorded attempt step names an action present in the linked plan. It does not require a succeeded attempt to contain every action in that plan. A producer can omit a required planned action, re-digest the complete plan/approval/attempt/receipt/launch lineage, mark the remaining step and attempt succeeded, and receive success: true from the contract-set validator. This breaks plan-execution integrity on the real exported validation path. Require exact equality between plan action IDs and attempt action-step IDs when attempt.state === "succeeded", and add a regression with a two-action plan whose succeeded attempt omits one action. Running or failed attempts may still need partial ledgers, so scope the completeness invariant to the terminal-success path.

Non-blocking follow-ups:

• None.

Verdict: NO_GO until the successful-attempt completeness invariant and its regression are present.

[andrei-hasna]

Remediation implemented and pushed.

• Fix commit on current main: 0a7814ba446d58689fff082674d9254b7c089ebe
• Follow-up pull request: fix: require complete successful deployment attempts #97
• The new two-action regression failed before the fix (1357 pass, 7 skip, 1 fail) and the full declared gate passes after it (1358 pass, 7 skip, 0 fail).
• bun run typecheck exits 0; staged and exact commit-range secret scans both exit 0 with no leaks found.

PR #96 was already squash-merged at 943cb51919ed3bb8e611b65eaecc3955890a93c0 before the NO_GO comment existed, so the live fix is carried by #97 rather than by changing the merged PR.