feat(2): refactor — SSO-dep plan refinement (deps AFTER generic + setup_custom_tests + failure isolation)

Per operator-2026-05-28 SSO-dep plan (plan-sso-dep-testing.md). Substantial orchestrator
restructuring:

NEW LIFECYCLE ORDER:
  1. Recipe deploy ALONE (no deps).
  2. install / upgrade / backup / restore — recipe-only generic tiers.
  3. setup_custom_tests step (NEW):
     a. Deploy each declared dep + provision realm/client/test-user via harness.sso.
     b. Write $CCCI_DEPS_FILE in dict shape {dep_recipe: {domain, realm, client_id, client_secret,
        admin_user, admin_password, discovery_url, token_url, ...}}.
     c. Run tests/<recipe>/setup_custom_tests.sh hook (jq-readable; wires OIDC env via abra
        secret insert + .env edits + in-place 'abra app deploy --force --chaos').
  4. CUSTOM tier with deps-ready flag; @pytest.mark.requires_deps tests skip with
     'deps-not-ready: <reason>' when setup_custom_tests fails. NON-deps custom tests still run
     normally — FAILURE ISOLATION (a DoD item per plan).
  5. Teardown: recipe first, deps in reverse declaration order.

Harness changes:
- runner/run_recipe_ci.py: deps deploy moves from BEFORE recipe deploy to AFTER restore tier.
  Adds _enrich_deps_with_sso() + _run_setup_custom_tests_hook(). DG4.1 generalised to
  'one abra app new per app' (recipe + each dep); in-place redeploys (\--force) don't count.
- runner/harness/deps.py: write_run_state + load_run_state accept dict OR list shape;
  deps_as_dict() coerces either to a recipe→entry map.
- runner/harness/sso.py: admin_password_inside() public re-export.
- tests/conftest.py: deps_creds fixture (full creds dict); deps_apps fixture flattens to
  recipe→domain string. pytest_collection_modifyitems hook skips
  \@pytest.mark.requires_deps tests when CCCI_DEPS_READY=0.
  pytest_configure registers the marker.

Recipe content:
- tests/lasuite-docs/setup_custom_tests.sh: NEW hook reads $CCCI_DEPS_FILE via jq;
  inserts oidc_rpcs secret at BUMPED version (v1→v2) since abra app new -S generates v1 first
  and Swarm forbids overwriting; updates SECRET_OIDC_RPCS_VERSION in .env; writes 9 OIDC env
  vars (REALM/DISCOVERY/AUTH/TOKEN/USERINFO/LOGOUT/JWKS/CLIENT_ID/SCOPES); ensures trailing
  newline on .env so writes don't concatenate (caught a 'TIMEOUT=900OIDC_REALM=...' bug);
  triggers in-place 'abra app deploy --force --chaos --no-input'.
- tests/lasuite-docs/functional/test_oidc_with_keycloak.py: refactored to consume deps_creds
  fixture (no longer calls setup_keycloak_realm itself — the orchestrator does it in
  setup_custom_tests). Marked \@pytest.mark.requires_deps.

Cold-verifiable on cc-ci (log /root/ccci-refactor-lasuite-r5.log):
  RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py
  install: PASS, custom: 3 PASS incl. test_oidc_password_grant_against_dep_keycloak.
  deploy-count = 2 (expect 2) — DG4.1 generalised holds.
  Smoke regression: RECIPE=custom-html STAGES=install,custom → 5 PASS, deploy-count=1.

Closes DEFERRED.md #5 (lasuite-docs OIDC parity ports via this plan).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -74,13 +74,50 @@ def live_app() -> str:
 
 @pytest.fixture(scope="session")
 def deps_apps() -> dict[str, str]:
-    """Phase 2 Q2.3 dependency-resolver contract: when a recipe declares `DEPS = [...]` in its
-    `recipe_meta.py`, the orchestrator deploys each dep BEFORE the recipe under test, persists
-    their per-run identity to `$CCCI_DEPS_FILE`, and tears them down LAST in finally. Tests access
-    the dep's per-run domain via this fixture: `deps_apps["keycloak"]` returns the dep's domain
-    or raises KeyError if the dep wasn't declared. Returns {} when the recipe declared no deps."""
-    state = deps_mod.load_run_state()
-    return {entry["recipe"]: entry["domain"] for entry in state if entry.get("domain")}
+    """Phase 2 Q2.3 dependency-resolver contract (refined operator-2026-05-28 SSO-dep plan §1):
+    when a recipe declares `DEPS = [...]` in its `recipe_meta.py`, the orchestrator deploys each
+    dep AFTER the generic tiers (between RESTORE and CUSTOM) and persists their per-run identity
+    + SSO creds to `$CCCI_DEPS_FILE`. Tests access the dep's per-run domain via this fixture.
+    For full SSO creds (realm/client/secret/admin) use the `deps_creds` fixture instead.
+
+    Returns `{dep_recipe: domain}` (str→str). Empty when no deps declared OR deps-not-ready."""
+    state = deps_mod.deps_as_dict(deps_mod.load_run_state())
+    return {r: e["domain"] for r, e in state.items() if e.get("domain")}
+
+
+@pytest.fixture(scope="session")
+def deps_creds() -> dict[str, dict]:
+    """Full SSO-creds dict for each declared dep (operator-2026-05-28 SSO-dep plan §1).
+    `deps_creds["keycloak"]` returns the entry written by setup_custom_tests with keys
+    domain/realm/client_id/client_secret/user/password/email/admin_user/admin_password/
+    discovery_url/token_url/.... Use this in `@pytest.mark.requires_deps` tests that need to
+    authenticate via OIDC."""
+    return deps_mod.deps_as_dict(deps_mod.load_run_state())
+
+
+def pytest_collection_modifyitems(config, items):
+    """SSO-dep plan §4: tests marked `@pytest.mark.requires_deps` are skipped with reason
+    `deps-not-ready: <captured-err>` when the orchestrator's setup_custom_tests step failed
+    (orchestrator sets CCCI_DEPS_READY=0 in env). Non-deps custom tests are unaffected.
+
+    This is failure-isolation per plan §1 — generic tiers cannot break the SSO-marked tests'
+    skip status, and an SSO-setup failure cannot break the generic tiers (they run first)."""
+    deps_ready_env = os.environ.get("CCCI_DEPS_READY", "1")
+    if deps_ready_env == "1":
+        return
+    reason = os.environ.get("CCCI_DEPS_NOT_READY_REASON", "(no reason given)")
+    skip_mark = pytest.mark.skip(reason=f"deps-not-ready: {reason}")
+    for item in items:
+        if "requires_deps" in item.keywords:
+            item.add_marker(skip_mark)
+
+
+def pytest_configure(config):
+    """Register the `requires_deps` marker so pytest doesn't warn about it."""
+    config.addinivalue_line(
+        "markers",
+        "requires_deps: test requires DEPS-declared services + setup_custom_tests success.",
+    )
 
 
 def _wait_healthy(domain, meta):