M6 (part 1): per-recipe meta + D4 recipe-local discovery + shared naming helper

Recipe-agnostic harness (no surgery to enroll a recipe): recipe_meta.py for
health path/codes/timeouts; run_recipe_local discovers + runs recipe-shipped
tests/ against the live app. install non-regressed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/lifecycle.py

@@ -114,9 +114,10 @@ def http_get(domain: str, path: str = "/", timeout: int = 15) -> int:
         return 0
 
 
-def wait_healthy(domain: str, ok_codes=(200, 301, 302), deploy_timeout: int = 600,
-                 http_timeout: int = 300) -> None:
-    """Wait for stack services converged, then for the app to answer over HTTPS."""
+def wait_healthy(domain: str, ok_codes=(200, 301, 302), path: str = "/",
+                 deploy_timeout: int = 600, http_timeout: int = 300) -> None:
+    """Wait for stack services converged, then for the app to answer ok over HTTPS at `path`.
+    `path` is per-recipe (recipe_meta.HEALTH_PATH), e.g. keycloak uses /realms/master."""
     deadline = time.time() + deploy_timeout
     while time.time() < deadline:
         if services_converged(domain):
@@ -128,11 +129,11 @@ def wait_healthy(domain: str, ok_codes=(200, 301, 302), deploy_timeout: int = 60
     deadline = time.time() + http_timeout
     last = 0
     while time.time() < deadline:
-        last = http_get(domain)
+        last = http_get(domain, path)
         if last in ok_codes:
             return
         time.sleep(5)
-    raise TimeoutError(f"{domain}: not healthy over HTTPS (last status {last})")
+    raise TimeoutError(f"{domain}: not healthy over HTTPS {path} (last status {last})")
 
 
 def upgrade_app(domain: str, version: str | None = None) -> None:

runner/harness/naming.py

@@ -0,0 +1,20 @@
+"""Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
+
+Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
+64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
+"""
+from __future__ import annotations
+
+import hashlib
+import time
+
+
+def _short(s: str, n: int = 8) -> str:
+    return "".join(c for c in s if c.isalnum())[:n] or "local"
+
+
+def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
+    ref = ref or ("local" + str(int(time.time())))
+    tag = _short(recipe, 4).lower()
+    h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
+    return f"{tag}-{h}.ci.commoninternet.net"

runner/run_recipe_ci.py

@@ -16,11 +16,14 @@ Run env (python with pytest+playwright, PLAYWRIGHT_BROWSERS_PATH) is provided by
 """
 from __future__ import annotations
 
+import glob
 import os
 import subprocess
 import sys
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(ROOT, "runner"))
+from harness import lifecycle, naming  # noqa: E402
 STAGE_FILES = {
     "install": "test_install.py",
     "upgrade": "test_upgrade.py",
@@ -73,11 +76,37 @@ def main() -> int:
         ran += 1
         if rc != 0:
             overall = rc
+    # D4: recipe-local tests. If the recipe repo ships a tests/ dir, deploy the app and run those
+    # tests against the LIVE deployment (contract: CCCI_BASE_URL + CCCI_APP_DOMAIN env), merging the
+    # result into this run as another reported stage. Teardown is guaranteed.
+    rc = run_recipe_local(recipe)
+    if rc is not None:
+        ran += 1
+        if rc != 0:
+            overall = rc
+
     if ran == 0:
         print("no stage test files found", file=sys.stderr)
         return 1
     return overall
 
 
+def run_recipe_local(recipe: str) -> int | None:
+    local_dir = os.path.expanduser(f"~/.abra/recipes/{recipe}/tests")
+    if not os.path.isdir(local_dir) or not glob.glob(os.path.join(local_dir, "test_*.py")):
+        return None  # recipe ships no tests/ — D4 is a no-op for it
+    print("\n===== STAGE: recipe-local (D4) =====", flush=True)
+    domain = naming.app_domain(recipe, os.environ.get("PR", "0"), os.environ.get("REF"))
+    lifecycle.janitor()
+    try:
+        lifecycle.deploy_app(recipe, domain, version=os.environ.get("VERSION") or None)
+        lifecycle.wait_healthy(domain)
+        env = dict(os.environ, CCCI_APP_DOMAIN=domain, CCCI_BASE_URL=f"https://{domain}")
+        return subprocess.call([sys.executable, "-m", "pytest", "-v", "-rA", local_dir],
+                               cwd=ROOT, env=env)
+    finally:
+        lifecycle.teardown_app(domain, verify=False)
+
+
 if __name__ == "__main__":
     raise SystemExit(main())