M6 (part 1): per-recipe meta + D4 recipe-local discovery + shared naming helper

Recipe-agnostic harness (no surgery to enroll a recipe): recipe_meta.py for
health path/codes/timeouts; run_recipe_local discovers + runs recipe-shipped
tests/ against the live app. install non-regressed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/lifecycle.py

@@ -114,9 +114,10 @@ def http_get(domain: str, path: str = "/", timeout: int = 15) -> int:
         return 0
 
 
-def wait_healthy(domain: str, ok_codes=(200, 301, 302), deploy_timeout: int = 600,
-                 http_timeout: int = 300) -> None:
-    """Wait for stack services converged, then for the app to answer over HTTPS."""
+def wait_healthy(domain: str, ok_codes=(200, 301, 302), path: str = "/",
+                 deploy_timeout: int = 600, http_timeout: int = 300) -> None:
+    """Wait for stack services converged, then for the app to answer ok over HTTPS at `path`.
+    `path` is per-recipe (recipe_meta.HEALTH_PATH), e.g. keycloak uses /realms/master."""
     deadline = time.time() + deploy_timeout
     while time.time() < deadline:
         if services_converged(domain):
@@ -128,11 +129,11 @@ def wait_healthy(domain: str, ok_codes=(200, 301, 302), deploy_timeout: int = 60
     deadline = time.time() + http_timeout
     last = 0
     while time.time() < deadline:
-        last = http_get(domain)
+        last = http_get(domain, path)
         if last in ok_codes:
             return
         time.sleep(5)
-    raise TimeoutError(f"{domain}: not healthy over HTTPS (last status {last})")
+    raise TimeoutError(f"{domain}: not healthy over HTTPS {path} (last status {last})")
 
 
 def upgrade_app(domain: str, version: str | None = None) -> None:

runner/harness/naming.py

@@ -0,0 +1,20 @@
+"""Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
+
+Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
+64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
+"""
+from __future__ import annotations
+
+import hashlib
+import time
+
+
+def _short(s: str, n: int = 8) -> str:
+    return "".join(c for c in s if c.isalnum())[:n] or "local"
+
+
+def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
+    ref = ref or ("local" + str(int(time.time())))
+    tag = _short(recipe, 4).lower()
+    h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
+    return f"{tag}-{h}.ci.commoninternet.net"