feat(1d): migrate keycloak/cryptpad/matrix-synapse/n8n/lasuite-docs overlays to deploy-once contract (DG7)

Mechanical port to the assertion-only contract (no softened/skipped assertions): install uses
live_app + generic.assert_serving (extend) + the recipe's http/playwright/api checks; upgrade seeds
its data marker then generic.do_upgrade + asserts survival; backup/restore split into test_backup.py
(seed->do_backup->mutate) + new test_restore.py (do_restore->assert original). Recipe-specifics
preserved verbatim (keycloak realm+admin-console+kc_admin, matrix/lasuite db-service psql markers,
cryptpad/n8n volume markers). No recipe now double-deploys under the deploy-once orchestrator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/cryptpad/test_backup.py

@@ -1,5 +1,7 @@
-"""cryptpad — backup/restore stage (D2): write a marker into the backed-up cryptpad_data volume,
-backup, mutate, restore, assert the restored state matches the pre-mutation (backed-up) state.
+"""cryptpad — BACKUP overlay (Phase 1d, DG4): seed a known state into the backed-up cryptpad_data
+volume, back it up (assert a snapshot artifact), then mutate so the RESTORE overlay (test_restore.py)
+can prove the backed-up state returns. Runs on the shared deployment; the mutated marker persists for
+the restore tier.
 
 The cryptpad `app` service is labelled `backupbot.backup=true`, so its volumes (incl. cryptpad_data)
 are backed up. Marker is checked via `exec_in_app` (data isn't HTTP-served)."""
@@ -8,32 +10,21 @@ import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 MARKER = "/cryptpad/data/ci-marker.txt"
 
 
-def test_backup_mutate_restore(deployed, meta):
-    domain = deployed
+def test_backup_captures_state(live_app, meta):
+    domain = live_app
 
-    # 1) establish original state in the backed-up volume, then back it up
+    # 1) establish original state in the backed-up volume, then back it up (reuse the generic op:
+    #    backup + assert a snapshot artifact was produced)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo original > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
-    lifecycle.backup_app(domain)
+    snap = generic.do_backup(domain)
+    assert snap, "backup produced no snapshot artifact"
 
     # 2) mutate state (diverge from the backup)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo mutated > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "mutated"
-
-    # 3) restore -> state returns to the backed-up "original"
-    lifecycle.restore_app(domain)
-    lifecycle.wait_healthy(
-        domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
-    assert (
-        lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
-    ), "restore did not return the pre-mutation state"

tests/cryptpad/test_install.py

@@ -1,23 +1,29 @@
-"""cryptpad — install stage (recipe #3, stateful/no-DB). D2 install + D3 Playwright."""
+"""cryptpad — INSTALL overlay (Phase 1d, DG4): override + extend-by-composition.
+
+Reuses the generic "really serving" assertion, then ADDS the recipe-specific checks: cryptpad answers
+over real HTTPS through the gateway, and a real browser loads the live cryptpad landing page and sees
+its served app (D2 install + D3 Playwright). Assertion-only on the shared deployment."""
 
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 
-def test_http_reachable(deployed_app):
-    """cryptpad answers over real HTTPS through the gateway (nginx -> cryptpad app)."""
-    status = lifecycle.http_get(deployed_app, "/")
-    assert status in (200, 301, 302), f"expected 2xx/3xx from {deployed_app}, got {status}"
+def test_serving_and_content(live_app, meta):
+    # extend-by-composition: reuse the generic "really serving" assertion first ...
+    generic.assert_serving(live_app, meta)
 
+    # ... then the recipe-specific assertions.
+    # cryptpad answers over real HTTPS through the gateway (nginx -> cryptpad app).
+    status = lifecycle.http_get(live_app, "/")
+    assert status in (200, 301, 302), f"expected 2xx/3xx from {live_app}, got {status}"
 
-def test_playwright_loads_cryptpad(deployed_app):
-    """A real browser loads the live cryptpad landing page and sees its served app."""
+    # A real browser loads the live cryptpad landing page and sees its served app.
     from playwright.sync_api import sync_playwright
 
-    url = f"https://{deployed_app}/"
+    url = f"https://{live_app}/"
     with sync_playwright() as p:
         browser = p.chromium.launch(args=["--no-sandbox"])
         try:

tests/cryptpad/test_restore.py

@@ -0,0 +1,24 @@
+"""cryptpad — RESTORE overlay (Phase 1d, DG4): data-integrity, extends the generic restore.
+
+Runs after the backup overlay (test_backup.py) on the SAME shared deployment, which left the
+cryptpad_data marker mutated to "mutated" after backing up "original". This restores the snapshot via
+the shared op helper (`generic.do_restore`, which also asserts the app is healthy + serving
+afterwards), then asserts the volume data returned to the pre-mutation "original" — the app-specific
+data integrity the generic restore cannot check. Reads the marker via `exec_in_app` (data isn't
+HTTP-served). Assertion-only (no deploy/teardown)."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import generic, lifecycle  # noqa: E402
+
+MARKER = "/cryptpad/data/ci-marker.txt"
+
+
+def test_restore_returns_state(live_app, meta):
+    domain = live_app
+    generic.do_restore(domain, meta)  # restore + assert healthy/serving
+    assert (
+        lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
+    ), "restore did not return the pre-mutation state"

tests/cryptpad/test_upgrade.py

@@ -1,53 +1,28 @@
-"""cryptpad — upgrade stage (D2): deploy the previous published version, write a data marker into a
-persistent volume, upgrade to current/$REF, assert the app stays healthy and the data survives.
+"""cryptpad — UPGRADE overlay (Phase 1d, DG4): data-continuity, extends the generic upgrade.
 
-cryptpad data isn't HTTP-served as a static file (it's an encrypted datastore), so the marker is
-written into the cryptpad_data volume and read back via `exec_in_app` (docker exec), not HTTP."""
+The orchestrator deployed the previous published version ONCE; this overlay writes a marker into the
+persistent cryptpad_data volume (cryptpad data isn't HTTP-served as a static file — it's an encrypted
+datastore — so the marker is read back via `exec_in_app`, not HTTP), performs the in-place upgrade via
+the shared op helper (`generic.do_upgrade`, which also asserts reconverge + serving + that the
+deployment moved), then asserts the data SURVIVED. Assertion-only on the shared deployment."""
 
 import os
 import sys
 
-import pytest
-
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 MARKER = "/cryptpad/data/ci-marker.txt"
 
 
-@pytest.fixture
-def old_app(recipe, app_domain, meta, request):
-    prev = lifecycle.previous_version(recipe)
-    if not prev:
-        pytest.skip(f"{recipe}: no previous published version to upgrade from")
-    lifecycle.janitor()
-    request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
-    lifecycle.deploy_app(recipe, app_domain, version=prev)
-    lifecycle.wait_healthy(
-        app_domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
-    return app_domain, prev
-
-
-def test_upgrade_preserves_data(old_app, meta):
-    domain, prev = old_app
+def test_upgrade_preserves_data(live_app, meta):
+    domain = live_app
     # write a data marker into the persistent cryptpad_data volume
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo upgrade-survives > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "upgrade-survives"
 
-    # upgrade previous -> current/$REF
-    lifecycle.upgrade_app(domain, version=os.environ.get("VERSION") or None)
-    lifecycle.wait_healthy(
-        domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
+    # in-place upgrade previous -> target (reuses the generic op: upgrade + assert reconverge/serving)
+    generic.do_upgrade(domain, os.environ.get("VERSION") or None, meta)
 
     # app healthy and the data written before the upgrade is still there
     assert lifecycle.http_get(domain, "/") in (200, 301, 302)