feat(1d): migrate keycloak/cryptpad/matrix-synapse/n8n/lasuite-docs overlays to deploy-once contract (DG7)

Mechanical port to the assertion-only contract (no softened/skipped assertions): install uses
live_app + generic.assert_serving (extend) + the recipe's http/playwright/api checks; upgrade seeds
its data marker then generic.do_upgrade + asserts survival; backup/restore split into test_backup.py
(seed->do_backup->mutate) + new test_restore.py (do_restore->assert original). Recipe-specifics
preserved verbatim (keycloak realm+admin-console+kc_admin, matrix/lasuite db-service psql markers,
cryptpad/n8n volume markers). No recipe now double-deploys under the deploy-once orchestrator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/keycloak/test_backup.py

@@ -1,32 +1,27 @@
-"""keycloak — backup/restore stage (D2): create a realm, backup, delete it (mutate), restore,
-assert the realm is back (mariadb restored to the backed-up state)."""
+"""keycloak — BACKUP overlay (Phase 1d, DG4): seed a known state (the marker realm in mariadb),
+back it up (assert a snapshot artifact), then mutate (delete the realm) so the RESTORE overlay
+(test_restore.py) can prove the backed-up state returns. Runs on the shared deployment; the mutated
+state persists for the restore tier."""
 
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
 import kc_admin  # noqa: E402
-from harness import lifecycle  # noqa: E402
+from harness import generic  # noqa: E402
 
 
-def test_backup_mutate_restore(deployed):
-    domain = deployed
+def test_backup_captures_state(live_app, meta):
+    domain = live_app
     pw = kc_admin.admin_password(domain)
     tok = kc_admin.admin_token(domain, pw)
 
-    # 1) create the marker realm, then back up
+    # 1) create the marker realm, then back up (reuse the generic op: backup + assert a snapshot)
     assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
     assert kc_admin.marker_realm_exists(domain, tok)
-    lifecycle.backup_app(domain)
+    snap = generic.do_backup(domain)
+    assert snap, "backup produced no snapshot artifact"
 
-    # 2) mutate: delete the realm
+    # 2) mutate: delete the realm (diverge from the backup)
     assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
     assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"
-
-    # 3) restore -> realm returns
-    lifecycle.restore_app(domain)
-    lifecycle.wait_healthy(
-        domain, path="/realms/master", ok_codes=(200,), deploy_timeout=600, http_timeout=600
-    )
-    tok2 = kc_admin.admin_token(domain, pw)
-    assert kc_admin.marker_realm_exists(domain, tok2), "restore did not bring back the realm"

tests/keycloak/test_install.py

@@ -1,22 +1,28 @@
-"""keycloak — install stage (recipe #2, DB-backed SSO; D2 install + D3 Playwright)."""
+"""keycloak — INSTALL overlay (Phase 1d, DG4): override + extend-by-composition.
+
+Reuses the generic "really serving" assertion, then ADDS the recipe-specific checks: the master
+realm endpoint answers 200 over HTTPS (keycloak + mariadb are up), and a real browser loads the
+keycloak admin console (D2 install + D3 Playwright). Assertion-only on the shared deployment."""
 
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 
-def test_realm_endpoint_healthy(deployed_app):
-    """The master realm endpoint answers 200 over HTTPS (keycloak + mariadb are up)."""
-    assert lifecycle.http_get(deployed_app, "/realms/master") == 200
+def test_serving_and_admin_console(live_app, meta):
+    # extend-by-composition: reuse the generic "really serving" assertion first ...
+    generic.assert_serving(live_app, meta)
 
+    # ... then the recipe-specific assertions.
+    # The master realm endpoint answers 200 over HTTPS (keycloak + mariadb are up).
+    assert lifecycle.http_get(live_app, "/realms/master") == 200
 
-def test_playwright_admin_login(deployed_app):
-    """A real browser loads the keycloak admin console (renders the sign-in UI)."""
+    # A real browser loads the keycloak admin console (renders the sign-in UI).
     from playwright.sync_api import sync_playwright
 
-    url = f"https://{deployed_app}/admin/master/console/"
+    url = f"https://{live_app}/admin/master/console/"
     with sync_playwright() as p:
         browser = p.chromium.launch(args=["--no-sandbox"])
         try:

tests/keycloak/test_restore.py

@@ -0,0 +1,22 @@
+"""keycloak — RESTORE overlay (Phase 1d, DG4): data-integrity, extends the generic restore.
+
+Runs after the backup overlay (test_backup.py) on the SAME shared deployment, which left the marker
+realm deleted after backing it up. This restores the snapshot via the shared op helper
+(`generic.do_restore`, which also asserts the app is healthy + serving afterwards), then asserts the
+marker realm returned (mariadb restored to the backed-up state) — the app-specific data integrity
+the generic restore cannot check. Assertion-only (no deploy/teardown)."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+import kc_admin  # noqa: E402
+from harness import generic  # noqa: E402
+
+
+def test_restore_returns_state(live_app, meta):
+    domain = live_app
+    generic.do_restore(domain, meta)  # restore + assert healthy/serving
+    pw = kc_admin.admin_password(domain)
+    tok = kc_admin.admin_token(domain, pw)
+    assert kc_admin.marker_realm_exists(domain, tok), "restore did not bring back the realm"

tests/keycloak/test_upgrade.py

@@ -1,49 +1,27 @@
-"""keycloak — upgrade stage (D2): deploy previous version, create a realm (DB data), upgrade to
-current/$REF, assert the app is healthy and the realm survived (mariadb data preserved)."""
+"""keycloak — UPGRADE overlay (Phase 1d, DG4): data-continuity, extends the generic upgrade.
+
+The orchestrator deployed the previous published version ONCE; this overlay creates a marker realm
+(DB data in mariadb) on the live app, performs the in-place upgrade via the shared op helper
+(`generic.do_upgrade`, which also asserts reconverge + serving + that the deployment moved), then
+asserts the realm SURVIVED (mariadb data preserved). Assertion-only on the shared deployment."""
 
 import os
 import sys
 
-import pytest
-
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
 import kc_admin  # noqa: E402
-from harness import lifecycle  # noqa: E402
+from harness import generic  # noqa: E402
 
 
-@pytest.fixture
-def old_app(recipe, app_domain, meta, request):
-    prev = lifecycle.previous_version(recipe)
-    if not prev:
-        pytest.skip(f"{recipe}: no previous published version")
-    lifecycle.janitor()
-    request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
-    lifecycle.deploy_app(recipe, app_domain, version=prev)
-    lifecycle.wait_healthy(
-        app_domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
-    return app_domain, prev
-
-
-def test_upgrade_preserves_realm(old_app, meta):
-    domain, prev = old_app
+def test_upgrade_preserves_realm(live_app, meta):
+    domain = live_app
     pw = kc_admin.admin_password(domain)
     tok = kc_admin.admin_token(domain, pw)
     assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
     assert kc_admin.marker_realm_exists(domain, tok), "marker realm not created"
 
-    lifecycle.upgrade_app(domain, version=os.environ.get("VERSION") or None)
-    lifecycle.wait_healthy(
-        domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
+    # in-place upgrade previous -> target (reuses the generic op: upgrade + assert reconverge/serving)
+    generic.do_upgrade(domain, os.environ.get("VERSION") or None, meta)
 
     # re-auth (token from the old instance is fine, but get a fresh one post-upgrade) and verify
     tok2 = kc_admin.admin_token(domain, pw)