feat(1d): migrate keycloak/cryptpad/matrix-synapse/n8n/lasuite-docs overlays to deploy-once contract (DG7)

Mechanical port to the assertion-only contract (no softened/skipped assertions): install uses
live_app + generic.assert_serving (extend) + the recipe's http/playwright/api checks; upgrade seeds
its data marker then generic.do_upgrade + asserts survival; backup/restore split into test_backup.py
(seed->do_backup->mutate) + new test_restore.py (do_restore->assert original). Recipe-specifics
preserved verbatim (keycloak realm+admin-console+kc_admin, matrix/lasuite db-service psql markers,
cryptpad/n8n volume markers). No recipe now double-deploys under the deploy-once orchestrator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/n8n/test_backup.py

@@ -1,5 +1,7 @@
-"""n8n — backup/restore stage (D2): write a marker into the backed-up /home/node/.n8n path, backup,
-mutate, restore, assert the restored state matches the pre-mutation state.
+"""n8n — BACKUP overlay (Phase 1d, DG4): seed a known state into the backed-up /home/node/.n8n path,
+back it up (assert a snapshot artifact), then mutate so the RESTORE overlay (test_restore.py) can
+prove the backed-up state returns. Runs on the shared deployment; the mutated marker persists for the
+restore tier.
 
 The n8n `app` service is labelled `backupbot.backup=true` with `backupbot.backup.path=/home/node/.n8n`,
 so a marker file there is backed up; checked via `exec_in_app`."""
@@ -8,29 +10,21 @@ import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 MARKER = "/home/node/.n8n/ci-marker.txt"
 
 
-def test_backup_mutate_restore(deployed, meta):
-    domain = deployed
+def test_backup_captures_state(live_app, meta):
+    domain = live_app
 
+    # 1) establish original state in the backed-up path, then back it up (reuse the generic op:
+    #    backup + assert a snapshot artifact was produced)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo original > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
-    lifecycle.backup_app(domain)
+    snap = generic.do_backup(domain)
+    assert snap, "backup produced no snapshot artifact"
 
+    # 2) mutate state (diverge from the backup)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo mutated > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "mutated"
-
-    lifecycle.restore_app(domain)
-    lifecycle.wait_healthy(
-        domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
-    assert (
-        lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
-    ), "restore did not return the pre-mutation state"

tests/n8n/test_install.py

@@ -1,22 +1,28 @@
-"""n8n — install stage (recipe #6, workflow automation). D2 install + D3 Playwright."""
+"""n8n — INSTALL overlay (Phase 1d, DG4): override + extend-by-composition.
+
+Reuses the generic "really serving" assertion, then ADDS the recipe-specific checks: /healthz answers
+200, and a real browser loads the live n8n editor SPA over HTTPS (D2 install + D3 Playwright).
+Assertion-only on the shared deployment."""
 
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 
-def test_healthz(deployed_app):
-    status = lifecycle.http_get(deployed_app, "/healthz")
-    assert status == 200, f"expected 200 from {deployed_app}/healthz, got {status}"
+def test_serving_and_editor(live_app, meta):
+    # extend-by-composition: reuse the generic "really serving" assertion first ...
+    generic.assert_serving(live_app, meta)
 
+    # ... then the recipe-specific assertions.
+    status = lifecycle.http_get(live_app, "/healthz")
+    assert status == 200, f"expected 200 from {live_app}/healthz, got {status}"
 
-def test_playwright_loads_editor(deployed_app):
-    """A real browser loads the live n8n editor SPA over HTTPS."""
+    # A real browser loads the live n8n editor SPA over HTTPS.
     from playwright.sync_api import sync_playwright
 
-    url = f"https://{deployed_app}/"
+    url = f"https://{live_app}/"
     with sync_playwright() as p:
         browser = p.chromium.launch(args=["--no-sandbox"])
         try:

tests/n8n/test_restore.py

@@ -0,0 +1,24 @@
+"""n8n — RESTORE overlay (Phase 1d, DG4): data-integrity, extends the generic restore.
+
+Runs after the backup overlay (test_backup.py) on the SAME shared deployment, which left the
+/home/node/.n8n marker mutated to "mutated" after backing up "original". This restores the snapshot
+via the shared op helper (`generic.do_restore`, which also asserts the app is healthy + serving
+afterwards), then asserts the data returned to the pre-mutation "original" — the app-specific data
+integrity the generic restore cannot check. Reads via `exec_in_app`. Assertion-only (no
+deploy/teardown)."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import generic, lifecycle  # noqa: E402
+
+MARKER = "/home/node/.n8n/ci-marker.txt"
+
+
+def test_restore_returns_state(live_app, meta):
+    domain = live_app
+    generic.do_restore(domain, meta)  # restore + assert healthy/serving
+    assert (
+        lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "original"
+    ), "restore did not return the pre-mutation state"

tests/n8n/test_upgrade.py

@@ -1,51 +1,27 @@
-"""n8n — upgrade stage (D2): deploy the previous published version, write a data marker into the
-persistent /home/node/.n8n volume, upgrade to current/$REF, assert health + data survival.
+"""n8n — UPGRADE overlay (Phase 1d, DG4): data-continuity, extends the generic upgrade.
 
-n8n state lives in the .n8n volume (sqlite + config); the marker is a file there, read back via
-`exec_in_app` (not HTTP-served)."""
+The orchestrator deployed the previous published version ONCE; this overlay writes a marker file into
+the persistent /home/node/.n8n volume (n8n state = sqlite + config; the marker is read back via
+`exec_in_app`, not HTTP-served), performs the in-place upgrade via the shared op helper
+(`generic.do_upgrade`, which also asserts reconverge + serving + that the deployment moved), then
+asserts the data SURVIVED. Assertion-only on the shared deployment."""
 
 import os
 import sys
 
-import pytest
-
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 MARKER = "/home/node/.n8n/ci-marker.txt"
 
 
-@pytest.fixture
-def old_app(recipe, app_domain, meta, request):
-    prev = lifecycle.previous_version(recipe)
-    if not prev:
-        pytest.skip(f"{recipe}: no previous published version to upgrade from")
-    lifecycle.janitor()
-    request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
-    lifecycle.deploy_app(recipe, app_domain, version=prev)
-    lifecycle.wait_healthy(
-        app_domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
-    return app_domain, prev
-
-
-def test_upgrade_preserves_data(old_app, meta):
-    domain, prev = old_app
+def test_upgrade_preserves_data(live_app, meta):
+    domain = live_app
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo upgrade-survives > {MARKER}"])
     assert lifecycle.exec_in_app(domain, ["cat", MARKER]).strip() == "upgrade-survives"
 
-    lifecycle.upgrade_app(domain, version=os.environ.get("VERSION") or None)
-    lifecycle.wait_healthy(
-        domain,
-        ok_codes=tuple(meta["HEALTH_OK"]),
-        path=meta["HEALTH_PATH"],
-        deploy_timeout=meta["DEPLOY_TIMEOUT"],
-        http_timeout=meta["HTTP_TIMEOUT"],
-    )
+    # in-place upgrade previous -> target (reuses the generic op: upgrade + assert reconverge/serving)
+    generic.do_upgrade(domain, os.environ.get("VERSION") or None, meta)
 
     assert lifecycle.http_get(domain, meta["HEALTH_PATH"]) == 200
     assert (