修正(08-08-production-deployment-execution): 先验生产公网身份再冻结目录

deploy/trialrun/production-identity-bootstrap-remote.sh

@@ -9,11 +9,16 @@ fail() {
   exit 1
 }
 
-for key in REMOTE_DIR REMOTE_ENV_FILE COMPOSE_FILE COMPOSE_PROJECT_NAME \
-  EXPECTED_PRODUCTION_ORIGIN_SHA256; do
+for key in IDENTITY_BOOTSTRAP_MODE REMOTE_DIR REMOTE_ENV_FILE COMPOSE_FILE \
+  COMPOSE_PROJECT_NAME EXPECTED_PRODUCTION_ORIGIN_SHA256; do
   [[ -n "${!key:-}" ]] || fail "${key}_MISSING"
 done
 
+case "$IDENTITY_BOOTSTRAP_MODE" in
+  origin|database) ;;
+  *) fail "IDENTITY_BOOTSTRAP_MODE_INVALID" ;;
+esac
+
 [[ "$EXPECTED_PRODUCTION_ORIGIN_SHA256" =~ ^[0-9a-f]{64}$ ]] \
   || fail "PROD_TARGET_ORIGIN_HASH_INVALID"
 cd "$REMOTE_DIR"
@@ -62,11 +67,8 @@ reject_non_production_identity() {
 }
 
 actual_origin="$(dotenv_value APP_ORIGIN)" || fail "PROD_TARGET_ORIGIN_MISSING"
-actual_db_name="$(dotenv_value POSTGRES_DB)" || fail "PROD_TARGET_DB_NAME_MISSING"
 [[ "$(hash_text "$actual_origin")" == "$EXPECTED_PRODUCTION_ORIGIN_SHA256" ]] \
   || fail "PROD_TARGET_ORIGIN_MISMATCH"
-reject_non_production_identity "$actual_db_name" \
-  || fail "PROD_TARGET_DB_NON_PRODUCTION_IDENTITY"
 
 if docker compose version >/dev/null 2>&1; then
   compose_cmd=(docker compose -p "$COMPOSE_PROJECT_NAME" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
@@ -90,6 +92,14 @@ runtime_origin="$(
 [[ "$(hash_text "$runtime_origin")" == "$EXPECTED_PRODUCTION_ORIGIN_SHA256" ]] \
   || fail "PROD_TARGET_RUNTIME_ORIGIN_MISMATCH"
 
+if [[ "$IDENTITY_BOOTSTRAP_MODE" == "origin" ]]; then
+  printf '[production-identity-bootstrap][PASS] origin_identity\n'
+  exit 0
+fi
+
 # Only the comparison baseline crosses the SSH channel. The database name
 # itself remains remote and cannot be reconstructed from task evidence.
+actual_db_name="$(dotenv_value POSTGRES_DB)" || fail "PROD_TARGET_DB_NAME_MISSING"
+reject_non_production_identity "$actual_db_name" \
+  || fail "PROD_TARGET_DB_NON_PRODUCTION_IDENTITY"
 printf '[production-identity-bootstrap][DB_SHA256] %s\n' "$(hash_text "$actual_db_name")"