修正(08-08-production-deployment-execution): 先验生产公网身份再冻结目录

deploy/trialrun/validate-env-contract.js

@@ -453,6 +453,14 @@ for (const requiredFragment of [
     errors.push(`install-warch3-ops-timer.sh 缺少活动部署环境绑定: ${requiredFragment}`);
   }
 }
+if (productionIdentityBootstrapScriptContent.indexOf('if (identityOnly === "1")')
+  > productionIdentityBootstrapScriptContent.indexOf('const databaseIdentityHash = bootstrapDatabaseIdentityHash')) {
+  errors.push('production-identity-bootstrap.mjs 的 identity-only 停止点必须位于数据库身份读取前');
+}
+if (productionIdentityBootstrapScriptContent.indexOf('verifyOriginIdentity(identity, contract, expectedOrigin);')
+  > productionIdentityBootstrapScriptContent.indexOf('const expectedRemoteDir = contract.REMOTE_DIR')) {
+  errors.push('production-identity-bootstrap.mjs 必须在 origin 双取样后冻结 contract REMOTE_DIR');
+}
 
 for (const requiredFragment of [
   'MODE="${1:-install}"',
@@ -634,8 +642,10 @@ for (const requiredFragment of [
   'HISTORICAL_TARGET_COMMIT',
   'HISTORICAL_PROJECT_COMMIT',
   'discoverRefreshTarget',
-  'assertExactHistoricalContract',
+  'assertContractForOriginVerification',
+  'verifyOriginIdentity',
   'bootstrapDatabaseIdentityHash',
+  'PRODUCTION_IDENTITY_ONLY',
   'EXPECTED_PRODUCTION_DB_NAME_SHA256',
   'DEPLOY_EXISTING_SCRIPT',
 ]) {
@@ -647,6 +657,8 @@ for (const requiredFragment of [
   'EXPECTED_PRODUCTION_ORIGIN_SHA256',
   'PROD_TARGET_RUNTIME_ORIGIN_MISMATCH',
   'PROD_TARGET_DB_NON_PRODUCTION_IDENTITY',
+  'origin_identity',
+  'IDENTITY_BOOTSTRAP_MODE',
   'DB_SHA256',
 ]) {
   if (!productionIdentityBootstrapRemoteScriptContent.includes(requiredFragment)) {