Implement credentialed live hardening workplan

tests/test_deployment.py

@@ -0,0 +1,44 @@
+from phase_memory.deployment import (
+    MANAGED_DEPLOYMENT_SCHEMA,
+    managed_deployment_manifest,
+    validate_managed_deployment_manifest,
+)
+from phase_memory.service_app import ServiceAppConfig
+
+
+def test_managed_deployment_manifest_declares_entrypoint_probes_and_store() -> None:
+    manifest = managed_deployment_manifest(
+        ServiceAppConfig(host="0.0.0.0", port=8090, local_store_path="/var/lib/phase-memory"),
+        image="registry.example/phase-memory:test",
+        namespace="agents",
+        replicas=2,
+    )
+    validation = validate_managed_deployment_manifest(manifest)
+
+    assert manifest["schema_version"] == MANAGED_DEPLOYMENT_SCHEMA
+    assert manifest["service"]["command"][0] == "phase-memory-service"
+    assert manifest["service"]["ports"][0]["container_port"] == 8090
+    assert manifest["probes"]["liveness"]["path"] == "/health"
+    assert manifest["probes"]["readiness"]["path"] == "/ready"
+    assert manifest["storage"]["volumes"][0]["mount_path"] == "/var/lib/phase-memory"
+    assert manifest["rollback"]["requires_store_snapshot"] is True
+    assert validation["valid"] is True
+    assert validation["diagnostics"] == []
+
+
+def test_managed_deployment_validation_reports_missing_contracts() -> None:
+    manifest = {
+        "schema_version": MANAGED_DEPLOYMENT_SCHEMA,
+        "service": {"command": ["python"], "replicas": 0},
+        "probes": {"liveness": {"path": "/wrong"}},
+        "storage": {"volumes": []},
+    }
+
+    validation = validate_managed_deployment_manifest(manifest)
+    codes = {diagnostic["code"] for diagnostic in validation["diagnostics"]}
+
+    assert validation["valid"] is False
+    assert "managed_deployment_missing_service_entrypoint" in codes
+    assert "managed_deployment_probe_missing" in codes
+    assert "managed_deployment_store_mount_missing" in codes
+    assert "managed_deployment_replica_count_invalid" in codes