feat: add deployment zone overlays

tests/test_graph_explorer.py

@@ -52,6 +52,11 @@ def test_graph_explorer_manifest_and_payload_validate() -> None:
     }
     filter_labels = {field["id"]: field["label"] for field in manifest["filter"]["fields"]}
     assert filter_labels["layer"] == "Node Type"
+    assert filter_labels["deploymentEnvironment"] == "Deployment Environment"
+    assert filter_labels["accessZone"] == "Access Zone"
+    assert {"by-deployment-environment", "by-deployment-scenario", "by-routing-authority", "by-access-zone"} <= {
+        mode["id"] for mode in manifest["modes"]
+    }
     nodes = [element for element in payload["elements"] if "source" not in element["data"]]
     edges = [element for element in payload["elements"] if "source" in element["data"]]
     registered_only = next(
@@ -164,7 +169,19 @@ def test_graph_explorer_presents_legacy_server_nodes_as_runtime_entities() -> No
                 "repo": "fixture-repo",
                 "domain": "testing",
                 "lifecycle": "active",
-                "attributes": {"host": "gitea.example.test", "server_type": "ingress-host"},
+                "attributes": {
+                    "host": "gitea.example.test",
+                    "server_type": "ingress-host",
+                    "deployment_overlay": {
+                        "deployment_environment": "test",
+                        "deployment_scenario": "coulombcore",
+                        "routing_authority": "kubernetes",
+                        "access_zone": "early-access",
+                        "policy_authority": "netkingdom-iam",
+                        "exposure_class": "early-access",
+                        "route_evidence": {"hostname": "gitea.example.test", "port": 443, "protocol": "tcp"},
+                    },
+                },
             },
             {
                 "id": "fixture.server.gitea.default.svc.cluster.local",
@@ -217,6 +234,12 @@ def test_graph_explorer_presents_legacy_server_nodes_as_runtime_entities() -> No
 
     assert nodes_by_id["fixture.server.gitea.example.test"]["kind"] == "ApplicationEndpoint"
     assert nodes_by_id["fixture.server.gitea.example.test"]["layer"] == "application"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["deploymentEnvironment"] == "test"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["deploymentScenario"] == "coulombcore"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["accessZone"] == "early-access"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["policyAuthority"] == "netkingdom-iam"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["routeHostname"] == "gitea.example.test"
+    assert nodes_by_id["fixture.server.gitea.example.test"]["routePort"] == 443
     assert nodes_by_id["fixture.server.gitea.default.svc.cluster.local"]["kind"] == "RuntimeService"
     assert nodes_by_id["fixture.server.gitea.default.svc.cluster.local"]["layer"] == "runtime_service"
     edge_types = {
@@ -387,6 +410,12 @@ def test_registry_serves_graph_explorer_exports(tmp_path: Path) -> None:
         assert "updateLabelVisibility" in page
         assert "ruleActionFor" in page
         assert "ruleRemovalSignature" in page
+        assert "zoneModeFields" in page
+        assert "renderMapOverview" in page
+        assert "route without policy authority" in page
+        assert "deploymentEnvironment" in page
+        assert "routingAuthority" in page
+        assert "accessZone" in page
         assert "Remove and redraw" in page
         assert "Rules are applied top to bottom" in page
         assert "showHelp" in page