[Deploy-S6] Deno Deploy tier-1 adapter (marquee)

[rickylabs]

[Deploy-S6] Deno Deploy tier-1 adapter (marquee) — RESEARCH + PLAN

Planning-only until PLAN-EVAL PASS. This PR carries the harness run docs
(research.md + plan.md) for slice #342, Phase 2 of the deployment epic, decision D2
(the deno-native beta marquee). No adapter/CLI/schema code is included — implementation begins only
after a separate-session PLAN-EVAL passes and the prerequisite slices merge.

Closes #342
Refs #327

Revision 2 (post-FAIL_PLAN). Rev 1 misattributed the 3-op deploy port to #338, demoted the
ratified 7-op contract, and premised "#337 not merged." Rev 2 selects Archetype 7 (composite),
conforms to the canonical 7-op deploy contract, records that the port expansion is owned by
#339/#340 (#342 consumes it), and re-baselines against merged main (#352 config + 3137e455
seed port already landed). Still planning-only.

Summary

A tier-1 Deno Deploy deployment target: deploy.targets['deno-deploy'] config member (spreads
#352's merged deployTargetBaseShape) + resolver + a DenoDeployTarget adapter implementing the
subset of the canonical 7-op deploy port (plan/emit · up · down · status · logs · rollback · secrets) that Deno Deploy supports, shelling the native deno deploy CLI (source build, no
Dockerfile) to push a scaffolded NetScript project to the new Deno Deploy platform
(console.deno.com) — reachable as netscript deploy deno-deploy <verb>. up is the marquee
one-click; host install/uninstall is explicitly unsupported (declared subset); secrets/rollback
route through the deploy core conventions (R-DEPLOY-3). Includes a required unstable-API
preflight guard in plan (Deno Deploy rejects --unstable-*, which NetScript KV plugins rely on).

Scope (planned; 4 commit slices, all < 30)

• S1 — packages/config: DenoDeployTarget type + DenoDeployTargetSchema (z.ZodType<…>,
  spread-composed like windows) + targets['deno-deploy'] key. Published-surface gate.
• S2 — unstable-API preflight guard (kernel, pure) + fixture tests.
• S3 — DenoDeployTarget adapter + DenoDeployCliAdapter (ProcessPort, mirrors
  ServyCliAdapter) + DEFAULT_DEPLOY_TARGETS registration.
• S4 — resolveDenoDeployTarget resolver + minimal CLI reach + README permissions + arch-debt
  update.

Archetype: ARCHETYPE-7 — Deploy Target Adapter (composite), composing ARCHETYPE-2
(Integration — the deno deploy port/adapter wrap) and ARCHETYPE-6 (CLI/Tooling — the thin
netscript deploy <target> <verb> router), folding neither. Config member follows the merged #352
small-contract spread pattern. Adapter satisfies R-DEPLOY-1..5 + gates F-DEPLOY-1/2.

Dependency note (Implement-phase merge order)

• [Deploy-S1] deploy.targets.* config contract (clean break) #352 ([Deploy-S1] config contract) — MERGED (44d7945b). Provides
  deployTargetBaseShape, which the new member spreads (R-DEPLOY-4). The rev-1 "[Deploy-S1] deploy.targets.* config contract (clean break, no windows alias) #337 not merged"
  premise is dropped.
• [Deploy-S2] Deployment target-adapter archetype doctrine entry #357 ([Deploy-S2] Deployment target-adapter archetype doctrine entry #338 Archetype-7 doctrine) — IMPL-EVAL PASS; ratifies the composite archetype + the
  canonical 7-op contract. Merged before Implement.
• [Deploy-S3] WindowsServicePort -> OsServicePort + SystemdAdapter #339/[Deploy-S4] deno compile single-binary bare-metal artifact #340 ([Deploy-S3] bare-metal) — OWNS the 3-op→7-op port-expansion commit. [Deploy-S6] Deno Deploy tier-1 adapter (marquee) #342
  consumes the expanded 7-op port and must NOT redefine it; it rebases onto that commit.
• The shipped 3-op DeployTargetPort on main is a seed stub from 3137e455 (an unrelated
  command-registry slice), not [Deploy-S2] Deployment target-adapter archetype doctrine entry #338's contract.

Merge order: #357 → #339/#340 port-expansion commit → rebase #342 (onto main, which already
carries #352 + 3137e455).

Open decisions surfaced (not decided here)

• NEEDS USER: CLI-push vs GitHub-push default for the marquee (proceeding on CLI-push as a
  reversible assumption).
• NEEDS USER: non-interactive CI auth for the new deno deploy (keyring/interactive confirmed;
  a documented env-var/org-token path is not) — blocks automated real pushes, not the design.

Validation for the evaluator

Static: scoped run-deno-check.ts/lint/fmt on packages/config + packages/cli;
deno publish --dry-run for the config surface; semantic fake-ProcessPort adapter tests. Merge
readiness is the scaffold.runtime E2E (deno task e2e:cli run scaffold.runtime --cleanup --format pretty) — evaluator-run, not per-slice.

🤖 Generated with Claude Code

https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

[rickylabs]

Rev 2 pushed — ready for PLAN-EVAL re-run

Addresses the peer FAIL_PLAN (blocking finding B1). Commits 0c760b3c (docs) + 8fe49901 (ledger), fast-forward on bf0beeef.

Corrections:

• Archetype 7 (composite) selected as primary — composes Arch 2 (Integration port/adapter) + Arch 6 (thin CLI router), folds neither. Rev-1's "Arch-6 folding Arch-2" framing is superseded.
• Conforms to the canonical 7-op deploy contract (plan/emit · up · down · status · logs · rollback · secrets); added the 7-op → Deno Deploy op-mapping (host install/uninstall explicitly unsupported = declared subset per R-DEPLOY-1; secrets/rollback route through the core conventions per R-DEPLOY-3).
• Port ownership fixed: the shipped 3-op DeployTargetPort is a seed stub from 3137e455 (unrelated command-registry slice), not [Deploy-S2] Deployment target-adapter archetype doctrine entry #338. The 3-op→7-op expansion is owned by [Deploy-S3] WindowsServicePort -> OsServicePort + SystemdAdapter #339/[Deploy-S4] deno compile single-binary bare-metal artifact #340; [Deploy-S6] Deno Deploy tier-1 adapter (marquee) #342 consumes the expanded port and must not redefine it.
• Re-baselined against merged main: [Deploy-S1] deploy.targets.* config contract (clean break) #352 (44d7945b) config contract is merged — the member spreads deployTargetBaseShape (R-DEPLOY-4). The rev-1 "[Deploy-S1] deploy.targets.* config contract (clean break, no windows alias) #337 not merged" premise is dropped.
• Merge order: [Deploy-S2] Deployment target-adapter archetype doctrine entry #357 (doctrine) → [Deploy-S3] WindowsServicePort -> OsServicePort + SystemdAdapter #339/[Deploy-S4] deno compile single-binary bare-metal artifact #340 port-expansion commit → rebase [Deploy-S6] Deno Deploy tier-1 adapter (marquee) #342.
• Dispatch lane corrected to Opus 4.8 sub-agents (WSL Codex/OpenHands is not the impl lane for this epic).

Two NEEDS USER items remain (CLI-push-vs-GitHub-push default; non-interactive CI auth) — both reversible, neither blocks the port/schema/guard/convention design. Still planning-only; not marking ready.