developer(ET): auto-commit from developer run_id=264

src/self_deploy.py

@@ -230,7 +230,17 @@ def build_deploy_command(repo: str, work_item_id: str | None, branch: str) -> li
     Build-once (BR-6): ``SOURCE_IMAGE=<staging-image>`` makes the hook retag the
     staging-validated image to the prod tag instead of rebuilding (no ``docker
     build``). The exit-code contract of the hook is untouched.
+
+    Provenance guard (ORCH-058, Strategy B): when the image-freshness feature is
+    active for this repo, the VALIDATED commit SHA is passed as
+    ``EXPECTED_REVISION=<sha>`` so the hook fail-closes (``exit 1``) before
+    ``docker tag`` if SOURCE_IMAGE's revision label does not match — a stale image
+    can never be silently promoted. When inactive (non-self / kill-switch off)
+    ``expected_revision`` returns ``""`` and the env is omitted, keeping the hook's
+    backward-compatible "no provenance check" behaviour (AC-5 / AC-7).
     """
+    from . import image_freshness
+
     host_dir = host_state_dir(repo, work_item_id)
     result_sentinel = os.path.join(host_dir, RESULT)
     hook_log = os.path.join(host_dir, "hook.log")
@@ -243,6 +253,9 @@ def build_deploy_command(repo: str, work_item_id: str | None, branch: str) -> li
         f"COMPOSE_PROFILE={shlex.quote(settings.deploy_prod_compose_profile)} "
         f"PREV_IMAGE_FILE={shlex.quote(settings.deploy_prod_prev_image_file)}"
     )
+    expected_rev = image_freshness.expected_revision(repo, branch)
+    if expected_rev:
+        env_assignments += f" EXPECTED_REVISION={shlex.quote(expected_rev)}"
     inner = (
         f"cd {shlex.quote(settings.deploy_host_repo_path)} && "
         f"{env_assignments} "