fix: rename deploy capability to guarded route

factory-capabilities.yaml

@@ -1,5 +1,5 @@
 services:
-  deploy-webhook:
+  git-proxy-deploy:
     url: http://77.42.112.29:8099/deploy
     provides: [deploy]
     required: true

src/fable5/cyber-preflight.ts

@@ -33,7 +33,7 @@ export interface CyberPreflightOptions {
 const REQUIRED_ENDPOINTS = [
   ["git_proxy_health", "http://127.0.0.1:8099/health"],
   ["git_proxy_factory_status", "http://127.0.0.1:8099/factory-status"],
-  ["deploy_webhook_health", "http://127.0.0.1:8099/deploy"],
+  ["deploy_route_health", "http://127.0.0.1:8099/deploy"],
 ] as const;
 
 export function runCyberPreflight(opts: CyberPreflightOptions): CyberPreflightReceipt {
@@ -45,7 +45,7 @@ export function runCyberPreflight(opts: CyberPreflightOptions): CyberPreflightRe
   checks.push(runCheck("docker_inventory", "ssh", ["-p", String(port), `root@${opts.host}`, "docker ps --format '{{.Names}} {{.Status}} {{.Ports}}'"], runner));
 
   for (const [name, url] of REQUIRED_ENDPOINTS) {
-    const probe = name === "deploy_webhook_health"
+    const probe = name === "deploy_route_health"
       ? `test "$(curl -sS -m 5 -o /dev/null -w '%{http_code}' -X POST ${url})" = "401"`
       : `curl -fsS -m 5 ${url}`;
     checks.push(runCheck(name, "ssh", ["-p", String(port), `root@${opts.host}`, probe], runner));

src/fable5/cyber-reconcile.test.ts

@@ -30,7 +30,7 @@ function writeInputs(root: string, checks: Array<{ name: string; ok: boolean; st
     reason: "test",
   }, null, 2));
   fs.writeFileSync(capabilities, `services:
-  deploy-webhook:
+  git-proxy-deploy:
     url: http://127.0.0.1:8099/deploy
     provides: [deploy]
     required: true
@@ -46,7 +46,7 @@ describe("cyber reconcile", () => {
   it("fails closed when live evidence contradicts required capabilities", () => {
     const root = tmpRoot();
     const { preflight, capabilities } = writeInputs(root, [
-      { name: "deploy_webhook_health", ok: false, status: 7, stderr: "connection failed" },
+      { name: "deploy_route_health", ok: false, status: 7, stderr: "connection failed" },
       { name: "git_proxy_factory_status", ok: false, status: 22, stderr: "404" },
       { name: "git_proxy_health", ok: false, status: 22, stderr: "404" },
     ]);
@@ -61,7 +61,7 @@ describe("cyber reconcile", () => {
   it("allows read-only only when all mapped capabilities have evidence", () => {
     const root = tmpRoot();
     const { preflight, capabilities } = writeInputs(root, [
-      { name: "deploy_webhook_health", ok: true, status: 0 },
+      { name: "deploy_route_health", ok: true, status: 0 },
       { name: "git_proxy_factory_status", ok: true, status: 0 },
       { name: "git_proxy_health", ok: true, status: 0 },
     ]);
@@ -75,7 +75,7 @@ describe("cyber reconcile", () => {
   it("writes a reconcile receipt", () => {
     const root = tmpRoot();
     const { preflight, capabilities } = writeInputs(root, [
-      { name: "deploy_webhook_health", ok: false, status: 7 },
+      { name: "deploy_route_health", ok: false, status: 7 },
       { name: "git_proxy_factory_status", ok: false, status: 22 },
       { name: "git_proxy_health", ok: false, status: 22 },
     ]);

src/fable5/cyber-reconcile.ts

@@ -55,7 +55,7 @@ function findingsForService(service: FactoryCapabilityService, preflight: CyberP
 }
 
 function matchingCheck(capability: string, preflight: CyberPreflightReceipt) {
-  if (capability === "deploy") return preflight.checks.find((check) => check.name === "deploy_webhook_health");
+  if (capability === "deploy") return preflight.checks.find((check) => check.name === "deploy_route_health");
   if (capability === "factory-status") return preflight.checks.find((check) => check.name === "git_proxy_factory_status");
   if (capability === "discovery") return preflight.checks.find((check) => check.name === "git_proxy_health");
   return undefined;

src/fable5/factory-capabilities.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { formatCapabilityReport, parseFactoryCapabilities, probeFactoryCapabilities } from "./factory-capabilities.js";
 
 const yaml = `services:
-  deploy-webhook:
+  git-proxy-deploy:
     url: http://77.42.112.29:8099/deploy
     provides: [deploy]
     required: true
@@ -16,7 +16,7 @@ describe("factory capabilities", () => {
   it("parses the capability registry", () => {
     const services = parseFactoryCapabilities(yaml);
     expect(services).toHaveLength(2);
-    expect(services[0]).toMatchObject({ name: "deploy-webhook", required: true, provides: ["deploy"] });
+    expect(services[0]).toMatchObject({ name: "git-proxy-deploy", required: true, provides: ["deploy"] });
   });
 
   it("fails required capabilities that return 404", async () => {

src/fable5/verify-cycle.test.ts

@@ -6,7 +6,7 @@ import { verifyCycle } from "./verify-cycle.js";
 
 const factoryOk = {
   factory: { status: "ok", phase: 4, containers: 25, agents: 6, infra: 14, monitoring: 5, skills: 65 },
-  deploy: { status: "ok", service: "deploy-webhook" },
+  deploy: { status: "ok", service: "git-proxy-deploy" },
   factoryAvailable: true,
   deployAvailable: true,
   errors: [],