fix(environment): re-import withdraws registry.artifacts and registry.auth

Like registry.mirrors (cli#1140), both are contract-owned: a contract that
declares registry without them withdraws the value an earlier import wrote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: antoinetoussaint-byte

cmd/environment/import.go

@@ -465,10 +465,12 @@ func applyContractFields(target, declaration *yaml.Node) {
 
 // contractOwnedOptional names the keys a coordinate contract owns whose ABSENCE is
 // itself a statement (docs/coordinate-contract-conventions.md in infra-base): an absent
-// registry.mirrors means "pull the upstream as the Dockerfile names it". Merging alone
-// would keep a mirror the contract withdrew, and the builder would keep mapping to a
-// repository that no longer exists.
-var contractOwnedOptional = map[string][]string{"registry": {"mirrors"}}
+// registry.mirrors means "pull the upstream as the Dockerfile names it", an absent
+// registry.artifacts "publish bundles to registry.url", an absent registry.auth "log
+// in to nothing". Merging alone would keep a value the contract withdrew, and the
+// render would keep pulling from, publishing to or logging in to a registry the
+// environment no longer holds.
+var contractOwnedOptional = map[string][]string{"registry": {"mirrors", "artifacts", "auth"}}
 
 // withdrawContractOwnedAbsences removes each contract-owned optional key the contract
 // no longer carries, under a parent the contract does declare. A parent the contract

cmd/environment/import_test.go

@@ -838,6 +838,24 @@ func TestImportRefusesANullRunnableScopeSelectionWithoutWriting(t *testing.T) {
 	}
 }
 
+func TestReimportWithdrawsArtifactsAndAuthTheContractNoLongerCarries(t *testing.T) {
+	dir := writeWorkspace(t, existingAzureWorkspace)
+	declared := strings.Replace(fixtureContract, `"registry": {"url": "x.azurecr.io"}`,
+		`"registry": {"url": "x.azurecr.io", "auth": "acr", "artifacts": "x.azurecr.io/bundles"}`, 1)
+	doImport(t, dir, importOptions{contractData: []byte(declared)})
+	if got := loadWorkspace(t, dir).FindEnvironment("azure").Registry; got.Auth != "acr" || got.Artifacts != "x.azurecr.io/bundles" {
+		t.Fatalf("auth and artifacts not imported: %+v", got)
+	}
+	doImport(t, dir, importOptions{contractData: []byte(fixtureContract)})
+	env := loadWorkspace(t, dir).FindEnvironment("azure")
+	if env.Registry.Auth != "" || env.Registry.Artifacts != "" || env.Registry.URL != "x.azurecr.io" {
+		t.Fatalf("a value the contract withdrew survived re-import: %+v", env.Registry)
+	}
+	if strings.Contains(readFile(t, filepath.Join(dir, resources.WorkspaceConfigurationName)), "bundles") {
+		t.Fatal("the withdrawn artifacts registry is still written in the workspace")
+	}
+}
+
 func TestReimportWithdrawsAMirrorTheContractNoLongerCarries(t *testing.T) {
 	dir := writeWorkspace(t, existingAzureWorkspace)
 	mirrored := strings.Replace(fixtureContract, `"registry": {"url": "x.azurecr.io"}`,

docs/commands.md

@@ -2318,10 +2318,11 @@ former spelling of `--coordinate-contract` for one release.
 Declared fields replace their exact named values. Maps merge by explicit key;
 omitted fields and unrelated entries remain intact. Explicit empty maps, empty
 sequences and nulls clear the corresponding field where its schema permits.
-One key is the contract's alone and its absence is a statement: `registry.mirrors`.
-A contract that declares `registry` without `mirrors` withdraws any mirror an earlier
-import wrote, so the builder stops mapping to a repository the environment no longer
-holds.
+Three keys are the contract's alone and their absence is a statement:
+`registry.mirrors`, `registry.artifacts` and `registry.auth`. A contract that declares
+`registry` without one of them withdraws the value an earlier import wrote, so the
+render stops pulling from, publishing bundles to or logging in to a registry the
+environment no longer holds.
 There is no special `store` alias, single-database limit, default secret path or
 ignored producer extension. Unknown fields and capabilities fail validation.