[crisfiorini-oss]

Summary

Allow a one-service dev deployment to update the existing output under an environment's GitOps path. deploy dev --published validates and patches that publication and derives its cell from the same module trees. A scratch render for another environment stays untouched. This avoids re-rendering unrelated services merely to replace one image.

Changes

Reuse existing publication-path confinement, inventory drift validation, image promotion and cell comparison. Keep the pre-build refusal when anything beyond the selected service would move. Accept module-qualified service secret mappings and retain the existing incremental-cell safeguard: a newly composed undelivered module does not withdraw existing delivered workloads, and consumers without a delivered identity are omitted.

Build or reuse: examined existing dev image promotion, publication paths, cell derivation and environment validators. Extend those implementations; no parallel deployment script, image rewriter, build pipeline or authorization bypass.

Testing

Focused published-environment regression passes with another environment's scratch render present, the changed service re-pinned and every other workload retained. Existing hosted cell update and unrelated-workload refusal tests pass. Qualified-secret and existing-cell preservation regressions passed for the earlier commits. Full suites run in GitHub CI; this is a draft pending every lane.

Open questions / Next steps

Use the native command for the Azure Documents compatibility deployment. This PR does not establish browser document or Robin chat acceptance and does not apply Terraform.

The dev deployment also retains a published service's repository prefix within its configured registry. A coordinate import may carry the registry host while an older publication uses a product prefix; building at the host root previously uploaded an image that the guarded patcher then refused. Select the existing prefix before the native build, leave other services' environment unchanged, preserve mirror behavior, and keep the guard that refuses images the render does not pin. Registry-with-port, isolation, foreign-registry refusal and published/hosted dev regressions pass. Observed consumer: module-robin#626 on hosted-eastus2.