From 5c3be21ac398a64e3bb247918664aaf0c1e4e306 Mon Sep 17 00:00:00 2001
From: Thierno Bah <44367278+soulbah@users.noreply.github.com>
Date: Sun, 11 Oct 2026 07:34:41 +0200
Subject: [PATCH] fix(ci): prove the indeterminate verdict on
 unknown-until-apply evidence

The platform runtime proof checked a Kubernetes deployment Policy against
the shared data Playground plan. That scenario no longer declares
Kubernetes resources, so the check found no target and returned no
decision on every platform.

Analyze the documented check-architecture plan without its saved plan
instead: the new subnet's network stays unknown until apply, so the Policy
that passes on the locked project is indeterminate and exits 3. The proof
now also requires the unknown_until_apply reason and no longer depends on
what the Playground scenarios declare.
---
 scripts/verify-platform-runtime.ts | 52 +++++++++++++++++++-----------
 1 file changed, 34 insertions(+), 18 deletions(-)

diff --git a/scripts/verify-platform-runtime.ts b/scripts/verify-platform-runtime.ts
index 9e2b148..7e37745 100644
--- a/scripts/verify-platform-runtime.ts
+++ b/scripts/verify-platform-runtime.ts
@@ -1212,19 +1212,6 @@ export async function runJourney(
 
   message = "Subnets must not belong to a declared virtual network (synthetic violation)."
 }
-`,
-      );
-      writeFileSync(
-        join(syntheticPack, "policies", "unknown.rf.hcl"),
-        `policy "unknown" {
-  target {
-    concept = kubernetes.concept.deployment
-  }
-
-  assert = exists(contexts(rf.context.runtime, rf.concept.kubernetes-cluster))
-
-  message = "Deployments must declare the Kubernetes cluster they run on."
-}
 `,
       );
       writeFileSync(
@@ -1278,13 +1265,42 @@ export async function runJourney(
         }),
       (evidence) => `${String(evidence.violations)} violations`,
     );
+    // The Policy that passes on the locked project stays indeterminate when its
+    // evidence is unknown until apply. Without its saved plan, the documented
+    // check-architecture plan cannot establish the new subnet's network, so the
+    // proof does not depend on what the Playground scenarios happen to declare.
+    const unknownUntilApplyDocument = join(outputs, "run-unknown-until-apply.json");
     policyVerdicts.indeterminate = attempt(
       "policy-indeterminate-exits-3",
-      () =>
-        assertPolicyOutcome(checkInput(onlineDocument, "runtime-proofs.policy.unknown"), {
-          exitCode: 3,
-          verdict: "indeterminate",
-        }),
+      () => {
+        run(
+          [
+            "run",
+            join(root, "scripts", "fixtures", "docs", "check-architecture", "pass", "plan.json"),
+            "--project",
+            project,
+            "--no-serve",
+            "-o",
+            unknownUntilApplyDocument,
+          ],
+          project,
+          offlineEnvironment,
+        );
+        const outcome = checkInput(unknownUntilApplyDocument, "runtime-proofs.policy.passes");
+        const evidence = assertPolicyOutcome(outcome, { exitCode: 3, verdict: "indeterminate" });
+        const result = JSON.parse(outcome.stdout) as {
+          architectures?: { evaluations?: { reasons?: unknown }[] }[];
+        };
+        const reasons = (result.architectures?.[0]?.evaluations ?? []).flatMap((entry) =>
+          Array.isArray(entry.reasons) ? entry.reasons : [],
+        );
+        if (!reasons.includes("unknown_until_apply")) {
+          throw new Error(
+            "the indeterminate evaluation does not cite evidence unknown until apply",
+          );
+        }
+        return evidence;
+      },
       (evidence) => `${String(evidence.evaluations)} evaluations`,
     );