[lyyzka]

The effective-candidate deployment test fails once the checked-in runtime already uses pull_policy: never: its first document-wide always replacement then changes app B's gateway, and the production guard correctly rejects the unrelated policy change.

Construct the candidate through the exact x-runtime anchor instead. Exercise both app manifests with source runtime policies of always and never, assert the effective gateway configuration stays identical, and retain rejection coverage for gateway, filesystem, environment, volume, and forbidden runtime pull-policy changes. This changes only the owning test; production validation and manifests are unchanged.

Validation:

• Reproduced the original failure from main 4c57fce92c316628e59600203c7ba48722f61636.
• Recorded the expanded matrix red before the fix: app B / source never fails because gateway changes.
• Effective-candidate matrix: all 4 cases passed (5/5 including the parent test).
• All 73 deployment contract tests passed.
• node --check and git diff --check passed.

Used the existing Docker Compose parser and existing dependencies. No package install, image build/pull, service deployment, or production operation was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T16:14:38.416367Z	b164d68	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.