Audit fixes: discovery guards + instance file anchoring (#63-#66)

[max06]

Remaining four findings from the 2026-08-11 template audit.

#63 — instance-level file anchoring

apps[].strategicMergePatches/jsonPatches/transformers string entries now anchor deployment-relative through convertPaths (previously appended verbatim → resolved against helmfile's cache dir → silently never applied; only inline maps worked). Inherits the fail-on-missing contract from #61. Positive fixture d48 proves a deployment-local patch file applies; negative fixture proves a typo fails loudly.

#64 — leaf-name uniqueness

Validated across the whole repo before the stage-1 filter, so per-app ArgoCD renders cannot hide a collision. Fails listing the duplicate name and every path using it.

#65 — pseudo-cluster "."

Zero-cluster repos (global deployments only, e.g. during bootstrap) no longer register the global apps/ dir as cluster ".". Repro captured pre-fix (cluster: . render target); post-fix the outcome is a clean zero-target render.

#66 — discovery dump opt-in

The full clusters/deployments dict comment block is now emitted only with ATLAS_DEBUG_DISCOVERY set.

Tests

10 new bats tests (discovery-guards.bats + d48) over three new fixture roots. Full suite: 463/463 (one unrelated parallel flake ruled out by re-run).

Note: the self-review will flag the known deployment47 Secret ghost — that is #70, unrelated.

🤖 Generated with Claude Code

[github-actions]

ATLAS Review

Changes detected in 2 resource(s) across 2 release(s).
Please review before merging.

Affected releases

cluster1 / deployment47 / secret-app (1 resources)

Secret/secret-app-secret (15 lines)

@@ data.generatedCert @@
! ± value change
- REDACTED:sha256:64c2cc8965eb
+ REDACTED:sha256:0531e6a12023

@@ stringData.fromSops @@
! ± value change
- REDACTED:sha256:9dacb914694b
+ REDACTED:sha256:9fab3a1ed1c3

@@ stringData.note @@
! ± value change
- REDACTED:sha256:be359b14f3f4
+ REDACTED:sha256:531854cef641

cluster1 / deployment48 / stage3-patches-release (new) (1 resources)

ConfigMap/stage3-patches-release-chart1 (new) (59 lines)

! + entire resource added:
+ ---
+ # Source: chart1/templates/patched_resources.yaml
+ apiVersion: v1
+ data:
+   values:
+     aChartValue: on default
+     atlas:
+       appTemplates: templates
+       cwd: /github/workspace/tests
+       deployment:
+         cluster: cluster1
+         clusterName: cluster1
+         deploymentName: deployment48
+         deploymentPath: /github/workspace/tests/deployments/cluster1/apps/deployment48/deployment.yaml
+       deploymentDefinitions: deployments
+       instance:
+         name: app-patches
+         template: app-patches
+       redactSecrets: true
+     clusterGotmplFromGlobalSops: REDACTED
+     clusterGotmplFromGlobalYaml: fromGlobal
+     clusterOnly: fromCluster
+     globalOnly: fromGlobal
+     gotmplFromSops: REDACTED
+     gotmplFromYaml: fromGlobal
+     gotmplTest: gotmpl
+     nested:
+       fromCluster: true
+       fromGlobal: true
+       shared: REDACTE
+     overrideAll: REDACTE
+     overrideClusterUp: REDACTE
+     overrideGroupUp: global
+     sopsBool: true
+     sopsCluster: REDACTED
+     sopsFloat: 3.14
+     sopsGlobal: REDACTED
+     sopsNested:
+       deep:
+         verySecret: REDACTED
+       level: REDACTE
+       secretKey: REDACTED
+     sopsNumber: 42
+     sopsOverride: REDACTE
+     sopsString: REDAC-REDA-REDA
+ kind: ConfigMap
+ metadata:
+   annotations:
+     atlas-test/from-instance-file: "yes"
+     atlas-test/patched: "yes"
+   labels:
+     app.kubernetes.io/instance: stage3-patches-release
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: chart1
+     app.kubernetes.io/version: 1.16.0
+     helm.sh/chart: chart1-0.1.0
+   name: stage3-patches-release-chart1
+   namespace: test

---

Generated by ATLAS Review — Re-run