Execution: config-fields registry + update-codeq-token.sh restructure & reconcile (layer 3)

[Kenny-Heitritter]

Parent

Map #16 · implements the layer-3 decision locked in #20 (config-migration systematization).

What to build

Make config convergence for existing users a documented, single-surface contract. Two paired edits:

• opencode / CODEQ_DEPLOYMENT.md: add the authoritative System-owned config fields registry — the exact fields Dstacks re-asserts (provider.qbraid.options.apiKey, .baseURL, mcp.pod_mcp.command/type/enabled, and the model-migration map), the fields it must not touch (everything else = user-owned, e.g. the permission block), and a running Retired ids / renamed fields list. Add the scoped contract (a codeq change owes a paired Dstacks re-assert only on rename / retire-id / forced-default / new-injected-field) and the release-checklist line that fires when the registry changes.
• qbraid-Dstacks / update-codeq-token.sh: restructure the jq block into two labeled buckets — (1) environment-injected (apiKey, baseURL, mcp command/type/enabled) and (2) migrations / forced corrections (the model-migration map + future rename/retire/forced-default) — with a header comment pointing at the registry. No behavior change.

Reconcile the two drifted copies: qbraid-lab-base/scripts/update-codeq-token.sh is canonical (it's the image that deploys to staging/prod); qbraid-overlay/scripts/update-codeq-token.sh has drifted to a pre-migration version. Bring the overlay copy in line or de-dupe — this may fold into the flagged overlay rework if that's in flight; the contract must name lab-base as canonical either way.

Full spec: #20.

Acceptance criteria

• CODEQ_DEPLOYMENT.md carries the System-owned config fields registry + Retired ids/renamed fields list + the scoped contract + the release-checklist line.
• update-codeq-token.sh (canonical qbraid-lab-base copy) is reorganized into the two labeled buckets with a header pointing at the registry — no behavior change.
• The overlay copy is reconciled with (or de-duped against) the canonical copy, or explicitly deferred into the overlay rework with a tracking note.
• The doc names qbraid-lab-base as the canonical copy for the staging/prod path.

Blocked by

• Execution: publish the CODEQ_DEPLOYMENT.md anchor doc to dev #23 — publish the anchor doc (the registry lives in it).

[Kenny-Heitritter]

Implemented across two PRs — open for review (not merged).

• Dstacks: qBraid/qbraid-Dstacks#77 (commit 850d1d2) — canonical qbraid-lab-base/scripts/update-codeq-token.sh restructured into the two labeled buckets (env-injected / migrations) with a header pointing at the registry, no behavior change (proven byte-identical across 5 sample configs on both the jq and sed paths); drifted qbraid-overlay copy reconciled to byte-identical logic and marked lab-base-canonical.
• Doc: docs(codeq): execution-era CODEQ_DEPLOYMENT.md sections (#25–#29) #42 — System-owned config fields registry + user-owned exclusions + retired-ids list + scoped contract + release-checklist line.

Follow-up flagged: full de-dup of the overlay copy to a single source belongs to the overlay rework (each copy is wired into its own Dockerfile today).