fix: skip Build drawer collect for Registered External names

Preflight emitted external-config while project provision was still
unknown, so Continue forced typing org secrets that POST /build ignores.

Author: kaje94

services/aep-api/internal/app/app.go

@@ -1040,8 +1040,9 @@ func Assemble(cfg config.Config, in Infra, seam Seam) (*App, error) {
 	// anything already provisioned OR in-flight (buildProvisionStatus collapses the
 	// provisioning tri-state onto the "already handled" bool).
 	preflightSvc := build.NewPreflightService(build.PreflightDeps{
-		Design: designComponents{store: artifactStore},
-		Status: buildProvisionStatus{svc: provisioningSvc},
+		Design:  designComponents{store: artifactStore},
+		Status:  buildProvisionStatus{svc: provisioningSvc},
+		Catalog: buildOrgCatalog{plane: catalogValuePlane},
 	})
 	// delivery — the Delivery Pipeline domain (P6): the public single-tag build
 	// surface, the task read + promote-dispatch surface, and the task-log SSE

services/aep-api/internal/app/build_adapters.go

@@ -95,6 +95,20 @@ func (b buildProvisionStatus) Ready(ctx context.Context, orgID, projectID, depNa
 	return st.Status != "unknown", nil
 }
 
+// buildOrgCatalog adapts CatalogValuePlane onto preflight's OrgCatalogReader:
+// non-empty org env cells means Registered External — the drawer must not
+// collect values. Nil plane is fail-open (HasOrgEnvCells false).
+type buildOrgCatalog struct {
+	plane provisioning.CatalogValuePlane
+}
+
+func (b buildOrgCatalog) HasOrgEnvCells(orgID, name string) bool {
+	if b.plane == nil {
+		return false
+	}
+	return len(b.plane.EnvCells(orgID, name)) > 0
+}
+
 // buildGateResolver adapts the provisioning feature onto the build plan path's
 // GateResolver port: author the version's dependencies and mint its
 // `provision` gates INTO the version's milestone, so the run's dispatch

services/aep-api/internal/delivery/build/preflight.go

@@ -46,6 +46,13 @@ type ProvisionStatusReader interface {
 	Ready(ctx context.Context, orgID, projectID, depName string) (bool, error)
 }
 
+// OrgCatalogReader reports whether a logical name already holds values on the
+// org catalog plane (Registered External — non-empty env cells). Nil means
+// fail-open: treat the name as Project External and still emit external-config.
+type OrgCatalogReader interface {
+	HasOrgEnvCells(orgID, name string) bool
+}
+
 // --- wire shapes (names drive the generated schema names — keep them exactly
 // --- BuildPreflight / PreflightItem / ConfigKeyView) ------------------------
 
@@ -86,20 +93,22 @@ type BuildPreflight struct {
 
 // PreflightDeps carries the preflight service's ports.
 type PreflightDeps struct {
-	Design PreflightDesignReader
-	Status ProvisionStatusReader
+	Design  PreflightDesignReader
+	Status  ProvisionStatusReader
+	Catalog OrgCatalogReader
 }
 
 // PreflightService computes the build dependency-drawer preflight from the
 // design at HEAD, filtering out anything already provisioned or in-flight.
 type PreflightService struct {
-	design PreflightDesignReader
-	status ProvisionStatusReader
+	design  PreflightDesignReader
+	status  ProvisionStatusReader
+	catalog OrgCatalogReader
 }
 
 // NewPreflightService wires the preflight service.
 func NewPreflightService(d PreflightDeps) *PreflightService {
-	return &PreflightService{design: d.Design, status: d.Status}
+	return &PreflightService{design: d.Design, status: d.Status, catalog: d.Catalog}
 }
 
 // Preflight walks every component's dependencies at HEAD — service AND
@@ -116,7 +125,9 @@ func NewPreflightService(d PreflightDeps) *PreflightService {
 //     computed Status/Reason (spec.ComputeDependencyStatus, via
 //     dependencyBlocker) says so; this is the dependency-management proceed
 //     gate Task 1 orphaned, reborn here. Otherwise, an "external-config" item
-//     (key/secret views only) when the dependency is not yet Ready.
+//     (key/secret views only) when the dependency is not yet Ready and is not
+//     a Registered External (org catalog already holds env cells — the drawer
+//     must not collect secrets that live on the org record).
 //   - platform-resource: a "platform-resource" item when not yet Ready.
 //   - org-service: an "org-service" item when Status is one of the three
 //     non-resolved resolution states (unresolved | blocked | ambiguous);
@@ -172,9 +183,10 @@ func (s *PreflightService) itemsFor(ctx context.Context, orgID, projectID, compo
 // still-ambiguous/unresolved dependency has no derived config keys yet). Once
 // resolved (or when no resolver was ever wired — the fail-open empty Status),
 // the pre-existing external-config item (key/secret views only) is emitted
-// when the dependency is not yet Ready — unchanged: config collection stays a
-// provisioning-readiness concern local to this preflight, not part of
-// ComputeDependencyStatus.
+// when the dependency is not yet Ready and is not Registered (org catalog
+// env cells). Config collection stays a provisioning-readiness concern local
+// to this preflight, not part of ComputeDependencyStatus. Registered names
+// still author from org cells at POST /build; they just do not collect here.
 func (s *PreflightService) externalItems(ctx context.Context, orgID, projectID, componentName string, d spec.Dependency) ([]PreflightItem, error) {
 	if kind, desc, blocked := dependencyBlocker(d); blocked {
 		return []PreflightItem{{
@@ -184,6 +196,11 @@ func (s *PreflightService) externalItems(ctx context.Context, orgID, projectID,
 			Description: desc,
 		}}, nil
 	}
+	if s.catalog != nil && s.catalog.HasOrgEnvCells(orgID, d.Name) {
+		// Org cells already hold values; project Ready is irrelevant until
+		// POST /build authors the instance from those cells.
+		return nil, nil
+	}
 	ready, err := s.status.Ready(ctx, orgID, projectID, d.Name)
 	if err != nil {
 		return nil, err

services/aep-api/internal/delivery/build/preflight_test.go

@@ -303,3 +303,54 @@ func TestPreflight_ExternalResolved_FallsThroughToConfigItem(t *testing.T) {
 	require.Len(t, pf.Items, 1)
 	require.Equal(t, "external-config", pf.Items[0].Kind)
 }
+
+// fakeCatalog reports names that already hold org env cells (Registered
+// External). Missing / false is Project External — same fail-open as a nil
+// Catalog port.
+type fakeCatalog map[string]bool
+
+func (f fakeCatalog) HasOrgEnvCells(_, name string) bool { return f[name] }
+
+// A Registered External already holds values on the org plane. Preflight must
+// not emit external-config (the Build drawer would force typing secrets that
+// POST /build ignores). Project External still collects as today.
+func TestPreflight_RegisteredExternal_DoesNotEmitConfigItem(t *testing.T) {
+	comps := []spec.DesignComponent{{Name: "board", ComponentType: spec.ComponentTypeService,
+		Dependencies: []spec.Dependency{
+			{Kind: spec.DependencyKindExternal, Name: "openweathermap",
+				Config: []spec.ConfigKey{{Key: "api_key", Secret: true}}},
+			{Kind: spec.DependencyKindExternal, Name: "travel-board-fx",
+				Config: []spec.ConfigKey{{Key: "api_key", Secret: true}}},
+		}}}
+	svc := NewPreflightService(PreflightDeps{
+		Design:  fakeDesign{comps: comps},
+		Status:  fakeStatus{},
+		Catalog: fakeCatalog{"openweathermap": true},
+	})
+	pf, err := svc.Preflight(context.Background(), "acme", "travel-board")
+	require.NoError(t, err)
+	kinds := kindsByDep(pf.Items)
+	_, weather := kinds["openweathermap"]
+	require.False(t, weather, "Registered name must not raise external-config, got %v", kinds["openweathermap"])
+	require.Equal(t, []string{"external-config"}, kinds["travel-board-fx"])
+	require.True(t, pf.NeedsInput)
+}
+
+// An unresolved Registered name still raises the blocker — catalog cells do
+// not skip dependency resolution.
+func TestPreflight_RegisteredExternal_UnresolvedStillEmitsBlocker(t *testing.T) {
+	comps := []spec.DesignComponent{{Name: "board", ComponentType: spec.ComponentTypeService,
+		Dependencies: []spec.Dependency{
+			{Kind: spec.DependencyKindExternal, Name: "openweathermap",
+				Status: spec.DependencyStatusUnresolved, Reason: spec.DependencyReasonNeedsInput},
+		}}}
+	svc := NewPreflightService(PreflightDeps{
+		Design:  fakeDesign{comps: comps},
+		Status:  fakeStatus{},
+		Catalog: fakeCatalog{"openweathermap": true},
+	})
+	pf, err := svc.Preflight(context.Background(), "acme", "travel-board")
+	require.NoError(t, err)
+	require.Len(t, pf.Items, 1)
+	require.Equal(t, "external-unresolved", pf.Items[0].Kind)
+}