Phase 1 abgeschlossen: Node-Identitaet in Control Core verkabelt (§3.6, §6.3)

- NodeIdentity/NodeRole in hms_domain: persistente node_id aus
  userdata/identity, Rollen RENDER_NODE/COORDINATOR/CONTROL_DESK,
  plausible Kombinationen validiert, keine Auto-Leader-Wahl (§6.3)
- Control Core: create_app(identity) injizierbar; Dev-Modus ephemeral;
  Registry registriert eigene Node; neue Endpunkte /system/identity
  (ohne Secrets, §27.1) und /cluster/nodes (UI-Kategorien §6.3)
- 16 neue/aktualisierte Integrationstests; Gesamtsuite 199 gruen

tests/integration/test_control_server.py

@@ -1,7 +1,8 @@
 """Integrationstests Control Core (PLAN.md §6.1B, §23, §36 Nr. 9).
 
 FastAPI-REST + WebSocket mit derselben Parameter-Engine, die auch
-Art-Net bedient (§11: eine autoritative Instanz).
+Art-Net bedient (§11: eine autoritative Instanz). Node-Identität und
+Cluster-Registry sind verkabelt (§6.3).
 """
 
 from __future__ import annotations
@@ -11,6 +12,7 @@ import uuid
 import pytest
 from fastapi.testclient import TestClient
 from hms_control_server import create_app
+from hms_domain import NodeIdentity, NodeRole
 
 
 @pytest.fixture()
@@ -18,6 +20,15 @@ def client() -> TestClient:
     return TestClient(create_app())
 
 
+@pytest.fixture()
+def named_client() -> TestClient:
+    """App mit injizierter produktionsähnlicher Identität."""
+    identity = NodeIdentity.ephemeral(
+        "Show Server A", frozenset({NodeRole.RENDER_NODE, NodeRole.COORDINATOR})
+    )
+    return TestClient(create_app(identity=identity))
+
+
 def _payload(path: str, value: float) -> dict:
     return {"parameter_path": path, "value": value}
 
@@ -27,27 +38,63 @@ def path() -> str:
     return f"composition/{uuid.uuid4()}/layer/{uuid.uuid4()}/opacity"
 
 
-# ---------- Health/Capabilities ----------
+# ---------- Health/Capabilities/Identity ----------
 
 
 def test_health(client: TestClient) -> None:
     r = client.get("/api/v1/system/health")
     assert r.status_code == 200
     assert r.json()["status"] == "ok"
-    assert r.json()["phase"] == 0
+    assert r.json()["phase"] == 1
+    assert r.json()["node_id"]  # Identität in Health sichtbar
+
+
+def test_identity_reports_roles_without_secrets(named_client: TestClient) -> None:
+    r = named_client.get("/api/v1/system/identity")
+    assert r.status_code == 200
+    body = r.json()
+    assert body["display_name"] == "Show Server A"
+    assert body["roles"] == ["COORDINATOR", "RENDER_NODE"]
+    assert body["renders_locally"] is True
+    assert body["is_coordinator"] is True
+    # keine vertraulichen Felder (§27.1)
+    blob = str(body).lower()
+    for forbidden in ("token", "secret", "password"):
+        assert forbidden not in blob
+
+
+def test_two_apps_get_distinct_dev_identities() -> None:
+    """Ohne injizierte Identität erhält jede App-Instanz eine eigene ID
+    (Dev-Modus; Showbetrieb nutzt persistente Identität über den Launcher)."""
+    a = TestClient(create_app()).get("/api/v1/system/identity").json()
+    b = TestClient(create_app()).get("/api/v1/system/identity").json()
+    assert a["node_id"] != b["node_id"]
 
 
 def test_capabilities_reported_without_fake_tier(client: TestClient) -> None:
     r = client.get("/api/v1/system/capabilities")
     assert r.status_code == 200
-    body = r.json()
-    assert body["tier"] is None  # ungeprüft (CPU-only-Umgebung), kein Fake
+    assert r.json()["tier"] is None  # ungeprüft (CPU-only), kein Fake
 
 
 def test_diagnostics_reports_not_connected(client: TestClient) -> None:
     r = client.get("/api/v1/diagnostics")
     assert r.status_code == 200
-    assert r.json()["renderer"] == "not_connected"  # IPC-Handshake Phase 1
+    assert r.json()["renderer"] == "not_connected"
+    assert r.json()["node_id"]
+
+
+# ---------- Cluster-Registry (§6.3) ----------
+
+
+def test_self_node_listed_in_cluster_nodes(named_client: TestClient) -> None:
+    r = named_client.get("/api/v1/cluster/nodes")
+    assert r.status_code == 200
+    body = r.json()
+    self_entry = next(n for n in body["nodes"] if n["node_id"] == body["self"])
+    assert self_entry["display_name"] == "Show Server A"
+    assert set(self_entry["roles"]) == {"RENDER_NODE", "COORDINATOR"}
+    assert self_entry["health"] in ("online", "offline")  # ohne Heartbeat offline
 
 
 # ---------- Commands (§23.2) ----------
@@ -66,7 +113,7 @@ def test_duplicate_command_id_is_idempotent(client: TestClient, path: str) -> No
     first = client.post("/api/v1/commands", json=cmd).json()
     second = client.post("/api/v1/commands", json=cmd).json()
     assert first["status"] == "ack"
-    assert second.get("duplicate") is True  # gleiches Ack, kein Doppel-Apply
+    assert second.get("duplicate") is True
     assert second["result"]["revision"] == first["revision"]
 
 

tests/unit/test_node_identity.py

@@ -0,0 +1,96 @@
+"""Unit-Tests Node-Identität und Rollen (PLAN.md §3.6, §6.3, §10.1)."""
+
+from __future__ import annotations
+
+import uuid
+from pathlib import Path
+
+import pytest
+from hms_domain import NodeIdentity, NodeRole
+
+
+def _roles(*r: NodeRole) -> frozenset[NodeRole]:
+    return frozenset(r)
+
+
+# ---------- Persistenz (§3.6, §6.3) ----------
+
+
+def test_load_or_create_persists_across_restart(tmp_path: Path) -> None:
+    identity_dir = tmp_path / "userdata" / "identity"
+    first = NodeIdentity.load_or_create(
+        identity_dir, "Show Server A", _roles(NodeRole.RENDER_NODE, NodeRole.COORDINATOR)
+    )
+    second = NodeIdentity.load_or_create(
+        identity_dir, "Show Server A", _roles(NodeRole.RENDER_NODE, NodeRole.COORDINATOR)
+    )
+    assert first.node_id == second.node_id  # persistente node_id (§3.6)
+    uuid.UUID(first.node_id)  # gültige UUID
+
+
+def test_identity_file_location_per_spec(tmp_path: Path) -> None:
+    """node_id liegt unter userdata/identity/ (§9-Struktur)."""
+    identity_dir = tmp_path / "userdata" / "identity"
+    NodeIdentity.load_or_create(identity_dir, "N", _roles(NodeRole.RENDER_NODE))
+    assert (identity_dir / "node_id").is_file()
+
+
+def test_two_nodes_get_distinct_persistent_ids(tmp_path: Path) -> None:
+    a = NodeIdentity.load_or_create(tmp_path / "a", "Node A", _roles(NodeRole.RENDER_NODE))
+    b = NodeIdentity.load_or_create(tmp_path / "b", "Node B", _roles(NodeRole.RENDER_NODE))
+    assert a.node_id != b.node_id  # doppelte node_id wäre Fehler (§6.3)
+
+
+# ---------- Rollen (§6.3) ----------
+
+
+@pytest.mark.parametrize(
+    "roles",
+    [
+        _roles(NodeRole.RENDER_NODE),
+        _roles(NodeRole.COORDINATOR),
+        _roles(NodeRole.CONTROL_DESK),
+        _roles(NodeRole.RENDER_NODE, NodeRole.COORDINATOR),
+        _roles(NodeRole.CONTROL_DESK, NodeRole.COORDINATOR),
+    ],
+)
+def test_valid_role_combinations_accepted(roles) -> None:
+    identity = NodeIdentity.ephemeral("Test Node", roles)
+    assert identity.roles == roles
+
+
+@pytest.mark.parametrize(
+    "roles",
+    [
+        frozenset(),  # keine Rolle
+        _roles(NodeRole.RENDER_NODE, NodeRole.CONTROL_DESK),  # Desk + Renderer unplausibel
+    ],
+)
+def test_invalid_role_combinations_rejected(roles) -> None:
+    with pytest.raises(ValueError):
+        NodeIdentity.ephemeral("Test Node", roles)
+
+
+def test_role_properties() -> None:
+    render_only = NodeIdentity.ephemeral("R", _roles(NodeRole.RENDER_NODE))
+    coord_only = NodeIdentity.ephemeral("C", _roles(NodeRole.COORDINATOR))
+    both = NodeIdentity.ephemeral("B", _roles(NodeRole.RENDER_NODE, NodeRole.COORDINATOR))
+    assert render_only.renders_locally and not render_only.is_coordinator
+    assert coord_only.is_coordinator and not coord_only.renders_locally
+    assert both.is_coordinator and both.renders_locally  # §6.3: Coordinator auf Render-Node
+
+
+def test_display_name_editable_without_identity_change(tmp_path: Path) -> None:
+    """Umbenennung ändert die node_id nicht (§10.1: Name ist kein Identitätsteil
+    für Parameterpfade)."""
+    identity_dir = tmp_path / "identity"
+    a = NodeIdentity.load_or_create(identity_dir, "Alter Name", _roles(NodeRole.RENDER_NODE))
+    b = NodeIdentity.load_or_create(identity_dir, "Neuer Name", _roles(NodeRole.RENDER_NODE))
+    assert a.node_id == b.node_id
+    assert a.display_name != b.display_name
+
+
+def test_ephemeral_distinct_ids() -> None:
+    a = NodeIdentity.ephemeral("A", _roles(NodeRole.RENDER_NODE))
+    b = NodeIdentity.ephemeral("B", _roles(NodeRole.RENDER_NODE))
+    assert a.node_id != b.node_id  # Tests dürfen niemals dieselbe ID teilen