[RonaldHensbergen]

Closes #1035.

The E150 provide-side cross-check from #1028 only ran in the compose renderer (cli/renderer.py); the Kubernetes renderer had just the consume-side E084 check, so a provided contract advertising a host that no rendered k8s Service matched did not fail closed on the helm target.

Changes

• cli/k8s_renderer.py: render_helm now runs the new _check_provided_contract_services right after _check_binding_services. Every provided http-service, sql-database, cache-service, and object-storage contract's advertised network host (the host field, the endpoint's hostname part, or a serviceName resolved through the renderer's service-naming rule to the serving workload's Service name -- honoring workload-level serviceName overrides) is checked against the Services the render produces for that module; a mismatch fails closed with E150 (same code as the compose check, matching how E071-E080 are shared across render targets). External hosts (dots, ports, credentials) are skipped, and modules whose workloads render no Service at all are left to their own diagnostics -- mirroring the compose check.
• tests/test_k8s_renderer.py: 7 new tests covering the failing host, passing host, serviceName mapping (hit and miss), sql-database/object-storage endpoints, external-host skipping, the no-rendered-services skip, and workload serviceName overrides.
• README.md / docs/modules.md / CHANGELOG.md: the E150 documentation now covers both render targets.

Verification

• tests/test_k8s_renderer.py: 33 passed (incl. the golden chart hashes -- the real profile is unaffected).
• Full suite: 1973 tests, only pre-existing unrelated failure (test_security.py rule-set version, caused by in-progress working-tree changes not part of this branch).
• ruff check and markdownlint clean on the touched files.

[RonaldHensbergen]

Self-review (contributor == reviewer), all angles checked:

• Functioneel / fail-closed: _check_provided_contract_services runs in render_helm right after _check_binding_services, before the error gate, so an E150 mismatch returns {} files — the chart is not written. The "renders green but breaks at runtime" scenario (provide host no k8s Service answers) is now a render-time error. Verified against the real profile (still renders clean, golden hashes unchanged) and against broken plans (superset host nowhere, dagster serviceName no-such-workload, workload serviceName override cases) — all fail closed with E150 at the expected paths.
• serviceName semantics: a provide serviceName names a workload and is resolved through _compose_service_name to the workload's rendered Service name, honoring workload-level serviceName overrides (host must then be the Service name, not the workload name) — consistent with what E084 consume-side bindings and _release_scope_binding_hosts expect.
• E/W-codes: E150 is reused deliberately — codes are shared across render targets already (E071–E080 in both renderers); no new code allocated, so no collision with main or open PRs (fresh fetch checked; E150 is the highest code in use).
• Tests: 7 new tests in tests/test_k8s_renderer.py (fail host, pass host, serviceName hit/miss, sql-database + object-storage endpoints, external hosts skipped, no-rendered-services skip, serviceName override). tests/test_k8s_renderer.py: 33 passed; with test_contract_host_resolution.py and test_main.py: 205 passed; full suite 1973 tests with only the pre-existing, unrelated test_security.py rule-set-version failure (working-tree-only changes, not on this branch).
• Docs/conventies: README E150 row now covers both targets, docs/modules.md describes the helm cross-check, CHANGELOG [Unreleased] has a Fixed entry; ruff and markdownlint clean on touched files.

Geen openstaande punten meer; PR is naar mijn oordeel merge-klaar.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[RonaldHensbergen]

CI fix pushed (fadbabb): the SonarCloud quality gate failed on the first push with 10.9% duplication on new code (limit 3%) -- _check_provided_contract_services duplicated the compose E150 check's candidate/diagnostic logic.

The E150 core is now shared once in cli/renderer.py (_provided_contract_host_candidates + _validate_provided_contract_hosts_against, parameterized by target wording and a resolve_service_name hook for the helm target's workload-level serviceName overrides); both renderers are thin wrappers. Also merged current main (#75) into the branch.

Result: new_duplicated_lines_density 10.85% -> 0.0%, all 15 checks pass (incl. SonarCloud Code Analysis), 1996 tests OK locally, ruff clean.