fix(runtime): preserve per-host service specs and role-aware routing

src/open_range/builder/service_manifest.py

@@ -235,14 +235,14 @@ def generate_service_specs(
         services dict (or the topology hosts list as fallback).
     """
     specs: list[ServiceSpec] = []
-    seen_daemons: set[str] = set()
+    seen_identities: set[tuple[str, str]] = set()
 
     services = compose.get("services", {}) if compose else {}
 
     if services:
-        specs = _from_compose(services, seen_daemons)
+        specs = _from_compose(services, seen_identities)
     else:
-        specs = _from_topology(topology, seen_daemons)
+        specs = _from_topology(topology, seen_identities)
 
     return specs
 
@@ -322,7 +322,7 @@ def _build_service_spec(
 
 def _from_compose(
     services: dict[str, Any],
-    seen_daemons: set[str],
+    seen_identities: set[tuple[str, str]],
 ) -> list[ServiceSpec]:
     """Generate specs from the compose services section."""
     specs: list[ServiceSpec] = []
@@ -348,9 +348,10 @@ def _from_compose(
             continue
 
         daemon = hint[0]
-        if daemon in seen_daemons:
+        identity = (svc_name, daemon)
+        if identity in seen_identities:
             continue
-        seen_daemons.add(daemon)
+        seen_identities.add(identity)
 
         env_vars = _env_from_compose_service(svc_def)
         spec = _build_service_spec(
@@ -365,7 +366,7 @@ def _from_compose(
 
 def _from_topology(
     topology: dict[str, Any],
-    seen_daemons: set[str],
+    seen_identities: set[tuple[str, str]],
 ) -> list[ServiceSpec]:
     """Generate specs from the topology hosts list (fallback path)."""
     specs: list[ServiceSpec] = []
@@ -385,9 +386,10 @@ def _from_topology(
             continue
 
         daemon = hint[0]
-        if daemon in seen_daemons:
+        identity = (host_name, daemon)
+        if identity in seen_identities:
             continue
-        seen_daemons.add(daemon)
+        seen_identities.add(identity)
 
         spec = _build_service_spec(host=host_name, hint=hint)
         specs.append(spec)

src/open_range/server/environment.py

@@ -1111,23 +1111,36 @@ class RangeEnvironment(Environment[RangeAction, RangeObservation, RangeState]):
         """Determine which container to route the command to.
 
         Reads from the snapshot topology to find the appropriate host:
-        - Red: host with role=attacker or zone=external.
-        - Blue: host with role=siem or zone=management.
-
-        The snapshot topology must define hosts with roles or zones.
-        For string-only host lists, matches by name then falls back to
-        positional convention (first host for Red, last for Blue).
+        - Red: host with role=attacker or zone=external
+        - Blue: host with role=siem or zone=management
+
+        Resolution priority:
+        1. host_catalog metadata (compiled from manifest)
+        2. dict entries in topology["hosts"] with role/zone
+        3. literal host-name match ("attacker"/"siem")
+        4. zone membership fallback via topology["zones"]
+        5. positional fallback (first host for Red, last for Blue)
         """
         if not self._snapshot or not isinstance(self._snapshot.topology, dict):
             raise RuntimeError("Cannot resolve target — no snapshot topology loaded")
 
-        hosts = self._snapshot.topology.get("hosts", [])
+        topology = self._snapshot.topology
+        hosts = topology.get("hosts", [])
         if not hosts:
             raise RuntimeError("Cannot resolve target — snapshot topology has no hosts")
 
         target_role = "attacker" if action.mode == "red" else "siem"
         target_zone = "external" if action.mode == "red" else "management"
 
+        host_catalog = topology.get("host_catalog", {})
+        if isinstance(host_catalog, dict):
+            for host_name, meta in host_catalog.items():
+                if not isinstance(meta, dict):
+                    continue
+                if meta.get("role") == target_role or meta.get("zone") == target_zone:
+                    if host_name:
+                        return self._container_name(str(host_name))
+
         # Look for a host with matching role or zone
         for h in hosts:
             if isinstance(h, dict):
@@ -1142,6 +1155,15 @@ class RangeEnvironment(Environment[RangeAction, RangeObservation, RangeState]):
             if name == target_role:
                 return self._container_name(name)
 
+        zones = topology.get("zones", {})
+        if isinstance(zones, dict):
+            candidates = zones.get(target_zone, [])
+            if isinstance(candidates, list):
+                for candidate in candidates:
+                    host_name = str(candidate).strip()
+                    if host_name:
+                        return self._container_name(host_name)
+
         # Use positional convention: first host for Red, last for Blue
         fallback = hosts[0] if action.mode == "red" else hosts[-1]
         name = fallback if isinstance(fallback, str) else fallback.get("name", fallback.get("hostname", ""))

tests/test_environment.py

@@ -67,6 +67,46 @@ class TestReset:
         assert env.snapshot is not None
 
 
+class TestTargetResolution:
+    """Target selection should honor manifest-compiled metadata."""
+
+    def test_resolve_target_uses_host_catalog_roles(self):
+        env = RangeEnvironment(docker_available=False)
+        env.reset(
+            snapshot=SnapshotSpec(
+                topology={
+                    "hosts": ["web", "kali1", "socbox"],
+                    "host_catalog": {
+                        "web": {"role": "web", "zone": "dmz"},
+                        "kali1": {"role": "attacker", "zone": "external"},
+                        "socbox": {"role": "siem", "zone": "management"},
+                    },
+                },
+                task=TaskSpec(red_briefing="Go.", blue_briefing="Watch."),
+            )
+        )
+        assert env._resolve_target(RangeAction(command="id", mode="red")) == "kali1"
+        assert env._resolve_target(RangeAction(command="id", mode="blue")) == "socbox"
+
+    def test_resolve_target_uses_zone_mapping_for_string_hosts(self):
+        env = RangeEnvironment(docker_available=False)
+        env.reset(
+            snapshot=SnapshotSpec(
+                topology={
+                    "hosts": ["web", "kali1", "socbox"],
+                    "zones": {
+                        "dmz": ["web"],
+                        "external": ["kali1"],
+                        "management": ["socbox"],
+                    },
+                },
+                task=TaskSpec(red_briefing="Go.", blue_briefing="Watch."),
+            )
+        )
+        assert env._resolve_target(RangeAction(command="id", mode="red")) == "kali1"
+        assert env._resolve_target(RangeAction(command="id", mode="blue")) == "socbox"
+
+
 class TestRedStep:
     """Red agent actions."""
 

tests/test_service_spec.py

@@ -281,8 +281,8 @@ class TestGenerateFromCompose:
         assert specs[0].env_vars["MYSQL_ROOT_PASSWORD"] == "secret"
         assert specs[0].env_vars["MYSQL_DATABASE"] == "app"
 
-    def test_no_duplicate_daemons(self):
-        """If two compose services map to the same daemon, only one spec is produced."""
+    def test_repeated_daemons_on_different_hosts_are_preserved(self):
+        """Two hosts may intentionally run the same daemon family."""
         compose = {
             "services": {
                 "siem": {"image": "rsyslog:latest"},
@@ -290,8 +290,21 @@ class TestGenerateFromCompose:
             }
         }
         specs = generate_service_specs(compose, {"hosts": []})
-        assert len(specs) == 1
-        assert specs[0].daemon == "rsyslogd"
+        assert len(specs) == 2
+        assert {spec.host for spec in specs} == {"siem", "firewall"}
+        assert all(spec.daemon == "rsyslogd" for spec in specs)
+
+    def test_same_daemon_across_multiple_web_hosts(self):
+        compose = {
+            "services": {
+                "web1": {"image": "nginx:1.25"},
+                "web2": {"image": "nginx:1.25"},
+            }
+        }
+        specs = generate_service_specs(compose, {"hosts": ["web1", "web2"]})
+        assert len(specs) == 2
+        assert {spec.host for spec in specs} == {"web1", "web2"}
+        assert all(spec.daemon == "nginx" for spec in specs)
 
 
 # ---------------------------------------------------------------------------