refactor(workload): plugin architecture wave + apps UI + volume scopes

Completes the workload-first refactor's plugin layer:

- internal/workload/plugin/ — Source/Trigger plugin contract,
  registry, types (Workload, DeploymentIntent, InboundEvent,
  PublicFace). Self-registering init() pattern + blank-import
  in cmd/server/main.go.
- Source plugins: image (blue-green with multi-face proxy routing),
  compose, static. Trigger plugins: registry, git, manual.
- internal/deployer/dispatch.go — DispatchPlugin/Teardown/Reconcile
  seam routing the legacy deployer through plugins.
- internal/api/workload_*.go — REST surface: workloads, env,
  volumes, chain (parent/children), promote-from. hooks.go
  serves /api/hooks/kinds/{kind}/schema for the wizard.
- internal/store: workload_env (encrypt-at-rest secrets) and
  workload_volumes tables, keyed on workload_id.
- cmd/server/static_backend.go — phantom-row adapter delegating
  the static source plugin to the legacy staticsite.Manager
  (deleted at hard cutover once the static inline port lands).
- web/src/routes/apps/ — /apps list + /apps/new wizard +
  /apps/[id] detail with kind-aware compose / image / static
  forms (Advanced JSON toggle), env panel, volumes panel,
  webhook panel, chain panel, manual deploy.

Volume scope generalization (v2 resolver):

- internal/volume.ResolveWorkloadPath (workload-keyed, sits
  next to legacy ResolvePath). Honors all VolumeScope values:
  absolute, ephemeral, instance, stage, project, project_named,
  named. internal/workload/plugin/source/image/image.go
  computeMounts wires settings + imageTag through. Coverage in
  internal/volume/resolver_test.go (portable Linux/Windows via
  t.TempDir).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/workload/plugin/trigger/git/git.go

@@ -0,0 +1,123 @@
+// Package git implements the "git" trigger: matches inbound git push or
+// tag-create events from Gitea, GitHub, or GitLab against a repo + ref
+// filter.
+package git
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+// Config is the per-workload trigger config. Repo is "owner/name" (must
+// match the event repo). Mode controls whether branch pushes or tag
+// pushes fire the deploy. Branch is exact-matched when Mode=="push";
+// TagPattern is glob-matched when Mode=="tag".
+type Config struct {
+	Repo       string `json:"repo"`
+	Mode       string `json:"mode"` // "push" | "tag"
+	Branch     string `json:"branch"`
+	TagPattern string `json:"tag_pattern"`
+}
+
+type trigger struct{}
+
+func init() { plugin.RegisterTrigger(&trigger{}) }
+
+func (*trigger) Kind() string { return "git" }
+
+func (*trigger) SchemaSample() any {
+	return Config{
+		Repo:   "owner/repo",
+		Mode:   "push",
+		Branch: "main",
+	}
+}
+
+func (*trigger) Validate(cfg json.RawMessage) error {
+	var c Config
+	if len(cfg) == 0 {
+		return fmt.Errorf("git trigger: config is required")
+	}
+	if err := json.Unmarshal(cfg, &c); err != nil {
+		return fmt.Errorf("git trigger: invalid json: %w", err)
+	}
+	switch c.Mode {
+	case "push":
+		// Branch is optional ("" means any branch).
+	case "tag":
+		pattern := c.TagPattern
+		if pattern == "" {
+			pattern = "*"
+		}
+		if _, err := path.Match(pattern, "probe"); err != nil {
+			return fmt.Errorf("git trigger: invalid tag_pattern %q: %w", pattern, err)
+		}
+	default:
+		return fmt.Errorf("git trigger: mode must be \"push\" or \"tag\"")
+	}
+	return nil
+}
+
+func (*trigger) Match(ctx context.Context, deps plugin.Deps, w plugin.Workload, evt plugin.InboundEvent) (*plugin.DeploymentIntent, error) {
+	if evt.Git == nil {
+		return nil, nil
+	}
+	cfg, err := plugin.TriggerConfigOf[Config](w)
+	if err != nil {
+		return nil, fmt.Errorf("git trigger: decode config: %w", err)
+	}
+	if cfg.Repo != "" && !strings.EqualFold(cfg.Repo, evt.Git.Repo) {
+		return nil, nil
+	}
+	if !refMatches(cfg, evt.Git.Ref) {
+		return nil, nil
+	}
+	meta := map[string]string{
+		"repo":   evt.Git.Repo,
+		"vendor": evt.Git.Vendor,
+		"ref":    evt.Git.Ref,
+		"pusher": evt.Git.Pusher,
+	}
+	if evt.Git.Branch != "" {
+		meta["branch"] = evt.Git.Branch
+	}
+	if evt.Git.Tag != "" {
+		meta["tag"] = evt.Git.Tag
+	}
+	return &plugin.DeploymentIntent{
+		Reason:      "git-push",
+		Reference:   evt.Git.CommitSHA,
+		Metadata:    meta,
+		TriggeredAt: time.Now().UTC(),
+		TriggeredBy: "git-webhook",
+	}, nil
+}
+
+func refMatches(cfg Config, ref string) bool {
+	switch cfg.Mode {
+	case "push":
+		branch, ok := strings.CutPrefix(ref, "refs/heads/")
+		if !ok {
+			return false
+		}
+		return cfg.Branch == "" || cfg.Branch == branch
+	case "tag":
+		tag, ok := strings.CutPrefix(ref, "refs/tags/")
+		if !ok {
+			return false
+		}
+		pattern := cfg.TagPattern
+		if pattern == "" {
+			pattern = "*"
+		}
+		matched, err := path.Match(pattern, tag)
+		return err == nil && matched
+	}
+	return false
+}

internal/workload/plugin/trigger/git/git_test.go

@@ -0,0 +1,142 @@
+package git
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+func mustConfig(t *testing.T, c Config) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(c)
+	if err != nil {
+		t.Fatalf("marshal config: %v", err)
+	}
+	return b
+}
+
+func TestValidate(t *testing.T) {
+	tr := &trigger{}
+	cases := []struct {
+		name    string
+		cfg     json.RawMessage
+		wantErr bool
+	}{
+		{"empty body rejected", nil, true},
+		{"missing mode rejected", mustConfig(t, Config{Repo: "owner/repo"}), true},
+		{"push mode valid", mustConfig(t, Config{Repo: "owner/repo", Mode: "push", Branch: "main"}), false},
+		{"push mode without branch (any-branch)", mustConfig(t, Config{Repo: "owner/repo", Mode: "push"}), false},
+		{"tag mode valid", mustConfig(t, Config{Repo: "owner/repo", Mode: "tag", TagPattern: "v*"}), false},
+		{"tag mode no pattern (wildcard fallback)", mustConfig(t, Config{Repo: "owner/repo", Mode: "tag"}), false},
+		{"tag mode bad glob", mustConfig(t, Config{Repo: "owner/repo", Mode: "tag", TagPattern: "v[oops"}), true},
+		{"unknown mode", mustConfig(t, Config{Repo: "owner/repo", Mode: "merge"}), true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tr.Validate(tc.cfg)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) err=%v want err=%v", tc.name, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestRefMatches(t *testing.T) {
+	cases := []struct {
+		name string
+		cfg  Config
+		ref  string
+		want bool
+	}{
+		{"push main matches", Config{Mode: "push", Branch: "main"}, "refs/heads/main", true},
+		{"push main rejects other branch", Config{Mode: "push", Branch: "main"}, "refs/heads/dev", false},
+		{"push tag is rejected in push mode", Config{Mode: "push", Branch: "main"}, "refs/tags/v1.0.0", false},
+		{"push any-branch", Config{Mode: "push"}, "refs/heads/whatever", true},
+		{"tag mode v* matches v1.2.3", Config{Mode: "tag", TagPattern: "v*"}, "refs/tags/v1.2.3", true},
+		{"tag mode v* rejects latest", Config{Mode: "tag", TagPattern: "v*"}, "refs/tags/latest", false},
+		{"tag mode rejects heads ref", Config{Mode: "tag", TagPattern: "v*"}, "refs/heads/main", false},
+		{"tag mode empty pattern matches any tag", Config{Mode: "tag"}, "refs/tags/whatever", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := refMatches(tc.cfg, tc.ref); got != tc.want {
+				t.Errorf("refMatches(%+v, %q) = %v, want %v", tc.cfg, tc.ref, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestMatch(t *testing.T) {
+	tr := &trigger{}
+	wl := plugin.Workload{
+		ID:            "wkl-1",
+		TriggerConfig: mustConfig(t, Config{Repo: "Owner/Repo", Mode: "push", Branch: "main"}),
+	}
+
+	t.Run("wrong event kind", func(t *testing.T) {
+		evt := plugin.InboundEvent{Kind: "image-push"}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("matching push fires intent with sha", func(t *testing.T) {
+		// Branch is populated by the webhook ingress alongside Ref; the
+		// trigger reads either independently. Set both here to mirror the
+		// real wire shape.
+		evt := plugin.InboundEvent{
+			Kind: "git-push",
+			Git: &plugin.GitEvent{
+				Repo:      "owner/repo",
+				Ref:       "refs/heads/main",
+				Branch:    "main",
+				CommitSHA: "deadbeef",
+				Pusher:    "alice",
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected non-nil intent")
+		}
+		if intent.Reference != "deadbeef" {
+			t.Errorf("intent.Reference = %q, want deadbeef", intent.Reference)
+		}
+		if intent.Reason != "git-push" {
+			t.Errorf("intent.Reason = %q, want git-push", intent.Reason)
+		}
+		if intent.Metadata["branch"] != "main" {
+			t.Errorf("expected branch=main in metadata, got %q", intent.Metadata["branch"])
+		}
+	})
+
+	t.Run("repo case-insensitive comparison", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "git-push",
+			Git:  &plugin.GitEvent{Repo: "OWNER/REPO", Ref: "refs/heads/main"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected case-insensitive repo match")
+		}
+	})
+
+	t.Run("wrong repo returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "git-push",
+			Git:  &plugin.GitEvent{Repo: "other/repo", Ref: "refs/heads/main"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+}

internal/workload/plugin/trigger/manual/manual.go

@@ -0,0 +1,57 @@
+// Package manual implements the "manual" trigger: any ManualEvent fires a
+// deploy. No per-workload config — the trigger always matches its kind.
+package manual
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+type trigger struct{}
+
+func init() { plugin.RegisterTrigger(&trigger{}) }
+
+func (*trigger) Kind() string { return "manual" }
+
+func (*trigger) SchemaSample() any { return struct{}{} }
+
+func (*trigger) Validate(cfg json.RawMessage) error {
+	// Manual triggers have no config; accept empty or a small valid JSON
+	// blob. The cap prevents an admin from pinning a 1 MiB blob to a
+	// trigger row that gets serialized on every read.
+	if len(cfg) == 0 {
+		return nil
+	}
+	if len(cfg) > 1024 {
+		return fmt.Errorf("manual trigger: config must be empty or a small JSON value (got %d bytes)", len(cfg))
+	}
+	if !json.Valid(cfg) {
+		return fmt.Errorf("manual trigger: invalid json")
+	}
+	return nil
+}
+
+func (*trigger) Match(ctx context.Context, deps plugin.Deps, w plugin.Workload, evt plugin.InboundEvent) (*plugin.DeploymentIntent, error) {
+	if evt.Kind != "manual" || evt.Manual == nil {
+		return nil, nil
+	}
+	actor := evt.Manual.Actor
+	if actor == "" {
+		actor = "manual"
+	}
+	meta := map[string]string{}
+	if evt.Manual.Note != "" {
+		meta["note"] = evt.Manual.Note
+	}
+	return &plugin.DeploymentIntent{
+		Reason:      "manual",
+		Reference:   evt.Manual.Reference,
+		Metadata:    meta,
+		TriggeredAt: time.Now().UTC(),
+		TriggeredBy: actor,
+	}, nil
+}

internal/workload/plugin/trigger/manual/manual_test.go

@@ -0,0 +1,83 @@
+package manual
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+func TestValidate(t *testing.T) {
+	tr := &trigger{}
+	cases := []struct {
+		name    string
+		cfg     json.RawMessage
+		wantErr bool
+	}{
+		{"empty body accepted", nil, false},
+		{"empty object accepted", json.RawMessage(`{}`), false},
+		{"valid small object accepted", json.RawMessage(`{"note":"hello"}`), false},
+		{"invalid json rejected", json.RawMessage(`not json`), true},
+		{"oversize rejected", json.RawMessage(`{"big":"` + strings.Repeat("x", 1100) + `"}`), true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tr.Validate(tc.cfg)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) err=%v want err=%v", tc.name, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestMatch(t *testing.T) {
+	tr := &trigger{}
+	wl := plugin.Workload{ID: "wkl-1"}
+
+	t.Run("wrong kind ignored", func(t *testing.T) {
+		evt := plugin.InboundEvent{Kind: "image-push"}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("manual fires with actor + note", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind:   "manual",
+			Manual: &plugin.ManualEvent{Actor: "alice", Reference: "v1.0.0", Note: "rollback"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected non-nil intent")
+		}
+		if intent.TriggeredBy != "alice" {
+			t.Errorf("TriggeredBy = %q, want alice", intent.TriggeredBy)
+		}
+		if intent.Reference != "v1.0.0" {
+			t.Errorf("Reference = %q, want v1.0.0", intent.Reference)
+		}
+		if intent.Metadata["note"] != "rollback" {
+			t.Errorf("note metadata = %q, want rollback", intent.Metadata["note"])
+		}
+	})
+
+	t.Run("missing actor falls back", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind:   "manual",
+			Manual: &plugin.ManualEvent{Reference: "v2"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent.TriggeredBy != "manual" {
+			t.Errorf("TriggeredBy = %q, want manual", intent.TriggeredBy)
+		}
+	})
+}

internal/workload/plugin/trigger/registry/registry.go

@@ -0,0 +1,115 @@
+// Package registry implements the "registry" trigger: matches inbound image
+// push events from container registries (Docker Hub, Gitea, ghcr, generic
+// webhooks, polling) against a repo + tag-pattern filter.
+package registry
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+// Config is the per-workload trigger config blob. Image is the
+// fully-qualified image reference the workload deploys (e.g.
+// "registry.example.com/owner/app"); a push of any matching tag fires a
+// deploy. TagPattern is a path.Match glob ("*" matches all).
+type Config struct {
+	Image      string `json:"image"`
+	TagPattern string `json:"tag_pattern"`
+}
+
+type trigger struct{}
+
+func init() { plugin.RegisterTrigger(&trigger{}) }
+
+func (*trigger) Kind() string { return "registry" }
+
+func (*trigger) SchemaSample() any {
+	return Config{
+		Image:      "registry.example.com/owner/app",
+		TagPattern: "v*",
+	}
+}
+
+func (*trigger) Validate(cfg json.RawMessage) error {
+	var c Config
+	if len(cfg) == 0 {
+		return fmt.Errorf("registry trigger: config is required")
+	}
+	if err := json.Unmarshal(cfg, &c); err != nil {
+		return fmt.Errorf("registry trigger: invalid json: %w", err)
+	}
+	if strings.TrimSpace(c.Image) == "" {
+		return fmt.Errorf("registry trigger: image is required")
+	}
+	pattern := c.TagPattern
+	if pattern == "" {
+		pattern = "*"
+	}
+	if _, err := path.Match(pattern, "probe"); err != nil {
+		return fmt.Errorf("registry trigger: invalid tag_pattern %q: %w", pattern, err)
+	}
+	return nil
+}
+
+func (*trigger) Match(ctx context.Context, deps plugin.Deps, w plugin.Workload, evt plugin.InboundEvent) (*plugin.DeploymentIntent, error) {
+	if evt.Kind != "image-push" || evt.Image == nil {
+		return nil, nil
+	}
+	cfg, err := plugin.TriggerConfigOf[Config](w)
+	if err != nil {
+		return nil, fmt.Errorf("registry trigger: decode config: %w", err)
+	}
+	if !imageMatches(cfg.Image, fullRepo(evt.Image)) {
+		return nil, nil
+	}
+	pattern := cfg.TagPattern
+	if pattern == "" {
+		pattern = "*"
+	}
+	matched, err := path.Match(pattern, evt.Image.Tag)
+	if err != nil || !matched {
+		return nil, nil
+	}
+	return &plugin.DeploymentIntent{
+		Reason:      "registry-push",
+		Reference:   evt.Image.Tag,
+		Metadata:    map[string]string{"digest": evt.Image.Digest, "repo": evt.Image.Repo},
+		TriggeredAt: time.Now().UTC(),
+		TriggeredBy: "registry-webhook",
+	}, nil
+}
+
+func fullRepo(e *plugin.ImagePushEvent) string {
+	if e.Registry == "" {
+		return e.Repo
+	}
+	return e.Registry + "/" + e.Repo
+}
+
+// imageMatches: registry host case-insensitive, path/owner/name exact.
+// Single-segment refs (e.g. Docker Hub officials like "nginx") have no
+// `/` and match by exact equality of the bare name.
+func imageMatches(want, got string) bool {
+	if want == got {
+		return true
+	}
+	wIdx := strings.IndexByte(want, '/')
+	gIdx := strings.IndexByte(got, '/')
+	// Both single-segment: equality already failed above, so no match.
+	if wIdx < 0 && gIdx < 0 {
+		return false
+	}
+	// One side single-segment, the other qualified — does not match.
+	if wIdx < 0 || gIdx < 0 {
+		return false
+	}
+	wHost, wPath := want[:wIdx], want[wIdx:]
+	gHost, gPath := got[:gIdx], got[gIdx:]
+	return strings.EqualFold(wHost, gHost) && wPath == gPath
+}

internal/workload/plugin/trigger/registry/registry_test.go

@@ -0,0 +1,155 @@
+package registry
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/alexei/tinyforge/internal/workload/plugin"
+)
+
+func mustConfig(t *testing.T, c Config) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(c)
+	if err != nil {
+		t.Fatalf("marshal config: %v", err)
+	}
+	return b
+}
+
+func TestValidate(t *testing.T) {
+	tr := &trigger{}
+	cases := []struct {
+		name    string
+		cfg     json.RawMessage
+		wantErr bool
+	}{
+		{"empty body rejected", nil, true},
+		{"missing image rejected", mustConfig(t, Config{TagPattern: "*"}), true},
+		{"valid wildcard", mustConfig(t, Config{Image: "owner/app", TagPattern: "*"}), false},
+		{"valid with glob", mustConfig(t, Config{Image: "registry.example.com/owner/app", TagPattern: "v*"}), false},
+		{"invalid glob", mustConfig(t, Config{Image: "owner/app", TagPattern: "v[oops"}), true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tr.Validate(tc.cfg)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) err=%v want err=%v", tc.name, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestImageMatches(t *testing.T) {
+	cases := []struct {
+		name        string
+		want, got   string
+		shouldMatch bool
+	}{
+		{"exact qualified", "registry.example.com/owner/app", "registry.example.com/owner/app", true},
+		{"host case-insensitive", "REGISTRY.example.com/owner/app", "registry.example.com/owner/app", true},
+		{"path mismatch", "registry.example.com/owner/app", "registry.example.com/owner/other", false},
+		{"different registry", "a.example.com/owner/app", "b.example.com/owner/app", false},
+		// Single-segment images (Docker Hub officials) — recently fixed.
+		{"both single-segment equal", "nginx", "nginx", true},
+		{"both single-segment unequal", "nginx", "postgres", false},
+		{"want single, got qualified", "nginx", "library/nginx", false},
+		{"want qualified, got single", "library/nginx", "nginx", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := imageMatches(tc.want, tc.got); got != tc.shouldMatch {
+				t.Errorf("imageMatches(%q, %q) = %v, want %v", tc.want, tc.got, got, tc.shouldMatch)
+			}
+		})
+	}
+}
+
+func TestMatch(t *testing.T) {
+	tr := &trigger{}
+	cfg := mustConfig(t, Config{Image: "registry.example.com/owner/app", TagPattern: "v*"})
+	wl := plugin.Workload{
+		ID:            "wkl-1",
+		TriggerConfig: cfg,
+	}
+
+	t.Run("wrong event kind returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{Kind: "git-push"}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("matching push produces intent", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/app",
+				Tag:      "v1.2.3",
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected non-nil intent")
+		}
+		if intent.Reference != "v1.2.3" {
+			t.Errorf("intent.Reference = %q, want v1.2.3", intent.Reference)
+		}
+		if intent.Reason != "registry-push" {
+			t.Errorf("intent.Reason = %q, want registry-push", intent.Reason)
+		}
+	})
+
+	t.Run("tag outside glob returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/app",
+				Tag:      "latest", // doesn't match v*
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent for tag=latest, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("wrong repo returns nil", func(t *testing.T) {
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{
+				Registry: "registry.example.com",
+				Repo:     "owner/other",
+				Tag:      "v1.0.0",
+			},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wl, evt)
+		if err != nil || intent != nil {
+			t.Fatalf("expected nil intent for wrong repo, got intent=%v err=%v", intent, err)
+		}
+	})
+
+	t.Run("empty pattern matches anything", func(t *testing.T) {
+		wlAny := plugin.Workload{
+			ID:            "wkl-any",
+			TriggerConfig: mustConfig(t, Config{Image: "owner/app"}),
+		}
+		evt := plugin.InboundEvent{
+			Kind: "image-push",
+			Image: &plugin.ImagePushEvent{Repo: "owner/app", Tag: "latest"},
+		}
+		intent, err := tr.Match(context.Background(), plugin.Deps{}, wlAny, evt)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if intent == nil {
+			t.Fatal("expected match with empty pattern")
+		}
+	})
+}