from __future__ import annotations

from fastapi import FastAPI
from fastapi.testclient import TestClient

from src.api.v1.agents import router
from src.services.delivery_closure_workbench import load_delivery_closure_workbench

REBOOT_SAFE_NEXT_STEP = (
    "restore_windows99_no_secret_management_channel_or_collect_local_console_"
    "verify_readback_then_rerun_reboot_scorecard_no_reboot"
)
REBOOT_ACTIVE_BLOCKERS = [
    "all_required_hosts_not_in_10_minute_reboot_window",
    "backup_core_green_not_1",
    "host_boot_observation_older_than_target_window",
    "host_unreachable_after_reboot",
    "host_uptime_unknown",
    "post_start_blocked_not_zero",
    "reboot_event_required_host_unreachable",
    "service_green_not_1",
    "wazuh_dashboard_degraded",
    "windows99_remote_execution_channel_unavailable",
    "windows99_vmware_autostart_readback_missing",
]
DRILL_ACTIVE_BLOCKERS = [
    "service_green_not_ready",
    "backup_core_green_not_ready",
    "all_required_hosts_reachable_not_ready",
    "latest_verify_only_metric_present_not_ready",
    "blocked_only_by_fresh_reboot_window_not_ready",
]


def test_delivery_closure_workbench_endpoint_returns_product_summary():
    app = FastAPI()
    app.include_router(router, prefix="/api/v1")
    client = TestClient(app)

    response = client.get("/api/v1/agents/delivery-closure-workbench")

    assert response.status_code == 200
    data = response.json()
    _assert_delivery_workbench_shape(data)


def test_delivery_closure_workbench_surfaces_gitops_runtime_readback_current(
    monkeypatch,
):
    build_sha = "0123456789abcdef0123456789abcdef01234567"
    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
    monkeypatch.setenv("AWOOOI_DESIRED_API_IMAGE_TAG", build_sha)

    payload = load_delivery_closure_workbench()
    summary = payload["summary"]
    production_lane = {
        lane["id"]: lane for lane in payload["lanes"]
    }["production_deploy"]
    metric = production_lane["metric"]

    assert summary["production_deploy_image_tag_matches_main"] is True
    assert (
        summary[
            "production_deploy_runtime_build_matches_gitops_desired_image_tag"
        ]
        is True
    )
    assert (
        summary["production_deploy_runtime_build_deploy_readback_current"]
        is True
    )
    assert (
        summary[
            "production_deploy_runtime_build_committed_readback_drift_accepted"
        ]
        is True
    )
    assert (
        metric["runtime_build_matches_gitops_desired_image_tag"]
        is True
    )
    assert metric["runtime_build_deploy_readback_current"] is True
    assert metric["runtime_build_committed_readback_drift_accepted"] is True


def test_delivery_closure_workbench_uses_gitea_private_inventory_lane():
    payload = load_delivery_closure_workbench()

    _assert_delivery_workbench_shape(payload)
    lanes = {lane["id"]: lane for lane in payload["lanes"]}
    sources = {source["id"]: source for source in payload["source_statuses"]}

    assert "github" not in lanes
    assert "github_private_backup" not in sources
    assert lanes["gitea_private_inventory"]["source_id"] == (
        "gitea_private_inventory_p0_scorecard"
    )
    assert lanes["gitea_private_inventory"]["blocker_count"] == 0
    assert lanes["gitea_private_inventory"]["completion_percent"] == 100
    assert lanes["gitea_private_inventory"]["metric"]["kind"] == "private_inventory"
    assert lanes["gitea_private_inventory"]["metric"]["workplan_id"] == "P0-003"
    assert lanes["gitea_private_inventory"]["metric"]["private_inventory_source"] == "gitea"
    assert lanes["gitea_private_inventory"]["metric"]["gitea_repo_inventory_status"] == "ok"
    assert lanes["gitea_private_inventory"]["metric"]["gitea_visibility_scope"] == "admin_export"
    assert lanes["gitea_private_inventory"]["metric"]["expected_product_count"] == 11
    assert lanes["gitea_private_inventory"]["metric"]["present_product_row_count"] == 11
    assert lanes["gitea_private_inventory"]["metric"]["missing_product_row_count"] == 0
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_intake_ready"
        ]
        is True
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_intake_ready_count"
        ]
        == 1
    )
    assert lanes["gitea_private_inventory"]["metric"][
        "authenticated_inventory_single_preflight_intake_schema_version"
    ] == "gitea_authenticated_inventory_single_preflight_intake_v1"
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_payload_skeleton_repo_count_floor"
        ]
        == 4
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_required_redaction_attestation_count"
        ]
        == 8
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_token_value_collection_allowed"
        ]
        is False
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_repo_write_performed"
        ]
        is False
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_refs_sync_performed"
        ]
        is False
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_github_api_used"
        ]
        is False
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "authenticated_inventory_single_preflight_runtime_action_performed"
        ]
        is False
    )
    assert (
        lanes["gitea_private_inventory"]["metric"][
            "github_lane_excluded_from_p0_blocker_count"
        ]
        is True
    )
    assert lanes["gitea_private_inventory"]["metric"]["active_blockers"] == []
    assert lanes["gitea_private_inventory"]["next_action"] == (
        "continue_to_p0_006_source_to_runtime_drift_cleanup"
    )


def test_delivery_closure_workbench_marks_release_lane_complete_when_controlled_package_ready():
    payload = load_delivery_closure_workbench()

    _assert_delivery_workbench_shape(payload)
    lane = {lane["id"]: lane for lane in payload["lanes"]}["release"]

    assert lane["source_id"] == "status_cleanup"
    assert lane["status"] == "controlled_status_cleanup_package_ready"
    assert lane["blocker_count"] == 0
    assert lane["completion_percent"] == 100
    assert lane["metric"]["raw_overall_completion_percent"] == 74
    assert lane["metric"]["controlled_status_cleanup_package_ready"] is True


def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane():
    payload = load_delivery_closure_workbench()

    _assert_delivery_workbench_shape(payload)
    lane = {lane["id"]: lane for lane in payload["lanes"]}["credential_escrow"]

    assert lane["source_id"] == "credential_escrow_evidence_intake_readiness"
    assert lane["status"] == "closed_credential_escrow_evidence_refs_controlled_closeout"
    assert lane["blocker_count"] == 0
    assert lane["completion_percent"] == 100
    assert lane["metric"]["kind"] == "credential_escrow_evidence"
    assert lane["metric"]["workplan_id"] == "P0-005"
    assert lane["metric"]["required_item_count"] == 5
    assert lane["metric"]["effective_missing_count"] == 0
    assert lane["metric"]["active_gate_present"] is False
    assert lane["metric"]["preflight_status"] == "ready_for_reviewer_acceptance_writeback"
    assert lane["metric"]["accepted_item_count"] == 5
    assert lane["metric"]["owner_response_received_count"] == 1
    assert lane["metric"]["owner_response_accepted_count"] == 1
    assert lane["metric"]["runtime_gate_count"] == 0
    assert lane["metric"]["secret_value_collection_allowed"] is False
    assert lane["metric"]["credential_marker_write_authorized_count"] == 0
    assert lane["metric"]["controlled_closeout_status"] == (
        "ready_for_p0_005_controlled_closeout"
    )
    assert (
        lane["metric"]["controlled_closeout_redacted_receipt_writeback_ready_count"]
        == 1
    )
    assert lane["metric"]["controlled_closeout_source_ref"] == (
        "docs/operations/"
        "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
    )
    assert lane["metric"]["controlled_closeout_projected_effective_missing_count"] == 0
    assert lane["metric"]["single_preflight_intake_ready"] is True
    assert lane["metric"]["single_preflight_intake_ready_count"] == 1
    assert lane["metric"]["single_preflight_intake_schema_version"] == (
        "credential_escrow_single_preflight_intake_v1"
    )
    assert lane["metric"]["single_preflight_required_item_count"] == 5
    assert (
        lane["metric"]["single_preflight_secret_value_collection_allowed"]
        is False
    )
    assert (
        lane["metric"]["single_preflight_credential_marker_write_performed"]
        is False
    )
    assert lane["metric"]["single_preflight_runtime_action_performed"] is False
    assert lane["metric"]["owner_response_skeleton_required_item_count"] == 5
    assert (
        lane["metric"]["owner_response_skeleton_secret_value_collection_allowed"]
        is False
    )
    assert lane["next_action"] == "continue_to_p0_006_source_to_runtime_drift_cleanup"


def test_delivery_closure_workbench_exposes_p0_006_reboot_slo_lane():
    payload = load_delivery_closure_workbench()

    _assert_delivery_workbench_shape(payload)
    lane = {lane["id"]: lane for lane in payload["lanes"]}["reboot_auto_recovery"]

    assert lane["source_id"] == "reboot_auto_recovery_slo_scorecard"
    assert lane["status"] == "blocked_reboot_auto_recovery_slo_not_ready"
    assert lane["blocker_count"] == 11
    assert lane["completion_percent"] == 47
    assert lane["metric"]["kind"] == "reboot_auto_recovery_slo"
    assert lane["metric"]["workplan_id"] == "P0-006"
    assert lane["metric"]["target_minutes"] == 10
    assert lane["metric"]["can_claim_all_services_recovered_within_target"] is False
    assert lane["metric"]["observed_host_count"] == 7
    assert lane["metric"]["missing_host_count"] == 0
    assert lane["metric"]["unreachable_host_count"] == 1
    assert lane["metric"]["stale_host_count"] == 5
    assert lane["metric"]["service_green"] is False
    assert lane["metric"]["product_data_green"] is True
    assert lane["metric"]["backup_core_green"] is False
    assert lane["metric"]["stockplatform_freshness_status"] == "ok"
    assert lane["metric"]["stockplatform_ingestion_status"] == "ok"
    assert lane["metric"]["stockplatform_freshness_blocker_count"] == 0
    assert lane["metric"]["stockplatform_ingestion_blocker_count"] == 0
    assert lane["metric"]["stockplatform_final_retry_window_passed"] is False
    assert lane["metric"]["stockplatform_controlled_recovery_gate_required"] is False
    assert lane["metric"]["drill_preflight_status"] == (
        "blocked_reboot_drill_preflight_not_ready"
    )
    assert lane["metric"]["drill_preflight_ready"] is False
    assert lane["metric"]["drill_preflight_ready_count"] == 0
    assert lane["metric"]["drill_preflight_blocker_count"] == 5
    assert lane["metric"]["drill_preflight_active_blockers"] == DRILL_ACTIVE_BLOCKERS
    assert (
        lane["metric"]["drill_preflight_break_glass_authorization_required"]
        is True
    )
    assert (
        lane["metric"]["drill_preflight_execution_authorized_by_this_endpoint"]
        is False
    )
    assert (
        lane["metric"]["drill_preflight_host_reboot_authorized_by_this_endpoint"]
        is False
    )
    assert lane["metric"]["drill_preflight_runtime_write_allowed"] is False
    assert lane["metric"]["drill_preflight_target_required_host_count"] == 7
    assert lane["metric"]["drill_preflight_target_observed_host_count"] == 7
    assert lane["metric"]["drill_preflight_target_missing_host_count"] == 0
    assert lane["metric"]["drill_preflight_target_unreachable_host_count"] == 1
    assert lane["metric"]["drill_preflight_target_stale_host_count"] == 5
    assert lane["metric"]["drill_preflight_verify_only_available"] is True
    assert lane["metric"]["drill_preflight_post_apply_verifier_endpoint"] == (
        "/api/v1/agents/reboot-auto-recovery-slo-scorecard"
    )
    assert (
        lane["metric"]["drill_preflight_secret_value_collection_allowed"]
        is False
    )
    assert lane["metric"]["drill_preflight_workflow_trigger_performed"] is False
    assert lane["metric"]["host_reboot_performed"] is False
    assert lane["metric"]["service_restart_performed"] is False
    assert lane["metric"]["database_write_or_restore_performed"] is False
    assert lane["metric"]["secret_value_collection_allowed"] is False
    assert lane["metric"]["active_blockers"] == REBOOT_ACTIVE_BLOCKERS
    assert lane["next_action"] == REBOOT_SAFE_NEXT_STEP


def _assert_delivery_workbench_shape(data: dict):
    assert data["schema_version"] == "delivery_closure_workbench_v1"
    assert data["snapshot_generated_at"]
    assert data["source_generated_at"]
    assert data["generated_at"] != data["snapshot_generated_at"]
    assert data["generated_at"].endswith("+08:00")
    assert data["runtime_readback_generated_at"] == data["generated_at"]
    assert data["safe_next_step"] == REBOOT_SAFE_NEXT_STEP
    assert data["active_blockers"] == REBOOT_ACTIVE_BLOCKERS
    assert data["readback"]["workbench_status"] == "blocked_delivery_actions_required"
    assert data["readback"]["generated_at"] == data["generated_at"]
    assert data["readback"]["runtime_readback_generated_at"] == data["generated_at"]
    assert data["readback"]["source_generated_at"] == data["source_generated_at"]
    assert data["readback"]["snapshot_generated_at"] == data["snapshot_generated_at"]
    assert data["readback"]["current_p0_workplan_id"] == "P0-006"
    assert data["readback"]["current_p0_source_id"] == (
        "reboot_auto_recovery_slo_scorecard"
    )
    assert data["readback"]["current_p0_status"] == (
        "blocked_reboot_auto_recovery_slo_not_ready"
    )
    assert data["readback"]["current_p0_safe_next_step"] == data["safe_next_step"]
    assert data["readback"]["current_p0_active_blockers"] == data["active_blockers"]
    assert data["readback"]["current_p0_readiness_percent"] == 47
    assert data["readback"]["current_p0_drill_preflight_status"] == (
        "blocked_reboot_drill_preflight_not_ready"
    )
    assert data["readback"]["current_p0_drill_preflight_ready"] is False
    assert (
        data["readback"]["current_p0_drill_preflight_break_glass_required"]
        is True
    )
    assert (
        data["readback"][
            "current_p0_drill_preflight_execution_authorized_by_this_endpoint"
        ]
        is False
    )
    assert data["readback"]["closed_p0_workplan_ids"] == ["P0-003", "P0-005"]
    assert data["readback"]["github_lane_status"] == "stopped_retired_do_not_use"
    assert data["readback"]["secret_value_collection_allowed"] is False
    assert data["readback"]["workflow_trigger_authorized"] is False
    assert data["readback"]["runtime_write_authorized"] is False
    assert data["rollups"]["source_count"] == 9
    assert data["rollups"]["loaded_source_count"] == 9
    assert data["rollups"]["high_risk_blocker_count"] == data["summary"][
        "high_risk_blocker_count"
    ]
    assert data["rollups"]["current_p0_blocker_count"] == 11
    assert data["rollups"]["current_p0_readiness_percent"] == 47
    assert data["rollups"]["current_p0_blocked_by_fresh_reboot_window_only"] is False
    assert data["rollups"]["current_p0_service_green"] is False
    assert data["rollups"]["current_p0_product_data_green"] is True
    assert data["rollups"]["current_p0_backup_core_green"] is False
    assert (
        data["rollups"]["current_p0_stockplatform_freshness_status"]
        == "ok"
    )
    assert (
        data["rollups"]["current_p0_stockplatform_ingestion_status"]
        == "ok"
    )
    assert data["rollups"]["current_p0_drill_preflight_ready"] is False
    assert data["rollups"]["current_p0_drill_preflight_ready_count"] == 0
    assert data["rollups"]["current_p0_drill_preflight_blocker_count"] == 5
    assert data["rollups"]["current_p0_drill_preflight_break_glass_required"] is True
    assert (
        data["rollups"][
            "current_p0_drill_preflight_execution_authorized_by_this_endpoint"
        ]
        is False
    )
    assert data["rollups"]["current_p0_drill_preflight_runtime_write_allowed"] is False
    assert data["rollups"]["gitea_private_inventory_blocker_count"] == 0
    assert data["rollups"]["credential_escrow_blocker_count"] == 0
    assert data["rollups"]["production_deploy_hard_blocker_count"] == 0
    assert data["rollups"]["secret_values_collected"] is False
    assert data["rollups"]["workflow_trigger_authorized"] is False
    assert data["rollups"]["runtime_write_authorized"] is False
    assert data["rollups"]["runtime_readback_generated_at_present"] is True
    assert data["rollups"]["source_generated_at_present"] is True
    source_statuses = {source["id"]: source for source in data["source_statuses"]}
    reboot_source = source_statuses["reboot_auto_recovery_slo_scorecard"]
    assert reboot_source["snapshot_generated_at"] == "2026-07-02T15:08:44+08:00"
    assert reboot_source["runtime_readback_generated_at"] == reboot_source["generated_at"]
    assert reboot_source["runtime_readback_generated_at"].endswith("+08:00")
    assert data["summary"]["source_count"] == 9
    assert data["summary"]["generated_at"] == data["generated_at"]
    assert data["summary"]["runtime_readback_generated_at"] == data["generated_at"]
    assert data["summary"]["source_generated_at"] == data["source_generated_at"]
    assert data["summary"]["snapshot_generated_at"] == data["snapshot_generated_at"]
    assert data["summary"]["loaded_source_count"] == 9
    assert data["summary"]["runtime_execution_authorized"] is False
    assert data["summary"]["remote_write_authorized"] is False
    assert data["summary"]["repo_creation_authorized"] is False
    assert data["summary"]["visibility_change_authorized"] is False
    assert data["summary"]["refs_sync_authorized"] is False
    assert data["summary"]["workflow_trigger_authorized"] is False
    assert data["summary"]["github_global_freeze_enabled"] is True
    assert data["summary"]["github_lane_status"] == "stopped_retired_do_not_use"
    assert data["summary"]["github_lane_excluded_from_p0_blocker_count"] is True
    assert data["summary"]["gitea_runner_attestation_request_status"] == (
        "owner_attestation_request_ready_waiting_response"
    )
    assert data["summary"]["gitea_runner_attestation_request_ready"] is True
    assert data["summary"]["gitea_runner_attestation_request_active_blocker_count"] == 1
    assert data["summary"]["gitea_runner_attestation_contract_id"] == (
        "ubuntu_latest_gitea_runner_label"
    )
    assert data["summary"]["gitea_runner_attestation_runner_label"] == "ubuntu-latest"
    assert data["summary"]["gitea_runner_attestation_workflow_count"] == 8
    assert data["summary"]["gitea_runner_attestation_required_owner_field_count"] >= 10
    assert data["summary"]["gitea_runner_attestation_forbidden_action_count"] >= 8
    assert data["summary"]["gitea_runner_attestation_owner_response_received_count"] == 0
    assert data["summary"]["gitea_runner_attestation_owner_response_accepted_count"] == 0
    assert data["summary"]["gitea_runner_attestation_request_sent"] is False
    assert data["summary"]["gitea_runner_attestation_request_send_performed"] is False
    assert (
        data["summary"]["gitea_runner_attestation_runner_label_change_allowed"]
        is False
    )
    assert (
        data["summary"]["gitea_runner_attestation_runner_registration_allowed"]
        is False
    )
    assert data["summary"]["gitea_runner_attestation_secret_read_allowed"] is False
    assert data["summary"]["github_blocked_preflight_target_count"] == 0
    assert data["summary"]["github_operator_unblock_required"] is False
    assert data["summary"]["reboot_auto_recovery_status"] == (
        "blocked_reboot_auto_recovery_slo_not_ready"
    )
    assert data["summary"]["reboot_auto_recovery_workplan_id"] == "P0-006"
    assert data["summary"]["reboot_auto_recovery_readiness_percent"] == 47
    assert data["summary"]["reboot_auto_recovery_active_blocker_count"] == 11
    assert data["summary"]["reboot_auto_recovery_can_claim_slo"] is False
    assert data["summary"]["reboot_auto_recovery_service_green"] is False
    assert data["summary"]["reboot_auto_recovery_product_data_green"] is True
    assert data["summary"]["reboot_auto_recovery_observed_host_count"] == 7
    assert data["summary"]["reboot_auto_recovery_stale_host_count"] == 5
    assert (
        data["summary"]["reboot_auto_recovery_stockplatform_freshness_status"]
        == "ok"
    )
    assert (
        data["summary"]["reboot_auto_recovery_stockplatform_ingestion_status"]
        == "ok"
    )
    assert (
        data["summary"][
            "reboot_auto_recovery_stockplatform_final_retry_window_passed"
        ]
        is False
    )
    assert (
        data["summary"][
            "reboot_auto_recovery_stockplatform_controlled_recovery_gate_required"
        ]
        is False
    )
    assert data["summary"]["reboot_auto_recovery_safe_next_step"] == REBOOT_SAFE_NEXT_STEP
    assert data["summary"]["reboot_auto_recovery_drill_preflight_status"] == (
        "blocked_reboot_drill_preflight_not_ready"
    )
    assert data["summary"]["reboot_auto_recovery_drill_preflight_ready"] is False
    assert data["summary"]["reboot_auto_recovery_drill_preflight_ready_count"] == 0
    assert data["summary"]["reboot_auto_recovery_drill_preflight_blocker_count"] == 5
    assert (
        data["summary"][
            "reboot_auto_recovery_drill_preflight_break_glass_required"
        ]
        is True
    )
    assert (
        data["summary"][
            "reboot_auto_recovery_drill_preflight_execution_authorized_by_this_endpoint"
        ]
        is False
    )
    assert (
        data["summary"][
            "reboot_auto_recovery_drill_preflight_host_reboot_authorized_by_this_endpoint"
        ]
        is False
    )
    assert (
        data["summary"]["reboot_auto_recovery_drill_preflight_runtime_write_allowed"]
        is False
    )
    assert (
        data["summary"][
            "reboot_auto_recovery_drill_preflight_target_selector_scope"
        ]
        == "awoooi_p0_reboot_slo_hosts"
    )
    assert data["summary"][
        "reboot_auto_recovery_drill_preflight_post_apply_verifier_endpoint"
    ] == "/api/v1/agents/reboot-auto-recovery-slo-scorecard"
    assert data["summary"]["gitea_private_inventory_status"] == (
        "closed_gitea_private_inventory_controlled_closeout"
    )
    assert data["summary"]["gitea_private_inventory_workplan_id"] == "P0-003"
    assert data["summary"]["gitea_private_inventory_source"] == "gitea"
    assert data["summary"]["gitea_private_inventory_review_readiness_percent"] == 100
    assert data["summary"]["gitea_private_inventory_active_blocker_count"] == 0
    assert data["summary"]["gitea_private_inventory_repo_inventory_status"] == "ok"
    assert data["summary"]["gitea_private_inventory_visibility_scope"] == "admin_export"
    assert data["summary"]["gitea_private_inventory_expected_product_count"] == 11
    assert data["summary"]["gitea_private_inventory_present_product_row_count"] == 11
    assert data["summary"]["gitea_private_inventory_missing_product_row_count"] == 0
    assert data["summary"]["gitea_private_inventory_accepted_payload_count"] == 1
    assert (
        data["summary"][
            "gitea_private_inventory_owner_coverage_attestation_received_count"
        ]
        == 1
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_intake_ready"
        ]
        is True
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_intake_ready_count"
        ]
        == 1
    )
    assert data["summary"][
        "gitea_private_inventory_authenticated_single_preflight_intake_schema_version"
    ] == "gitea_authenticated_inventory_single_preflight_intake_v1"
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_payload_skeleton_repo_count_floor"
        ]
        == 4
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_required_redaction_attestation_count"
        ]
        == 8
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_token_value_collection_allowed"
        ]
        is False
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_repo_write_performed"
        ]
        is False
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_refs_sync_performed"
        ]
        is False
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_github_api_used"
        ]
        is False
    )
    assert (
        data["summary"][
            "gitea_private_inventory_authenticated_single_preflight_runtime_action_performed"
        ]
        is False
    )
    assert (
        data["summary"][
            "gitea_private_inventory_all_active_product_repos_have_owner_readiness_row"
        ]
        is True
    )
    assert data["summary"]["p0_cicd_baseline_status"] == (
        "ready_for_template_copy_apply_gate"
    )
    assert data["summary"]["p0_cicd_baseline_source_readiness_percent"] == 100
    assert data["summary"]["p0_cicd_template_copy_apply_gate_status"] == (
        "controlled_template_copy_apply_gate_ready"
    )
    assert data["summary"]["p0_cicd_template_copy_apply_allowed"] is True
    assert data["summary"]["p0_cicd_template_copy_authorized"] is True
    assert data["summary"]["p0_cicd_template_copy_workflow_trigger_authorized"] is False
    assert data["summary"]["p0_cicd_template_copy_auto_branch_trigger_authorized"] is False
    assert data["summary"]["p0_cicd_template_copy_generic_runner_label_authorized"] is False
    assert data["summary"]["p0_cicd_template_copy_runner_pressure_guard_required"] is True
    assert data["summary"]["p0_cicd_template_copy_receipt_status"] == (
        "controlled_template_copy_receipt_ready"
    )
    assert data["summary"]["p0_cicd_template_copy_receipt_ready"] is True
    assert data["summary"]["p0_cicd_template_copy_receipt_active_blocker_count"] == 0
    assert data["summary"]["p0_cicd_template_copy_source_template_file_present"] is True
    assert (
        data["summary"]["p0_cicd_template_copy_destination_workflow_file_present"]
        is True
    )
    assert (
        data["summary"]["p0_cicd_template_copy_destination_workflow_matches_template"]
        is True
    )
    assert data["summary"]["p0_cicd_template_copy_workflow_dispatch_declared"] is True
    assert data["summary"]["p0_cicd_template_copy_auto_branch_event_count"] == 0
    assert data["summary"]["p0_cicd_template_copy_generic_runner_label_count"] == 0
    assert data["summary"]["p0_cicd_template_copy_active_workflow_file_created"] is True
    assert data["summary"]["p0_cicd_template_copy_workflow_trigger_performed"] is False
    assert data["summary"]["p0_cicd_warning_step_runtime_enablement_gate_status"] == (
        "controlled_warning_step_runtime_enabled"
    )
    assert data["summary"]["p0_cicd_warning_step_runtime_enablement_gate_ready"] is True
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_active_blocker_count"
        ]
        == 0
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_controlled_apply_allowed"
        ]
        is True
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_controlled_apply_completed"
        ]
        is True
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_runtime_execution_enabled"
        ]
        is True
    )
    assert (
        data["summary"]["p0_cicd_warning_step_runtime_enablement_switch_changed"]
        is True
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_workflow_dispatch_authorized"
        ]
        is False
    )
    assert data["summary"]["p0_cicd_warning_step_runtime_enablement_switch"] == (
        "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED"
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_current_switch_default"
        ]
        == "1"
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_desired_switch_value"
        ]
        == "1"
    )
    assert (
        data["summary"][
            "p0_cicd_warning_step_runtime_enablement_trigger_performed"
        ]
        is False
    )
    assert data["summary"]["production_deploy_status"] == "closure_verified"
    assert data["summary"]["production_deploy_image_tag_matches_main"] is True
    assert data["summary"]["backup_credential_escrow_intake_status"] == (
        "closed_credential_escrow_evidence_refs_controlled_closeout"
    )
    assert data["summary"]["backup_credential_escrow_active_gate_present"] is False
    assert data["summary"]["backup_credential_escrow_preflight_status"] == (
        "ready_for_reviewer_acceptance_writeback"
    )
    assert data["summary"]["backup_credential_escrow_required_item_count"] == 5
    assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 0
    assert data["summary"]["backup_credential_escrow_accepted_item_count"] == 5
    assert data["summary"]["backup_credential_escrow_owner_response_received_count"] == 1
    assert data["summary"]["backup_credential_escrow_owner_response_accepted_count"] == 1
    assert data["summary"]["backup_credential_escrow_secret_value_collection_allowed"] is False
    assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0
    assert data["summary"]["backup_credential_escrow_controlled_closeout_status"] == (
        "ready_for_p0_005_controlled_closeout"
    )
    assert (
        data["summary"][
            "backup_credential_escrow_redacted_receipt_writeback_ready_count"
        ]
        == 1
    )
    assert data["summary"]["backup_credential_escrow_closeout_receipt_ref"] == (
        "docs/operations/"
        "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
    )
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_intake_ready"
        ]
        is True
    )
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_intake_ready_count"
        ]
        == 1
    )
    assert data["summary"][
        "backup_credential_escrow_single_preflight_intake_schema_version"
    ] == "credential_escrow_single_preflight_intake_v1"
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_required_item_count"
        ]
        == 5
    )
    assert data["summary"][
        "backup_credential_escrow_single_preflight_safe_next_step"
    ] == "continue_to_p0_006_source_to_runtime_drift_cleanup"
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_secret_value_collection_allowed"
        ]
        is False
    )
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_credential_marker_write_performed"
        ]
        is False
    )
    assert (
        data["summary"][
            "backup_credential_escrow_single_preflight_runtime_action_performed"
        ]
        is False
    )
    assert data["summary"]["secret_values_collected"] is False

    lane_ids = {lane["id"] for lane in data["lanes"]}
    assert lane_ids == {
        "release",
        "production_deploy",
        "reboot_auto_recovery",
        "credential_escrow",
        "gitea_private_inventory",
        "cicd_baseline",
        "gitea",
        "runtime",
        "backup",
    }
    assert data["operation_boundaries"]["read_only_api_allowed"] is True
    assert data["operation_boundaries"]["runtime_write_allowed"] is False
    assert data["operation_boundaries"]["remote_write_allowed"] is False
    assert data["operation_boundaries"]["repo_creation_allowed"] is False
    assert data["operation_boundaries"]["visibility_change_allowed"] is False
    assert data["operation_boundaries"]["refs_sync_allowed"] is False
    assert data["operation_boundaries"]["workflow_trigger_allowed"] is False
    assert data["operation_boundaries"]["gitea_api_write_allowed"] is False
    assert (
        data["operation_boundaries"][
            "gitea_authenticated_inventory_import_execution_allowed"
        ]
        is False
    )
    assert data["operation_boundaries"]["github_write_channel_ready"] is False
    assert data["operation_boundaries"]["github_controlled_apply_allowed"] is False
    assert data["operation_boundaries"]["secret_value_collection_allowed"] is False
    assert data["operation_boundaries"]["host_reboot_performed"] is False
    assert data["operation_boundaries"]["service_restart_performed"] is False
    assert data["operation_boundaries"]["database_write_or_restore_performed"] is False
    assert (
        data["operation_boundaries"]["stockplatform_manual_data_write_performed"]
        is False
    )
