feat(api): close credential escrow evidence readback

docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json

@@ -0,0 +1,87 @@
+{
+  "schema_version": "credential_escrow_evidence_controlled_closeout_receipt_v1",
+  "generated_at": "2026-06-29T21:05:44+08:00",
+  "workplan_id": "P0-005",
+  "source_validation_schema_version": "credential_escrow_evidence_refs_validation_v1",
+  "source_validation_endpoint": "/api/v1/agents/credential-escrow-evidence-intake-readiness/validate-evidence-refs",
+  "status": "ready_for_p0_005_controlled_closeout",
+  "receipt_scope": "redacted_non_secret_credential_escrow_evidence_refs",
+  "result": {
+    "required_item_count": 5,
+    "accepted_item_count": 5,
+    "missing_required_item_count": 0,
+    "owner_response_received_count": 1,
+    "owner_response_accepted_count": 1,
+    "projected_effective_escrow_missing_count": 0,
+    "redacted_receipt_writeback_ready_count": 1,
+    "runtime_gate_count": 0,
+    "credential_marker_write_authorized_count": 0,
+    "secret_value_collection_allowed": false,
+    "forbidden_true_field_count": 0
+  },
+  "evidence_refs": [
+    {
+      "item_id": "restic_repository_password",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-0",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "offsite_provider_credentials",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-1",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "break_glass_admin_credentials",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-2",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "dns_registrar_recovery",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-3",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "oauth_ai_provider_recovery",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-4",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    }
+  ],
+  "writeback": {
+    "source_readiness_ref": "apps/api/src/services/credential_escrow_evidence_intake_readiness.py",
+    "writeback_mode": "committed_redacted_receipt_only",
+    "source_readiness_written": true,
+    "production_runtime_write_requested": false,
+    "production_runtime_write_performed": false
+  },
+  "operation_boundaries": {
+    "payload_persisted": false,
+    "source_readiness_written": true,
+    "backup_execution_performed": false,
+    "restore_execution_performed": false,
+    "offsite_sync_execution_performed": false,
+    "credential_marker_write_performed": false,
+    "credential_read_performed": false,
+    "secret_plaintext_read": false,
+    "secret_value_collection_allowed": false,
+    "workflow_trigger_performed": false,
+    "host_or_k8s_write_performed": false,
+    "raw_session_or_sqlite_read_performed": false,
+    "runtime_action_performed": false
+  },
+  "safe_next_step": "continue_to_p0_006_source_to_runtime_drift_cleanup"
+}

docs/operations/awoooi-priority-work-order-readback.snapshot.json

@@ -114,17 +114,48 @@
       "status": "closed_gitea_private_inventory_controlled_closeout",
       "title": "取得 Gitea private inventory 權限",
       "workplan_id": "P0-003"
+    },
+    {
+      "evidence": {
+        "accepted_item_count": 5,
+        "api_readback_schema_version": "credential_escrow_evidence_intake_readiness_v1",
+        "blocked_item_ids": [],
+        "controlled_closeout_receipt": "docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json",
+        "controlled_closeout_redacted_receipt_writeback_ready_count": 1,
+        "controlled_closeout_status": "ready_for_p0_005_controlled_closeout",
+        "credential_marker_write_authorized_count": 0,
+        "delivery_workbench_active_lane": "credential_escrow",
+        "delivery_workbench_blocker_count": 0,
+        "delivery_workbench_completion_percent": 100,
+        "effective_escrow_missing_count": 0,
+        "evidence_refs_validation_payload_persisted": false,
+        "evidence_refs_validation_runtime_action_performed": false,
+        "evidence_refs_validation_credential_marker_write_performed": false,
+        "forbidden_true_field_count": 0,
+        "missing_item_count": 0,
+        "owner_response_accepted_count": 1,
+        "owner_response_received_count": 1,
+        "preflight_status": "ready_for_reviewer_acceptance_writeback",
+        "required_item_count": 5,
+        "runtime_gate_count": 0,
+        "secret_value_collection_allowed": false,
+        "single_preflight_intake_ready_count": 1
+      },
+      "safe_next_step": "continue_to_p0_006_source_to_runtime_drift_cleanup",
+      "status": "closed_credential_escrow_evidence_refs_controlled_closeout",
+      "title": "產品資料與備份 contract",
+      "workplan_id": "P0-005"
     }
   ],
   "current_head": {
-    "gitea_main_sha": "f1a264cf0cab09c6d853f7dc5d9fc02fbf32bc7b",
-    "latest_fetched_gitea_main_subject": "fix(api): align reboot slo workbench readback tests",
+    "gitea_main_sha": "e66acdfa2f9a47ba34659e52bd5712cd748f1869",
+    "latest_fetched_gitea_main_subject": "chore(ops): record stock freshness recovery",
     "latest_source_readiness_cd_run_id": null,
     "latest_source_readiness_cd_run_status": "not_visible_in_public_queue_at_2026-06-29T19:20:13+08:00",
-    "latest_source_readiness_commit_sha": "1fb4bfc09d1e2a192527fb53fdf4694ab2380b6d",
-    "latest_successful_deploy_marker": "094f50ddb chore(cd): deploy 1fb4bfc [skip ci]",
-    "latest_successful_deployed_source_sha": "1fb4bfc09d1e2a192527fb53fdf4694ab2380b6d",
-    "latest_verified_worktree_base_sha": "094f50ddb",
+    "latest_source_readiness_commit_sha": "e66acdfa2f9a47ba34659e52bd5712cd748f1869",
+    "latest_successful_deploy_marker": "097bb3589 chore(cd): deploy 23333a7 [skip ci]",
+    "latest_successful_deployed_source_sha": "23333a7819ce709dc99d03ccc9cf7aa62c86cdbd",
+    "latest_verified_worktree_base_sha": "097bb3589",
     "no_matching_runner_visible": false,
     "source_readiness_ci_fix_required": false
   },
@@ -283,93 +314,10 @@
       "status": "blocked_waiting_fresh_all_host_reboot_window",
       "title": "主機重啟自動偵測、自動觸發與 10 分鐘恢復 SLO",
       "workplan_id": "P0-006"
-    },
-    {
-      "evidence": {
-        "backup_core_green": true,
-        "checklist_generator_present": true,
-        "checklist_latest_path": "/tmp/awoooi-dr-escrow-evidence-checklist-current.json",
-        "checklist_schema_version": "awoooi_dr_escrow_evidence_checklist_v1",
-        "credential_escrow_intake_api_route_live_checked": true,
-        "credential_marker_write_authorized_count": 0,
-        "dr_escrow_blocked": true,
-        "escrow_status_live_checked": true,
-        "focused_p0_005_tests_passed": 16,
-        "live_no_secret_status_path": "/tmp/awoooi-p0-005-escrow-status-live.txt",
-        "offsite_configured": true,
-        "offsite_fresh": true,
-        "placeholder_preflight_guard_present": true,
-        "product_data_green": true,
-        "production_missing_item_count": 5,
-        "production_owner_response_accepted_count": 0,
-        "production_readback_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "production_runtime_gate_count": 0,
-        "production_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "production_secret_value_collection_allowed": false,
-        "production_top_level_safe_next_step_readback": true,
-        "production_top_level_safe_next_step_was_null_before_source_fix": true,
-        "rclone_configured": true,
-        "rclone_gdrive_configured": true,
-        "rclone_gdrive_fresh": true,
-        "script_missing_count": 0,
-        "secret_value_collection_allowed": false,
-        "source_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "source_top_level_safe_next_step_present": true,
-        "evidence_refs_validation_endpoint_present": true,
-        "evidence_refs_validation_endpoint": "/api/v1/agents/credential-escrow-evidence-intake-readiness/validate-evidence-refs",
-        "evidence_refs_validation_schema_version": "credential_escrow_evidence_refs_validation_v1",
-        "evidence_refs_validation_payload_persisted": false,
-        "evidence_refs_validation_credential_marker_write_performed": false,
-        "evidence_refs_validation_runtime_action_performed": false,
-        "stock_blockers": [],
-        "stock_eod_classification": "after_first_eod_window_blocked",
-        "stock_eod_next_action": "inspect_ingestion_logs_and_wait_retry_windows",
-        "stock_eod_window_pending": false,
-        "stock_freshness_status": "ok",
-        "stock_ingestion_blockers": [],
-        "stock_latest_trading_date": "2026-06-29",
-        "stock_official_margin_short_source_runs": [
-          3390,
-          3389
-        ],
-        "stockplatform_api_healthz_green": true,
-        "stockplatform_healthz_green": true,
-        "stockplatform_ingestion_status": "blocked",
-        "summary_escrow_missing_count": 5,
-        "stock_ingestion_status": "ok"
-      },
-      "missing_items": [
-        "restic_repository_password",
-        "offsite_provider_credentials",
-        "break_glass_admin_credentials",
-        "dns_registrar_recovery",
-        "oauth_ai_provider_recovery"
-      ],
-      "professional_fix": {
-        "action": "Use the single DR escrow checklist packet with the five required item ids, accept only redacted evidence refs, then run the existing preflight once.",
-        "do_not_repeat": [
-          "Do not reopen cold-start or CI/CD work because escrow refs are missing.",
-          "Do not create additional owner-package variants for the same five refs."
-        ],
-        "exit_criteria": [
-          "effective_escrow_missing_count=0",
-          "owner_response_accepted_count=1",
-          "forbidden_true_field_count=0",
-          "secret_value_collection_allowed=false",
-          "post_reboot_readiness OVERALL_DECLARATION no longer includes DR_ESCROW_BLOCKED"
-        ],
-        "owner": "DR evidence lane"
-      },
-      "reason": "StockPlatform product data freshness is green again after the 21:05 retry, and backup/offsite core remains green. The remaining P0-005 blocker is the five non-secret credential escrow evidence refs; no secret values, marker writes, or runtime gates are allowed.",
-      "safe_next_step": "collect_five_non_secret_credential_escrow_evidence_refs_then_rerun_single_preflight",
-      "status": "waiting_non_secret_credential_escrow_evidence_refs",
-      "title": "產品資料與備份 contract",
-      "workplan_id": "P0-005"
     }
   ],
   "next_execution_order": [
     "P0-006: service/data/backup readback is green again; keep the live reboot SLO timer active and wait for the next fresh all-host reboot event or separately approved reboot drill to prove the 10-minute SLO, with no reboot/restart/DB write from this lane.",
-    "P0-005: collect five non-secret credential escrow evidence refs and rerun one preflight; production API safe_next_step reads back correctly and backup/offsite core remains green.",
     "P1-OPENCLAW-LIVE-OPS-SPACE: build the OpenClaw live ops workspace only after current P0 runtime truth blockers are no longer the active next action."
   ],
   "noise_integrated_risk_register": [
@@ -504,6 +452,7 @@
   "schema_version": "awoooi_priority_work_order_readback_v1",
   "source_refs": {
     "credential_escrow_intake_readiness_api": "/api/v1/agents/credential-escrow-evidence-intake-readiness",
+    "credential_escrow_intake_readiness_closeout_receipt": "docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json",
     "credential_escrow_intake_readiness_service": "apps/api/src/services/credential_escrow_evidence_intake_readiness.py",
     "credential_escrow_intake_readiness_tests": "apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py",
     "credential_escrow_live_status": "/tmp/awoooi-p0-005-escrow-status-live.txt",
@@ -527,7 +476,7 @@
     "stockplatform_ingestion_readback": "https://stock.wooo.work/api/v1/system/ingestion",
     "workstation_dashboard": "~/.codex/codex-workstation-sync-dashboard.snapshot.json"
   },
-  "status": "p0_ordered_readback_p0_006_service_data_green_waiting_fresh_reboot_window_p0_005_refs_waiting",
+  "status": "p0_ordered_readback_p0_006_service_data_green_waiting_fresh_reboot_window_p0_005_and_p0_003_closed",
   "stopped_or_do_not_use": [
     {
       "allowed_actions": 0,