feat(governance): 新增 owner release approval gate

apps/api/tests/test_ai_agent_result_capture_owner_release_approval_gate.py

@@ -0,0 +1,108 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from src.services.ai_agent_result_capture_owner_release_approval_gate import (
+    load_latest_ai_agent_result_capture_owner_release_approval_gate,
+)
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+FIXTURE = REPO_ROOT / "docs/evaluations/ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+
+
+def test_load_latest_ai_agent_result_capture_owner_release_approval_gate_snapshot() -> None:
+    data = load_latest_ai_agent_result_capture_owner_release_approval_gate()
+
+    assert data["schema_version"] == "ai_agent_result_capture_owner_release_approval_gate_v1"
+    assert data["program_status"]["current_task_id"] == "P2-131"
+    assert data["program_status"]["next_task_id"] == "P2-132"
+    assert data["program_status"]["runtime_authority"] == "result_capture_owner_release_approval_gate_only_no_live_write"
+
+    rollups = data["rollups"]
+    assert rollups["owner_release_approval_packet_count"] == 5
+    assert rollups["maintenance_window_approval_gate_count"] == 5
+    assert rollups["live_apply_release_approval_gate_count"] == 5
+    assert rollups["rollback_owner_approval_check_count"] == 5
+    assert rollups["blocked_approval_transition_count"] == 6
+    assert rollups["operator_action_count"] == 5
+    assert rollups["critical_blocker_count"] == 5
+    assert rollups["owner_release_approved_count"] == 0
+    assert rollups["maintenance_window_approved_count"] == 0
+    assert rollups["rollback_owner_confirmed_count"] == 0
+    assert rollups["post_release_verifier_ready_count"] == 0
+    assert rollups["release_approval_pass_count"] == 0
+    assert rollups["live_apply_release_pass_count"] == 0
+    assert rollups["writer_apply_count"] == 0
+    assert rollups["execution_apply_count"] == 0
+    assert rollups["receipt_write_count"] == 0
+    assert rollups["gateway_queue_write_count"] == 0
+    assert rollups["telegram_send_count"] == 0
+    assert rollups["bot_api_call_count"] == 0
+    assert rollups["result_capture_write_count"] == 0
+    assert rollups["learning_write_count"] == 0
+    assert rollups["playbook_trust_write_count"] == 0
+    assert rollups["production_write_count"] == 0
+    assert {item["owner_release_approved"] for item in data["owner_release_approval_packets"]} == {False}
+    assert {item["maintenance_window_approved"] for item in data["maintenance_window_approval_gates"]} == {False}
+    assert {item["live_apply_release_enabled"] for item in data["live_apply_release_approval_gates"]} == {False}
+    assert {item["rollback_owner_confirmed"] for item in data["rollback_owner_approval_checks"]} == {False}
+
+
+def _copy_fixture(tmp_path: Path) -> dict:
+    source = json.loads(FIXTURE.read_text(encoding="utf-8"))
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+    return source
+
+
+def test_result_capture_owner_release_approval_gate_rejects_owner_release_approved(tmp_path: Path) -> None:
+    source = _copy_fixture(tmp_path)
+    source["owner_release_approval_packets"][0]["owner_release_approved"] = True
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="must stay unapproved and unpassed"):
+        load_latest_ai_agent_result_capture_owner_release_approval_gate(tmp_path)
+
+
+def test_result_capture_owner_release_approval_gate_rejects_maintenance_window_approved(tmp_path: Path) -> None:
+    source = _copy_fixture(tmp_path)
+    source["maintenance_window_approval_gates"][0]["maintenance_window_approved"] = True
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="must remain required and unapproved"):
+        load_latest_ai_agent_result_capture_owner_release_approval_gate(tmp_path)
+
+
+def test_result_capture_owner_release_approval_gate_rejects_live_apply_enabled(tmp_path: Path) -> None:
+    source = _copy_fixture(tmp_path)
+    source["live_apply_release_approval_gates"][0]["live_apply_release_enabled"] = True
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="must stay held and disabled"):
+        load_latest_ai_agent_result_capture_owner_release_approval_gate(tmp_path)
+
+
+def test_result_capture_owner_release_approval_gate_rejects_rollup_drift(tmp_path: Path) -> None:
+    source = _copy_fixture(tmp_path)
+    source["rollups"]["owner_release_approval_packet_count"] = 4
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="rollup counts mismatch"):
+        load_latest_ai_agent_result_capture_owner_release_approval_gate(tmp_path)
+
+
+def test_result_capture_owner_release_approval_gate_rejects_forbidden_display_terms(tmp_path: Path) -> None:
+    source = _copy_fixture(tmp_path)
+    source["operator_actions"][0]["operator_instruction"] = "work_window_transcript must never show"
+    target = tmp_path / "ai_agent_result_capture_owner_release_approval_gate_2026-06-14.json"
+    target.write_text(json.dumps(source, ensure_ascii=False), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="forbidden display terms"):
+        load_latest_ai_agent_result_capture_owner_release_approval_gate(tmp_path)

apps/api/tests/test_ai_agent_result_capture_owner_release_approval_gate_api.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from src.main import app
+
+
+@pytest.mark.asyncio
+async def test_get_agent_result_capture_owner_release_approval_gate_api() -> None:
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://testserver") as client:
+        response = await client.get("/api/v1/agents/agent-result-capture-owner-release-approval-gate")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["schema_version"] == "ai_agent_result_capture_owner_release_approval_gate_v1"
+    assert data["program_status"]["current_task_id"] == "P2-131"
+    assert data["program_status"]["next_task_id"] == "P2-132"
+
+    rollups = data["rollups"]
+    assert rollups["owner_release_approval_packet_count"] == 5
+    assert rollups["maintenance_window_approval_gate_count"] == 5
+    assert rollups["live_apply_release_approval_gate_count"] == 5
+    assert rollups["rollback_owner_approval_check_count"] == 5
+    assert rollups["blocked_approval_transition_count"] == 6
+    assert rollups["operator_action_count"] == 5
+    assert rollups["owner_release_approved_count"] == 0
+    assert rollups["maintenance_window_approved_count"] == 0
+    assert rollups["rollback_owner_confirmed_count"] == 0
+    assert rollups["post_release_verifier_ready_count"] == 0
+    assert rollups["release_approval_pass_count"] == 0
+    assert rollups["live_apply_release_pass_count"] == 0
+    assert rollups["writer_apply_count"] == 0
+    assert rollups["execution_apply_count"] == 0
+    assert rollups["receipt_write_count"] == 0
+    assert rollups["result_capture_write_count"] == 0
+    assert rollups["learning_write_count"] == 0
+    assert rollups["playbook_trust_write_count"] == 0
+    assert rollups["gateway_queue_write_count"] == 0
+    assert rollups["telegram_send_count"] == 0
+    assert rollups["bot_api_call_count"] == 0
+    assert rollups["production_write_count"] == 0
+    assert {item["owner_release_approved"] for item in data["owner_release_approval_packets"]} == {False}
+    assert {item["maintenance_window_approved"] for item in data["maintenance_window_approval_gates"]} == {False}
+    assert {item["live_apply_release_enabled"] for item in data["live_apply_release_approval_gates"]} == {False}