diff --git a/apps/api/src/services/delivery_closure_workbench.py b/apps/api/src/services/delivery_closure_workbench.py index 42c3987b1..05e924614 100644 --- a/apps/api/src/services/delivery_closure_workbench.py +++ b/apps/api/src/services/delivery_closure_workbench.py @@ -18,6 +18,9 @@ from src.services.awoooi_status_cleanup_dashboard import ( from src.services.backup_dr_readiness_matrix import ( load_latest_backup_dr_readiness_matrix, ) +from src.services.credential_escrow_evidence_intake_readiness import ( + load_latest_credential_escrow_evidence_intake_readiness, +) from src.services.gitea_private_inventory_p0_scorecard import ( load_latest_gitea_private_inventory_p0_scorecard, ) @@ -43,6 +46,7 @@ def load_delivery_closure_workbench() -> dict[str, Any]: gitea = load_latest_gitea_workflow_runner_health() runtime = load_latest_runtime_surface_inventory() backup = load_latest_backup_dr_readiness_matrix() + credential_escrow_intake = load_latest_credential_escrow_evidence_intake_readiness() return build_delivery_closure_workbench( status_cleanup=status_cleanup, production_deploy=production_deploy, @@ -51,6 +55,7 @@ def load_delivery_closure_workbench() -> dict[str, Any]: gitea=gitea, runtime=runtime, backup=backup, + credential_escrow_intake=credential_escrow_intake, ) @@ -63,6 +68,7 @@ def build_delivery_closure_workbench( gitea: dict[str, Any], runtime: dict[str, Any], backup: dict[str, Any], + credential_escrow_intake: dict[str, Any], ) -> dict[str, Any]: """Build the delivery workbench response from already validated snapshots.""" status_summary = _dict(status_cleanup.get("summary")) @@ -82,6 +88,14 @@ def build_delivery_closure_workbench( runtime_rollups = _dict(runtime.get("rollups")) backup_status = _dict(backup.get("program_status")) backup_rollups = _dict(backup.get("rollups")) + credential_intake_rollups = _dict(credential_escrow_intake.get("rollups")) + credential_intake_readback = _dict(credential_escrow_intake.get("readback")) + single_preflight_intake = _dict( + credential_escrow_intake.get("single_preflight_intake") + ) + single_preflight_boundaries = _dict( + single_preflight_intake.get("operation_boundaries") + ) private_inventory_blockers = _int( private_inventory_rollups.get("active_blocker_count") @@ -423,6 +437,43 @@ def build_delivery_closure_workbench( "forbidden_true_field_count": _int( backup_rollups.get("credential_escrow_forbidden_true_field_count") ), + "single_preflight_intake_ready": ( + credential_escrow_intake.get("single_preflight_intake_ready") + is True + ), + "single_preflight_intake_ready_count": _int( + credential_intake_rollups.get("single_preflight_intake_ready_count") + ), + "single_preflight_intake_schema_version": str( + single_preflight_intake.get("schema_version") or "" + ), + "single_preflight_required_item_count": _int( + single_preflight_intake.get("required_item_count") + ), + "single_preflight_secret_value_collection_allowed": ( + single_preflight_boundaries.get("secret_value_collection_allowed") + is True + ), + "single_preflight_credential_marker_write_performed": ( + single_preflight_boundaries.get( + "credential_marker_write_performed" + ) + is True + ), + "single_preflight_runtime_action_performed": ( + single_preflight_boundaries.get("runtime_action_performed") is True + ), + "owner_response_skeleton_required_item_count": _int( + credential_escrow_intake.get( + "owner_response_skeleton_required_item_count" + ) + ), + "owner_response_skeleton_secret_value_collection_allowed": ( + credential_escrow_intake.get( + "owner_response_skeleton_secret_value_collection_allowed" + ) + is True + ), "scorecard_schema_version": str( backup_rollups.get( "credential_escrow_intake_scorecard_schema_version" @@ -636,6 +687,20 @@ def build_delivery_closure_workbench( "credential_escrow_forbidden_true_field_count" ) ), + "credential_escrow_single_preflight_intake_ready": ( + credential_escrow_intake.get("single_preflight_intake_ready") + is True + ), + "credential_escrow_single_preflight_intake_schema_version": str( + single_preflight_intake.get("schema_version") or "" + ), + "credential_escrow_single_preflight_required_item_count": _int( + single_preflight_intake.get("required_item_count") + ), + "credential_escrow_single_preflight_secret_value_collection_allowed": ( + single_preflight_boundaries.get("secret_value_collection_allowed") + is True + ), }, "href": "/operations", "next_action": _first_backup_action(backup.get("readiness_rows")), @@ -1036,6 +1101,34 @@ def build_delivery_closure_workbench( "backup_credential_escrow_forbidden_true_field_count": _int( backup_rollups.get("credential_escrow_forbidden_true_field_count") ), + "backup_credential_escrow_single_preflight_intake_ready": ( + credential_escrow_intake.get("single_preflight_intake_ready") is True + ), + "backup_credential_escrow_single_preflight_intake_ready_count": _int( + credential_intake_rollups.get("single_preflight_intake_ready_count") + ), + "backup_credential_escrow_single_preflight_intake_schema_version": str( + single_preflight_intake.get("schema_version") or "" + ), + "backup_credential_escrow_single_preflight_required_item_count": _int( + single_preflight_intake.get("required_item_count") + ), + "backup_credential_escrow_single_preflight_safe_next_step": str( + credential_intake_readback.get("safe_next_step") + or credential_escrow_intake.get("safe_next_step") + or "" + ), + "backup_credential_escrow_single_preflight_secret_value_collection_allowed": ( + single_preflight_boundaries.get("secret_value_collection_allowed") + is True + ), + "backup_credential_escrow_single_preflight_credential_marker_write_performed": ( + single_preflight_boundaries.get("credential_marker_write_performed") + is True + ), + "backup_credential_escrow_single_preflight_runtime_action_performed": ( + single_preflight_boundaries.get("runtime_action_performed") is True + ), "github_write_channel_ready": False, "github_account_status": "stopped_retired_do_not_use", "github_account_suspended": False, diff --git a/apps/api/tests/test_delivery_closure_workbench_api.py b/apps/api/tests/test_delivery_closure_workbench_api.py index a95746132..55b6721ca 100644 --- a/apps/api/tests/test_delivery_closure_workbench_api.py +++ b/apps/api/tests/test_delivery_closure_workbench_api.py @@ -77,6 +77,26 @@ def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane(): assert lane["metric"]["runtime_gate_count"] == 0 assert lane["metric"]["secret_value_collection_allowed"] is False assert lane["metric"]["credential_marker_write_authorized_count"] == 0 + assert lane["metric"]["single_preflight_intake_ready"] is True + assert lane["metric"]["single_preflight_intake_ready_count"] == 1 + assert lane["metric"]["single_preflight_intake_schema_version"] == ( + "credential_escrow_single_preflight_intake_v1" + ) + assert lane["metric"]["single_preflight_required_item_count"] == 5 + assert ( + lane["metric"]["single_preflight_secret_value_collection_allowed"] + is False + ) + assert ( + lane["metric"]["single_preflight_credential_marker_write_performed"] + is False + ) + assert lane["metric"]["single_preflight_runtime_action_performed"] is False + assert lane["metric"]["owner_response_skeleton_required_item_count"] == 5 + assert ( + lane["metric"]["owner_response_skeleton_secret_value_collection_allowed"] + is False + ) assert lane["next_action"] == ( "collect_redacted_non_secret_evidence_refs_then_rerun_preflight" ) @@ -135,6 +155,48 @@ def _assert_delivery_workbench_shape(data: dict): assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 5 assert data["summary"]["backup_credential_escrow_secret_value_collection_allowed"] is False assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0 + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_intake_ready" + ] + is True + ) + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_intake_ready_count" + ] + == 1 + ) + assert data["summary"][ + "backup_credential_escrow_single_preflight_intake_schema_version" + ] == "credential_escrow_single_preflight_intake_v1" + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_required_item_count" + ] + == 5 + ) + assert data["summary"][ + "backup_credential_escrow_single_preflight_safe_next_step" + ] == "collect_redacted_non_secret_evidence_refs_then_rerun_preflight" + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_secret_value_collection_allowed" + ] + is False + ) + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_credential_marker_write_performed" + ] + is False + ) + assert ( + data["summary"][ + "backup_credential_escrow_single_preflight_runtime_action_performed" + ] + is False + ) assert data["summary"]["secret_values_collected"] is False lane_ids = {lane["id"] for lane in data["lanes"]}