feat(api): surface escrow preflight in workbench

apps/api/src/services/delivery_closure_workbench.py

@@ -18,6 +18,9 @@ from src.services.awoooi_status_cleanup_dashboard import (
 from src.services.backup_dr_readiness_matrix import (
     load_latest_backup_dr_readiness_matrix,
 )
+from src.services.credential_escrow_evidence_intake_readiness import (
+    load_latest_credential_escrow_evidence_intake_readiness,
+)
 from src.services.gitea_private_inventory_p0_scorecard import (
     load_latest_gitea_private_inventory_p0_scorecard,
 )
@@ -43,6 +46,7 @@ def load_delivery_closure_workbench() -> dict[str, Any]:
     gitea = load_latest_gitea_workflow_runner_health()
     runtime = load_latest_runtime_surface_inventory()
     backup = load_latest_backup_dr_readiness_matrix()
+    credential_escrow_intake = load_latest_credential_escrow_evidence_intake_readiness()
     return build_delivery_closure_workbench(
         status_cleanup=status_cleanup,
         production_deploy=production_deploy,
@@ -51,6 +55,7 @@ def load_delivery_closure_workbench() -> dict[str, Any]:
         gitea=gitea,
         runtime=runtime,
         backup=backup,
+        credential_escrow_intake=credential_escrow_intake,
     )
 
 
@@ -63,6 +68,7 @@ def build_delivery_closure_workbench(
     gitea: dict[str, Any],
     runtime: dict[str, Any],
     backup: dict[str, Any],
+    credential_escrow_intake: dict[str, Any],
 ) -> dict[str, Any]:
     """Build the delivery workbench response from already validated snapshots."""
     status_summary = _dict(status_cleanup.get("summary"))
@@ -82,6 +88,14 @@ def build_delivery_closure_workbench(
     runtime_rollups = _dict(runtime.get("rollups"))
     backup_status = _dict(backup.get("program_status"))
     backup_rollups = _dict(backup.get("rollups"))
+    credential_intake_rollups = _dict(credential_escrow_intake.get("rollups"))
+    credential_intake_readback = _dict(credential_escrow_intake.get("readback"))
+    single_preflight_intake = _dict(
+        credential_escrow_intake.get("single_preflight_intake")
+    )
+    single_preflight_boundaries = _dict(
+        single_preflight_intake.get("operation_boundaries")
+    )
 
     private_inventory_blockers = _int(
         private_inventory_rollups.get("active_blocker_count")
@@ -423,6 +437,43 @@ def build_delivery_closure_workbench(
                 "forbidden_true_field_count": _int(
                     backup_rollups.get("credential_escrow_forbidden_true_field_count")
                 ),
+                "single_preflight_intake_ready": (
+                    credential_escrow_intake.get("single_preflight_intake_ready")
+                    is True
+                ),
+                "single_preflight_intake_ready_count": _int(
+                    credential_intake_rollups.get("single_preflight_intake_ready_count")
+                ),
+                "single_preflight_intake_schema_version": str(
+                    single_preflight_intake.get("schema_version") or ""
+                ),
+                "single_preflight_required_item_count": _int(
+                    single_preflight_intake.get("required_item_count")
+                ),
+                "single_preflight_secret_value_collection_allowed": (
+                    single_preflight_boundaries.get("secret_value_collection_allowed")
+                    is True
+                ),
+                "single_preflight_credential_marker_write_performed": (
+                    single_preflight_boundaries.get(
+                        "credential_marker_write_performed"
+                    )
+                    is True
+                ),
+                "single_preflight_runtime_action_performed": (
+                    single_preflight_boundaries.get("runtime_action_performed") is True
+                ),
+                "owner_response_skeleton_required_item_count": _int(
+                    credential_escrow_intake.get(
+                        "owner_response_skeleton_required_item_count"
+                    )
+                ),
+                "owner_response_skeleton_secret_value_collection_allowed": (
+                    credential_escrow_intake.get(
+                        "owner_response_skeleton_secret_value_collection_allowed"
+                    )
+                    is True
+                ),
                 "scorecard_schema_version": str(
                     backup_rollups.get(
                         "credential_escrow_intake_scorecard_schema_version"
@@ -636,6 +687,20 @@ def build_delivery_closure_workbench(
                         "credential_escrow_forbidden_true_field_count"
                     )
                 ),
+                "credential_escrow_single_preflight_intake_ready": (
+                    credential_escrow_intake.get("single_preflight_intake_ready")
+                    is True
+                ),
+                "credential_escrow_single_preflight_intake_schema_version": str(
+                    single_preflight_intake.get("schema_version") or ""
+                ),
+                "credential_escrow_single_preflight_required_item_count": _int(
+                    single_preflight_intake.get("required_item_count")
+                ),
+                "credential_escrow_single_preflight_secret_value_collection_allowed": (
+                    single_preflight_boundaries.get("secret_value_collection_allowed")
+                    is True
+                ),
             },
             "href": "/operations",
             "next_action": _first_backup_action(backup.get("readiness_rows")),
@@ -1036,6 +1101,34 @@ def build_delivery_closure_workbench(
             "backup_credential_escrow_forbidden_true_field_count": _int(
                 backup_rollups.get("credential_escrow_forbidden_true_field_count")
             ),
+            "backup_credential_escrow_single_preflight_intake_ready": (
+                credential_escrow_intake.get("single_preflight_intake_ready") is True
+            ),
+            "backup_credential_escrow_single_preflight_intake_ready_count": _int(
+                credential_intake_rollups.get("single_preflight_intake_ready_count")
+            ),
+            "backup_credential_escrow_single_preflight_intake_schema_version": str(
+                single_preflight_intake.get("schema_version") or ""
+            ),
+            "backup_credential_escrow_single_preflight_required_item_count": _int(
+                single_preflight_intake.get("required_item_count")
+            ),
+            "backup_credential_escrow_single_preflight_safe_next_step": str(
+                credential_intake_readback.get("safe_next_step")
+                or credential_escrow_intake.get("safe_next_step")
+                or ""
+            ),
+            "backup_credential_escrow_single_preflight_secret_value_collection_allowed": (
+                single_preflight_boundaries.get("secret_value_collection_allowed")
+                is True
+            ),
+            "backup_credential_escrow_single_preflight_credential_marker_write_performed": (
+                single_preflight_boundaries.get("credential_marker_write_performed")
+                is True
+            ),
+            "backup_credential_escrow_single_preflight_runtime_action_performed": (
+                single_preflight_boundaries.get("runtime_action_performed") is True
+            ),
             "github_write_channel_ready": False,
             "github_account_status": "stopped_retired_do_not_use",
             "github_account_suspended": False,

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -77,6 +77,26 @@ def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane():
     assert lane["metric"]["runtime_gate_count"] == 0
     assert lane["metric"]["secret_value_collection_allowed"] is False
     assert lane["metric"]["credential_marker_write_authorized_count"] == 0
+    assert lane["metric"]["single_preflight_intake_ready"] is True
+    assert lane["metric"]["single_preflight_intake_ready_count"] == 1
+    assert lane["metric"]["single_preflight_intake_schema_version"] == (
+        "credential_escrow_single_preflight_intake_v1"
+    )
+    assert lane["metric"]["single_preflight_required_item_count"] == 5
+    assert (
+        lane["metric"]["single_preflight_secret_value_collection_allowed"]
+        is False
+    )
+    assert (
+        lane["metric"]["single_preflight_credential_marker_write_performed"]
+        is False
+    )
+    assert lane["metric"]["single_preflight_runtime_action_performed"] is False
+    assert lane["metric"]["owner_response_skeleton_required_item_count"] == 5
+    assert (
+        lane["metric"]["owner_response_skeleton_secret_value_collection_allowed"]
+        is False
+    )
     assert lane["next_action"] == (
         "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
     )
@@ -135,6 +155,48 @@ def _assert_delivery_workbench_shape(data: dict):
     assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 5
     assert data["summary"]["backup_credential_escrow_secret_value_collection_allowed"] is False
     assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_intake_ready"
+        ]
+        is True
+    )
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_intake_ready_count"
+        ]
+        == 1
+    )
+    assert data["summary"][
+        "backup_credential_escrow_single_preflight_intake_schema_version"
+    ] == "credential_escrow_single_preflight_intake_v1"
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_required_item_count"
+        ]
+        == 5
+    )
+    assert data["summary"][
+        "backup_credential_escrow_single_preflight_safe_next_step"
+    ] == "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_secret_value_collection_allowed"
+        ]
+        is False
+    )
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_credential_marker_write_performed"
+        ]
+        is False
+    )
+    assert (
+        data["summary"][
+            "backup_credential_escrow_single_preflight_runtime_action_performed"
+        ]
+        is False
+    )
     assert data["summary"]["secret_values_collected"] is False
 
     lane_ids = {lane["id"] for lane in data["lanes"]}