From 140d8142fd4065eb1a474c2e914300d126ec3291 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 1 Jul 2026 21:14:37 +0800
Subject: [PATCH] fix(cd): keep backup freshness on controlled profile

---
 .gitea/workflows/cd.yaml                         | 10 ++++++++++
 ops/runner/test_cd_controlled_runtime_profile.py | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 58880607..64d0377c 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -538,10 +538,18 @@ jobs:
                 ;;
               scripts/ci/wait-host-web-build-pressure.sh)
                 ;;
+              # 2026-07-01 Codex: backup freshness/readback scripts are
+              # covered by shell syntax checks and focused exporter tests.
+              # Keep them off B5 so a metadata/script recovery patch does not
+              # require the host Docker socket.
+              scripts/backup/backup-awoooi-frequent.sh)
+                ;;
               scripts/backup/gitea-repo-bundle-backup.sh)
                 ;;
               scripts/ops/backup-health-textfile-exporter.py)
                 ;;
+              scripts/ops/tests/test_backup_health_textfile_exporter.py)
+                ;;
               scripts/reboot-recovery/deploy-to-110.sh)
                 ;;
               scripts/reboot-recovery/deploy-to-188.sh)
@@ -778,6 +786,7 @@ jobs:
               ../../scripts/reboot-recovery/diagnose-110-ssh-publickey-auth.sh \
               ../../scripts/reboot-recovery/repair-110-ssh-publickey-auth-local.sh \
               ../../scripts/reboot-recovery/verify-cold-start-monitor-deploy.sh \
+              ../../scripts/backup/backup-awoooi-frequent.sh \
               ../../scripts/backup/gitea-repo-bundle-backup.sh
             DATABASE_URL="${DATABASE_URL:-postgresql+asyncpg://ci:ci@localhost/ci}" \
             PYTHONFAULTHANDLER=1 python3.11 -m pytest \
@@ -824,6 +833,7 @@ jobs:
               ../../ops/runner/test_install_awoooi_non110_runner_user_service.py \
               ../../ops/runner/test_check_awoooi_110_controlled_cd_lane_readiness.py \
               ../../ops/runner/test_verify_awoooi_non110_cd_closure.py \
+              ../../scripts/ops/tests/test_backup_health_textfile_exporter.py \
               ../../scripts/reboot-recovery/tests/test_dr_escrow_evidence_checklist.py \
               ../../scripts/reboot-recovery/tests/test_cold_start_monitor_bounded_probes.py \
               ../../scripts/reboot-recovery/tests/test_reboot_auto_recovery_slo_installer.py \
diff --git a/ops/runner/test_cd_controlled_runtime_profile.py b/ops/runner/test_cd_controlled_runtime_profile.py
index 065c3ada..370a2031 100644
--- a/ops/runner/test_cd_controlled_runtime_profile.py
+++ b/ops/runner/test_cd_controlled_runtime_profile.py
@@ -100,6 +100,20 @@ def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile()
         assert source in text
 
 
+def test_backup_freshness_sources_stay_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "scripts/backup/backup-awoooi-frequent.sh)",
+        "scripts/backup/gitea-repo-bundle-backup.sh)",
+        "scripts/ops/backup-health-textfile-exporter.py)",
+        "scripts/ops/tests/test_backup_health_textfile_exporter.py)",
+        "../../scripts/backup/backup-awoooi-frequent.sh",
+        "../../scripts/ops/tests/test_backup_health_textfile_exporter.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_log_controlled_writeback_consumer_apply_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     expected_sources = [