Merge remote-tracking branch 'gitea-ssh/main' into codex/github-redacted-evidence-validator-20260627

# Conflicts:
#	docs/LOGBOOK.md

apps/api/tests/test_awoooi_status_cleanup_dashboard.py

@@ -14,11 +14,21 @@ def test_load_latest_awoooi_status_cleanup_dashboard_reads_committed_snapshot():
     data = load_latest_awoooi_status_cleanup_dashboard()
 
     assert data["schema_version"] == "awoooi_status_cleanup_dashboard_v1"
-    assert data["summary"]["dashboard_status"] == "blocked_status_cleanup_apply_not_authorized"
+    assert data["summary"]["dashboard_status"] == "controlled_status_cleanup_package_ready"
     assert data["summary"]["gate_count"] == 5
-    assert data["summary"]["blocked_gate_count"] == 5
-    assert data["summary"]["accepted_owner_flag_count"] == 0
-    assert data["summary"]["required_owner_flag_count"] == 6
+    assert data["summary"]["blocked_gate_count"] == 0
+    assert data["summary"]["accepted_owner_flag_count"] == data["summary"]["required_owner_flag_count"]
+    assert data["summary"]["required_owner_flag_count"] >= 1
+    assert data["summary"]["approved_update_section_count"] == data["summary"]["required_update_section_count"]
+    assert data["summary"]["required_update_section_count"] >= 1
+    assert data["summary"]["approved_target_path_count"] == data["summary"]["target_path_count"]
+    assert data["summary"]["target_path_count"] >= 1
+    assert data["summary"]["boundary_ack_count"] == data["summary"]["required_boundary_ack_count"]
+    assert data["summary"]["required_boundary_ack_count"] >= 1
+    assert data["summary"]["controlled_status_cleanup_package_ready"] is True
+    assert data["summary"]["controlled_owner_acknowledgements_ready"] is True
+    assert data["summary"]["controlled_dry_run_package_ready"] is True
+    assert data["summary"]["controlled_post_apply_verifier_required"] is True
     assert data["summary"]["apply_allowed"] is False
     assert data["summary"]["memory_write_authorized"] is False
     assert data["summary"]["wazuh_api_live_query_authorized"] is False
@@ -64,6 +74,7 @@ def test_load_latest_awoooi_status_cleanup_dashboard_reads_committed_snapshot():
         "execution_plan",
         "apply_gate",
     }
+    assert {item["blocked"] for item in data["gate_cards"]} == {False}
 
 
 def test_awoooi_status_cleanup_dashboard_rejects_memory_write_authorization(tmp_path):
@@ -93,6 +104,24 @@ def test_awoooi_status_cleanup_dashboard_rejects_live_metadata_gate(tmp_path):
         load_latest_awoooi_status_cleanup_dashboard(tmp_path)
 
 
+def test_awoooi_status_cleanup_dashboard_rejects_controlled_ack_count_drift(tmp_path):
+    snapshot = _snapshot()
+    snapshot["summary"]["accepted_owner_flag_count"] = 5
+    _write_snapshot(tmp_path, snapshot)
+
+    with pytest.raises(ValueError, match="controlled acknowledgements incomplete"):
+        load_latest_awoooi_status_cleanup_dashboard(tmp_path)
+
+
+def test_awoooi_status_cleanup_dashboard_rejects_controlled_flag_drift(tmp_path):
+    snapshot = _snapshot()
+    snapshot["summary"]["controlled_status_cleanup_package_ready"] = False
+    _write_snapshot(tmp_path, snapshot)
+
+    with pytest.raises(ValueError, match="controlled_status_cleanup_package_ready"):
+        load_latest_awoooi_status_cleanup_dashboard(tmp_path)
+
+
 def test_awoooi_status_cleanup_dashboard_rejects_missing_risk_control(tmp_path):
     snapshot = _snapshot()
     snapshot["risk_controls"] = [

apps/api/tests/test_awoooi_status_cleanup_dashboard_api.py

@@ -16,8 +16,10 @@ def test_awoooi_status_cleanup_dashboard_endpoint_returns_snapshot():
     assert response.status_code == 200
     data = response.json()
     assert data["schema_version"] == "awoooi_status_cleanup_dashboard_v1"
-    assert data["summary"]["dashboard_status"] == "blocked_status_cleanup_apply_not_authorized"
+    assert data["summary"]["dashboard_status"] == "controlled_status_cleanup_package_ready"
     assert data["summary"]["gate_count"] == 5
+    assert data["summary"]["blocked_gate_count"] == 0
+    assert data["summary"]["controlled_status_cleanup_package_ready"] is True
     assert data["summary"]["apply_allowed"] is False
     assert data["summary"]["memory_write_authorized"] is False
     assert data["summary"]["wazuh_api_live_query_authorized"] is False

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -38,6 +38,10 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     sources = {source["id"]: source for source in data["source_statuses"]}
     assert sorted(lanes) == ["backup", "gitea", "github", "release", "runtime"]
     assert lanes["release"]["metric"]["kind"] == "blocked_gate"
+    assert lanes["release"]["status"] == "controlled_status_cleanup_package_ready"
+    assert lanes["release"]["blocker_count"] == 0
+    assert lanes["release"]["metric"]["blocked"] == 0
+    assert lanes["release"]["metric"]["total"] == 5
     assert lanes["github"]["metric"]["kind"] == "private_backup_verified"
     assert lanes["gitea"]["metric"]["kind"] == "workflow_count"
     assert lanes["runtime"]["metric"]["kind"] == "surface_count"