Merge remote-tracking branch 'origin/main' into codex/p0-obs-001-20260714

apps/web/src/components/iwooos/security-asset-control-plane-cockpit.tsx

@@ -70,6 +70,7 @@ type Copy = {
   failedCollectors: string;
   failedCollectorsUnavailable: string;
   sameRunMissing: string;
+  loading: string;
   unavailable: string;
   refresh: string;
 };
@@ -120,6 +121,7 @@ const COPY: Record<"zh" | "en", Copy> = {
     failedCollectors: "失敗 Collector",
     failedCollectorsUnavailable: "失敗原因待安全分類",
     sameRunMissing: "尚無同 run 閉環證據",
+    loading: "正在載入資安控制平面",
     unavailable: "Live readback 無法取得",
     refresh: "重新整理資安控制平面",
   },
@@ -168,6 +170,7 @@ const COPY: Record<"zh" | "en", Copy> = {
     failedCollectors: "Failed collectors",
     failedCollectorsUnavailable: "Failure detail awaiting safe classification",
     sameRunMissing: "No same-run closure evidence",
+    loading: "Loading security control plane",
     unavailable: "Live readback unavailable",
     refresh: "Refresh security control plane",
   },
@@ -1016,7 +1019,38 @@ export function SecurityAssetControlPlaneCockpit({
           </div>
         </div>
       ) : (
-        <div className="h-64 animate-pulse bg-[#ebe8df]" />
+        <div
+          className="space-y-px bg-[#d8d3c7] p-px"
+          role="status"
+          aria-label={copy.loading}
+        >
+          <span className="sr-only">{copy.loading}</span>
+          <div className="grid grid-cols-3 gap-px lg:grid-cols-6">
+            {Array.from({ length: 6 }, (_, index) => (
+              <div
+                key={index}
+                className="h-16 animate-pulse bg-white px-3 py-3"
+                aria-hidden="true"
+              >
+                <div className="h-2 w-3/5 bg-[#e5e1d7]" />
+                <div className="mt-3 h-4 w-2/5 bg-[#d8d3c7]" />
+              </div>
+            ))}
+          </div>
+          <div className="grid gap-px sm:grid-cols-2">
+            {Array.from({ length: 2 }, (_, index) => (
+              <div
+                key={index}
+                className="h-24 animate-pulse bg-[#f8f7f3] p-3"
+                aria-hidden="true"
+              >
+                <div className="h-2 w-1/3 bg-[#d8d3c7]" />
+                <div className="mt-3 h-2 w-full bg-[#e5e1d7]" />
+                <div className="mt-2 h-2 w-4/5 bg-[#e5e1d7]" />
+              </div>
+            ))}
+          </div>
+        </div>
       )}
     </section>
   );

k8s/awoooi-prod/06-deployment-api.yaml

@@ -160,12 +160,12 @@ spec:
             - name: AWOOOI_BUILD_COMMIT_SHA
               # 2026-06-29 Codex: CD rewrites this to the deployed image tag so
               # production deploy readback does not rely on a stale static snapshot.
-              value: "378d867e9c58ec2dc77c3ec14ff49720e9b2897b"
+              value: "6960d39197facedc846ae04e1f2c5eb597f6d48f"
             - name: AWOOOI_DESIRED_API_IMAGE_TAG
               # 2026-06-30 Codex: CD rewrites this alongside AWOOOI_BUILD_COMMIT_SHA.
               # Production readback compares runtime image truth against this
               # GitOps desired tag instead of doing a slow Gitea raw fetch.
-              value: "378d867e9c58ec2dc77c3ec14ff49720e9b2897b"
+              value: "6960d39197facedc846ae04e1f2c5eb597f6d48f"
             - name: DATABASE_POOL_SIZE
               # 2026-07-01 Codex: production role `awoooi` currently has a low
               # connection limit. Keep API pool conservative until DB role

k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml

@@ -66,7 +66,7 @@ spec:
             - name: DATABASE_NULL_POOL
               value: "true"
             - name: AWOOOI_BUILD_COMMIT_SHA
-              value: "378d867e9c58ec2dc77c3ec14ff49720e9b2897b"
+              value: "6960d39197facedc846ae04e1f2c5eb597f6d48f"
             - name: ENABLE_AWOOOP_ANSIBLE_CANDIDATE_BACKFILL_WORKER
               value: "false"
             - name: ENABLE_AWOOOP_ANSIBLE_CHECK_MODE_WORKER

k8s/awoooi-prod/08-deployment-worker.yaml

@@ -173,7 +173,7 @@ spec:
             - name: DATABASE_BOOTSTRAP_DDL_ENABLED
               value: "false"
             - name: AWOOOI_BUILD_COMMIT_SHA
-              value: "378d867e9c58ec2dc77c3ec14ff49720e9b2897b"
+              value: "6960d39197facedc846ae04e1f2c5eb597f6d48f"
             - name: ENABLE_AWOOOP_ANSIBLE_CANDIDATE_BACKFILL_WORKER
               value: "true"
             - name: ENABLE_SECURITY_CONTROL_PLANE_MAINTENANCE_WORKER

k8s/awoooi-prod/kustomization.yaml

@@ -40,9 +40,9 @@ resources:
 # ⚠️ 重要: name 必須與 deployment YAML 中的 image 完全匹配 (含 tag)
     # newName + newTag 由 CI 透過 kustomize edit set image 注入
 images:
-- digest: sha256:6ff7e49f1848f8994278c309f8243c8406a2fa7301f4b3d6d91dea402e07e390
+- digest: sha256:539d0f7c43eed2dd5633f1154bea59be00f2a38f739414cc2a43fa940f31c633
   name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/api
-- digest: sha256:8aec619ded93d0057fddf7840b3ea404fe06e46189d1b69e39288e4db84e2898
+- digest: sha256:e9f5604ff83dec1d652d2759e4e00f78603d0c018d2ec261f1257ed7ac91c872
   name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/web