feat(governance): 新增 TG canary delivery rehearsal

apps/api/tests/test_ai_agent_professional_task_expansion.py

@@ -18,9 +18,9 @@ def test_load_latest_ai_agent_professional_task_expansion_snapshot() -> None:
     snapshot = load_latest_ai_agent_professional_task_expansion()
 
     assert snapshot["schema_version"] == "ai_agent_professional_task_expansion_v1"
-    assert snapshot["program_status"]["current_task_id"] == "P2-405D"
-    assert snapshot["program_status"]["next_task_id"] == "P2-405E"
-    assert snapshot["program_status"]["overall_completion_percent"] == 96
+    assert snapshot["program_status"]["current_task_id"] == "P2-405E"
+    assert snapshot["program_status"]["next_task_id"] == "P2-405F"
+    assert snapshot["program_status"]["overall_completion_percent"] == 98
     assert snapshot["program_status"]["runtime_authority"] == (
         "professional_task_expansion_and_telegram_bridge_read_only_no_send"
     )
@@ -106,6 +106,17 @@ def test_load_latest_ai_agent_professional_task_expansion_snapshot() -> None:
     assert rollups["canary_delivery_receipt_write_enabled_count"] == 0
     assert rollups["canary_delivery_secret_read_enabled_count"] == 0
     assert rollups["canary_delivery_paid_api_enabled_count"] == 0
+    assert rollups["canary_delivery_rehearsal_count"] == 1
+    assert rollups["canary_delivery_rehearsal_step_count"] == 6
+    assert rollups["canary_delivery_rehearsal_readback_check_count"] == 8
+    assert rollups["canary_delivery_rehearsal_stop_condition_count"] == 7
+    assert rollups["canary_delivery_rehearsal_rollback_mute_control_count"] == 5
+    assert rollups["canary_delivery_rehearsal_completed_check_count"] == 8
+    assert rollups["canary_delivery_rehearsal_failed_check_count"] == 0
+    assert rollups["canary_delivery_rehearsal_live_send_enabled_count"] == 0
+    assert rollups["canary_delivery_rehearsal_gateway_queue_write_enabled_count"] == 0
+    assert rollups["canary_delivery_rehearsal_bot_api_call_enabled_count"] == 0
+    assert rollups["canary_delivery_rehearsal_receipt_write_enabled_count"] == 0
 
 
 def test_professional_tasks_cover_required_agents_and_reporting() -> None:
@@ -245,6 +256,38 @@ def test_canary_delivery_gate_waits_for_explicit_delivery_fields() -> None:
     assert all(value is False for value in gate["execution_flags"].values())
 
 
+def test_canary_delivery_rehearsal_is_ready_without_live_send() -> None:
+    snapshot = load_latest_ai_agent_professional_task_expansion()
+    rehearsal = snapshot["telegram_runtime_bridge"]["canary_delivery_rehearsal"]
+
+    assert rehearsal["status"] == "ready_no_send_rehearsal"
+    assert rehearsal["rehearsal_ready"] is True
+    assert rehearsal["selected_message_type"] == "daily_agent_workload_digest"
+    assert rehearsal["selected_preview_id"] == "p2_405b_preview_daily_agent_workload_digest_v1"
+    assert rehearsal["target_room_env"] == "SRE_GROUP_CHAT_ID"
+    assert rehearsal["target_room_value_visible"] is False
+    assert rehearsal["sanitized_preview_hash"].startswith("sha256:")
+    assert rehearsal["dedup_key"] == "awoooi:agent-report:daily:2026-06-18:v1"
+    assert len(rehearsal["dry_run_steps"]) == 6
+    assert len(rehearsal["stop_conditions"]) == 7
+    assert len(rehearsal["rollback_mute_controls"]) == 5
+
+    envelope = rehearsal["gateway_envelope_preview"]
+    assert envelope["queue_write_enabled"] is False
+    assert envelope["bot_api_call_enabled"] is False
+    assert envelope["telegram_send_enabled"] is False
+    assert envelope["delivery_receipt_write_enabled"] is False
+
+    readback = rehearsal["readback_drill"]
+    assert readback["owner_agent"] == "hermes"
+    assert len(readback["required_checks"]) == 8
+    assert readback["completed_check_count"] == 8
+    assert readback["failed_check_count"] == 0
+    assert readback["production_receipt_write_enabled"] is False
+    assert readback["live_receipt_readback_enabled"] is False
+    assert all(value is False for value in rehearsal["execution_flags"].values())
+
+
 def test_rejects_telegram_send_enabled(tmp_path: Path) -> None:
     snapshot = copy.deepcopy(load_latest_ai_agent_professional_task_expansion())
     snapshot["telegram_runtime_bridge"]["telegram_send_enabled"] = True
@@ -359,6 +402,28 @@ def test_rejects_canary_delivery_gateway_queue_write_enabled(tmp_path: Path) ->
         load_latest_ai_agent_professional_task_expansion(tmp_path)
 
 
+def test_rejects_canary_delivery_rehearsal_send_enabled(tmp_path: Path) -> None:
+    snapshot = copy.deepcopy(load_latest_ai_agent_professional_task_expansion())
+    rehearsal = snapshot["telegram_runtime_bridge"]["canary_delivery_rehearsal"]
+    rehearsal["execution_flags"]["telegram_send_enabled"] = True
+    snapshot["rollups"]["canary_delivery_rehearsal_live_send_enabled_count"] = 1
+    _write_snapshot(tmp_path, snapshot)
+
+    with pytest.raises(ValueError, match="canary rehearsal execution flags mismatch"):
+        load_latest_ai_agent_professional_task_expansion(tmp_path)
+
+
+def test_rejects_canary_delivery_rehearsal_receipt_write_enabled(tmp_path: Path) -> None:
+    snapshot = copy.deepcopy(load_latest_ai_agent_professional_task_expansion())
+    rehearsal = snapshot["telegram_runtime_bridge"]["canary_delivery_rehearsal"]
+    rehearsal["readback_drill"]["production_receipt_write_enabled"] = True
+    snapshot["rollups"]["canary_delivery_rehearsal_receipt_write_enabled_count"] = 1
+    _write_snapshot(tmp_path, snapshot)
+
+    with pytest.raises(ValueError, match="production receipt write must remain false"):
+        load_latest_ai_agent_professional_task_expansion(tmp_path)
+
+
 def test_rejects_high_risk_without_approval(tmp_path: Path) -> None:
     snapshot = copy.deepcopy(load_latest_ai_agent_professional_task_expansion())
     high_task = next(task for task in snapshot["professional_tasks"] if task["risk_tier"] == "high")

apps/api/tests/test_ai_agent_professional_task_expansion_api.py

@@ -17,9 +17,9 @@ def test_ai_agent_professional_task_expansion_endpoint() -> None:
     assert response.status_code == 200
     payload = response.json()
     assert payload["schema_version"] == "ai_agent_professional_task_expansion_v1"
-    assert payload["program_status"]["current_task_id"] == "P2-405D"
-    assert payload["program_status"]["next_task_id"] == "P2-405E"
-    assert payload["program_status"]["overall_completion_percent"] == 96
+    assert payload["program_status"]["current_task_id"] == "P2-405E"
+    assert payload["program_status"]["next_task_id"] == "P2-405F"
+    assert payload["program_status"]["overall_completion_percent"] == 98
     assert payload["program_status"]["runtime_authority"] == (
         "professional_task_expansion_and_telegram_bridge_read_only_no_send"
     )
@@ -54,6 +54,13 @@ def test_ai_agent_professional_task_expansion_endpoint() -> None:
     assert payload["rollups"]["canary_delivery_attempt_allowed_count"] == 0
     assert payload["rollups"]["canary_delivery_gateway_queue_write_enabled_count"] == 0
     assert payload["rollups"]["canary_delivery_bot_api_call_enabled_count"] == 0
+    assert payload["rollups"]["canary_delivery_rehearsal_count"] == 1
+    assert payload["rollups"]["canary_delivery_rehearsal_step_count"] == 6
+    assert payload["rollups"]["canary_delivery_rehearsal_readback_check_count"] == 8
+    assert payload["rollups"]["canary_delivery_rehearsal_failed_check_count"] == 0
+    assert payload["rollups"]["canary_delivery_rehearsal_gateway_queue_write_enabled_count"] == 0
+    assert payload["rollups"]["canary_delivery_rehearsal_bot_api_call_enabled_count"] == 0
+    assert payload["rollups"]["canary_delivery_rehearsal_receipt_write_enabled_count"] == 0
     assert payload["telegram_runtime_bridge"]["canary_approval_package"]["live_send_enabled"] is False
     assert payload["telegram_runtime_bridge"]["canary_send_approval_packet"]["approval_granted"] is False
     assert (
@@ -63,5 +70,16 @@ def test_ai_agent_professional_task_expansion_endpoint() -> None:
     assert payload["telegram_runtime_bridge"]["canary_delivery_gate"]["delivery_approved"] is False
     assert payload["telegram_runtime_bridge"]["canary_delivery_gate"]["delivery_attempt_allowed"] is False
     assert payload["telegram_runtime_bridge"]["canary_delivery_gate"]["target_room_value_visible"] is False
+    assert payload["telegram_runtime_bridge"]["canary_delivery_rehearsal"]["rehearsal_ready"] is True
+    assert (
+        payload["telegram_runtime_bridge"]["canary_delivery_rehearsal"]["selected_message_type"]
+        == "daily_agent_workload_digest"
+    )
+    assert (
+        payload["telegram_runtime_bridge"]["canary_delivery_rehearsal"]["gateway_envelope_preview"][
+            "telegram_send_enabled"
+        ]
+        is False
+    )
     assert len(payload["telegram_runtime_bridge"]["no_send_message_previews"]) == 6
     assert len(payload["telegram_runtime_bridge"]["receipt_expectations"]) == 6