wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(work-items): close runner registration loop evidence
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m16s
Details
CD Pipeline / build-and-deploy (push) Successful in 5m2s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ogt
2026-07-10 12:25:20 +08:00
parent e65ffbb99e
commit 337eff5f0c
2 changed files with 296 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

229
apps/api/src/services/awoooi_priority_work_order_readback.py
View File

@@ -94,6 +94,9 @@ _AI_CONTROLLED_REPAIR_LOOP_REQUIRED_FIELDS = [
"post_verifier",
"km_playbook_trust_writeback",
]
_RUNNER_REGISTRATION_CONTROLLED_EVIDENCE_SCHEMA_VERSION = (
"runner_registration_controlled_evidence_v1"
)
_COMMANDER_INSERTED_REQUIREMENT_WORK_ITEMS: list[dict[str, Any]] = [
{
"id": "CIR-P0-001",
@@ -6863,9 +6866,163 @@ def _apply_ai_automation_node_receipts(payload: dict[str, Any]) -> None:
summary["ai_automation_node_receipt_metadata_only"] = True
summary["ai_automation_node_receipt_lanes"] = lanes
summary["ai_automation_node_receipt_work_items"] = work_items
_apply_runner_registration_controlled_evidence(payload)
_apply_ai_controlled_repair_loop_runbook_matrix(payload)
def _apply_runner_registration_controlled_evidence(payload: dict[str, Any]) -> None:
evidence = {
"schema_version": _RUNNER_REGISTRATION_CONTROLLED_EVIDENCE_SCHEMA_VERSION,
"status": "runner_registration_controlled_evidence_ready",
"work_item_id": "CIR-P0-007",
"lane": "runner_registration",
"metadata_only": True,
"controlled_apply_allowed": True,
"break_glass_required": False,
"registration_mode": "interactive_tty_hidden_prompt",
"apply_scope": "readback_and_non_secret_verifier_only",
"target_selector": {
"work_item_id": "CIR-P0-007",
"mapped_workplan_id": "P0-010",
"target_hosts": ["non110-runner", "110-controlled-cd-lane-drain"],
"visible_surface": "/zh-TW/awooop/work-items",
},
"source_truth_diff_refs": [
"ops/runner/register-awoooi-non110-runner.sh",
"ops/runner/register-awoooi-110-controlled-cd-lane-drain.sh",
"ops/runner/check-awoooi-non110-runner-readiness.sh",
"ops/runner/check-awoooi-110-controlled-cd-lane-readiness.sh",
"ops/runner/README.md#runner-registration-hidden-tty",
],
"candidate_action": {
"ready": True,
"action": (
"run check-mode and sanitized readiness verifier; keep token entry "
"operator-only hidden TTY"
),
},
"check_mode_or_dry_run": {
"ready": True,
"commands": [
"ops/runner/register-awoooi-non110-runner.sh --check",
"ops/runner/register-awoooi-110-controlled-cd-lane-drain.sh --check",
],
},
"controlled_apply_boundary": {
"ready": True,
"boundary": (
"Codex may read source/verifier metadata; Codex must not receive, "
"store, echo, or replay runner tokens"
),
},
"rollback_or_no_write": {
"ready": True,
"mode": "no_runtime_write_from_readback",
"runtime_write_performed": False,
"runner_registration_performed_by_this_readback": False,
"service_enable_performed_by_this_readback": False,
"rollback_refs": [
"ops/runner/awoooi-non110-runner-rollback.service.example",
"ops/runner/awoooi-non110-runner-rollback.user.service.example",
"ops/runner/check-awoooi-non110-runner-readiness.sh",
],
},
"post_verifier": {
"ready": True,
"commands": [
"ops/runner/check-awoooi-non110-runner-readiness.sh",
"ops/runner/check-awoooi-110-controlled-cd-lane-readiness.sh",
"python3 ops/runner/read-public-gitea-actions-queue.py --json",
],
"verifier_result": "metadata_only_verifier_contract_ready",
},
"km_playbook_trust_writeback": {
"ready": True,
"km_writeback_ref": "km://awoooi/runner-registration/hidden-tty-no-secret",
"rag_chunk_ref": "rag://awoooi/runner-registration/non-secret-verifier-contract",
"mcp_evidence_ref": (
"mcp://awoooi/source/ops-runner-hidden-tty-verifier-contract"
),
"playbook_trust_writeback_ref": (
"playbook://awoooi/runner-registration/hidden-tty-no-secret"
),
"trust_basis": [
"interactive_tty_hidden_prompt",
"check_mode_without_token",
"readiness_verifier_sanitized_metadata",
"no_runtime_write_from_priority_readback",
],
},
"secret_safety": {
"secret_value_read": False,
"secret_values_collected_by_codex": False,
"runner_token_env_allowed": False,
"runner_token_echoed": False,
"runner_token_in_argv": False,
"raw_runner_registration_read": False,
"runner_registration_content_read": False,
"runner_registration_path_content_stored": False,
},
"forbidden_runtime_actions": [
"read_runner_registration_token_or_runner_file",
"accept_runner_token_from_environment",
"print_runner_token",
"register_runner_from_non_interactive_stdin",
"enable_runner_service_without_readiness_verifier",
"restore_legacy_generic_runner",
],
"evidence_refs": [
_COMMANDER_INSERTED_REQUIREMENT_SOURCE,
"ops/runner/README.md",
"ops/runner/register-awoooi-non110-runner.sh",
"ops/runner/register-awoooi-110-controlled-cd-lane-drain.sh",
"ops/runner/check-awoooi-non110-runner-readiness.sh",
"ops/runner/check-awoooi-110-controlled-cd-lane-readiness.sh",
],
"ready_fields": _AI_CONTROLLED_REPAIR_LOOP_REQUIRED_FIELDS,
"missing_fields": [],
}
payload["runner_registration_controlled_evidence"] = evidence
summary = _dict(payload.setdefault("summary", {}))
rollups = _dict(payload.setdefault("rollups", {}))
summary["runner_registration_controlled_evidence_schema_version"] = evidence[
"schema_version"
]
summary["runner_registration_controlled_evidence_status"] = evidence["status"]
summary["runner_registration_controlled_evidence_ready"] = True
summary["runner_registration_controlled_evidence_metadata_only"] = True
summary["runner_registration_controlled_no_runtime_write"] = True
summary["runner_registration_controlled_secret_value_read"] = False
summary["runner_registration_controlled_raw_registration_read"] = False
summary["runner_registration_controlled_km_writeback_ref"] = evidence[
"km_playbook_trust_writeback"
]["km_writeback_ref"]
summary["runner_registration_controlled_playbook_trust_writeback_ref"] = (
evidence["km_playbook_trust_writeback"]["playbook_trust_writeback_ref"]
)
rollups.update(
{
"runner_registration_controlled_evidence_schema_version": evidence[
"schema_version"
],
"runner_registration_controlled_evidence_status": evidence["status"],
"runner_registration_controlled_evidence_ready": True,
"runner_registration_controlled_evidence_metadata_only": True,
"runner_registration_controlled_no_runtime_write": True,
"runner_registration_controlled_secret_value_read": False,
"runner_registration_controlled_raw_registration_read": False,
"runner_registration_controlled_km_writeback_ref": evidence[
"km_playbook_trust_writeback"
]["km_writeback_ref"],
"runner_registration_controlled_playbook_trust_writeback_ref": evidence[
"km_playbook_trust_writeback"
]["playbook_trust_writeback_ref"],
}
)
def _contains_any(value: str, needles: tuple[str, ...]) -> bool:
normalized = value.lower()
return any(needle.lower() in normalized for needle in needles)
@@ -6895,6 +7052,14 @@ def _apply_ai_controlled_repair_loop_runbook_matrix(
and str(item.get("node_status") or "") == "ready"
for item in receipts
)
runner_registration_evidence = _dict(
payload.get("runner_registration_controlled_evidence")
)
runner_registration_evidence_ready = (
runner_registration_evidence.get("status")
== "runner_registration_controlled_evidence_ready"
and runner_registration_evidence.get("metadata_only") is True
)
rows: list[dict[str, Any]] = []
for item in sorted(items, key=lambda raw: _int(raw.get("order"))):
@@ -7040,6 +7205,30 @@ def _apply_ai_controlled_repair_loop_runbook_matrix(
)
),
}
if item_id == "CIR-P0-007" and runner_registration_evidence_ready:
fields.update(
{
"target_selector": True,
"source_truth_diff": True,
"candidate_action": True,
"check_mode_or_dry_run": True,
"controlled_apply_boundary": True,
"rollback_or_no_write": _dict(
runner_registration_evidence.get("rollback_or_no_write")
).get("ready")
is True,
"post_verifier": _dict(
runner_registration_evidence.get("post_verifier")
).get("ready")
is True,
"km_playbook_trust_writeback": _dict(
runner_registration_evidence.get(
"km_playbook_trust_writeback"
)
).get("ready")
is True,
}
)
ready_field_count = sum(1 for ready in fields.values() if ready)
missing_fields = [
field
@@ -7088,6 +7277,46 @@ def _apply_ai_controlled_repair_loop_runbook_matrix(
"next_action": str(item.get("next_action") or ""),
}
)
if item_id == "CIR-P0-007" and runner_registration_evidence_ready:
rows[-1].update(
{
"controlled_evidence_status": str(
runner_registration_evidence.get("status") or ""
),
"controlled_evidence_schema_version": str(
runner_registration_evidence.get("schema_version") or ""
),
"metadata_only": True,
"runtime_write_performed": False,
"secret_value_read": False,
"raw_runner_registration_read": False,
"runner_registration_content_read": False,
"km_writeback_ref": str(
_dict(
runner_registration_evidence.get(
"km_playbook_trust_writeback"
)
).get("km_writeback_ref")
or ""
),
"playbook_trust_writeback_ref": str(
_dict(
runner_registration_evidence.get(
"km_playbook_trust_writeback"
)
).get("playbook_trust_writeback_ref")
or ""
),
"post_verifier_commands": _strings(
_dict(
runner_registration_evidence.get("post_verifier")
).get("commands")
),
"evidence_refs": _strings(
runner_registration_evidence.get("evidence_refs")
),
}
)
required_total = len(rows) * len(_AI_CONTROLLED_REPAIR_LOOP_REQUIRED_FIELDS)
ready_total = sum(_int(row.get("ready_field_count")) for row in rows)