feat(ai): verify canonical learning writeback

apps/api/src/services/ai_agent_autonomous_runtime_control.py

@@ -3476,13 +3476,29 @@ def _runtime_stage_receipt_has_required_proof(receipt: Mapping[str, Any]) -> boo
     """Reject learning receipts that do not prove the durable write."""
 
     stage_id = str(receipt.get("stage_id") or "")
-    if stage_id not in {"rag_writeback", "playbook_trust"}:
+    if stage_id not in {
+        "km_playbook_writeback",
+        "rag_writeback",
+        "playbook_trust",
+    }:
         return True
     detail = receipt.get("detail")
     if not isinstance(detail, Mapping):
         return False
     if detail.get("durable_write_acknowledged") is not True:
         return False
+    if stage_id == "km_playbook_writeback":
+        return bool(
+            detail.get("schema_version") == "ansible_km_writeback_v1"
+            and str(detail.get("knowledge_entry_id") or "")
+            and str(detail.get("canonical_playbook_id") or "")
+            and str(detail.get("km_row_version") or "")
+            and detail.get("repository_write_acknowledged") is True
+            and detail.get("repository_readback_verified") is True
+            and detail.get("raw_log_payload_stored") is False
+            and detail.get("secret_value_stored") is False
+            and str(detail.get("writer_source_sha") or "")
+        )
     if stage_id == "rag_writeback":
         primary_embedding = bool(
             detail.get("embedding_persisted") is True
@@ -3495,11 +3511,25 @@ def _runtime_stage_receipt_has_required_proof(receipt: Mapping[str, Any]) -> boo
         )
         return primary_embedding or chunk_fallback
     return bool(
-        str(detail.get("canonical_playbook_id") or "")
+        detail.get("schema_version")
+        == "ansible_playbook_trust_writeback_v2"
+        and detail.get("identity_schema_version")
+        == "ansible_playbook_identity_v1"
+        and str(detail.get("identity_fingerprint") or "")
+        and str(detail.get("canonical_playbook_id") or "")
+        and _int_value(detail.get("playbook_row_version")) > 0
+        and str(detail.get("playbook_row_updated_at") or "")
+        and str(detail.get("playbook_row_fingerprint") or "")
         and detail.get("trust_score") is not None
-        and _int_value(detail.get("success_count"))
-        + _int_value(detail.get("failure_count"))
-        > 0
+        and _int_value(detail.get("trust_observation_count")) > 0
+        and detail.get("learning_recorded") is True
+        and detail.get("trust_updated") is True
+        and detail.get("repository_write_acknowledged") is True
+        and detail.get("repository_readback_verified") is True
+        and detail.get("operation_receipt_readback_verified") is True
+        and detail.get("raw_log_payload_stored") is False
+        and detail.get("secret_value_stored") is False
+        and str(detail.get("writer_source_sha") or "")
     )
 
 
@@ -4635,6 +4665,150 @@ def _build_independent_post_verifier_runtime_readback(
     }
 
 
+def _build_canonical_learning_runtime_readback(
+    *,
+    operation_latest_rows: Iterable[Mapping[str, Any] | Any],
+    loop_ledger: Mapping[str, Any],
+) -> dict[str, Any]:
+    rows = [_row_mapping(row) for row in operation_latest_rows]
+    automation_run_id = str(loop_ledger.get("automation_run_id") or "")
+    apply_op_id = str(loop_ledger.get("apply_op_id") or "")
+    catalog_id = str(loop_ledger.get("catalog_id") or "")
+    playbook_path = str(loop_ledger.get("playbook_path") or "")
+    learning_operation = next(
+        (
+            row
+            for row in rows
+            if str(row.get("operation_type") or "")
+            == "ansible_learning_writeback_recorded"
+            and str(row.get("parent_op_id") or "") == apply_op_id
+            and str(row.get("automation_run_id") or "")
+            == automation_run_id
+        ),
+        {},
+    )
+    stage_receipts = {
+        str(receipt.get("stage_id") or ""): receipt
+        for receipt in loop_ledger.get("same_run_stage_receipts") or []
+        if isinstance(receipt, Mapping)
+    }
+    km_receipt = stage_receipts.get("km_playbook_writeback") or {}
+    trust_receipt = stage_receipts.get("playbook_trust") or {}
+    km_detail = km_receipt.get("detail")
+    if not isinstance(km_detail, Mapping):
+        km_detail = {}
+    trust_detail = trust_receipt.get("detail")
+    if not isinstance(trust_detail, Mapping):
+        trust_detail = {}
+    canonical_playbook_id = str(
+        trust_detail.get("canonical_playbook_id") or ""
+    )
+    km_playbook_id = str(km_detail.get("canonical_playbook_id") or "")
+    writer_source_sha = str(
+        trust_detail.get("writer_source_sha") or ""
+    ).lower()
+    km_writer_source_sha = str(
+        km_detail.get("writer_source_sha") or ""
+    ).lower()
+    controls = {
+        "same_run_learning_operation": bool(learning_operation),
+        "learning_operation_success": (
+            learning_operation.get("status") == "success"
+        ),
+        "learning_parent_apply_matches": bool(
+            apply_op_id
+            and str(learning_operation.get("parent_op_id") or "")
+            == apply_op_id
+        ),
+        "km_writeback_receipt_v1": (
+            km_detail.get("schema_version") == "ansible_km_writeback_v1"
+        ),
+        "km_repository_readback_verified": bool(
+            km_detail.get("repository_write_acknowledged") is True
+            and km_detail.get("repository_readback_verified") is True
+            and km_detail.get("durable_write_acknowledged") is True
+        ),
+        "km_row_version_present": bool(
+            str(km_detail.get("knowledge_entry_id") or "")
+            and str(km_detail.get("km_row_version") or "")
+        ),
+        "playbook_trust_receipt_v2": (
+            trust_detail.get("schema_version")
+            == "ansible_playbook_trust_writeback_v2"
+        ),
+        "canonical_playbook_identity_resolved": bool(
+            trust_detail.get("identity_schema_version")
+            == "ansible_playbook_identity_v1"
+            and str(trust_detail.get("identity_fingerprint") or "")
+            and canonical_playbook_id
+            and trust_detail.get("catalog_id") == catalog_id
+            and trust_detail.get("playbook_path") == playbook_path
+        ),
+        "km_playbook_identity_matches": bool(
+            canonical_playbook_id
+            and canonical_playbook_id == km_playbook_id
+            and km_detail.get("catalog_id") == catalog_id
+        ),
+        "playbook_repository_readback_verified": bool(
+            trust_detail.get("repository_write_acknowledged") is True
+            and trust_detail.get("repository_readback_verified") is True
+            and trust_detail.get("operation_receipt_readback_verified") is True
+            and trust_detail.get("durable_write_acknowledged") is True
+        ),
+        "playbook_row_version_present": bool(
+            _int_value(trust_detail.get("playbook_row_version")) > 0
+            and str(trust_detail.get("playbook_row_updated_at") or "")
+            and str(trust_detail.get("playbook_row_fingerprint") or "")
+        ),
+        "learning_and_trust_acknowledged": bool(
+            trust_detail.get("learning_recorded") is True
+            and trust_detail.get("trust_updated") is True
+            and _int_value(trust_detail.get("trust_observation_count")) > 0
+        ),
+        "learning_receipts_public_safe": bool(
+            km_detail.get("raw_log_payload_stored") is False
+            and km_detail.get("secret_value_stored") is False
+            and trust_detail.get("raw_log_payload_stored") is False
+            and trust_detail.get("secret_value_stored") is False
+        ),
+        "writer_source_sha_same_run": bool(
+            writer_source_sha
+            and writer_source_sha == km_writer_source_sha
+        ),
+    }
+    blockers = [
+        f"{control_id}_not_verified"
+        for control_id, verified in controls.items()
+        if verified is not True
+    ]
+    return {
+        "schema_version": "awoooi_canonical_learning_runtime_v1",
+        "status": "runtime_evidence_ready" if not blockers else "in_progress",
+        "automation_run_id": automation_run_id or None,
+        "apply_op_id": apply_op_id or None,
+        "learning_operation_id": str(
+            learning_operation.get("op_id") or ""
+        )
+        or None,
+        "knowledge_entry_id": str(
+            km_detail.get("knowledge_entry_id") or ""
+        )
+        or None,
+        "canonical_playbook_id": canonical_playbook_id or None,
+        "catalog_id": catalog_id or None,
+        "km_row_version": km_detail.get("km_row_version"),
+        "playbook_row_version": trust_detail.get("playbook_row_version"),
+        "playbook_row_fingerprint": trust_detail.get(
+            "playbook_row_fingerprint"
+        ),
+        "writer_source_sha": writer_source_sha or None,
+        "runtime_evidence_ready": not blockers,
+        "controls": controls,
+        "active_blockers": blockers,
+        "writes_on_read": False,
+    }
+
+
 def build_runtime_receipt_readback_from_rows(
     *,
     project_id: str = _DEFAULT_PROJECT_ID,
@@ -4783,6 +4957,10 @@ def build_runtime_receipt_readback_from_rows(
             loop_ledger=loop_ledger,
         )
     )
+    canonical_learning_runtime = _build_canonical_learning_runtime_readback(
+        operation_latest_rows=operation_latest,
+        loop_ledger=loop_ledger,
+    )
     trace_ledger = _build_trace_ledger(
         operation_summary=operation_summary,
         auto_repair_summary=auto_repair_summary,
@@ -4919,6 +5097,7 @@ def build_runtime_receipt_readback_from_rows(
         },
         "autonomous_single_writer_runtime": single_writer_runtime,
         "independent_post_verifier_runtime": independent_post_verifier_runtime,
+        "canonical_learning_runtime": canonical_learning_runtime,
         "auto_repair_execution_receipt": {
             **auto_repair_summary,
             "latest": _sanitize_latest_rows(
@@ -6475,6 +6654,11 @@ async def build_ai_agent_autonomous_runtime_control_with_live_readback(
         readback=readback,
         boundary_readback=boundary_readback,
     )
+    _attach_canonical_learning_readback(
+        payload,
+        readback=readback,
+        boundary_readback=boundary_readback,
+    )
     payload.setdefault("rollups", {})[
         "executor_trust_boundary_verified_count"
     ] = 1 if boundary_readback.get("production_boundary_verified") is True else 0
@@ -6505,7 +6689,6 @@ def _attach_autonomous_single_writer_readback(
     source_controls = source_boundary.get("controls")
     if not isinstance(source_controls, Mapping):
         source_controls = {}
-
     runtime_run_id = str(runtime.get("automation_run_id") or "")
     strict_run_id = str(strict_runtime.get("automation_run_id") or "")
     deployed_source_sha = str(
@@ -6658,6 +6841,105 @@ def _attach_independent_post_verifier_readback(
     ] = 1 if closed else 0
 
 
+def _attach_canonical_learning_readback(
+    payload: dict[str, Any],
+    *,
+    readback: Mapping[str, Any],
+    boundary_readback: Mapping[str, Any],
+) -> None:
+    runtime = readback.get("canonical_learning_runtime")
+    if not isinstance(runtime, Mapping):
+        runtime = {}
+    source_boundary = boundary_readback.get(
+        "canonical_learning_source_boundary"
+    )
+    if not isinstance(source_boundary, Mapping):
+        source_boundary = {}
+    strict_runtime = payload.get("strict_runtime_completion")
+    if not isinstance(strict_runtime, Mapping):
+        strict_runtime = {}
+    runtime_controls = runtime.get("controls")
+    if not isinstance(runtime_controls, Mapping):
+        runtime_controls = {}
+    source_controls = source_boundary.get("controls")
+    if not isinstance(source_controls, Mapping):
+        source_controls = {}
+    normalized_source_controls = {
+        (
+            f"source_{control_id}"
+            if str(control_id) in runtime_controls
+            else str(control_id)
+        ): verified is True
+        for control_id, verified in source_controls.items()
+    }
+
+    runtime_run_id = str(runtime.get("automation_run_id") or "")
+    strict_run_id = str(strict_runtime.get("automation_run_id") or "")
+    deployed_source_sha = str(
+        boundary_readback.get("deployed_source_sha") or ""
+    ).lower()
+    writer_source_sha = str(
+        runtime.get("writer_source_sha") or ""
+    ).lower()
+    controls = {
+        "strict_runtime_same_run_closed": bool(
+            strict_runtime.get("closed") is True
+            and runtime_run_id
+            and runtime_run_id == strict_run_id
+        ),
+        "writer_source_sha_matches_deployment": bool(
+            deployed_source_sha
+            and writer_source_sha == deployed_source_sha
+        ),
+        **{
+            str(control_id): verified is True
+            for control_id, verified in runtime_controls.items()
+        },
+        **normalized_source_controls,
+    }
+    blockers = [
+        *list(runtime.get("active_blockers") or []),
+        *list(source_boundary.get("active_blockers") or []),
+        *[
+            f"{control_id}_not_verified"
+            for control_id, verified in controls.items()
+            if verified is not True
+        ],
+    ]
+    blockers = list(dict.fromkeys(str(blocker) for blocker in blockers if blocker))
+    closed = bool(controls and not blockers)
+    payload["autonomous_canonical_learning_writeback"] = {
+        "schema_version": (
+            "awoooi_autonomous_canonical_learning_writeback_v1"
+        ),
+        "work_item_id": "AIA-P0-004",
+        "status": "verified_ready" if closed else "in_progress",
+        "closed": closed,
+        "automation_run_id": runtime_run_id or None,
+        "deployed_source_sha": deployed_source_sha or None,
+        "writer_source_sha": writer_source_sha or None,
+        "apply_op_id": runtime.get("apply_op_id"),
+        "learning_operation_id": runtime.get("learning_operation_id"),
+        "knowledge_entry_id": runtime.get("knowledge_entry_id"),
+        "canonical_playbook_id": runtime.get("canonical_playbook_id"),
+        "catalog_id": runtime.get("catalog_id"),
+        "km_row_version": runtime.get("km_row_version"),
+        "playbook_row_version": runtime.get("playbook_row_version"),
+        "playbook_row_fingerprint": runtime.get(
+            "playbook_row_fingerprint"
+        ),
+        "source_receipt_ref": source_boundary.get("receipt_ref"),
+        "source_verifier": source_boundary.get("verifier"),
+        "controls": controls,
+        "active_blockers": blockers,
+        "writes_on_read": False,
+        "source_only_counts_as_completion": False,
+    }
+    payload.setdefault("rollups", {})[
+        "autonomous_canonical_learning_writeback_closed_count"
+    ] = 1 if closed else 0
+
+
 _RUNTIME_OPERATION_COUNTS_SQL = """
     SELECT
         coalesce(input ->> 'semantic_operation_type', operation_type)