feat(api): expose gitea runner attestation request

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -276,6 +276,31 @@ def _assert_delivery_workbench_shape(data: dict):
     assert data["summary"]["github_global_freeze_enabled"] is True
     assert data["summary"]["github_lane_status"] == "stopped_retired_do_not_use"
     assert data["summary"]["github_lane_excluded_from_p0_blocker_count"] is True
+    assert data["summary"]["gitea_runner_attestation_request_status"] == (
+        "owner_attestation_request_ready_waiting_response"
+    )
+    assert data["summary"]["gitea_runner_attestation_request_ready"] is True
+    assert data["summary"]["gitea_runner_attestation_request_active_blocker_count"] == 1
+    assert data["summary"]["gitea_runner_attestation_contract_id"] == (
+        "ubuntu_latest_gitea_runner_label"
+    )
+    assert data["summary"]["gitea_runner_attestation_runner_label"] == "ubuntu-latest"
+    assert data["summary"]["gitea_runner_attestation_workflow_count"] == 8
+    assert data["summary"]["gitea_runner_attestation_required_owner_field_count"] >= 10
+    assert data["summary"]["gitea_runner_attestation_forbidden_action_count"] >= 8
+    assert data["summary"]["gitea_runner_attestation_owner_response_received_count"] == 0
+    assert data["summary"]["gitea_runner_attestation_owner_response_accepted_count"] == 0
+    assert data["summary"]["gitea_runner_attestation_request_sent"] is False
+    assert data["summary"]["gitea_runner_attestation_request_send_performed"] is False
+    assert (
+        data["summary"]["gitea_runner_attestation_runner_label_change_allowed"]
+        is False
+    )
+    assert (
+        data["summary"]["gitea_runner_attestation_runner_registration_allowed"]
+        is False
+    )
+    assert data["summary"]["gitea_runner_attestation_secret_read_allowed"] is False
     assert data["summary"]["github_blocked_preflight_target_count"] == 0
     assert data["summary"]["github_operator_unblock_required"] is False
     assert data["summary"]["reboot_auto_recovery_status"] == (

apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from src.api.v1.agents import router
+
+
+def test_gitea_workflow_runner_owner_attestation_request_endpoint():
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.get(
+        "/api/v1/agents/gitea-workflow-runner-owner-attestation-request"
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert (
+        data["schema_version"]
+        == "gitea_workflow_runner_owner_attestation_request_v1"
+    )
+    assert data["priority"] == "P1-002"
+    assert data["status"] == "owner_attestation_request_ready_waiting_response"
+    assert data["readback"]["contract_id"] == "ubuntu_latest_gitea_runner_label"
+    assert data["readback"]["runner_label"] == "ubuntu-latest"
+    assert data["request_packet"]["request_template_ready"] is True
+    assert data["request_packet"]["request_sent"] is False
+    assert data["request_packet"]["owner_response_received"] is False
+    assert data["request_packet"]["owner_response_accepted"] is False
+    assert (
+        len(data["request_packet"]["workflow_ids_requiring_attestation"])
+        == data["rollups"]["workflow_requiring_attestation_count"]
+        == 8
+    )
+    assert data["rollups"]["required_owner_field_count"] >= 10
+    assert data["rollups"]["owner_response_received_count"] == 0
+    assert data["rollups"]["owner_response_accepted_count"] == 0
+    assert "owner_attestation_response_not_received" in data["active_blockers"]
+
+    boundaries = data["operation_boundaries"]
+    assert boundaries["read_only_api_allowed"] is True
+    assert boundaries["request_send_performed"] is False
+    assert boundaries["workflow_modification_allowed"] is False
+    assert boundaries["workflow_trigger_allowed"] is False
+    assert boundaries["runner_label_change_allowed"] is False
+    assert boundaries["runner_registration_allowed"] is False
+    assert boundaries["runner_restart_allowed"] is False
+    assert boundaries["secret_read_allowed"] is False
+    assert boundaries["runner_token_read_allowed"] is False
+    assert boundaries["gitea_api_write_allowed"] is False
+    assert boundaries["github_api_used"] is False