Merge remote-tracking branch 'origin/main' into codex/p0-006-ai-log-triage-20260709

apps/api/tests/test_awoooi_priority_work_order_readback_api.py

@@ -618,20 +618,71 @@ def test_awoooi_priority_work_order_readback_surfaces_gitea_bundle_truth():
     assert runbook_summary["break_glass_runbook_count"] == sum(
         1 for item in runbook_rows if item["coverage_state"] == "break_glass"
     )
-    assert runbook_summary["next_work_item_id"] == "CIR-P0-007"
+    assert runbook_summary["next_work_item_id"] == "CIR-P0-009"
     assert runbook_by_id["CIR-P0-006"]["break_glass_required"] is True
     assert runbook_by_id["CIR-P0-006"]["controlled_apply_allowed"] is False
     assert runbook_by_id["CIR-P0-007"]["controlled_apply_allowed"] is True
-    assert runbook_by_id["CIR-P0-007"]["coverage_state"] == "partial"
+    assert runbook_by_id["CIR-P0-007"]["coverage_state"] == "ready"
+    assert runbook_by_id["CIR-P0-007"]["ready_field_count"] == 8
+    assert runbook_by_id["CIR-P0-007"]["missing_fields"] == []
+    assert runbook_by_id["CIR-P0-007"]["rollback_or_no_write_ready"] is True
+    assert runbook_by_id["CIR-P0-007"]["post_verifier_ready"] is True
+    assert (
+        runbook_by_id["CIR-P0-007"]["km_playbook_trust_writeback_ready"]
+        is True
+    )
     assert runbook_by_id["CIR-P0-007"]["manual_terminal_allowed"] is False
-    assert "km_playbook_trust_writeback" in runbook_by_id["CIR-P0-007"][
-        "missing_fields"
-    ]
+    assert runbook_by_id["CIR-P0-007"]["controlled_evidence_status"] == (
+        "runner_registration_controlled_evidence_ready"
+    )
+    assert runbook_by_id["CIR-P0-007"]["runtime_write_performed"] is False
+    assert runbook_by_id["CIR-P0-007"]["secret_value_read"] is False
+    assert runbook_by_id["CIR-P0-007"]["raw_runner_registration_read"] is False
+    assert runbook_by_id["CIR-P0-007"][
+        "runner_registration_content_read"
+    ] is False
+    assert runbook_by_id["CIR-P0-007"]["km_writeback_ref"] == (
+        "km://awoooi/runner-registration/hidden-tty-no-secret"
+    )
+    assert runbook_by_id["CIR-P0-007"]["playbook_trust_writeback_ref"] == (
+        "playbook://awoooi/runner-registration/hidden-tty-no-secret"
+    )
+    runner_registration_evidence = payload["runner_registration_controlled_evidence"]
+    assert runner_registration_evidence["schema_version"] == (
+        "runner_registration_controlled_evidence_v1"
+    )
+    assert runner_registration_evidence["metadata_only"] is True
+    assert runner_registration_evidence["registration_mode"] == (
+        "interactive_tty_hidden_prompt"
+    )
+    assert runner_registration_evidence["rollback_or_no_write"]["ready"] is True
+    assert runner_registration_evidence["rollback_or_no_write"][
+        "runtime_write_performed"
+    ] is False
+    assert runner_registration_evidence["rollback_or_no_write"][
+        "runner_registration_performed_by_this_readback"
+    ] is False
+    assert runner_registration_evidence["secret_safety"]["secret_value_read"] is False
+    assert runner_registration_evidence["secret_safety"][
+        "raw_runner_registration_read"
+    ] is False
+    assert runner_registration_evidence["km_playbook_trust_writeback"][
+        "km_writeback_ref"
+    ] == "km://awoooi/runner-registration/hidden-tty-no-secret"
+    assert runner_registration_evidence["km_playbook_trust_writeback"][
+        "playbook_trust_writeback_ref"
+    ] == "playbook://awoooi/runner-registration/hidden-tty-no-secret"
     assert payload["summary"]["ai_controlled_repair_loop_p0_runbook_count"] == (
         runbook_summary["p0_runbook_count"]
     )
     assert payload["summary"]["ai_controlled_repair_loop_next_work_item_id"] == (
-        "CIR-P0-007"
+        "CIR-P0-009"
+    )
+    assert payload["summary"]["runner_registration_controlled_evidence_ready"] is True
+    assert payload["summary"]["runner_registration_controlled_no_runtime_write"] is True
+    assert (
+        payload["summary"]["runner_registration_controlled_secret_value_read"]
+        is False
     )
     assert payload["summary"][
         "ai_controlled_repair_loop_manual_as_default_terminal_allowed"
@@ -1547,14 +1598,21 @@ def test_awoooi_priority_work_order_readback_endpoint_returns_snapshot(
         1 for item in inserted_items if item["priority"] == "P0"
     )
     assert endpoint_matrix["summary"]["manual_terminal_count"] == 0
-    assert endpoint_matrix["summary"]["next_work_item_id"] == "CIR-P0-007"
+    assert endpoint_matrix["summary"]["next_work_item_id"] == "CIR-P0-009"
     assert endpoint_row_by_id["CIR-P0-006"]["coverage_state"] == "break_glass"
     assert endpoint_row_by_id["CIR-P0-006"]["controlled_apply_allowed"] is False
-    assert endpoint_row_by_id["CIR-P0-007"]["coverage_state"] == "partial"
+    assert endpoint_row_by_id["CIR-P0-007"]["coverage_state"] == "ready"
     assert endpoint_row_by_id["CIR-P0-007"]["controlled_apply_allowed"] is True
+    assert endpoint_row_by_id["CIR-P0-007"]["missing_fields"] == []
+    assert endpoint_row_by_id["CIR-P0-007"]["runtime_write_performed"] is False
+    assert endpoint_row_by_id["CIR-P0-007"]["secret_value_read"] is False
+    assert endpoint_row_by_id["CIR-P0-007"][
+        "raw_runner_registration_read"
+    ] is False
     assert data["summary"]["ai_controlled_repair_loop_next_work_item_id"] == (
-        "CIR-P0-007"
+        "CIR-P0-009"
     )
+    assert data["summary"]["runner_registration_controlled_evidence_ready"] is True
     assert data["summary"]["ai_controlled_repair_loop_manual_terminal_count"] == 0