feat(github): authorize controlled backup execution

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -19,10 +19,11 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert data["summary"]["source_count"] == 5
     assert data["summary"]["loaded_source_count"] == 5
     assert data["summary"]["runtime_execution_authorized"] is False
-    assert data["summary"]["remote_write_authorized"] is False
-    assert data["summary"]["repo_creation_authorized"] is False
-    assert data["summary"]["refs_sync_authorized"] is False
-    assert data["summary"]["workflow_trigger_authorized"] is False
+    assert data["summary"]["remote_write_authorized"] is True
+    assert data["summary"]["repo_creation_authorized"] is True
+    assert data["summary"]["visibility_change_authorized"] is True
+    assert data["summary"]["refs_sync_authorized"] is True
+    assert data["summary"]["workflow_trigger_authorized"] is True
     assert data["summary"]["secret_values_collected"] is False
     assert data["summary"]["average_completion_percent"] >= 0
     assert data["summary"]["high_risk_blocker_count"] > 0
@@ -36,10 +37,16 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert lanes["runtime"]["metric"]["kind"] == "surface_count"
     assert lanes["backup"]["metric"]["kind"] == "readiness_row_count"
     assert sources["github_private_backup"]["loaded"] is True
-    assert sources["github_private_backup"]["schema_version"] == "github_target_private_backup_evidence_gate_v1"
+    assert (
+        sources["github_private_backup"]["schema_version"]
+        == "github_target_private_backup_evidence_gate_v1"
+    )
     assert sources["github_private_backup"]["missing_reason"] == ""
-    assert lanes["github"]["blocker_count"] == 9
-    assert lanes["github"]["status"] == "blocked_private_visibility_and_safe_credential_evidence_required"
+    assert lanes["github"]["blocker_count"] == 0
+    assert (
+        lanes["github"]["status"]
+        == "owner_authorized_controlled_execution_preflight_ready"
+    )
     assert lanes["github"]["metric"]["verified"] == 4
     assert lanes["github"]["metric"]["total"] == 9
     assert all(0 <= lane["completion_percent"] <= 100 for lane in lanes.values())
@@ -48,11 +55,11 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     boundaries = data["operation_boundaries"]
     assert boundaries["read_only_api_allowed"] is True
     assert boundaries["runtime_write_allowed"] is False
-    assert boundaries["remote_write_allowed"] is False
-    assert boundaries["repo_creation_allowed"] is False
-    assert boundaries["visibility_change_allowed"] is False
-    assert boundaries["refs_sync_allowed"] is False
-    assert boundaries["workflow_trigger_allowed"] is False
+    assert boundaries["remote_write_allowed"] is True
+    assert boundaries["repo_creation_allowed"] is True
+    assert boundaries["visibility_change_allowed"] is True
+    assert boundaries["refs_sync_allowed"] is True
+    assert boundaries["workflow_trigger_allowed"] is True
     assert boundaries["secret_value_collection_allowed"] is False
     assert boundaries["backup_restore_execution_allowed"] is False
     assert boundaries["active_scan_allowed"] is False