Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715

apps/api/tests/test_iwooos_security_asset_control_plane.py

@@ -31,6 +31,8 @@ def _ready_payload(
     *,
     discovery_status: str = "success",
     discovery_error: str | None = None,
+    automation_rows: list[SimpleNamespace] | None = None,
+    runtime_receipt_counts: dict[str, int] | None = None,
 ) -> dict:
     now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC)
     discovery = _row(
@@ -79,16 +81,25 @@ def _ready_payload(
             "encryption_at_rest",
         )
     ]
-    automation = [
-        _row(operation_type="asset_discovered", status="success", cnt=1),
-        _row(operation_type="rule_matched", status="success", cnt=3),
-        _row(operation_type="rule_created", status="success", cnt=2),
-        _row(operation_type="ansible_check_mode_executed", status="dry_run", cnt=2),
-        _row(operation_type="ansible_apply_executed", status="success", cnt=1),
-        _row(operation_type="remediation_verified", status="success", cnt=1),
-        _row(operation_type="km_created", status="success", cnt=1),
-        _row(operation_type="ansible_apply_executed", status="failed", cnt=1),
-    ]
+    automation = (
+        automation_rows
+        if automation_rows is not None
+        else [
+            _row(operation_type="asset_discovered", status="success", cnt=1),
+            _row(operation_type="rule_matched", status="success", cnt=3),
+            _row(operation_type="rule_created", status="success", cnt=2),
+            _row(
+                operation_type="ansible_check_mode_executed",
+                status="dry_run",
+                cnt=2,
+            ),
+            _row(operation_type="ansible_apply_executed", status="success", cnt=1),
+            _row(operation_type="remediation_verified", status="success", cnt=1),
+            _row(operation_type="km_created", status="success", cnt=1),
+            _row(operation_type="ansible_apply_executed", status="failed", cnt=1),
+        ]
+    )
+    runtime_counts = runtime_receipt_counts or {}
     return build_iwooos_security_asset_control_plane(
         discovery_row=discovery,
         inventory_rows=inventory,
@@ -108,6 +119,9 @@ def _ready_payload(
             resolved_incident_count_24h=3,
             decision_chain_count_24h=5,
             normalized_event_count_24h=18,
+            correlated_controlled_route_count_24h=runtime_counts.get("correlate", 0),
+            independent_verifier_pass_count_24h=runtime_counts.get("verify", 0),
+            learning_writeback_count_24h=runtime_counts.get("learn", 0),
             mttr_minutes_24h=14.25,
         ),
         audit_row=_row(
@@ -188,6 +202,9 @@ def test_builds_live_asset_siem_audit_and_ai_control_plane_without_false_closure
     assert any(
         item["work_item_id"] == "AIA-P1-001-01" for item in payload["work_items"]
     )
+    assert any(
+        item["work_item_id"] == "AIA-P0-008-01" for item in payload["work_items"]
+    )
 
     public_text = json.dumps(payload, ensure_ascii=False)
     assert "192.168." not in public_text
@@ -197,6 +214,41 @@ def test_builds_live_asset_siem_audit_and_ai_control_plane_without_false_closure
     assert 'secret_value_collection_allowed": true' not in public_text.lower()
 
 
+def test_projects_canonical_runtime_receipts_without_false_same_run_closure() -> None:
+    payload = _ready_payload(
+        automation_rows=[
+            _row(operation_type="asset_discovered", status="success", cnt=1),
+            _row(operation_type="rule_matched", status="success", cnt=2),
+            _row(operation_type="rule_created", status="success", cnt=2),
+            _row(
+                operation_type="ansible_check_mode_executed",
+                status="dry_run",
+                cnt=2,
+            ),
+            _row(operation_type="ansible_apply_executed", status="success", cnt=1),
+            _row(operation_type="remediation_verified", status="success", cnt=2),
+            _row(operation_type="km_created", status="success", cnt=2),
+        ],
+        runtime_receipt_counts={"correlate": 7, "verify": 5, "learn": 4},
+    )
+
+    ai_stages = {
+        stage["stage_id"]: stage for stage in payload["ai_automation"]["stages"]
+    }
+    assert ai_stages["correlate"]["receipt_count_24h"] == 7
+    assert ai_stages["verify"]["receipt_count_24h"] == 5
+    assert ai_stages["learn"]["receipt_count_24h"] == 4
+    assert payload["summary"]["verified_remediation_receipt_count_24h"] == 5
+    assert payload["summary"]["siem_stage_coverage_percent"] == 100
+    assert payload["summary"]["ai_loop_stage_coverage_percent"] == 100
+    assert payload["completion"]["strict_runtime_closure_percent"] == 0
+    assert payload["ai_automation"]["same_run_closed_loop_proven"] is False
+
+    work_items = {item["work_item_id"]: item for item in payload["work_items"]}
+    assert "AIA-P0-007-01" not in work_items
+    assert work_items["AIA-P0-008-01"]["gap_count"] == 1
+
+
 def test_discovery_failure_exposes_only_allowlisted_collector_ids() -> None:
     raw_error = (
         "RuntimeError: asset_collector_failures=domain_tls_inventory,"
@@ -687,6 +739,17 @@ def test_service_bounds_source_concurrency_for_database_budget(monkeypatch) -> N
     assert "digest_pinned" in inventory_query
     assert "live_tls_probe_evidenced" in inventory_query
     assert "live_tls_healthy" in inventory_query
+    siem_query = next(
+        statement for statement in statements if "FROM alert_rule_catalog" in statement
+    )
+    assert "correlated_controlled_route_count_24h" in siem_query
+    assert "ansible_candidate_matched" in siem_query
+    assert "independent_verifier_pass_count_24h" in siem_query
+    assert "all_postconditions_passed" in siem_query
+    assert "executor_returncode_trusted" in siem_query
+    assert "learning_writeback_count_24h" in siem_query
+    assert "ansible_learning_writeback_recorded" in siem_query
+    assert "repository_readback_verified" in siem_query
 
 
 def test_public_api_returns_live_aggregate(monkeypatch) -> None: