Merge remote-tracking branch 'origin/main' into codex/aia-p0-006-security-control-plane-20260711

apps/api/tests/test_gitea_actions_secret_variable_name_inventory_api.py

@@ -27,8 +27,12 @@ def test_gitea_actions_secret_variable_name_inventory_loader_is_value_safe() ->
     assert payload["status"] == "gitea_actions_secret_variable_name_inventory_ready"
     assert payload["ready"] is True
     assert payload["summary"]["workflow_file_count"] == committed_workflow_file_count
-    assert payload["summary"]["referenced_secret_name_count"] == 26
-    assert payload["summary"]["referenced_variable_name_count"] == 0
+    assert payload["summary"]["referenced_secret_name_count"] == len(
+        payload["secret_name_rows"]
+    )
+    assert payload["summary"]["referenced_variable_name_count"] == len(
+        payload["variable_name_rows"]
+    )
     assert payload["summary"]["secret_values_collected"] is False
     assert payload["summary"]["variable_values_collected"] is False
     assert payload["operation_boundaries"]["secret_value_read_allowed"] is False

apps/api/tests/test_gitea_workflow_runner_health_api.py

@@ -80,5 +80,17 @@ def test_gitea_workflow_runner_health_endpoint_returns_committed_snapshot():
     )
     assert mcp_artifact_mirror["notification_policy"] == "read_only_no_notify"
     assert mcp_artifact_mirror["notify_bridge_calls"] == 0
+    mcp_protocol_replay = next(
+        row
+        for row in workflow_records
+        if row["workflow_id"] == "mcp_external_protocol_replay"
+    )
+    assert mcp_protocol_replay["runner_labels"] == ["awoooi-non110-host"]
+    assert mcp_protocol_replay["runner_evidence_status"] == (
+        "non110_host_runner_mapped"
+    )
+    assert mcp_protocol_replay["notification_policy"] == "read_only_no_notify"
+    assert mcp_protocol_replay["notify_bridge_calls"] == 0
+    assert "schedule" in mcp_protocol_replay["triggers"]
     assert "workflow 修改批准" in data["operator_contract"]["must_not_interpret_as"]
     assert "Secret 已讀取或可輸出" in data["operator_contract"]["must_not_interpret_as"]