wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(api): expose credential escrow delivery lane
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 19s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m43s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-29 16:46:42 +08:00
parent 3ccfd53b3f
commit 60d51d40da
3 changed files with 127 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
apps/api/src/services/delivery_closure_workbench.py
View File

@@ -86,6 +86,25 @@ def build_delivery_closure_workbench(
private_inventory_blockers = _int(
private_inventory_rollups.get("active_blocker_count")
)
credential_escrow_required_items = _int(
backup_rollups.get("credential_escrow_required_item_count")
)
credential_escrow_missing_items = _int(
backup_rollups.get("credential_escrow_effective_missing_count")
)
credential_escrow_completion = _percent(
(
(credential_escrow_required_items - credential_escrow_missing_items)
/ max(credential_escrow_required_items, 1)
)
* 100
)
backup_blocked_row_ids = _strings(backup_rollups.get("blocked_row_ids"))
backup_non_credential_blockers = [
row_id
for row_id in backup_blocked_row_ids
if row_id != "credential_escrow_markers"
]
runtime_action_required = set(
_strings(runtime_rollups.get("action_required_surface_ids"))
)
@@ -358,6 +377,66 @@ def build_delivery_closure_workbench(
"href": "/deployments",
"next_action": _first_string(production_deploy.get("next_actions")),
},
{
"id": "credential_escrow",
"source_id": "backup_dr_credential_escrow",
"completion_percent": credential_escrow_completion,
"status": str(
backup_rollups.get("credential_escrow_intake_status")
or "blocked_waiting_non_secret_credential_escrow_evidence"
),
"blocker_count": credential_escrow_missing_items,
"metric": {
"kind": "credential_escrow_evidence",
"workplan_id": "P0-005",
"required_item_count": credential_escrow_required_items,
"effective_missing_count": credential_escrow_missing_items,
"active_gate_present": backup_rollups.get(
"credential_escrow_active_gate_present"
)
is True,
"preflight_status": str(
backup_rollups.get("credential_escrow_preflight_status") or ""
),
"owner_response_received_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_received_count"
)
),
"owner_response_accepted_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_accepted_count"
)
),
"runtime_gate_count": _int(
backup_rollups.get("credential_escrow_runtime_gate_count")
),
"secret_value_collection_allowed": (
backup_rollups.get(
"credential_escrow_secret_value_collection_allowed"
)
is True
),
"credential_marker_write_authorized_count": _int(
backup_rollups.get("credential_marker_write_authorized_count")
),
"forbidden_true_field_count": _int(
backup_rollups.get("credential_escrow_forbidden_true_field_count")
),
"scorecard_schema_version": str(
backup_rollups.get(
"credential_escrow_intake_scorecard_schema_version"
)
or ""
),
"scorecard_verifier": str(
backup_rollups.get("credential_escrow_intake_scorecard_verifier")
or ""
),
},
"href": "/operations",
"next_action": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
},
{
"id": "gitea_private_inventory",
"source_id": "gitea_private_inventory_p0_scorecard",
@@ -498,10 +577,12 @@ def build_delivery_closure_workbench(
backup_status.get("overall_completion_percent")
),
"status": str(backup_status.get("current_task_id") or "unknown"),
"blocker_count": len(_strings(backup_rollups.get("blocked_row_ids"))),
"blocker_count": len(backup_non_credential_blockers),
"metric": {
"kind": "readiness_row_count",
"rows": _int(backup_rollups.get("total_rows")),
"blocked_row_ids": backup_blocked_row_ids,
"non_credential_blocked_row_ids": backup_non_credential_blockers,
"credential_escrow_intake_scorecard_schema_version": str(
backup_rollups.get(
"credential_escrow_intake_scorecard_schema_version"

27
apps/api/tests/test_delivery_closure_workbench_api.py
View File

@@ -56,6 +56,32 @@ def test_delivery_closure_workbench_uses_gitea_private_inventory_lane():
)
def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane():
payload = load_delivery_closure_workbench()
_assert_delivery_workbench_shape(payload)
lane = {lane["id"]: lane for lane in payload["lanes"]}["credential_escrow"]
assert lane["source_id"] == "backup_dr_credential_escrow"
assert lane["status"] == "blocked_waiting_non_secret_credential_escrow_evidence"
assert lane["blocker_count"] == 5
assert lane["completion_percent"] == 0
assert lane["metric"]["kind"] == "credential_escrow_evidence"
assert lane["metric"]["workplan_id"] == "P0-005"
assert lane["metric"]["required_item_count"] == 5
assert lane["metric"]["effective_missing_count"] == 5
assert lane["metric"]["active_gate_present"] is True
assert lane["metric"]["preflight_status"] == "blocked_waiting_owner_response_content"
assert lane["metric"]["owner_response_received_count"] == 0
assert lane["metric"]["owner_response_accepted_count"] == 0
assert lane["metric"]["runtime_gate_count"] == 0
assert lane["metric"]["secret_value_collection_allowed"] is False
assert lane["metric"]["credential_marker_write_authorized_count"] == 0
assert lane["next_action"] == (
"collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
)
def _assert_delivery_workbench_shape(data: dict):
assert data["schema_version"] == "delivery_closure_workbench_v1"
assert data["summary"]["source_count"] == 7
@@ -115,6 +141,7 @@ def _assert_delivery_workbench_shape(data: dict):
assert lane_ids == {
"release",
"production_deploy",
"credential_escrow",
"gitea_private_inventory",
"cicd_baseline",
"gitea",