wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(host188): forward controlled callback correlation

Browse Source
This commit is contained in:
Your Name
2026-07-18 17:03:30 +08:00
parent 7d1968835a
commit 6de70e1910
9 changed files with 2725 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
apps/api/src/services/awooop_ansible_post_verifier.py
View File

@@ -251,14 +251,14 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
"set -euo pipefail; "
"root=/home/ollama/.local/share/awoooi-controlled-apply/"
"openclaw-callback-forwarder/"
"payloads/ffc45311b6403b30cb6ae6e1aa83dae1a047e9c9 && "
"payloads/8f367f8e7d6104c44b29bd5fa2d894db09ddf365 && "
"manifest=\"$root/manifest.json\" && "
"test -d \"$root\" && test ! -L \"$root\" && "
"test \"$(stat -c '%U:%G:%a' \"$root\")\" = 'ollama:ollama:755' && "
"test -f \"$manifest\" && test ! -L \"$manifest\" && "
"test \"$(stat -c '%U:%G:%a' \"$manifest\")\" = 'ollama:ollama:444' && "
"test \"$(sha256sum \"$manifest\" | cut -d' ' -f1)\" = "
"dafeb467b744ee7e80dc043d51f9e5d7e6905a58103f1710d519b553b56c6e48",
"0e5edaf700d264b44cc0eae3b9429af642be0b1563a0bffa633942d30d2c2e1c",
),
AssetPostcondition(
"host_188_openclaw_callback_overlay_enabled",
@@ -273,7 +273,7 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
"test \"$(stat -c '%U:%G:%a' \"$override\")\" = "
"'ollama:ollama:444' && "
"test \"$(sha256sum \"$override\" | cut -d' ' -f1)\" = "
"8f6b7e8a0d6746c1331e99910656e64deebf67c9582bab3e1d36f71bb7a253c0",
"33c4594d4e4092b2a2367583a67f4c9a82ead0d28ca5078eca4896276084da0d",
),
AssetPostcondition(
"host_188_openclaw_callback_payload_runtime",
@@ -282,7 +282,7 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
"set -euo pipefail; "
"root=/home/ollama/.local/share/awoooi-controlled-apply/"
"openclaw-callback-forwarder/"
"payloads/ffc45311b6403b30cb6ae6e1aa83dae1a047e9c9 && "
"payloads/8f367f8e7d6104c44b29bd5fa2d894db09ddf365 && "
"telegram=\"$root/app/bot/telegram.py\" && "
"config=\"$root/app/core/config.py\" && "
"forwarder=\"$root/app/services/telegram_callback_forwarder.py\" && "
@@ -297,7 +297,7 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
"test -f \"$forwarder\" && test ! -L \"$forwarder\" && "
"test \"$(stat -c '%U:%G:%a' \"$forwarder\")\" = 'ollama:ollama:444' && "
"test \"$(sha256sum \"$forwarder\" | cut -d' ' -f1)\" = "
"0d7693e34f63db4491d974f9f76a3a1c793d32cda193cb55ed3d8c86297b4fe3 && "
"8e8e0faf6322abb21d670ad9094f1805d7a4b3643da8fe88d74a8c9591066bf3 && "
"ids=$(docker ps -q "
"--filter label=com.docker.compose.project=clawbot "
"--filter label=com.docker.compose.service=clawbot) && "
@@ -314,7 +314,7 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
"e1b8b633f7b4780d3078d6c42a55e49d200255d3597a34e0cd2fd649b84eaea1 && "
"test \"$(docker exec \"$ids\" sha256sum "
"/app/app/services/telegram_callback_forwarder.py | cut -d' ' -f1)\" = "
"0d7693e34f63db4491d974f9f76a3a1c793d32cda193cb55ed3d8c86297b4fe3 && "
"8e8e0faf6322abb21d670ad9094f1805d7a4b3643da8fe88d74a8c9591066bf3 && "
"test \"$(docker inspect --format='{{range .Mounts}}{{if eq "
".Destination \"/app/app/bot/telegram.py\"}}{{.Source}}|"
"{{.Destination}}|{{.Type}}|{{.RW}}{{end}}{{end}}' \"$id\")\" = "

22
apps/api/tests/test_host188_openclaw_callback_forwarder_ansible_catalog.py
View File

@@ -31,12 +31,13 @@ SERVICE_REGISTRY = ROOT / "ops" / "config" / "service-registry.yaml"
MONITORING_REGISTRY = ROOT / "ops" / "monitoring" / "service-registry.yaml"
CATALOG_ID = "ansible:188-openclaw-callback-forwarder"
CANONICAL_ASSET_ID = "service:openclaw:host188"
EXPECTED_SHA = "ffc45311b6403b30cb6ae6e1aa83dae1a047e9c9"
EXPECTED_SHA = "8f367f8e7d6104c44b29bd5fa2d894db09ddf365"
UPSTREAM_SOURCE_COMMIT = "ffc45311b6403b30cb6ae6e1aa83dae1a047e9c9"
EXPECTED_MANIFEST_SHA256 = (
"dafeb467b744ee7e80dc043d51f9e5d7e6905a58103f1710d519b553b56c6e48"
"0e5edaf700d264b44cc0eae3b9429af642be0b1563a0bffa633942d30d2c2e1c"
)
EXPECTED_OVERRIDE_SHA256 = (
"8f6b7e8a0d6746c1331e99910656e64deebf67c9582bab3e1d36f71bb7a253c0"
"33c4594d4e4092b2a2367583a67f4c9a82ead0d28ca5078eca4896276084da0d"
)
PAYLOAD_ROOT = (
ROOT
@@ -54,7 +55,7 @@ EXPECTED_PAYLOAD_SHA256 = {
"e1b8b633f7b4780d3078d6c42a55e49d200255d3597a34e0cd2fd649b84eaea1"
),
"app/services/telegram_callback_forwarder.py": (
"0d7693e34f63db4491d974f9f76a3a1c793d32cda193cb55ed3d8c86297b4fe3"
"8e8e0faf6322abb21d670ad9094f1805d7a4b3643da8fe88d74a8c9591066bf3"
),
}
@@ -353,6 +354,15 @@ def test_openclaw_playbook_is_check_first_bounded_and_rollback_capable() -> None
"/home/ollama/.local/share/awoooi-controlled-apply/"
f"openclaw-callback-forwarder/payloads/{EXPECTED_SHA}"
),
).replace(
"{{ callback_identity_path }}",
(
"/home/ollama/.local/share/awoooi-controlled-apply/"
"openclaw-callback-forwarder/receipts/current-deployment.json"
),
).replace(
"{{ callback_identity_container_path }}",
"/run/awoooi/openclaw-callback-forwarder/current-deployment.json",
)
assert hashlib.sha256(rendered_override.encode()).hexdigest() == (
EXPECTED_OVERRIDE_SHA256
@@ -411,7 +421,9 @@ def test_openclaw_payload_manifest_is_hash_pinned_and_overlay_only() -> None:
assert hashlib.sha256(manifest_path.read_bytes()).hexdigest() == (
EXPECTED_MANIFEST_SHA256
)
assert manifest["source_commit"] == EXPECTED_SHA
assert manifest["source_commit"] == UPSTREAM_SOURCE_COMMIT
assert manifest["overlay_revision"] == EXPECTED_SHA
assert manifest["overlay_revision_kind"] == "git_blob_of_callback_forwarder"
assert manifest["deployment_mode"] == (
"host_user_owned_read_only_compose_override_no_build_no_pull"
)

135
apps/api/tests/test_host188_openclaw_callback_forwarder_payload_contract.py Normal file
View File

@@ -0,0 +1,135 @@
from __future__ import annotations
import importlib.util
import json
import sys
from pathlib import Path
from types import ModuleType, SimpleNamespace
import pytest
ROOT = Path(__file__).resolve().parents[3]
REVISION = "8f367f8e7d6104c44b29bd5fa2d894db09ddf365"
PAYLOAD = (
ROOT
/ "infra"
/ "ansible"
/ "files"
/ "openclaw-callback-forwarder"
/ REVISION
/ "app"
/ "services"
/ "telegram_callback_forwarder.py"
)
def _load_payload() -> ModuleType:
spec = importlib.util.spec_from_file_location(
"host188_controlled_callback_forwarder",
PAYLOAD,
)
assert spec is not None and spec.loader is not None
module = importlib.util.module_from_spec(spec)
sys.modules[spec.name] = module
spec.loader.exec_module(module)
return module
def _identity() -> dict[str, str]:
return {
"schema_version": "openclaw_callback_deployment_identity_v1",
"catalog_id": "ansible:188-openclaw-callback-forwarder",
"trace_id": "trace:host188:001",
"run_id": "run:host188:001",
"work_item_id": "AIA-SRE-017",
}
def _update() -> dict:
return {
"update_id": 77,
"callback_query": {
"data": "detail:INC-20260716-TEST",
"from": {"id": 7, "username": "operator"},
"id": "callback-forward-77",
"message": {
"chat": {"id": -1001},
"message_id": 9,
"text": "incident",
},
},
}
class _CaptureClient:
def __init__(self) -> None:
self.body = b""
async def post(self, _url: str, *, content: bytes, headers: dict) -> object:
self.body = content
assert headers["X-Telegram-Forward-Schema"] == (
"telegram_callback_forward_v1"
)
return SimpleNamespace(status_code=200)
def test_identity_loader_accepts_exact_regular_file_and_rejects_unsafe_shapes(
tmp_path: Path,
) -> None:
module = _load_payload()
identity_path = tmp_path / "current-deployment.json"
identity_path.write_text(json.dumps(_identity()), encoding="utf-8")
assert module.load_controlled_correlation(str(identity_path)) == {
"schema_version": "awoooi_controlled_callback_correlation_v1",
"trace_id": "trace:host188:001",
"run_id": "run:host188:001",
"work_item_id": "AIA-SRE-017",
}
identity_path.write_text(json.dumps({**_identity(), "extra": "no"}), encoding="utf-8")
assert module.load_controlled_correlation(str(identity_path)) is None
identity_path.write_text("x" * 4097, encoding="utf-8")
assert module.load_controlled_correlation(str(identity_path)) is None
target = tmp_path / "target.json"
target.write_text(json.dumps(_identity()), encoding="utf-8")
identity_path.unlink()
identity_path.symlink_to(target)
assert module.load_controlled_correlation(str(identity_path)) is None
@pytest.mark.asyncio
async def test_forwarder_adds_exact_correlation_and_preserves_legacy_fallback(
tmp_path: Path,
) -> None:
module = _load_payload()
identity_path = tmp_path / "current-deployment.json"
identity_path.write_text(json.dumps(_identity()), encoding="utf-8")
client = _CaptureClient()
forwarder = module.TelegramCallbackForwarder(
enabled=True,
url="https://awoooi.wooo.work/api/v1/telegram/callback-forward",
signing_key="test-key",
controlled_identity_path=str(identity_path),
)
result = await forwarder.forward(_update(), now=1, client=client)
assert result.acknowledged is True
assert json.loads(client.body)["controlled_correlation"] == {
"schema_version": "awoooi_controlled_callback_correlation_v1",
"trace_id": "trace:host188:001",
"run_id": "run:host188:001",
"work_item_id": "AIA-SRE-017",
}
identity_path.unlink()
legacy_client = _CaptureClient()
legacy_result = await forwarder.forward(
_update(),
now=2,
client=legacy_client,
)
assert legacy_result.acknowledged is True
assert "controlled_correlation" not in json.loads(legacy_client.body)

6
apps/api/tests/test_host188_openclaw_callback_overlay_post_verifier_contract.py
View File

@@ -15,7 +15,7 @@ CATALOG_ID = "ansible:188-openclaw-callback-forwarder"
EXPECTED_PAYLOAD_SHA256 = {
"af9600f32305ae73184651a8d3437063d7c8d35e3c3eb0910a2e27ac874c9302",
"e1b8b633f7b4780d3078d6c42a55e49d200255d3597a34e0cd2fd649b84eaea1",
"0d7693e34f63db4491d974f9f76a3a1c793d32cda193cb55ed3d8c86297b4fe3",
"8e8e0faf6322abb21d670ad9094f1805d7a4b3643da8fe88d74a8c9591066bf3",
}
FRESH_RECEIPT_BLOCKER = (
"fresh_callback_receipt_run_scope_unavailable_in_static_postcondition_registry"
@@ -72,8 +72,8 @@ def test_host188_overlay_probes_are_exact_and_secret_blind() -> None:
assert "stat -c '%U:%G:%a'" in joined
assert "ollama:ollama:444" in joined
assert "ollama:ollama:755" in joined
assert "dafeb467b744ee7e80dc043d51f9e5d7e6905a58103f1710d519b553b56c6e48" in joined
assert "8f6b7e8a0d6746c1331e99910656e64deebf67c9582bab3e1d36f71bb7a253c0" in joined
assert "0e5edaf700d264b44cc0eae3b9429af642be0b1563a0bffa633942d30d2c2e1c" in joined
assert "33c4594d4e4092b2a2367583a67f4c9a82ead0d28ca5078eca4896276084da0d" in joined
assert "docker-compose.override.yml" in joined
assert "COMPOSE_FILE" not in joined
assert all(digest in joined for digest in EXPECTED_PAYLOAD_SHA256)