wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(delivery): expose credential escrow scorecard

Browse Source
This commit is contained in:
Your Name
2026-06-29 10:48:28 +08:00
parent 7191193c71
commit 76e5bbcf47
5 changed files with 246 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

104
apps/api/src/services/delivery_closure_workbench.py
View File

@@ -411,6 +411,59 @@ def build_delivery_closure_workbench(
"metric": {
"kind": "readiness_row_count",
"rows": _int(backup_rollups.get("total_rows")),
"credential_escrow_intake_scorecard_schema_version": str(
backup_rollups.get(
"credential_escrow_intake_scorecard_schema_version"
)
or ""
),
"credential_escrow_intake_scorecard_verifier": str(
backup_rollups.get("credential_escrow_intake_scorecard_verifier")
or ""
),
"credential_escrow_intake_status": str(
backup_rollups.get("credential_escrow_intake_status") or ""
),
"credential_escrow_active_gate_present": backup_rollups.get(
"credential_escrow_active_gate_present"
)
is True,
"credential_escrow_preflight_status": str(
backup_rollups.get("credential_escrow_preflight_status") or ""
),
"credential_escrow_required_item_count": _int(
backup_rollups.get("credential_escrow_required_item_count")
),
"credential_escrow_effective_missing_count": _int(
backup_rollups.get("credential_escrow_effective_missing_count")
),
"credential_escrow_owner_response_received_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_received_count"
)
),
"credential_escrow_owner_response_accepted_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_accepted_count"
)
),
"credential_escrow_runtime_gate_count": _int(
backup_rollups.get("credential_escrow_runtime_gate_count")
),
"credential_escrow_secret_value_collection_allowed": (
backup_rollups.get(
"credential_escrow_secret_value_collection_allowed"
)
is True
),
"credential_marker_write_authorized_count": _int(
backup_rollups.get("credential_marker_write_authorized_count")
),
"credential_escrow_forbidden_true_field_count": _int(
backup_rollups.get(
"credential_escrow_forbidden_true_field_count"
)
),
},
"href": "/operations",
"next_action": _first_backup_action(backup.get("readiness_rows")),
@@ -646,6 +699,57 @@ def build_delivery_closure_workbench(
)
)
),
"backup_credential_escrow_intake_scorecard_schema_version": str(
backup_rollups.get(
"credential_escrow_intake_scorecard_schema_version"
)
or ""
),
"backup_credential_escrow_intake_scorecard_verifier": str(
backup_rollups.get("credential_escrow_intake_scorecard_verifier")
or ""
),
"backup_credential_escrow_intake_status": str(
backup_rollups.get("credential_escrow_intake_status") or ""
),
"backup_credential_escrow_active_gate_present": backup_rollups.get(
"credential_escrow_active_gate_present"
)
is True,
"backup_credential_escrow_preflight_status": str(
backup_rollups.get("credential_escrow_preflight_status") or ""
),
"backup_credential_escrow_required_item_count": _int(
backup_rollups.get("credential_escrow_required_item_count")
),
"backup_credential_escrow_effective_missing_count": _int(
backup_rollups.get("credential_escrow_effective_missing_count")
),
"backup_credential_escrow_owner_response_received_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_received_count"
)
),
"backup_credential_escrow_owner_response_accepted_count": _int(
backup_rollups.get(
"credential_escrow_owner_response_accepted_count"
)
),
"backup_credential_escrow_runtime_gate_count": _int(
backup_rollups.get("credential_escrow_runtime_gate_count")
),
"backup_credential_escrow_secret_value_collection_allowed": (
backup_rollups.get(
"credential_escrow_secret_value_collection_allowed"
)
is True
),
"backup_credential_marker_write_authorized_count": _int(
backup_rollups.get("credential_marker_write_authorized_count")
),
"backup_credential_escrow_forbidden_true_field_count": _int(
backup_rollups.get("credential_escrow_forbidden_true_field_count")
),
"github_write_channel_ready": github_preflight.get(
"github_write_channel_ready"
)

65
apps/api/tests/test_delivery_closure_workbench_api.py
View File

@@ -169,6 +169,40 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
data["summary"]["production_deploy_non110_runner_remaining_blocker_count"]
== 3
)
assert (
data["summary"][
"backup_credential_escrow_intake_scorecard_schema_version"
]
== "awoooi_post_reboot_credential_escrow_intake_scorecard_v1"
)
assert (
"scripts/reboot-recovery/post-reboot-credential-escrow-intake-scorecard.py"
in data["summary"]["backup_credential_escrow_intake_scorecard_verifier"]
)
assert data["summary"]["backup_credential_escrow_intake_status"] == (
"blocked_waiting_non_secret_credential_escrow_evidence"
)
assert data["summary"]["backup_credential_escrow_active_gate_present"] is True
assert data["summary"]["backup_credential_escrow_preflight_status"] == (
"blocked_waiting_owner_response_content"
)
assert data["summary"]["backup_credential_escrow_required_item_count"] == 5
assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 5
assert (
data["summary"]["backup_credential_escrow_owner_response_received_count"]
== 0
)
assert (
data["summary"]["backup_credential_escrow_owner_response_accepted_count"]
== 0
)
assert data["summary"]["backup_credential_escrow_runtime_gate_count"] == 0
assert (
data["summary"]["backup_credential_escrow_secret_value_collection_allowed"]
is False
)
assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0
assert data["summary"]["backup_credential_escrow_forbidden_true_field_count"] == 0
assert data["summary"]["github_write_channel_ready"] is False
assert data["summary"]["github_account_status"] == "suspended"
assert data["summary"]["github_account_suspended"] is True
@@ -380,6 +414,37 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
assert lanes["gitea"]["metric"]["kind"] == "workflow_count"
assert lanes["runtime"]["metric"]["kind"] == "surface_count"
assert lanes["backup"]["metric"]["kind"] == "readiness_row_count"
assert (
lanes["backup"]["metric"][
"credential_escrow_intake_scorecard_schema_version"
]
== "awoooi_post_reboot_credential_escrow_intake_scorecard_v1"
)
assert lanes["backup"]["metric"]["credential_escrow_intake_status"] == (
"blocked_waiting_non_secret_credential_escrow_evidence"
)
assert lanes["backup"]["metric"]["credential_escrow_active_gate_present"] is True
assert (
lanes["backup"]["metric"]["credential_escrow_effective_missing_count"]
== 5
)
assert (
lanes["backup"]["metric"]["credential_escrow_owner_response_received_count"]
== 0
)
assert (
lanes["backup"]["metric"]["credential_escrow_owner_response_accepted_count"]
== 0
)
assert lanes["backup"]["metric"]["credential_escrow_runtime_gate_count"] == 0
assert (
lanes["backup"]["metric"][
"credential_escrow_secret_value_collection_allowed"
]
is False
)
assert lanes["backup"]["metric"]["credential_marker_write_authorized_count"] == 0
assert lanes["backup"]["metric"]["credential_escrow_forbidden_true_field_count"] == 0
assert sources["github_private_backup"]["loaded"] is True
assert sources["production_deploy_readback"]["loaded"] is True
assert (

44
apps/web/src/lib/api-client.ts
View File

@@ -2584,6 +2584,19 @@ export interface DeliveryClosureWorkbenchSnapshot {
production_deploy_non110_runner_ready_registration_count: number
production_deploy_non110_runner_safe_next_step: string
production_deploy_non110_runner_remaining_blocker_count: number
backup_credential_escrow_intake_scorecard_schema_version: string
backup_credential_escrow_intake_scorecard_verifier: string
backup_credential_escrow_intake_status: string
backup_credential_escrow_active_gate_present: boolean
backup_credential_escrow_preflight_status: string
backup_credential_escrow_required_item_count: number
backup_credential_escrow_effective_missing_count: number
backup_credential_escrow_owner_response_received_count: number
backup_credential_escrow_owner_response_accepted_count: number
backup_credential_escrow_runtime_gate_count: number
backup_credential_escrow_secret_value_collection_allowed: boolean
backup_credential_marker_write_authorized_count: number
backup_credential_escrow_forbidden_true_field_count: number
github_write_channel_ready: boolean
github_account_status: string
github_account_suspended: boolean
@@ -2664,7 +2677,23 @@ export interface DeliveryClosureWorkbenchSnapshot {
}
| { kind: 'workflow_count'; count: number }
| { kind: 'surface_count'; total: number }
| { kind: 'readiness_row_count'; rows: number }
| {
kind: 'readiness_row_count'
rows: number
credential_escrow_intake_scorecard_schema_version: string
credential_escrow_intake_scorecard_verifier: string
credential_escrow_intake_status: string
credential_escrow_active_gate_present: boolean
credential_escrow_preflight_status: string
credential_escrow_required_item_count: number
credential_escrow_effective_missing_count: number
credential_escrow_owner_response_received_count: number
credential_escrow_owner_response_accepted_count: number
credential_escrow_runtime_gate_count: number
credential_escrow_secret_value_collection_allowed: boolean
credential_marker_write_authorized_count: number
credential_escrow_forbidden_true_field_count: number
}
href: string
operator_unblock?: DeliveryOperatorUnblock
next_action: string
@@ -14655,6 +14684,19 @@ export interface BackupDrReadinessMatrixSnapshot {
by_offsite_status: Record<string, number>
blocked_row_ids: string[]
action_required_row_ids: string[]
credential_escrow_intake_scorecard_schema_version: string
credential_escrow_intake_scorecard_verifier: string
credential_escrow_intake_status: string
credential_escrow_active_gate_present: boolean
credential_escrow_preflight_status: string
credential_escrow_required_item_count: number
credential_escrow_effective_missing_count: number
credential_escrow_owner_response_received_count: number
credential_escrow_owner_response_accepted_count: number
credential_escrow_runtime_gate_count: number
credential_escrow_secret_value_collection_allowed: boolean
credential_marker_write_authorized_count: number
credential_escrow_forbidden_true_field_count: number
}
readiness_rows: Array<{
target_id: string