wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(iwooos): surface controlled cd lane guardrail blocker
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m34s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-07-02 00:23:16 +08:00
parent 857cdc9547
commit 78c0795355
10 changed files with 247 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
apps/api/src/services/ai_agent_log_controlled_writeback_executor_readback.py
View File

@@ -372,12 +372,17 @@ def _current_blocker_queue_item(recovery: dict[str, Any]) -> dict[str, Any]:
recovery,
control_path_pressure_blocker=control_path_pressure_blocker,
)
queue_status = "controlled_recovery_packaged_waiting_control_path_readback"
if blocker_id == "controlled_cd_lane_guardrails_blocked":
queue_status = (
"controlled_recovery_packaged_waiting_controlled_cd_lane_guardrails_readback"
)
return {
"queue_item_id": f"current-p0-blocker::{blocker_id}",
"source_sample_id": source_sample_id,
"incident_id": str(recovery.get("incident_id") or ""),
"blocker_id": blocker_id,
"status": "controlled_recovery_packaged_waiting_control_path_readback",
"status": queue_status,
"risk_tier": str(recovery.get("risk_tier") or "unknown"),
"runner_label": str(recovery.get("runner_label") or ""),
"node_load_classifier": node_load_classifier,
@@ -506,6 +511,32 @@ def _current_blocker_safe_next_action(
],
}
if blocker_id == "controlled_cd_lane_guardrails_blocked":
return {
"action_id": (
"restore_controlled_cd_lane_guardrails_then_rerun_readiness_receipt"
),
"stage": "controlled_cd_lane_guardrails_receipt_required",
"action": (
"Verify the 110 controlled CD lane guardrails: config, ELF "
"binary, registration metadata, systemd limits, fail-closed "
"legacy runners, host pressure, and receipt writeback."
),
"command": "check-awoooi-110-controlled-cd-lane-readiness.sh",
"post_verifier": (
"harbor-registry-controlled-recovery-receipt validator && "
"priority work-order readback"
),
"requires_local_console": False,
"blocker_fields": [
"controlled_cd_lane_config_missing",
"controlled_cd_lane_binary_not_ready",
"controlled_cd_lane_registration_missing",
"controlled_cd_lane_service_not_active",
"controlled_cd_lane_pressure_guard",
],
}
if control_path_pressure_blocker:
return {
"action_id": "wait_host_pressure_gate_then_rerun_110_control_path_readback",

25
apps/api/src/services/ai_agent_log_controlled_writeback_plan_readback.py
View File

@@ -213,9 +213,20 @@ def _current_blocker_recovery(receipt: dict[str, Any]) -> dict[str, Any] | None:
cd_failed_after_registry_ready = bool(
registry_v2_ready and current_cd_status in {"Failure", "Blocked", "Canceled"}
)
harbor_repair_failed_after_registry_ready = bool(
historical_harbor_repair_failed_after_registry_ready = bool(
registry_v2_ready and harbor_repair_status in {"Failure", "Blocked"}
)
harbor_repair_failed_after_registry_ready = bool(
historical_harbor_repair_failed_after_registry_ready
and blocker_id != "controlled_cd_lane_guardrails_blocked"
)
ssh_auth_classification = str(
classification.get("ssh_auth_classification") or ""
)
external_control_path_blocker = ""
if ssh_auth_classification not in {"", "ssh_control_path_ready"}:
external_control_path_blocker = ssh_auth_classification
recovery = {
"source_sample_id": source_sample_id,
"project_id": str(receipt.get("project_id") or ""),
@@ -240,7 +251,9 @@ def _current_blocker_recovery(receipt: dict[str, Any]) -> dict[str, Any] | None:
"deployment_closure_state": _deployment_closure_state(
registry_v2_ready=registry_v2_ready,
current_cd_status=current_cd_status,
harbor_repair_status=harbor_repair_status,
harbor_repair_failed_after_registry_ready=(
harbor_repair_failed_after_registry_ready
),
fallback=str(classification.get("deployment_closure_state") or ""),
),
"deploy_marker_readback_required": bool(
@@ -278,9 +291,7 @@ def _current_blocker_recovery(receipt: dict[str, Any]) -> dict[str, Any] | None:
"harbor_110_remote_control_channel_unavailable",
"harbor_110_remote_ssh_publickey_auth_stalled",
},
"external_control_path_blocker": str(
classification.get("ssh_auth_classification") or ""
),
"external_control_path_blocker": external_control_path_blocker,
"metadata_only": True,
}
recovery["controlled_local_console_execution_plan"] = _list_of_dicts(
@@ -320,12 +331,12 @@ def _deployment_closure_state(
*,
registry_v2_ready: bool,
current_cd_status: str,
harbor_repair_status: str,
harbor_repair_failed_after_registry_ready: bool,
fallback: str,
) -> str:
if registry_v2_ready and current_cd_status in {"Failure", "Blocked", "Canceled"}:
return "blocked_latest_visible_cd_failure_after_registry_ready"
if registry_v2_ready and harbor_repair_status in {"Failure", "Blocked"}:
if registry_v2_ready and harbor_repair_failed_after_registry_ready:
return "blocked_harbor_110_repair_failure_after_registry_ready"
if registry_v2_ready:
return fallback or "registry_ready_waiting_deploy_marker_readback"

41
apps/api/src/services/awoooi_priority_work_order_readback.py
View File

@@ -697,9 +697,12 @@ def apply_ai_loop_current_blocker_execution_queue(
state["next_executable_mainline_workplan_id"] = (
"P0-006-AI-LOOP-CURRENT-BLOCKER-EXECUTION-QUEUE"
)
state["next_executable_mainline_state"] = (
"ai_loop_current_blocker_queue_waiting_110_control_path_readback"
)
next_mainline_state = "ai_loop_current_blocker_queue_waiting_110_control_path_readback"
if blocker_id == "controlled_cd_lane_guardrails_blocked":
next_mainline_state = (
"ai_loop_current_blocker_queue_waiting_controlled_cd_lane_guardrails_readback"
)
state["next_executable_mainline_state"] = next_mainline_state
state["ai_loop_current_blocker_execution_queue_count"] = len(queue)
state["ai_loop_current_blocker_id"] = blocker_id
state["ai_loop_current_blocker_registry_v2_ready"] = registry_v2_ready
@@ -1002,16 +1005,16 @@ def apply_ai_loop_current_blocker_execution_queue(
"The Harbor / 110 blocker is now visible as an AI Loop execution "
"queue item with metadata-only KM/RAG/MCP/PlayBook/AI Agent "
"writeback targets. The next action is not generic manual triage; "
"it is 110 control-path readback plus the bounded local recovery "
"package, ordered local-console phases, and post-apply verifier."
" Queue readback classifiers are normalized into explicit AI "
"blockers before KM/RAG/MCP/PlayBook writeback."
f"it is {blocker_id} through the bounded recovery package, ordered "
"verifier phases, and post-apply verifier. Queue readback "
"classifiers are normalized into explicit AI blockers before "
"KM/RAG/MCP/PlayBook writeback."
)
professional_fix = _dict(workplan.setdefault("professional_fix", {}))
professional_fix["action"] = (
"Run the AI Loop current blocker package in order: "
f"{', '.join(local_console_phase_ids)}, then rerun "
"Harbor queue / registry /v2/ / deploy-marker readbacks and write "
"controlled CD lane / registry /v2/ / priority readbacks and write "
"metadata-only KM/RAG/MCP/PlayBook receipts from normalized queue "
"classifier fields. Do not restart Docker "
"daemon, reboot hosts, drain nodes, switch registry provider, "
@@ -1028,13 +1031,13 @@ def apply_ai_loop_current_blocker_execution_queue(
"P0-006-AI-LOOP-CURRENT-BLOCKER-EXECUTION-QUEUE: registry /v2/ "
f"is already {first_item.get('registry_v2_status')} "
f"({registry_v2_status_classifier}); do not reopen Harbor 502 "
f"as the main blocker. Execute {blocker_id} through 110 "
"SSH/session control-path readback, ordered local-console phases, "
"post-recovery queue readbacks, and metadata-only KM/RAG/MCP/"
f"as the main blocker. Execute {blocker_id} through the "
"controlled CD lane guardrail verifier, registry readbacks, "
"priority work-order readback, and metadata-only KM/RAG/MCP/"
"PlayBook writeback."
)
]
if not deploy_marker_resolved_by_production_readback:
if active_deploy_marker_readback_required or active_cd_failed_after_registry_ready:
payload["next_execution_order"].append(
"P0-006-CD-DEPLOY-MARKER-READBACK: close the latest visible CD "
f"{active_current_cd_run_id or 'unknown'} status "
@@ -1044,8 +1047,7 @@ def apply_ai_loop_current_blocker_execution_queue(
payload["next_execution_order"].append(
"P0-006-HARBOR-REGISTRY-CONTROLLED-RECOVERY-PREFLIGHT: only "
"rerun Harbor watchdog repair if registry /v2/ regresses below "
"200/401; otherwise keep focus on 110 SSH control-path and "
"deploy-marker closure."
"200/401; otherwise keep focus on controlled CD lane guardrails."
)
else:
payload["next_execution_order"] = [
@@ -1064,7 +1066,7 @@ def apply_ai_loop_current_blocker_execution_queue(
"watchdog check-mode / repair-once and registry /v2/ readback."
)
]
if not deploy_marker_resolved_by_production_readback:
if active_deploy_marker_readback_required or active_cd_failed_after_registry_ready:
payload["next_execution_order"].append(
"P0-006-CD-DEPLOY-MARKER-READBACK: after registry /v2/ is "
"200/401, let the next Gitea CD run build/push/deploy and then "
@@ -1279,12 +1281,17 @@ def _ai_loop_current_blocker_can_override(
blocker_id: str,
queue_item: dict[str, Any],
) -> bool:
ai_loop_blocker_ids = {
"controlled_cd_lane_guardrails_blocked",
}
if status == "p0_006_blocked_harbor_registry_controlled_recovery_preflight":
return True
if status == "p0_006_blocked_stockplatform_public_api_runtime_drift":
return blocker_id.startswith("harbor_110_")
if not blocker_id.startswith("harbor_110_"):
return blocker_id.startswith("harbor_110_") or blocker_id in ai_loop_blocker_ids
if not blocker_id.startswith("harbor_110_") and blocker_id not in ai_loop_blocker_ids:
return False
if blocker_id in ai_loop_blocker_ids:
return True
return bool(
queue_item.get("deploy_marker_readback_required") is True
or queue_item.get("cd_failed_after_registry_ready") is True