feat(awooop): expose controlled execution preflight

apps/api/src/services/platform_operator_service.py

@@ -4292,6 +4292,144 @@ def _apply_gate_closure_tasks(
     ]
 
 
+def _apply_gate_controlled_execution_preflight(
+    *,
+    source_ref: str,
+    safe_source_ref: str,
+    catalog_id: str,
+    check_mode_playbook: Any,
+    apply_playbook: Any,
+    dry_run_passed: bool,
+    owner_release_package: dict[str, Any],
+    verifier_package: dict[str, Any],
+) -> dict[str, Any]:
+    """Describe the no-write route that would become executable after release gates."""
+
+    owner_release_approved = _safe_int(
+        owner_release_package.get("owner_release_approved_count")
+    )
+    maintenance_approved = _safe_int(
+        owner_release_package.get("maintenance_window_approved_count")
+    )
+    rollback_confirmed = _safe_int(
+        owner_release_package.get("rollback_owner_confirmed_count")
+    )
+    verifier_ready = _safe_int(verifier_package.get("post_release_verifier_ready_count"))
+    route_candidate_ready = (
+        dry_run_passed
+        and bool(catalog_id)
+        and str(apply_playbook or "").strip()
+        and str(apply_playbook or "").strip() != "--"
+    )
+    prerequisites = [
+        {
+            "key": "dry_run_passed",
+            "status": "passed" if dry_run_passed else "blocked_missing_dry_run",
+            "detail": f"dry_run_passed={str(dry_run_passed).lower()}",
+            "required": True,
+        },
+        {
+            "key": "allowlisted_route_candidate",
+            "status": (
+                "candidate_ready_no_runtime_authority"
+                if route_candidate_ready
+                else "route_missing"
+            ),
+            "detail": f"catalog={catalog_id}",
+            "required": True,
+        },
+        {
+            "key": "owner_release_receipt",
+            "status": (
+                "passed" if owner_release_approved > 0 else "blocked_missing_owner_release"
+            ),
+            "detail": f"approved={owner_release_approved}",
+            "required": True,
+        },
+        {
+            "key": "maintenance_window",
+            "status": (
+                "passed"
+                if maintenance_approved > 0
+                else "blocked_missing_maintenance_window"
+            ),
+            "detail": f"approved={maintenance_approved}",
+            "required": True,
+        },
+        {
+            "key": "rollback_owner",
+            "status": (
+                "passed" if rollback_confirmed > 0 else "blocked_missing_rollback_owner"
+            ),
+            "detail": f"confirmed={rollback_confirmed}",
+            "required": True,
+        },
+        {
+            "key": "post_apply_verifier",
+            "status": (
+                "passed"
+                if verifier_ready > 0
+                else "blocked_missing_post_apply_verifier"
+            ),
+            "detail": f"ready={verifier_ready}",
+            "required": True,
+        },
+        {
+            "key": "km_playbook_writeback",
+            "status": "blocked_until_verified_execution",
+            "detail": "km_write=0; playbook_trust_write=0",
+            "required": True,
+        },
+    ]
+    ready_count = sum(
+        1
+        for item in prerequisites
+        if item["status"] in {"passed", "candidate_ready_no_runtime_authority"}
+    )
+    blocked_count = len(prerequisites) - ready_count
+    route_count = 1 if route_candidate_ready else 0
+    return {
+        "schema_version": "awooop_controlled_execution_preflight_v1",
+        "status": "blocked_before_runtime_gate",
+        "source_id": source_ref,
+        "work_item_id": f"controlled-execution-gate:awoooi:{safe_source_ref}",
+        "runtime_execution_authorized": False,
+        "runtime_write_allowed": False,
+        "allowed_route_count": 0,
+        "candidate_route_count": route_count,
+        "ready_count": ready_count,
+        "total_count": len(prerequisites),
+        "blocked_count": blocked_count,
+        "next_action": "collect_owner_release_maintenance_rollback_and_verifier",
+        "blocked_reason": "owner_release_or_verifier_gate_missing",
+        "routes": [
+            {
+                "route_id": f"ansible-allowlisted-apply:{catalog_id}",
+                "transport": "ansible",
+                "status": (
+                    "candidate_ready_no_runtime_authority"
+                    if route_candidate_ready
+                    else "route_missing"
+                ),
+                "source_asset_id": f"ansible-apply-candidate:{catalog_id}",
+                "check_mode_playbook_path": check_mode_playbook,
+                "apply_playbook_path": apply_playbook,
+                "allowed": False,
+                "blocker": "runtime_gate_closed_until_owner_release_and_verifier",
+            }
+        ],
+        "prerequisites": prerequisites,
+        "forbidden_until_released": [
+            "ansible_apply",
+            "ssh_write",
+            "service_restart",
+            "telegram_send",
+            "km_writeback",
+            "playbook_trust_writeback",
+        ],
+    }
+
+
 def _status_chain_ansible_apply_gate_handoff(
     *,
     ansible_dry_run_only: bool,
@@ -4406,6 +4544,16 @@ def _status_chain_ansible_apply_gate_handoff(
         owner_release_package=owner_release_package,
         verifier_package=verifier_package,
     )
+    controlled_execution_preflight = _apply_gate_controlled_execution_preflight(
+        source_ref=str(source_ref),
+        safe_source_ref=safe_source_ref,
+        catalog_id=str(catalog_id),
+        check_mode_playbook=check_mode_playbook,
+        apply_playbook=apply_playbook,
+        dry_run_passed=dry_run_passed,
+        owner_release_package=owner_release_package,
+        verifier_package=verifier_package,
+    )
 
     return {
         "schema_version": "awooop_automation_handoff_v1",
@@ -4473,6 +4621,7 @@ def _status_chain_ansible_apply_gate_handoff(
             "owner_release_package": owner_release_package,
             "release_verifier_package": verifier_package,
             "closure_tasks": closure_tasks,
+            "controlled_execution_preflight": controlled_execution_preflight,
         },
         "candidate": {
             "catalog_id": catalog_id,

apps/api/tests/test_awooop_operator_timeline_labels.py

@@ -1901,6 +1901,34 @@ def test_awooop_status_chain_does_not_treat_ansible_check_mode_as_repair() -> No
     assert closure["closure_tasks"][3]["source_asset_id"] == (
         "agent-result-capture-release-verifier-preflight-gate:P2-136"
     )
+    controlled_execution = closure["controlled_execution_preflight"]
+    assert controlled_execution["schema_version"] == (
+        "awooop_controlled_execution_preflight_v1"
+    )
+    assert controlled_execution["status"] == "blocked_before_runtime_gate"
+    assert controlled_execution["runtime_execution_authorized"] is False
+    assert controlled_execution["runtime_write_allowed"] is False
+    assert controlled_execution["candidate_route_count"] == 1
+    assert controlled_execution["allowed_route_count"] == 0
+    assert controlled_execution["ready_count"] == 2
+    assert controlled_execution["total_count"] == 7
+    assert controlled_execution["blocked_count"] == 5
+    assert [item["key"] for item in controlled_execution["prerequisites"]] == [
+        "dry_run_passed",
+        "allowlisted_route_candidate",
+        "owner_release_receipt",
+        "maintenance_window",
+        "rollback_owner",
+        "post_apply_verifier",
+        "km_playbook_writeback",
+    ]
+    assert controlled_execution["routes"][0]["route_id"] == (
+        "ansible-allowlisted-apply:ansible:188-ai-web"
+    )
+    assert controlled_execution["routes"][0]["allowed"] is False
+    assert controlled_execution["routes"][0]["apply_playbook_path"] == (
+        "infra/ansible/playbooks/188-ai-web.yml"
+    )
     assert chain["execution"]["ansible"]["check_mode_total"] == 1
     assert chain["execution"]["ansible"]["apply_total"] == 0
     assert chain["execution"]["ansible"]["applied"] is False