fix(cd): keep knowledge readback off b5

.gitea/workflows/cd.yaml

@@ -452,6 +452,10 @@ jobs:
                 ;;
               apps/api/src/jobs/ai_slo_watchdog_job.py)
                 ;;
+              apps/api/src/repositories/knowledge_repository.py)
+                ;;
+              apps/api/src/services/knowledge_service.py)
+                ;;
               apps/api/src/models/knowledge.py)
                 ;;
               apps/api/src/models/playbook.py)
@@ -532,6 +536,8 @@ jobs:
                 ;;
               apps/api/tests/test_gitea_repo_bundle_backup_readback_api.py)
                 ;;
+              apps/api/tests/test_knowledge_repository_read_model.py)
+                ;;
               apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py)
                 ;;
               apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py)
@@ -864,8 +870,10 @@ jobs:
               src/api/v1/iwooos.py \
               src/api/v1/webhooks.py \
               src/jobs/ai_slo_watchdog_job.py \
+              src/repositories/knowledge_repository.py \
               src/models/knowledge.py \
               src/models/playbook.py \
+              src/services/knowledge_service.py \
               src/services/awoooi_production_deploy_readback_blocker.py \
               src/services/agent_replay_normalizer.py \
               src/services/ai_agent_log_intelligence_integration_readback.py \

docs/LOGBOOK.md

@@ -1,3 +1,24 @@
+## 2026-07-03 — 00:11 P0-006 latest CD profile / Windows99 live probe readback
+
+**完成內容**：
+- Gitea CD `#4474` 讀回：commit `038c8808 fix(reboot): surface windows99 ssh candidate readback` 的主 pytest 已 `3702 passed, 23 skipped`；真失敗點不是產品測試，而是 profile 被判成 `full` 後進入 B5，non-110 controlled runner 沒有 Docker socket，回 `BLOCKER b5_docker_socket_unavailable`。
+- 修正 `.gitea/workflows/cd.yaml` controlled-runtime classifier：`apps/api/src/repositories/knowledge_repository.py`、`apps/api/src/services/knowledge_service.py`、`apps/api/tests/test_knowledge_repository_read_model.py` 納入窄 profile；這批 KM readback 修復不需要 DB migration / B5 Docker socket。
+- `ops/runner/test_cd_controlled_runtime_profile.py` 新增 knowledge readback contract，避免同類 readback 修復再次掉進 full/B5。
+- 即時 no-secret Windows99 management probe：`host_reachable=true`、TCP `22/135/2179/3389/445=open`、`5985/5986=timeout`、`ssh_batch.status=permission_denied`、`rdp_console_reachable=true`、`hyperv_vmconnect_open=true`、`remote_execution_channel_ready=false`、`blockers=["windows99_remote_execution_channel_unavailable","windows99_winrm_unavailable","windows99_ssh_batch_denied"]`。
+- 即時 Windows99 VMware collector check：`port_22_open=1`、`port_3389_open=1`、`ssh_candidate_users=ogt,wooo,ooo,administrator,Administrator`、`ssh_batchmode_auth_ready=0`、`verify_collection_status=blocked_ssh_publickey_auth_missing`；沒有遠端寫入、沒有重啟、沒有 VM power change、沒有 Windows Update apply。
+
+**驗證**：
+- `DATABASE_URL=postgresql+asyncpg://test:test@localhost/test PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_knowledge_repository_read_model.py scripts/reboot-recovery/tests/test_windows99_management_channel_probe.py -q -p no:cacheprovider`：`6 passed`。
+- `python3.11 -m pytest ops/runner/test_cd_controlled_runtime_profile.py -q -p no:cacheprovider`：`49 passed`。
+- `python3.11` YAML readback `.gitea/workflows/cd.yaml`：通過。
+- `python3.11 ops/runner/guard-gitea-runner-pressure.py --root .`：`GITEA_RUNNER_PRESSURE_GUARD_OK workflow_files=12 scheduled_workflows=4 auto_branch_events_on_110=0 generic_runner_labels=0`。
+- `git diff --check`：通過。
+
+**仍維持**：
+- Production 仍停在 `e3887395cf`，最新 source `038c8808` 尚未部署；下一步必須推此 CD profile fix，等新的 Gitea CD 產生 deploy marker 後重驗 delivery / reboot scorecard / priority / Gitea bundle readback。
+- P0-006 仍 fail-closed：`windows99_remote_execution_channel_ready=false`、`windows99_vmware_verify_ready=false`、`windows99_update_no_auto_reboot_ready=false`；不得宣稱 10 分鐘全主機自動恢復 SLO 已完成。
+- 未讀 secret / token / `.env` / raw sessions / SQLite / auth；未使用 GitHub / gh；未 workflow_dispatch；未重啟主機 / VM / Docker / Nginx / K3s / DB / firewall；未 DROP / TRUNCATE / restore / prune。
+
 ## 2026-07-03 — 00:01 Knowledge Base production empty readback fix
 
 **完成內容**：

ops/runner/test_cd_controlled_runtime_profile.py

@@ -209,6 +209,19 @@ def test_log_controlled_writeback_consumer_apply_stays_on_controlled_runtime_pro
         assert source in text
 
 
+def test_knowledge_readback_sources_stay_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "apps/api/src/repositories/knowledge_repository.py)",
+        "apps/api/src/services/knowledge_service.py)",
+        "apps/api/tests/test_knowledge_repository_read_model.py)",
+        "src/repositories/knowledge_repository.py",
+        "src/services/knowledge_service.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_telegram_alert_ai_automation_matrix_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     expected_sources = [