fix(security): restrict executor SSH egress

apps/api/tests/test_awoooi_priority_work_order_readback_api.py

@@ -982,7 +982,7 @@ def test_ai_automation_program_ledger_is_authoritative_and_runtime_strict():
         for item_id in runtime_critical_ids
     )
     assert work_item_by_id["AIA-P0-011"]["order"] == 2
-    assert work_item_by_id["AIA-P0-011"]["status"] == "pending"
+    assert work_item_by_id["AIA-P0-011"]["status"] == "in_progress"
     assert work_item_by_id["AIA-P0-002"]["order"] == 3
     assert work_item_by_id["AIA-P0-006"]["order"] == 7
     assert work_item_by_id["AIA-P0-008"]["order"] == 8
@@ -1003,7 +1003,7 @@ def test_ai_automation_program_ledger_is_authoritative_and_runtime_strict():
         "broad_exception_handler_count"
     ] == 1371
     assert program_summary["codebase_review_finding_count"] == 8
-    assert program_summary["codebase_review_critical_finding_count"] == 3
+    assert program_summary["codebase_review_critical_finding_count"] == 2
     tenant_finding = next(
         row
         for row in program["codebase_review"]["findings"]

apps/api/tests/test_executor_network_policy_boundary.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+def _network_policies() -> dict[str, dict[str, Any]]:
+    repo_root = Path(__file__).resolve().parents[3]
+    path = repo_root / "k8s/awoooi-prod/02-network-policy.yaml"
+    return {
+        document["metadata"]["name"]: document
+        for document in yaml.safe_load_all(path.read_text())
+        if document
+    }
+
+
+def _ports(policy: dict[str, Any]) -> set[int]:
+    return {
+        int(port["port"])
+        for rule in policy["spec"].get("egress", [])
+        for port in rule.get("ports", [])
+    }
+
+
+def test_common_egress_does_not_grant_ssh() -> None:
+    policies = _network_policies()
+
+    common = policies["allow-required-egress"]
+    assert common["spec"]["podSelector"] == {
+        "matchLabels": {"system": "awoooi"}
+    }
+    assert 22 not in _ports(common)
+
+
+def test_only_execution_broker_receives_allowlisted_ssh_egress() -> None:
+    policies = _network_policies()
+
+    broker = policies["allow-ansible-executor-broker-ssh-egress"]
+    assert broker["spec"]["podSelector"] == {
+        "matchLabels": {
+            "app": "awoooi-ansible-executor-broker",
+            "component": "execution-broker",
+        }
+    }
+    assert _ports(broker) == {22}
+    assert {
+        target["ipBlock"]["cidr"]
+        for rule in broker["spec"]["egress"]
+        for target in rule["to"]
+    } == {
+        "192.168.0.110/32",
+        "192.168.0.120/32",
+        "192.168.0.121/32",
+        "192.168.0.188/32",
+    }
+
+
+def test_legacy_marker_does_not_accidentally_allow_egress() -> None:
+    legacy = _network_policies()["deny-legacy-access"]
+
+    assert legacy["spec"]["policyTypes"] == ["Egress"]
+    assert legacy["spec"]["egress"] == []
+
+
+def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
+
+    assert "02-network-policy.yaml" in workflow
+    assert "NETWORK_POLICY_ROLLBACK_FILE" in workflow
+    assert "allow-ansible-executor-broker-ssh-egress" in workflow
+    assert "api_ssh_egress_denied=true" in workflow
+    assert "worker_ssh_egress_denied=true" in workflow
+    assert "broker_ssh_egress_allowlisted=true" in workflow
+    assert "legacy_namespace_egress_allow_absent=true" in workflow

apps/api/tests/test_executor_trust_boundary_readback.py

@@ -21,6 +21,10 @@ def _verified_receipt(source_sha: str = "abc123") -> dict[str, str]:
         "broker_kubernetes_token_absent": "true",
         "broker_ssh_mount_present": "true",
         "legacy_executor_binding_absent": "true",
+        "api_ssh_egress_denied": "true",
+        "worker_ssh_egress_denied": "true",
+        "broker_ssh_egress_allowlisted": "true",
+        "legacy_namespace_egress_allow_absent": "true",
     }
 
 
@@ -46,10 +50,10 @@ def test_executor_trust_boundary_rejects_stale_or_incomplete_receipt() -> None:
     assert "verified_source_sha_mismatch" in stale["active_blockers"]
 
     incomplete_receipt = _verified_receipt()
-    incomplete_receipt["worker_ssh_mount_absent"] = "false"
+    incomplete_receipt["worker_ssh_egress_denied"] = "false"
     incomplete = build_executor_trust_boundary_readback(
         incomplete_receipt,
         deployed_source_sha="abc123",
     )
     assert incomplete["production_boundary_verified"] is False
-    assert "worker_ssh_mount_absent_not_verified" in incomplete["active_blockers"]
+    assert "worker_ssh_egress_denied_not_verified" in incomplete["active_blockers"]

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -154,7 +154,7 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "repair-ssh-key|repair-known-hosts|ssh-mcp-key" in workflow
     assert "legacy cluster-wide executor binding still exists" in workflow
     assert "awoooi-executor-boundary-verification" in workflow
-    assert "awoooi_executor_boundary_verification_v1" in workflow
+    assert "awoooi_executor_boundary_verification_v2" in workflow
     assert "executor_boundary_public_readback=verified_ready" in workflow
     assert "verified_source_sha" in workflow
     assert "argocd.argoproj.io/sync-options=Prune=false" in workflow
@@ -196,4 +196,7 @@ def test_api_log_does_not_claim_skipped_executor_was_scheduled() -> None:
     assert "awooop_ansible_check_mode_worker_schedule_evaluated" in main_source
     assert "scheduled_in_api_process=scheduled_task is not None" in main_source
     assert 'production_process_owner="awoooi-worker"' in main_source
+    assert (
+        'production_process_owner="awoooi-ansible-executor-broker"' in main_source
+    )
     assert "awooop_ansible_candidate_backfill_worker_schedule_evaluated" in main_source