Merge remote-tracking branch 'origin/main' into codex/p0-006-ai-log-triage-20260709

apps/api/tests/test_product_governance_matrix_readback_api.py

@@ -0,0 +1,172 @@
+from __future__ import annotations
+
+# ruff: noqa: E402
+import json
+import os
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
+
+from src.api.v1 import agents
+from src.api.v1.agents import router
+from src.services.gitea_repo_bundle_backup_readback import (
+    build_gitea_repo_bundle_backup_readback,
+)
+from src.services.product_governance_matrix_readback import (
+    build_product_governance_matrix_readback,
+    load_latest_product_governance_matrix_readback,
+)
+
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+_OPERATIONS_DIR = _REPO_ROOT / "docs" / "operations"
+_PRIVATE_INVENTORY_SNAPSHOT = (
+    _OPERATIONS_DIR / "awoooi-gitea-private-inventory-p0-scorecard.snapshot.json"
+)
+_DEV_PROD_SNAPSHOT = (
+    _OPERATIONS_DIR / "gitea-all-product-dev-prod-repo-readback.snapshot.json"
+)
+
+
+def _sample(name: str, value: float, **labels: str) -> dict:
+    merged = {"host": "188", **labels}
+    return {"name": name, "labels": merged, "value": value}
+
+
+def _repo_refs() -> list[str]:
+    data = json.loads(_DEV_PROD_SNAPSHOT.read_text(encoding="utf-8"))
+    return sorted(row["gitea_repo"] for row in data["products"])
+
+
+def _repo_bundle_payload() -> dict:
+    refs = _repo_refs()
+    samples = [
+        _sample("awoooi_gitea_bundle_expected_repo_count", len(refs)),
+        _sample("awoooi_gitea_bundle_expected_repo_missing_count", 0),
+        _sample("awoooi_gitea_bundle_failed_repo_count", 0),
+        _sample("awoooi_gitea_bundle_checksum_missing_count", 0),
+        _sample("awoooi_gitea_bundle_age_seconds", 600),
+        _sample("awoooi_gitea_bundle_fresh", 1),
+        _sample("awoooi_gitea_bundle_all_expected_ok", 1),
+        _sample("awoooi_gitea_bundle_sample_restore_dry_run_ok", 1),
+    ]
+    for repo in refs:
+        samples.extend(
+            [
+                _sample("awoooi_gitea_bundle_repo_present", 1, repo=repo),
+                _sample("awoooi_gitea_bundle_repo_ok", 1, repo=repo),
+                _sample("awoooi_gitea_bundle_repo_head_count", 2, repo=repo),
+                _sample(
+                    "awoooi_gitea_bundle_checksum_digest_present",
+                    1,
+                    repo=repo,
+                ),
+            ]
+        )
+    return build_gitea_repo_bundle_backup_readback(
+        metric_samples=samples,
+        generated_at="2026-07-10T12:00:00+08:00",
+        dev_prod_repo_refs=refs,
+        dev_prod_repo_truth_ref=(
+            "docs/operations/gitea-all-product-dev-prod-repo-readback.snapshot.json"
+        ),
+    )
+
+
+def test_product_governance_matrix_loads_committed_gitea_source_truth() -> None:
+    payload = load_latest_product_governance_matrix_readback(_OPERATIONS_DIR)
+
+    assert payload["schema_version"] == "product_governance_matrix_readback_v1"
+    assert payload["status"] == "product_governance_matrix_ready"
+    assert payload["source_control_authority"] == "gitea"
+    assert payload["summary"]["product_count"] == 12
+    assert payload["summary"]["ready_product_count"] == 12
+    assert payload["summary"]["canonical_repo_count"] == 12
+    assert payload["summary"]["ssh_verified_product_repo_count"] == 12
+    assert payload["summary"]["main_branch_present_product_repo_count"] == 12
+    assert payload["summary"]["dev_branch_present_product_repo_count"] == 12
+    assert payload["summary"]["private_or_auth_only_product_repo_count"] == 6
+    assert payload["summary"]["backup_evidence_linked_product_count"] == 12
+    assert payload["summary"]["backup_bundle_verified_product_count"] == 0
+    assert payload["summary"]["active_blocker_count"] == 0
+    assert payload["operation_boundaries"]["github_api_allowed"] is False
+    assert payload["operation_boundaries"]["secret_value_collection_allowed"] is False
+
+    rows = {row["product_id"]: row for row in payload["products"]}
+    assert rows["awoooi"]["canonical_repo"] == "wooo/awoooi"
+    assert rows["awoooi"]["prod_branch"] == "main"
+    assert rows["awoooi"]["dev_branch"] == "dev"
+    assert rows["awoooi"]["source_control_ready"] is True
+    assert rows["awooogo"]["canonical_repo"] == "wooo/AwoooGo"
+    assert rows["awooogo"]["private_or_auth_only"] is True
+    assert rows["awooogo"]["tokenless_http_status"] == 404
+    assert rows["awooogo"]["tokenless_404_is_visibility_auth"] is True
+    assert rows["awooogo"]["source_control_ready"] is True
+    assert rows["awooogo"]["backup_evidence_state"] == "backup_evidence_ref_only"
+
+
+def test_product_governance_matrix_applies_bundle_backup_overlay() -> None:
+    payload = load_latest_product_governance_matrix_readback(
+        _OPERATIONS_DIR,
+        repo_bundle_backup_readback=_repo_bundle_payload(),
+    )
+
+    assert payload["summary"]["backup_bundle_ready"] is True
+    assert payload["summary"]["backup_bundle_expected_repo_count"] == 12
+    assert payload["summary"]["backup_evidence_linked_product_count"] == 12
+    assert payload["summary"]["backup_bundle_verified_product_count"] == 12
+    assert all(
+        row["backup_evidence_state"] == "bundle_backup_verified"
+        for row in payload["products"]
+    )
+
+
+def test_product_governance_matrix_builder_blocks_missing_product_truth() -> None:
+    private_inventory_source = json.loads(
+        _PRIVATE_INVENTORY_SNAPSHOT.read_text(encoding="utf-8")
+    )
+    dev_prod = json.loads(_DEV_PROD_SNAPSHOT.read_text(encoding="utf-8"))
+    private_readback = load_latest_product_governance_matrix_readback(
+        _OPERATIONS_DIR
+    )
+    source_rows = private_inventory_source["product_rows"]
+    source_rows[0] = {**source_rows[0], "dev_branch_present": False}
+
+    payload = build_product_governance_matrix_readback(
+        private_inventory_source=private_inventory_source,
+        dev_prod_repo_readback=dev_prod,
+        private_inventory_readback={
+            "rollups": {
+                **private_readback["summary"],
+                "all_active_product_repos_have_gitea_owner_readiness_row": True,
+                "all_expected_product_repos_have_dev_and_main": False,
+            }
+        },
+        generated_at="2026-07-10T12:30:00+08:00",
+    )
+
+    assert payload["status"] == "product_governance_matrix_action_required"
+    assert payload["summary"]["ready_product_count"] == 11
+    assert payload["products"][0]["status"] == "action_required"
+
+
+def test_product_governance_matrix_endpoint_returns_payload(monkeypatch) -> None:
+    expected = load_latest_product_governance_matrix_readback(_OPERATIONS_DIR)
+    monkeypatch.setattr(
+        agents,
+        "load_latest_product_governance_matrix_readback",
+        lambda: expected,
+    )
+
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.get("/api/v1/agents/product-governance-matrix-readback")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["schema_version"] == "product_governance_matrix_readback_v1"
+    assert data["summary"]["product_count"] == 12
+    assert data["products"][0]["canonical_repo"].startswith("wooo/")

apps/api/tests/test_reboot_auto_recovery_slo_scorecard_api.py

@@ -46,6 +46,9 @@ EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP = (
     "restore_windows99_missing_vmx_source_for_aliases_then_rerun_no_secret_"
     "collector_and_scorecard_no_vm_power_change"
 )
+EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP = (
+    "rerun_no_secret_collector_and_scorecard_no_vm_power_change"
+)
 EXPECTED_WINDOWS99_POWERED_OFF_NEXT_STEP = (
     "run_windows99_vmware_autostart_check_mode_package_for_powered_off_aliases_"
     "then_rerun_no_secret_collector_no_vm_power_change"
@@ -1257,16 +1260,16 @@ def test_reboot_auto_recovery_slo_scorecard_promotes_collected_windows99_runtime
     )
 
     assert payload["primary_blocker"] == "reboot_event_required_host_unreachable"
-    assert payload["safe_next_step"] == EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP
-    assert payload["next_safe_action"] == EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP
+    assert payload["safe_next_step"] == EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP
+    assert payload["next_safe_action"] == EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP
     assert payload["readback"]["safe_next_step"] == (
-        EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP
+        EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP
     )
     assert payload["readback"]["next_safe_action"] == (
-        EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP
+        EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP
     )
     assert payload["reboot_sop_progress"]["next_safe_action"] == (
-        EXPECTED_WINDOWS99_MISSING_VMX_NEXT_STEP
+        EXPECTED_WINDOWS99_SCOPED_RELINK_READY_NEXT_STEP
     )
     assert payload["windows99_verify_collection"][
         "no_secret_collector_status"