fix(api): expose credential escrow safe next step

apps/api/src/services/credential_escrow_evidence_intake_readiness.py

@@ -254,6 +254,7 @@ def _build_payload(
     )
     if effective_missing == 0 and not blocked_items:
         status = "ready_for_escrow_marker_review"
+    safe_next_step = "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
 
     payload = {
         "schema_version": _SCHEMA_VERSION,
@@ -261,6 +262,7 @@ def _build_payload(
         "priority": "P0-005",
         "scope": "credential_escrow_evidence_intake",
         "status": status,
+        "safe_next_step": safe_next_step,
         "readback": {
             "workplan_id": "P0-005",
             "workplan_title": "產品資料與備份 contract",
@@ -270,9 +272,7 @@ def _build_payload(
             "source_backup_dr_readiness_matrix_ref": (
                 "docs/evaluations/backup_dr_readiness_matrix_2026-06-04.json"
             ),
-            "safe_next_step": (
-                "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
-            ),
+            "safe_next_step": safe_next_step,
         },
         "required_evidence_items": missing_items,
         "forbidden_values": forbidden_values,

apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py

@@ -27,6 +27,10 @@ def test_credential_escrow_evidence_intake_reports_p0_blocker():
     assert payload["schema_version"] == "credential_escrow_evidence_intake_readiness_v1"
     assert payload["priority"] == "P0-005"
     assert payload["status"] == "blocked_waiting_non_secret_credential_escrow_evidence"
+    assert payload["safe_next_step"] == (
+        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    )
+    assert payload["readback"]["safe_next_step"] == payload["safe_next_step"]
     assert payload["rollups"]["required_item_count"] == 5
     assert payload["rollups"]["missing_item_count"] == 5
     assert payload["rollups"]["effective_escrow_missing_count"] == 5
@@ -56,6 +60,9 @@ def test_credential_escrow_evidence_intake_endpoint_returns_readiness():
     assert response.status_code == 200
     data = response.json()
     assert data["priority"] == "P0-005"
+    assert data["safe_next_step"] == (
+        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    )
     assert data["rollups"]["missing_item_count"] == 5
     assert data["operation_boundaries"]["restore_execution_allowed"] is False
     assert data["operation_boundaries"]["workflow_trigger_allowed"] is False