fix(github): expose operator unblock actions

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -30,6 +30,10 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert data["summary"]["github_api_forbidden_count"] == 6
     assert data["summary"]["github_controlled_apply_ready_count"] == 0
     assert data["summary"]["github_blocked_preflight_target_count"] == 5
+    assert data["summary"]["github_operator_unblock_required"] is True
+    assert data["summary"]["github_operator_unblock_status"] == (
+        "github_account_suspended_external_action_required"
+    )
     assert data["summary"]["secret_values_collected"] is False
     assert data["summary"]["average_completion_percent"] >= 0
     assert data["summary"]["high_risk_blocker_count"] > 0
@@ -64,6 +68,17 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert lanes["github"]["metric"]["write_channel_ready"] is False
     assert lanes["github"]["metric"]["github_account_status"] == "suspended"
     assert lanes["github"]["metric"]["github_account_suspended"] is True
+    assert lanes["github"]["operator_unblock"]["required"] is True
+    assert lanes["github"]["operator_unblock"]["status"] == (
+        "github_account_suspended_external_action_required"
+    )
+    assert (
+        "complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
+        in lanes["github"]["operator_unblock"]["required_actions"]
+    )
+    assert lanes["github"]["next_action"] == (
+        "complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
+    )
     assert all(0 <= lane["completion_percent"] <= 100 for lane in lanes.values())
     assert all(lane["tone"] in {"ok", "warn", "danger"} for lane in lanes.values())
 

apps/api/tests/test_github_target_private_backup_evidence_gate.py

@@ -245,6 +245,25 @@ def test_load_github_target_private_backup_evidence_gate_from_committed_snapshot
     assert controlled_preflight["github_connector_missing_target_404_count"] == 0
     assert controlled_preflight["blocked_preflight_target_count"] == 5
     assert controlled_preflight["controlled_apply_ready_count"] == 0
+    assert controlled_preflight["operator_unblock_required"] is True
+    assert (
+        controlled_preflight["operator_unblock_status"]
+        == "github_account_suspended_external_action_required"
+    )
+    operator_unblock = controlled_preflight["operator_unblock"]
+    assert operator_unblock["required"] is True
+    assert operator_unblock["github_account_status"] == "suspended"
+    assert operator_unblock["github_account_suspended"] is True
+    assert operator_unblock["github_api_forbidden_count"] == 6
+    assert (
+        "complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
+        in operator_unblock["required_actions"]
+    )
+    assert "gh api /user --jq '{login:.login}'" in operator_unblock["recheck_commands"]
+    assert (
+        "do_not_paste_pat_token_private_key_cookie_session_or_authorization_header"
+        in operator_unblock["still_forbidden"]
+    )
     assert (
         controlled_preflight["operation_boundaries"]["controlled_apply_allowed"]
         is False

apps/api/tests/test_github_target_private_backup_evidence_gate_api.py

@@ -129,6 +129,19 @@ def test_github_target_private_backup_evidence_gate_endpoint_returns_read_only_g
     assert controlled_preflight["authorization_ready"] is True
     assert controlled_preflight["preflight_ready"] is False
     assert controlled_preflight["github_write_channel_ready"] is False
+    assert controlled_preflight["operator_unblock_required"] is True
+    assert (
+        controlled_preflight["operator_unblock_status"]
+        == "github_account_suspended_external_action_required"
+    )
+    assert (
+        "complete_github_account_suspension_appeal_or_provide_authorized_writable_namespace"
+        in controlled_preflight["operator_unblock"]["required_actions"]
+    )
+    assert (
+        "git push --dry-run origin HEAD:refs/heads/codex-github-write-channel-readonly-check"
+        in controlled_preflight["operator_unblock"]["recheck_commands"]
+    )
     assert controlled_preflight["blocked_preflight_target_count"] == 5
     assert "192.168.0." not in response.text
 
@@ -144,8 +157,7 @@ def test_github_target_controlled_execution_preflight_endpoint_returns_write_gap
     data = response.json()
     assert data["schema_version"] == "github_target_controlled_execution_preflight_v1"
     assert (
-        data["status"]
-        == "blocked_github_account_suspended_and_write_channel_required"
+        data["status"] == "blocked_github_account_suspended_and_write_channel_required"
     )
     assert data["authorization_ready"] is True
     assert data["preflight_ready"] is False
@@ -153,6 +165,15 @@ def test_github_target_controlled_execution_preflight_endpoint_returns_write_gap
     assert data["github_account_status"] == "suspended"
     assert data["github_account_suspended"] is True
     assert data["github_api_forbidden_count"] == 6
+    assert data["operator_unblock_required"] is True
+    assert data["operator_unblock_status"] == (
+        "github_account_suspended_external_action_required"
+    )
+    assert data["operator_unblock"]["github_account_suspended"] is True
+    assert (
+        "do_not_paste_pat_token_private_key_cookie_session_or_redacted_authorization_header"
+        in data["operator_unblock"]["still_forbidden"]
+    )
     assert data["github_create_repo_channel_ready"] is False
     assert data["github_refs_sync_channel_ready"] is False
     assert data["source_preflight_ready_count"] == 5