wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(github): add operator unblock governance closure

Browse Source
This commit is contained in:
Your Name
2026-06-28 18:58:25 +08:00
parent 5c540460c0
commit 9e3e7fbb6b
7 changed files with 637 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
apps/api/src/services/delivery_closure_workbench.py
View File

@@ -55,6 +55,10 @@ def build_delivery_closure_workbench(
github_boundaries = _dict(github.get("operation_boundaries"))
github_preflight = _dict(github.get("controlled_execution_preflight"))
github_operator_unblock = _dict(github_preflight.get("operator_unblock"))
github_governance_writeback = _dict(
github_preflight.get("internal_governance_writeback")
or github.get("internal_governance_writeback")
)
gitea_status = _dict(gitea.get("program_status"))
gitea_rollups = _dict(gitea.get("rollups"))
runtime_status = _dict(runtime.get("program_status"))
@@ -122,9 +126,20 @@ def build_delivery_closure_workbench(
"github_account_suspended"
)
is True,
"internal_governance_ready": github_governance_writeback.get("ready")
is True,
"km_writeback_ready": _int(
github_governance_writeback.get("km_writeback_ready_count")
),
"playbook_writeback_ready": _int(
github_governance_writeback.get(
"playbook_writeback_ready_count"
)
),
},
"href": "/governance?tab=automation-inventory",
"operator_unblock": github_operator_unblock,
"internal_governance_writeback": github_governance_writeback,
"next_action": str(
_first_string(github_operator_unblock.get("required_actions"))
or github_operator_unblock.get("safe_handoff")
@@ -263,6 +278,28 @@ def build_delivery_closure_workbench(
"github_operator_unblock_status": str(
github_operator_unblock.get("status") or ""
),
"github_internal_governance_writeback_ready": github_governance_writeback.get(
"ready"
)
is True,
"github_mcp_evidence_packet_count": _int(
github_governance_writeback.get("mcp_evidence_packet_count")
),
"github_rag_evidence_ref_count": _int(
github_governance_writeback.get("rag_evidence_ref_count")
),
"github_km_writeback_ready_count": _int(
github_governance_writeback.get("km_writeback_ready_count")
),
"github_playbook_writeback_ready_count": _int(
github_governance_writeback.get("playbook_writeback_ready_count")
),
"github_timeline_log_ready_count": _int(
github_governance_writeback.get("timeline_log_ready_count")
),
"github_logbook_entry_count": _int(
github_governance_writeback.get("logbook_entry_count")
),
"secret_values_collected": False,
},
"source_statuses": source_statuses,

259
apps/api/src/services/github_target_private_backup_evidence_gate.py
View File

@@ -29,12 +29,18 @@ _EXECUTION_AUTHORIZATION_FILE = (
_CONTROLLED_EXECUTION_PREFLIGHT_FILE = (
"github-target-controlled-execution-preflight.snapshot.json"
)
_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_FILE = (
"github-operator-unblock-governance-closure.snapshot.json"
)
_EXECUTION_AUTHORIZATION_SCHEMA_VERSION = (
"github_target_owner_execution_authorization_v1"
)
_CONTROLLED_EXECUTION_PREFLIGHT_SCHEMA_VERSION = (
"github_target_controlled_execution_preflight_v1"
)
_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_SCHEMA_VERSION = (
"github_operator_unblock_governance_closure_v1"
)
_GITHUB_WRITE_CHANNEL_RECHECK_COMMANDS = [
"gh api /user --jq '{login:.login}'",
"git push --dry-run origin HEAD:refs/heads/codex-github-write-channel-readonly-check",
@@ -166,6 +172,9 @@ def load_latest_github_target_private_backup_evidence_gate(
controlled_execution_preflight = _load_optional_snapshot(
directory / _CONTROLLED_EXECUTION_PREFLIGHT_FILE
)
operator_unblock_governance_closure = _load_optional_snapshot(
directory / _OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_FILE
)
_require_source_contracts(
decision=decision,
@@ -176,6 +185,7 @@ def load_latest_github_target_private_backup_evidence_gate(
missing_source_readiness=missing_source_readiness,
execution_authorization=execution_authorization,
controlled_execution_preflight=controlled_execution_preflight,
operator_unblock_governance_closure=operator_unblock_governance_closure,
)
return build_github_target_private_backup_evidence_gate(
decision=decision,
@@ -186,6 +196,7 @@ def load_latest_github_target_private_backup_evidence_gate(
missing_source_readiness=missing_source_readiness,
execution_authorization=execution_authorization,
controlled_execution_preflight=controlled_execution_preflight,
operator_unblock_governance_closure=operator_unblock_governance_closure,
)
@@ -504,6 +515,7 @@ def build_github_target_private_backup_evidence_gate(
missing_source_readiness: dict[str, Any] | None = None,
execution_authorization: dict[str, Any] | None = None,
controlled_execution_preflight: dict[str, Any] | None = None,
operator_unblock_governance_closure: dict[str, Any] | None = None,
) -> dict[str, Any]:
"""Build the read-only gate response from source-control snapshots."""
connector_payload = _dict(connector_readback)
@@ -512,6 +524,7 @@ def build_github_target_private_backup_evidence_gate(
missing_summary = _dict(missing_payload.get("summary"))
authorization_payload = _dict(execution_authorization)
execution_preflight_payload = _dict(controlled_execution_preflight)
governance_payload = _dict(operator_unblock_governance_closure)
authorization_summary = _execution_authorization_summary(authorization_payload)
execution_authorized = (
authorization_summary["authorization_present"]
@@ -615,6 +628,15 @@ def build_github_target_private_backup_evidence_gate(
targets=targets,
authorization_summary=authorization_summary,
)
internal_governance_writeback = (
_github_operator_unblock_internal_governance_writeback(
payload=governance_payload,
controlled_preflight=controlled_preflight,
)
)
controlled_preflight["internal_governance_writeback"] = (
internal_governance_writeback
)
private_backup_verified_count = sum(
1 for row in approval_required_targets if row["private_backup_verified"]
@@ -647,6 +669,7 @@ def build_github_target_private_backup_evidence_gate(
"github_missing_source_readiness": f"docs/security/{_MISSING_SOURCE_READINESS_FILE}",
"github_owner_execution_authorization": f"docs/security/{_EXECUTION_AUTHORIZATION_FILE}",
"github_controlled_execution_preflight": f"docs/security/{_CONTROLLED_EXECUTION_PREFLIGHT_FILE}",
"github_operator_unblock_governance_closure": f"docs/security/{_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_FILE}",
},
"summary": {
"target_decision_count": len(targets),
@@ -817,6 +840,30 @@ def build_github_target_private_backup_evidence_gate(
"github_missing_target_github_404_count": controlled_preflight[
"github_connector_missing_target_404_count"
],
"github_operator_unblock_internal_governance_ready": internal_governance_writeback[
"ready"
],
"github_operator_unblock_mcp_evidence_packet_count": internal_governance_writeback[
"mcp_evidence_packet_count"
],
"github_operator_unblock_rag_evidence_ref_count": internal_governance_writeback[
"rag_evidence_ref_count"
],
"github_operator_unblock_km_writeback_ready_count": internal_governance_writeback[
"km_writeback_ready_count"
],
"github_operator_unblock_playbook_writeback_ready_count": internal_governance_writeback[
"playbook_writeback_ready_count"
],
"github_operator_unblock_timeline_log_ready_count": internal_governance_writeback[
"timeline_log_ready_count"
],
"github_operator_unblock_logbook_entry_count": internal_governance_writeback[
"logbook_entry_count"
],
"github_operator_unblock_github_write_performed": internal_governance_writeback[
"github_write_performed"
],
"execution_ready_count": sum(
1 for row in approval_required_targets if row["execution_ready"]
),
@@ -847,6 +894,7 @@ def build_github_target_private_backup_evidence_gate(
"owner_response_intake_readiness": owner_response_intake_readiness,
"safe_credential_evidence_intake_readiness": safe_credential_evidence_intake_readiness,
"controlled_execution_preflight": controlled_preflight,
"internal_governance_writeback": internal_governance_writeback,
"targets": targets,
"acceptance_requirements": _acceptance_requirements(owner_response),
"rejection_rules": _rejection_rules(owner_response),
@@ -1375,6 +1423,7 @@ def _require_source_contracts(
missing_source_readiness: dict[str, Any],
execution_authorization: dict[str, Any],
controlled_execution_preflight: dict[str, Any],
operator_unblock_governance_closure: dict[str, Any],
) -> None:
_require_schema(decision, "github_target_decision_v1", _DECISION_FILE)
_require_schema(
@@ -1410,6 +1459,12 @@ def _require_source_contracts(
_CONTROLLED_EXECUTION_PREFLIGHT_SCHEMA_VERSION,
_CONTROLLED_EXECUTION_PREFLIGHT_FILE,
)
if operator_unblock_governance_closure:
_require_schema(
operator_unblock_governance_closure,
_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_SCHEMA_VERSION,
_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_FILE,
)
_require_decision_consistency(decision, _DECISION_FILE)
_require_probe_consistency(probe, _PROBE_FILE)
_require_approval_package_consistency(approval_package, _APPROVAL_PACKAGE_FILE)
@@ -1434,6 +1489,11 @@ def _require_source_contracts(
missing_source_readiness=missing_source_readiness,
label=_CONTROLLED_EXECUTION_PREFLIGHT_FILE,
)
if operator_unblock_governance_closure:
_require_operator_unblock_governance_closure_consistency(
payload=operator_unblock_governance_closure,
label=_OPERATOR_UNBLOCK_GOVERNANCE_CLOSURE_FILE,
)
_require_owner_response_boundaries(owner_response, _OWNER_RESPONSE_FILE)
@@ -1853,6 +1913,87 @@ def _require_controlled_execution_preflight_consistency(
)
def _require_operator_unblock_governance_closure_consistency(
*, payload: dict[str, Any], label: str
) -> None:
summary = _dict(payload.get("summary"))
boundaries = _dict(payload.get("operation_boundaries"))
mcp_packets = _list(payload.get("mcp_evidence_packets"))
rag_refs = _list(payload.get("rag_evidence_refs"))
km_items = [_dict(row) for row in _list(payload.get("km_writeback_items"))]
playbook_items = [
_dict(row) for row in _list(payload.get("playbook_writeback_items"))
]
timeline_items = [_dict(row) for row in _list(payload.get("timeline_log_items"))]
logbook_entries = _list(payload.get("logbook_entries"))
count_pairs = {
"mcp_evidence_packet_count": len(mcp_packets),
"rag_evidence_ref_count": len(rag_refs),
"km_writeback_item_count": len(km_items),
"km_writeback_ready_count": sum(
1 for row in km_items if row.get("ready_for_writeback") is True
),
"playbook_writeback_item_count": len(playbook_items),
"playbook_writeback_ready_count": sum(
1 for row in playbook_items if row.get("ready_for_writeback") is True
),
"timeline_log_item_count": len(timeline_items),
"timeline_log_ready_count": sum(
1 for row in timeline_items if row.get("ready_for_writeback") is True
),
"logbook_entry_count": len(logbook_entries),
}
mismatched = sorted(
key for key, expected in count_pairs.items() if _int(summary.get(key)) != expected
)
if mismatched:
raise ValueError(f"{label}: governance writeback count drift: {mismatched}")
false_summary_flags = {
"github_write_performed",
"gh_cli_called",
"github_api_called",
"github_repo_creation_performed",
"github_refs_sync_performed",
"github_visibility_change_performed",
"secret_values_collected",
"raw_session_or_sqlite_read",
"runtime_write_performed",
"host_or_k8s_write_performed",
}
enabled = sorted(
flag for flag in false_summary_flags if summary.get(flag) is not False
)
false_boundary_flags = {
"github_app_connector_mcp_allowed",
"gh_cli_allowed",
"github_api_allowed",
"github_actions_allowed",
"github_repo_creation_allowed",
"github_refs_sync_allowed",
"github_visibility_change_allowed",
"github_primary_switch_allowed",
"force_push_allowed",
"delete_refs_allowed",
"secret_value_collection_allowed",
"private_clone_url_collection_allowed",
"raw_session_read_allowed",
"sqlite_read_allowed",
"runtime_write_allowed",
"host_or_k8s_write_allowed",
}
enabled.extend(
sorted(
flag for flag in false_boundary_flags if boundaries.get(flag) is not False
)
)
if enabled:
raise ValueError(
f"{label}: governance closure must stay local-only: {enabled}"
)
def _require_owner_response_boundaries(payload: dict[str, Any], label: str) -> None:
if payload.get("runtime_execution_authorized") is not False:
raise ValueError(f"{label}: runtime_execution_authorized must be false")
@@ -2247,6 +2388,124 @@ def _github_write_channel_operator_unblock(
}
def _github_operator_unblock_internal_governance_writeback(
*,
payload: dict[str, Any],
controlled_preflight: dict[str, Any],
) -> dict[str, Any]:
if not payload:
return {
"schema_version": "missing_github_operator_unblock_governance_closure_v1",
"generated_at": "",
"status": "missing_operator_unblock_governance_closure_snapshot",
"ready": False,
"mcp_evidence_packet_count": 0,
"rag_evidence_ref_count": 0,
"km_writeback_ready_count": 0,
"playbook_writeback_ready_count": 0,
"timeline_log_ready_count": 0,
"logbook_entry_count": 0,
"github_account_status": controlled_preflight.get(
"github_account_status"
),
"github_account_suspended": controlled_preflight.get(
"github_account_suspended"
)
is True,
"github_write_channel_ready": controlled_preflight.get(
"github_write_channel_ready"
)
is True,
"github_write_performed": False,
"secret_values_collected": False,
"source_refs": {},
"mcp_evidence_packets": [],
"rag_evidence_refs": [],
"km_writeback_items": [],
"playbook_writeback_items": [],
"timeline_log_items": [],
"logbook_entries": [],
"operation_boundaries": {},
"still_forbidden": [],
"next_action": "add_committed_operator_unblock_governance_closure_snapshot",
}
summary = _dict(payload.get("summary"))
boundaries = _dict(payload.get("operation_boundaries"))
return {
"schema_version": str(payload.get("schema_version") or ""),
"generated_at": str(payload.get("generated_at") or ""),
"status": str(payload.get("status") or ""),
"ready": summary.get("governance_writeback_ready") is True,
"mcp_evidence_packet_count": _int(
summary.get("mcp_evidence_packet_count")
),
"rag_evidence_ref_count": _int(summary.get("rag_evidence_ref_count")),
"km_writeback_ready_count": _int(
summary.get("km_writeback_ready_count")
),
"playbook_writeback_ready_count": _int(
summary.get("playbook_writeback_ready_count")
),
"timeline_log_ready_count": _int(
summary.get("timeline_log_ready_count")
),
"logbook_entry_count": _int(summary.get("logbook_entry_count")),
"github_account_status": str(
summary.get("github_account_status")
or controlled_preflight.get("github_account_status")
or "unknown"
),
"github_account_suspended": summary.get("github_account_suspended") is True,
"github_write_channel_ready": summary.get("github_write_channel_ready")
is True,
"source_preflight_ready_count": _int(
summary.get("source_preflight_ready_count")
),
"controlled_apply_ready_count": _int(
summary.get("controlled_apply_ready_count")
),
"blocked_preflight_target_count": _int(
summary.get("blocked_preflight_target_count")
),
"github_write_performed": summary.get("github_write_performed") is True,
"gh_cli_called": summary.get("gh_cli_called") is True,
"github_api_called": summary.get("github_api_called") is True,
"secret_values_collected": summary.get("secret_values_collected") is True,
"source_refs": _dict(payload.get("source_refs")),
"mcp_evidence_packets": _list(payload.get("mcp_evidence_packets")),
"rag_evidence_refs": _list(payload.get("rag_evidence_refs")),
"km_writeback_items": _list(payload.get("km_writeback_items")),
"playbook_writeback_items": _list(payload.get("playbook_writeback_items")),
"timeline_log_items": _list(payload.get("timeline_log_items")),
"logbook_entries": _list(payload.get("logbook_entries")),
"operation_boundaries": {
"local_source_snapshot_allowed": boundaries.get(
"local_source_snapshot_allowed"
)
is True,
"github_app_connector_mcp_allowed": False,
"gh_cli_allowed": False,
"github_api_allowed": False,
"github_actions_allowed": False,
"github_repo_creation_allowed": False,
"github_refs_sync_allowed": False,
"github_visibility_change_allowed": False,
"github_primary_switch_allowed": False,
"force_push_allowed": False,
"delete_refs_allowed": False,
"secret_value_collection_allowed": False,
"private_clone_url_collection_allowed": False,
"raw_session_read_allowed": False,
"sqlite_read_allowed": False,
"runtime_write_allowed": False,
"host_or_k8s_write_allowed": False,
},
"still_forbidden": _strings(payload.get("still_forbidden")),
"next_action": str(payload.get("next_action") or ""),
}
def _controlled_execution_target_summary(value: Any) -> dict[str, Any]:
row = _dict(value)
return {