feat(ci): copy onboarding warning-step template

apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py

@@ -42,6 +42,19 @@ _SNAPSHOT_PATH = (
     / "operations"
     / "p0-cicd-baseline-source-readiness.snapshot.json"
 )
+_WARNING_STEP_TEMPLATE_PATH = (
+    _REPO_ROOT
+    / "docs"
+    / "operations"
+    / "templates"
+    / "awoooi-gitea-onboarding-warning-step.workflow.yaml"
+)
+_WARNING_STEP_WORKFLOW_PATH = (
+    _REPO_ROOT
+    / ".gitea"
+    / "workflows"
+    / "awoooi-onboarding-warning-step.yaml"
+)
 
 
 def test_p0_cicd_baseline_source_readiness_loader_reports_ready_sources():
@@ -117,6 +130,34 @@ def test_recreated_onboarding_sources_open_only_controlled_template_copy_gate():
         == payloads[1]["readback"]["required_acknowledgement_count"]
     )
     assert payloads[1]["readback"]["ready_for_template_copy_plan"] is True
+    execution_plan = payloads[2]
+    assert execution_plan["status"] == "controlled_template_copy_execution_plan_ready"
+    assert (
+        execution_plan["readback"]["execution_status"]
+        == "ready_for_controlled_template_copy"
+    )
+    assert execution_plan["readback"]["dry_run_only"] is False
+    assert (
+        execution_plan["readback"]["source_template_path"]
+        == "docs/operations/templates/"
+        "awoooi-gitea-onboarding-warning-step.workflow.yaml"
+    )
+    assert (
+        execution_plan["readback"]["destination_workflow_path"]
+        == ".gitea/workflows/awoooi-onboarding-warning-step.yaml"
+    )
+    assert execution_plan["readback"]["forbidden_events"] == [
+        "push",
+        "pull_request",
+        "pull_request_target",
+    ]
+    assert execution_plan["readback"]["allowed_runner_labels"] == [
+        "awoooi-non110-host"
+    ]
+    assert (
+        execution_plan["operation_boundaries"]["workflow_modification_allowed"]
+        is False
+    )
     apply_gate = payloads[3]
     assert apply_gate["status"] == "controlled_template_copy_apply_gate_ready"
     assert apply_gate["readback"]["apply_allowed"] is True
@@ -163,6 +204,32 @@ def test_p0_cicd_baseline_source_readiness_endpoint_returns_snapshot():
     assert data["operation_boundaries"]["workflow_modification_allowed"] is False
 
 
+def test_template_copy_execution_plan_endpoint_returns_controlled_plan():
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.get(
+        "/api/v1/agents/"
+        "awoooi-gitea-onboarding-warning-step-template-copy-execution-plan"
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert (
+        data["schema_version"]
+        == "awoooi_gitea_onboarding_warning_step_template_copy_execution_plan_v1"
+    )
+    assert data["status"] == "controlled_template_copy_execution_plan_ready"
+    assert (
+        data["readback"]["execution_status"]
+        == "ready_for_controlled_template_copy"
+    )
+    assert data["readback"]["dry_run_only"] is False
+    assert data["readback"]["template_runtime_default"] == "fail_closed_job_disabled"
+    assert data["operation_boundaries"]["workflow_trigger_allowed"] is False
+
+
 def test_template_copy_apply_gate_endpoint_returns_controlled_gate():
     app = FastAPI()
     app.include_router(router, prefix="/api/v1")
@@ -185,3 +252,25 @@ def test_template_copy_apply_gate_endpoint_returns_controlled_gate():
     assert data["readback"]["workflow_trigger_authorized"] is False
     assert data["operation_boundaries"]["workflow_modification_allowed"] is True
     assert data["operation_boundaries"]["workflow_trigger_allowed"] is False
+
+
+def test_warning_step_template_copy_is_fail_closed_and_pressure_guarded():
+    template = _WARNING_STEP_TEMPLATE_PATH.read_text(encoding="utf-8")
+    workflow = _WARNING_STEP_WORKFLOW_PATH.read_text(encoding="utf-8")
+
+    assert workflow == template
+    for forbidden in [
+        "push:",
+        "pull_request:",
+        "pull_request_target:",
+        "awoooi-host",
+        "awoooi-ubuntu",
+        "ubuntu-latest",
+        "self-hosted",
+    ]:
+        assert forbidden not in workflow
+
+    assert "workflow_dispatch:" in workflow
+    assert "runs-on: awoooi-non110-host" in workflow
+    assert 'AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "0"' in workflow
+    assert "ops/runner/guard-gitea-runner-pressure.py --root ." in workflow