From b4b273fb511cdb07a33547798590dc49dca9116f Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 19 Jul 2026 01:31:24 +0800 Subject: [PATCH] chore(sre): reconcile host ansible readiness --- ...3s_controlled_automation_work_items_api.py | 14 +++++++---- ...rolled-automation-work-items.snapshot.json | 23 ++++++++++++++----- 2 files changed, 27 insertions(+), 10 deletions(-) diff --git a/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py b/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py index c5a2607db..da481f6ca 100644 --- a/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py +++ b/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py @@ -116,11 +116,11 @@ def test_loader_returns_fixed_architecture_provider_order_and_agent99_bridge() - "total_items": 18, "by_priority": {"P0": 16, "P1": 2}, "by_status": { - "source_implemented_runtime_pending": 12, - "in_progress": 2, + "source_implemented_runtime_pending": 13, + "in_progress": 1, "planned": 4, }, - "source_implemented_items": 12, + "source_implemented_items": 13, "runtime_closed_items": 0, "program_completion_percent": 0, "asset_coverage_status": "partial", @@ -134,6 +134,12 @@ def test_ledger_links_confirmed_runtime_gaps_without_false_closure() -> None: assert "retired tombstone" in " ".join(items["AIA-SRE-002"]["confirmed_truth"]) assert "host120/host121" in " ".join(items["AIA-SRE-002"]["runtime_gaps"]) + assert items["AIA-SRE-008"]["status"] == ( + "source_implemented_runtime_pending" + ) + assert "all 13 auto-apply" in " ".join( + items["AIA-SRE-008"]["confirmed_truth"] + ) assert "public-HTTP" in items["AIA-SRE-013"]["exit_condition"] assert "Gate5 run" in " ".join(items["AIA-SRE-013"]["confirmed_truth"]) assert "Gemini" in " ".join(items["AIA-SRE-013"]["runtime_gaps"]) @@ -183,7 +189,7 @@ def test_projection_keeps_program_asset_and_runtime_truth_separate() -> None: payload = load_sre_k3s_controlled_automation_work_items() projection = build_sre_k3s_program_projection(payload) - assert projection["rollups"]["source_implemented_items"] == 12 + assert projection["rollups"]["source_implemented_items"] == 13 assert projection["rollups"]["runtime_closed_items"] == 0 assert projection["rollups"]["program_completion_percent"] == 0 assert projection["domain_count"] == 8 diff --git a/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json b/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json index 3cf5aa236..871dde2b4 100644 --- a/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json +++ b/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json @@ -486,23 +486,34 @@ "title": "Host/systemd 專屬 Ansible executor inventory", "owner_lane": "HostAutomation", "risk": "high", - "status": "in_progress", + "status": "source_implemented_runtime_pending", "dependencies": [ "AIA-SRE-004" ], "source_refs": [ "infra/ansible/inventory/hosts.yml", - "apps/api/src/services/awooop_ansible_audit_service.py" + "infra/ansible/playbooks/111-ollama-fallback.yml", + "apps/api/src/services/awooop_ansible_audit_service.py", + "apps/api/src/services/awooop_ansible_check_mode_service.py", + "apps/api/src/services/host_ansible_controlled_executor.py", + "apps/api/src/services/awooop_ansible_post_verifier.py", + "apps/api/src/services/awooop_ansible_learning_writeback.py" ], "executor": "host_ansible_executor", "verifier": "host_runtime_independent_verifier", "rollback": "catalog-specific compensating action", "exit_condition": "every host action has one exact inventory host, runtime manager identity, check mode, bounded apply and postcondition; host111 uses its LaunchAgent catalog and is verified locally plus from host120/host121", + "confirmed_truth": [ + "all 13 auto-apply and all 16 check-mode catalogs are registered with independent postconditions; the only no-check catalog is explicit break-glass restore-password-auth", + "Host111 Ollama uses one exact LaunchAgent catalog with host111 plus host120/host121 verifier origins and no Host110 fallback", + "check-mode and bounded apply are separate receipts, and executor return code alone cannot satisfy the post-verifier", + "inventory transport uses fixed strict host identities and does not permit accept-new host-key behavior" + ], "runtime_gaps": [ "host111 LaunchAgent catalog and sensor are source candidates without production apply receipt", "host120 and host121 independent origin probes have no same-run production verifier receipt" ], - "next_action": "close broad catalogs, then check/apply the exact host111 LaunchAgent playbook and verify local, host120 and host121 readbacks plus the canonical sensor rule" + "next_action": "deploy one exact source revision through the authorized Agent99/Ansible release lane, then check/apply the Host111 LaunchAgent catalog and independently read back host111 plus host120/host121 and the canonical sensor; retain no-write or rollback terminal on any mismatch" }, { "id": "AIA-SRE-009", @@ -861,11 +872,11 @@ "P1": 2 }, "by_status": { - "source_implemented_runtime_pending": 12, - "in_progress": 2, + "source_implemented_runtime_pending": 13, + "in_progress": 1, "planned": 4 }, - "source_implemented_items": 12, + "source_implemented_items": 13, "runtime_closed_items": 0, "program_completion_percent": 0, "asset_coverage_status": "partial",