Merge remote-tracking branch 'origin/main' into codex/p0-006-ai-log-triage-20260709

scripts/reboot-recovery/public-maintenance-edge-fallback-apply.sh

@@ -104,11 +104,8 @@ else
   echo "MAINTENANCE_FILE_PRESENT=0"
   echo "MAINTENANCE_FILE_HAS_MARKER=0"
 fi
-if sudo -n true >/dev/null 2>&1; then
-  echo "SUDO_N_READY=1"
-else
-  echo "SUDO_N_READY=0"
-fi
+SUDO_N_READY=$(if sudo -n true >/dev/null 2>&1; then echo 1; else echo 0; fi)
+echo "SUDO_N_READY=${SUDO_N_READY}"
 REMOTE_CONF_READABLE=$(if [ -r "$REMOTE_CONF" ]; then echo 1; else echo 0; fi)
 LIVE_CONF_HAS_INTERCEPT=$(if [ -r "$REMOTE_CONF" ] && grep -q 'proxy_intercept_errors on;' "$REMOTE_CONF"; then echo 1; else echo 0; fi)
 LIVE_CONF_HAS_ERROR_PAGE_503=$(if [ -r "$REMOTE_CONF" ] && grep -q 'error_page 502 503 504 =503 /__awoooi-maintenance.html;' "$REMOTE_CONF"; then echo 1; else echo 0; fi)
@@ -131,6 +128,9 @@ if [ "$REMOTE_CONF_READABLE" = 1 ] \
 else
   echo "EDGE_FALLBACK_READY=0"
   echo "BLOCKER edge_public_maintenance_live_config_drift"
+  if [ "$SUDO_N_READY" = 0 ]; then
+    echo "BLOCKER privileged_edge_apply_channel_unavailable"
+  fi
 fi
 REMOTE
 }

scripts/reboot-recovery/reboot-auto-recovery-slo-exporter.sh

@@ -315,6 +315,13 @@ edge_ready = kv.get("EDGE_FALLBACK_READY") == "1"
 edge_present = bool(kv.get("AWOOOI_PUBLIC_MAINTENANCE_EDGE_FALLBACK"))
 if edge_present and not edge_ready and not edge_blockers:
     edge_blockers.append("edge_public_maintenance_live_config_drift")
+if (
+    edge_present
+    and not edge_ready
+    and kv.get("SUDO_N_READY") == "0"
+    and "privileged_edge_apply_channel_unavailable" not in edge_blockers
+):
+    edge_blockers.append("privileged_edge_apply_channel_unavailable")
 
 blockers = list(payload.get("blockers") or [])
 for blocker in edge_blockers:

scripts/reboot-recovery/reboot-auto-recovery-slo-scorecard.py

@@ -539,6 +539,12 @@ def parse_public_maintenance_edge_readback(text: str) -> dict[str, Any]:
     ready = kv.get("EDGE_FALLBACK_READY") == "1"
     if not ready and not blockers:
         blockers.append("edge_public_maintenance_live_config_drift")
+    if (
+        not ready
+        and kv.get("SUDO_N_READY") == "0"
+        and "privileged_edge_apply_channel_unavailable" not in blockers
+    ):
+        blockers.append("privileged_edge_apply_channel_unavailable")
     return {
         "runtime_readback_present": True,
         "ready": ready,
@@ -1434,6 +1440,11 @@ def choose_safe_next_step(
             "prepare_public_maintenance_fallback_l1_external_static_origin_or_cdn_"
             "healthcheck_decision_record_then_controlled_cutover_with_rollback"
         )
+    if "privileged_edge_apply_channel_unavailable" in public_blockers:
+        return (
+            "restore_privileged_edge_apply_channel_then_rerun_edge_fallback_check_"
+            "and_nginx_t_apply_package_no_app_restart"
+        )
     if "edge_public_maintenance_live_config_drift" in public_blockers:
         return (
             "run_public_maintenance_edge_fallback_check_then_prepare_privileged_"
@@ -1613,6 +1624,7 @@ def reboot_sop_primary_blocker(active_blockers: list[str]) -> str:
         "windows99_console_verify_output_truncated",
         "public_route_raw_5xx_without_maintenance_fallback",
         "public_route_unreachable_without_external_l1_fallback",
+        "privileged_edge_apply_channel_unavailable",
         "edge_public_maintenance_live_config_drift",
         "public_maintenance_fallback_runtime_readback_missing",
         "post_start_blocked_not_zero",

scripts/reboot-recovery/tests/test_reboot_auto_recovery_slo_scorecard.py

@@ -148,6 +148,7 @@ MAINTENANCE_FILE_HAS_MARKER=0
 SUDO_N_READY=0
 EDGE_FALLBACK_READY=0
 BLOCKER edge_public_maintenance_live_config_drift
+BLOCKER privileged_edge_apply_channel_unavailable
 """
 
 
@@ -625,6 +626,7 @@ def test_edge_public_maintenance_live_config_drift_blocks_even_when_routes_are_2
 
     assert payload["status"] == "blocked_reboot_auto_recovery_slo_not_ready"
     assert "edge_public_maintenance_live_config_drift" in payload["active_blockers"]
+    assert "privileged_edge_apply_channel_unavailable" in payload["active_blockers"]
     assert payload["public_maintenance_fallback"]["ready"] is False
     assert (
         payload["public_maintenance_fallback"][
@@ -637,6 +639,10 @@ def test_edge_public_maintenance_live_config_drift_blocks_even_when_routes_are_2
         payload["public_maintenance_fallback"]["edge_fallback"]["sudo_n_ready"]
         is False
     )
+    assert (
+        "privileged_edge_apply_channel_unavailable"
+        in payload["public_maintenance_fallback"]["edge_fallback_blockers"]
+    )
     assert (
         payload["required_checks"]["public_maintenance_fallback_runtime_ready"]
         is False