feat(agent): validate ssh diagnosis receipt

apps/api/tests/test_ai_agent_log_controlled_writeback_executor_readback_api.py

@@ -68,7 +68,7 @@ def _assert_executor_readback(payload: dict, *, public_endpoint: bool = False):
     assert payload["rollups"]["current_blocker_local_recovery_package_count"] == 1
     assert (
         payload["rollups"]["current_blocker_harbor_recovery_receipt_input_count"]
-        == 7
+        == 8
     )
     assert payload["rollups"]["runtime_dispatch_performed"] is False
 
@@ -127,12 +127,13 @@ def _assert_executor_readback(payload: dict, *, public_endpoint: bool = False):
     assert current_queue[0]["harbor_recovery_receipt_endpoint"] == (
         "/api/v1/agents/harbor-registry-controlled-recovery-receipt"
     )
-    assert current_queue[0]["harbor_recovery_receipt_input_count"] == 7
+    assert current_queue[0]["harbor_recovery_receipt_input_count"] == 8
     assert [
         item["input_id"]
         for item in current_queue[0]["harbor_recovery_receipt_inputs"]
     ] == [
         "gitea_actions_queue_readback",
+        "ssh_publickey_diagnosis_output",
         "ssh_local_repair_output",
         "watchdog_check_output",
         "watchdog_repair_output",

apps/api/tests/test_awoooi_priority_work_order_readback_api.py

@@ -321,9 +321,10 @@ def test_awoooi_priority_work_order_readback_overlays_ai_loop_current_blocker_qu
     assert evidence["ai_loop_current_blocker_harbor_recovery_receipt_endpoint"] == (
         "/api/v1/agents/harbor-registry-controlled-recovery-receipt"
     )
-    assert evidence["ai_loop_current_blocker_harbor_recovery_receipt_input_count"] == 7
+    assert evidence["ai_loop_current_blocker_harbor_recovery_receipt_input_count"] == 8
     assert evidence["ai_loop_current_blocker_harbor_recovery_receipt_input_ids"] == [
         "gitea_actions_queue_readback",
+        "ssh_publickey_diagnosis_output",
         "ssh_local_repair_output",
         "watchdog_check_output",
         "watchdog_repair_output",
@@ -357,7 +358,7 @@ def test_awoooi_priority_work_order_readback_overlays_ai_loop_current_blocker_qu
         payload["summary"][
             "ai_loop_current_blocker_harbor_recovery_receipt_input_count"
         ]
-        == 7
+        == 8
     )
     assert payload["summary"][
         "ai_loop_current_blocker_harbor_recovery_receipt_input_ids"

apps/api/tests/test_harbor_registry_controlled_recovery_receipt.py

@@ -103,6 +103,45 @@ def test_harbor_recovery_receipt_routes_unhealthy_check_to_repair_once() -> None
     assert payload["controlled_apply_policy"]["manual_end_state"] is False
 
 
+def test_harbor_recovery_receipt_accepts_ssh_publickey_diagnosis() -> None:
+    payload = validate_harbor_registry_controlled_recovery_receipt(
+        {
+            "ssh_publickey_diagnosis_output": _ssh_publickey_diagnosis_output(),
+        }
+    )
+
+    assert payload["status"] == (
+        "ssh_publickey_diagnosis_receipt_waiting_110_local_repair_or_harbor_watchdog_check"
+    )
+    assert payload["safe_next_step"] == (
+        "run_110_local_ssh_metadata_check_then_harbor_watchdog_check_mode"
+    )
+    assert "ssh_publickey_offer_timeout_on_wooo" in payload["active_blockers"]
+    diagnosis = payload["readback"]["ssh_publickey_diagnosis"]
+    assert diagnosis["diagnosis_ready"] is True
+    assert diagnosis["node_exporter_ok"] is True
+    assert diagnosis["ssh_port_tcp_open"] is True
+    assert diagnosis["ssh_banner_seen"] is True
+    assert diagnosis["wooo_publickey_classification"] == "publickey_offer_timeout"
+    assert diagnosis["publickey_offer_timeout_seen"] is True
+    assert diagnosis["raw_output_returned"] is False
+    phases = {
+        phase["phase_id"]: phase
+        for phase in payload["local_console_phase_readback"]["phases"]
+    }
+    assert phases["diagnose_ssh_publickey"]["status"] == "ready"
+    assert phases["repair_ssh_metadata_if_check_confirms_metadata_drift"][
+        "status"
+    ] == "blocked_waiting_ssh_metadata_repair_receipt_after_publickey_timeout"
+    assert payload["rollups"]["ssh_publickey_diagnosis_receipt_seen"] is True
+    assert payload["rollups"]["ssh_publickey_wooo_publickey_classification"] == (
+        "publickey_offer_timeout"
+    )
+    assert payload["input_redaction"]["ssh_publickey_diagnosis_output"][
+        "line_count"
+    ] > 0
+
+
 def test_harbor_recovery_receipt_surfaces_gitea_queue_blockers() -> None:
     payload = validate_harbor_registry_controlled_recovery_receipt(
         {
@@ -303,6 +342,24 @@ SSH_RELOAD=skipped
 """
 
 
+def _ssh_publickey_diagnosis_output() -> str:
+    return """
+AWOOOI_110_SSH_PUBLICKEY_AUTH_DIAGNOSIS
+TARGET=192.168.0.110:22
+NODE_EXPORTER=ok
+NODE_LOAD1_PER_CPU=0.93
+NODE_LOAD_CLASSIFIER=load_not_high
+SSH_PORT=tcp_open
+SSH_BANNER=SSH-2.0-OpenSSH_8.9p1
+SSH_AUTH user=wooo mode=publickey rc=255 classification=publickey_offer_timeout
+SSH_AUTH user=root mode=publickey rc=255 classification=permission_denied
+SSH_AUTH user=git mode=publickey rc=255 classification=preauth_timeout
+SSH_AUTH user=ollama mode=publickey rc=255 classification=preauth_timeout
+SSH_AUTH user=wooo mode=password_disabled rc=255 classification=permission_denied
+INTERPRETATION=publickey_offer_timeout_on_wooo_means_check_110_authorized_keys_permissions_pam_or_account_lookup_path
+"""
+
+
 def _watchdog_check_output(*, ready: bool, status: int) -> str:
     ready_text = "true" if ready else "false"
     return f"""