fix(ops): bound CD DB probes and restore SigNoz collector

apps/api/tests/test_executor_network_policy_boundary.py

@@ -208,7 +208,10 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
     assert "import sys" in probe
     assert "concurrency_urls =" in probe
     assert "ThreadPoolExecutor(" in probe
-    assert "max_workers=8" in probe
+    assert "probe_worker_count" in probe
+    assert "max_workers=probe_worker_count" in probe
+    assert "max_workers=8" not in probe
+    assert "API_HTTP_CONCURRENCY_WORKERS" in probe
     assert "for attempt in range(1, concurrency_attempts + 1):" in probe
     assert "if attempt < concurrency_attempts:" in probe
     assert "transient_http_statuses" in probe
@@ -220,6 +223,9 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
         'api_http_concurrency_probe_passed="$API_HTTP_CONCURRENCY_VERIFIED"'
         in workflow
     )
+    assert "API_HTTP_PROBE_SAFETY_RESERVE=4" in workflow
+    assert "connection_budget_not_verified" in workflow
+    assert 'api_http_concurrency_probe_safety_reserve="$API_HTTP_PROBE_SAFETY_RESERVE"' in workflow
     assert 'connection_budget_verified="$CONNECTION_BUDGET_VERIFIED"' in workflow
     assert "workload DB identity/budget remains in progress" in workflow
 

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -272,7 +272,9 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "AWOOOI_DB_REQUIRED_CONNECTION_BUDGET" in workflow
     assert "api_http_concurrency_probe_passed" in workflow
     assert "ThreadPoolExecutor" in workflow
-    assert "max_workers=8" in workflow
+    assert "max_workers=probe_worker_count" in workflow
+    assert "max_workers=8" not in workflow
+    assert "api_http_concurrency_probe_safety_reserve" in workflow
     assert "WORKLOAD_DB_ROLLBACK_FILE" in workflow
     assert "restore_workload_database_projection" in workflow
     assert "awoooi-workload-db-identity-bootstrap.sh" in workflow

apps/api/tests/test_workload_database_identity_projection.py

@@ -280,13 +280,22 @@ def test_cd_uses_live_spec_rollback_and_non_mutating_post_verifier() -> None:
     assert "workload DB identity attempts exhausted before receipt write" in workflow
     assert "API_PUBLIC_READINESS_ATTEMPTS" in workflow
     assert "API_HTTP_CONCURRENCY_ATTEMPTS" in workflow
+    assert "API_HTTP_PROBE_SAFETY_RESERVE=4" in workflow
+    assert "API_HTTP_CONCURRENCY_WORKERS" in workflow
     assert "API sequential readiness permanent HTTP status" in workflow
     assert "api/v1/health/ready" in workflow
     assert "events/dossier/coverage?project_id=awoooi&limit=1" not in workflow
     assert "api/v1/platform/cicd/events" in workflow
     assert "?project_id=awoooi&limit=1" in workflow
-    assert "concurrency_urls = (db_probe_url,) * 8" in workflow
+    assert "concurrency_urls = (db_probe_url,) * probe_worker_count" in workflow
+    assert "max_workers=probe_worker_count" in workflow
+    assert "concurrency_urls = (db_probe_url,) * 8" not in workflow
+    assert "max_workers=8" not in workflow
     assert "concurrency_urls = urls * 6" not in workflow
+    assert "connection_budget_not_verified" in workflow
+    assert "connection_headroom_reserved_for_runtime" in workflow
+    assert "api_http_concurrency_probe_safety_reserve" in workflow
+    assert "api_http_concurrency_probe_skip_reason" in workflow
     assert "API_RESTART_COUNT_BEFORE=$(api_restart_total)" in workflow
     assert "API_RESTART_COUNT_AFTER=$(api_restart_total)" in workflow
     assert '"$API_PROBE_RESTART_FREE" != "true"' in workflow
@@ -353,7 +362,7 @@ def test_cd_api_readiness_retries_http_503_then_runs_all_200_concurrency(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
 ) -> None:
-    responses = [503, 200, *([200] * 8)]
+    responses = [503, 200, *([200] * 4)]
     calls: list[str] = []
 
     def fake_urlopen(url: str, *, timeout: int) -> _FakeHTTPResponse:
@@ -367,8 +376,9 @@ def test_cd_api_readiness_retries_http_503_then_runs_all_200_concurrency(
     monkeypatch.setattr(time, "sleep", lambda _seconds: None)
     monkeypatch.setenv("API_PUBLIC_READINESS_ATTEMPTS", "3")
     monkeypatch.setenv("API_PUBLIC_READINESS_DELAY_SECONDS", "0")
-    monkeypatch.setenv("API_HTTP_CONCURRENCY_ATTEMPTS", "2")
+    monkeypatch.setenv("API_HTTP_CONCURRENCY_ATTEMPTS", "1")
     monkeypatch.setenv("API_HTTP_CONCURRENCY_DELAY_SECONDS", "0")
+    monkeypatch.setenv("API_HTTP_CONCURRENCY_WORKERS", "4")
 
     exec(
         compile(
@@ -382,13 +392,43 @@ def test_cd_api_readiness_retries_http_503_then_runs_all_200_concurrency(
     output = capsys.readouterr()
     assert output.out.strip() == "true"
     assert "api_sequential_readiness=ready;attempt=2" in output.err
-    assert len(calls) == 10
+    assert len(calls) == 6
     assert calls[0].startswith("https://awoooi.wooo.work/api/v1/health/ready|")
     assert calls[1].startswith("https://awoooi.wooo.work/api/v1/health/ready|")
     assert all("platform/cicd/events" in call for call in calls[2:])
     assert responses == []
 
 
+def test_cd_api_concurrency_workers_are_capped_at_four(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    responses = [200, *([200] * 4)]
+    calls: list[str] = []
+
+    def fake_urlopen(url: str, *, timeout: int) -> _FakeHTTPResponse:
+        calls.append(f"{url}|{timeout}")
+        return _FakeHTTPResponse(responses.pop(0))
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    monkeypatch.setenv("API_HTTP_CONCURRENCY_WORKERS", "8")
+
+    exec(
+        compile(
+            _api_http_readiness_and_concurrency_python(),
+            "<cd-api-http-verifier>",
+            "exec",
+        ),
+        {},
+    )
+
+    output = capsys.readouterr()
+    assert output.out.strip() == "true"
+    assert len(calls) == 5
+    assert all("platform/cicd/events" in call for call in calls[1:])
+    assert responses == []
+
+
 def test_cd_api_readiness_exhaustion_stops_before_green_receipt_write(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],