wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(ai): separate runtime contracts from deploy SHA churn

Browse Source
This commit is contained in:
ogt
2026-07-11 11:34:24 +08:00
parent 478be85854
commit cf23e2b230
5 changed files with 316 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

130
apps/api/tests/test_ai_agent_autonomous_runtime_control.py
View File

@@ -1130,7 +1130,7 @@ def test_runtime_receipt_auxiliary_sql_keeps_source_family_counts_schema_safe():
assert "channel_chat_id LIKE 'alert-group:%'" in _RUNTIME_GROUPED_ALERT_EVENT_COUNTS_SQL
def test_autonomous_single_writer_requires_same_run_runtime_and_deployed_source() -> None:
def test_autonomous_single_writer_requires_same_run_and_deployed_contract_boundary() -> None:
run_id = "11111111-1111-4111-8111-111111111111"
rows = [
{
@@ -1193,6 +1193,12 @@ def test_autonomous_single_writer_requires_same_run_runtime_and_deployed_source(
boundary_readback={
"deployed_source_sha": "source123",
"autonomous_single_writer_source_boundary": {
"schema_version": (
"awoooi_autonomous_single_writer_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"receipt_ref": "configmap:awoooi-prod/boundary",
"verifier": "cd_tests_and_production_source_sha_v1",
"controls": source_controls,
@@ -1204,6 +1210,34 @@ def test_autonomous_single_writer_requires_same_run_runtime_and_deployed_source(
assert payload["autonomous_single_writer"]["closed"] is True
assert payload["autonomous_single_writer"]["active_blockers"] == []
assert payload["rollups"]["autonomous_single_writer_closed_count"] == 1
assert payload["autonomous_single_writer"]["source_compatibility"][
"exact_sha_match"
] is True
runtime_control_module._attach_autonomous_single_writer_readback(
payload,
readback={"autonomous_single_writer_runtime": runtime},
boundary_readback={
"deployed_source_sha": "newer-source",
"autonomous_single_writer_source_boundary": {
"schema_version": (
"awoooi_autonomous_single_writer_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"controls": source_controls,
"active_blockers": [],
},
},
)
assert payload["autonomous_single_writer"]["closed"] is True
assert payload["autonomous_single_writer"]["source_compatibility"][
"status"
] == "contract_compatible"
assert payload["autonomous_single_writer"]["source_compatibility"][
"exact_sha_match"
] is False
payload["strict_runtime_completion"]["automation_run_id"] = "other-run"
runtime_control_module._attach_autonomous_single_writer_readback(
@@ -1212,6 +1246,12 @@ def test_autonomous_single_writer_requires_same_run_runtime_and_deployed_source(
boundary_readback={
"deployed_source_sha": "source123",
"autonomous_single_writer_source_boundary": {
"schema_version": (
"awoooi_autonomous_single_writer_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"controls": source_controls,
"active_blockers": [],
},
@@ -1223,7 +1263,7 @@ def test_autonomous_single_writer_requires_same_run_runtime_and_deployed_source(
]["active_blockers"]
def test_independent_post_verifier_requires_same_run_and_deployed_source() -> None:
def test_independent_post_verifier_requires_same_run_and_deployed_contract_boundary() -> None:
run_id = "11111111-1111-4111-8111-111111111111"
apply_op_id = "33333333-3333-4333-8333-333333333333"
runtime = (
@@ -1283,6 +1323,12 @@ def test_independent_post_verifier_requires_same_run_and_deployed_source() -> No
boundary_readback={
"deployed_source_sha": "source123",
"independent_post_verifier_source_boundary": {
"schema_version": (
"awoooi_independent_post_verifier_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"receipt_ref": "configmap:awoooi-prod/boundary",
"verifier": "cd_tests_and_production_source_sha_v1",
"controls": source_controls,
@@ -1304,19 +1350,49 @@ def test_independent_post_verifier_requires_same_run_and_deployed_source() -> No
boundary_readback={
"deployed_source_sha": "different-source",
"independent_post_verifier_source_boundary": {
"schema_version": (
"awoooi_independent_post_verifier_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"controls": source_controls,
"active_blockers": [],
},
},
)
verifier = payload["autonomous_independent_post_verifier"]
assert verifier["closed"] is True
assert verifier["source_compatibility"]["status"] == "contract_compatible"
assert verifier["source_compatibility"]["exact_sha_match"] is False
runtime_control_module._attach_independent_post_verifier_readback(
payload,
readback={"independent_post_verifier_runtime": runtime},
boundary_readback={
"deployed_source_sha": "different-source",
"independent_post_verifier_source_boundary": {
"schema_version": (
"awoooi_independent_post_verifier_source_boundary_v1"
),
"status": "in_progress",
"source_boundary_verified": False,
"source_sha_matches_deployment": False,
"controls": source_controls,
"active_blockers": ["source_sha_not_deployed"],
},
},
)
verifier = payload["autonomous_independent_post_verifier"]
assert verifier["closed"] is False
assert "verifier_source_sha_matches_deployment_not_verified" in verifier[
"active_blockers"
]
assert "source_sha_not_deployed" in verifier["active_blockers"]
assert (
"runtime_contract_compatible_with_deployed_source_boundary_not_verified"
in verifier["active_blockers"]
)
def test_canonical_learning_requires_row_readback_and_deployed_source() -> None:
def test_canonical_learning_requires_row_readback_and_deployed_contract_boundary() -> None:
run_id = "11111111-1111-4111-8111-111111111111"
apply_op_id = "33333333-3333-4333-8333-333333333333"
catalog_id = "ansible:188-momo-backup-user"
@@ -1404,6 +1480,12 @@ def test_canonical_learning_requires_row_readback_and_deployed_source() -> None:
boundary_readback={
"deployed_source_sha": "source123",
"canonical_learning_source_boundary": {
"schema_version": (
"awoooi_canonical_learning_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"receipt_ref": "configmap:awoooi-prod/boundary",
"verifier": "cd_tests_and_production_source_sha_v1",
"controls": source_controls,
@@ -1427,16 +1509,46 @@ def test_canonical_learning_requires_row_readback_and_deployed_source() -> None:
boundary_readback={
"deployed_source_sha": "different-source",
"canonical_learning_source_boundary": {
"schema_version": (
"awoooi_canonical_learning_source_boundary_v1"
),
"status": "verified_ready",
"source_boundary_verified": True,
"source_sha_matches_deployment": True,
"controls": source_controls,
"active_blockers": [],
},
},
)
learning = payload["autonomous_canonical_learning_writeback"]
assert learning["closed"] is True
assert learning["source_compatibility"]["status"] == "contract_compatible"
assert learning["source_compatibility"]["exact_sha_match"] is False
runtime_control_module._attach_canonical_learning_readback(
payload,
readback={"canonical_learning_runtime": runtime},
boundary_readback={
"deployed_source_sha": "different-source",
"canonical_learning_source_boundary": {
"schema_version": (
"awoooi_canonical_learning_source_boundary_v1"
),
"status": "in_progress",
"source_boundary_verified": False,
"source_sha_matches_deployment": False,
"controls": source_controls,
"active_blockers": ["source_sha_not_deployed"],
},
},
)
learning = payload["autonomous_canonical_learning_writeback"]
assert learning["closed"] is False
assert "writer_source_sha_matches_deployment_not_verified" in learning[
"active_blockers"
]
assert "source_sha_not_deployed" in learning["active_blockers"]
assert (
"runtime_contract_compatible_with_deployed_source_boundary_not_verified"
in learning["active_blockers"]
)
def test_ai_agent_autonomous_runtime_control_uses_current_owner_directive():

53
apps/api/tests/test_awoooi_priority_work_order_readback_api.py
View File

@@ -165,10 +165,16 @@ def _autonomous_runtime_control_single_writer_closed() -> dict:
"configmap:awoooi-prod/awoooi-executor-boundary-verification"
),
"source_verifier": "cd_tests_and_production_source_sha_v1",
"controls": {
control_id: True
for control_id in priority_service._AI_SINGLE_WRITER_REQUIRED_CONTROL_IDS
"source_compatibility": {
"schema_version": "awoooi_runtime_source_compatibility_v1",
"status": "contract_compatible",
"exact_sha_match": False,
"runtime_contract_compatible_with_deployed_source_boundary": True,
},
"controls": dict.fromkeys(
priority_service._AI_SINGLE_WRITER_REQUIRED_CONTROL_IDS,
True,
),
"active_blockers": [],
}
return payload
@@ -193,13 +199,16 @@ def _autonomous_runtime_control_independent_post_verifier_closed() -> dict:
"configmap:awoooi-prod/awoooi-executor-boundary-verification"
),
"source_verifier": "cd_tests_and_production_source_sha_v1",
"controls": {
control_id: True
for control_id in (
priority_service
._AI_INDEPENDENT_POST_VERIFIER_REQUIRED_CONTROL_IDS
)
"source_compatibility": {
"schema_version": "awoooi_runtime_source_compatibility_v1",
"status": "contract_compatible",
"exact_sha_match": False,
"runtime_contract_compatible_with_deployed_source_boundary": True,
},
"controls": dict.fromkeys(
priority_service._AI_INDEPENDENT_POST_VERIFIER_REQUIRED_CONTROL_IDS,
True,
),
"active_blockers": [],
}
return payload
@@ -227,12 +236,16 @@ def _autonomous_runtime_control_canonical_learning_closed() -> dict:
"configmap:awoooi-prod/awoooi-executor-boundary-verification"
),
"source_verifier": "cd_tests_and_production_source_sha_v1",
"controls": {
control_id: True
for control_id in (
priority_service._AI_CANONICAL_LEARNING_REQUIRED_CONTROL_IDS
)
"source_compatibility": {
"schema_version": "awoooi_runtime_source_compatibility_v1",
"status": "contract_compatible",
"exact_sha_match": False,
"runtime_contract_compatible_with_deployed_source_boundary": True,
},
"controls": dict.fromkeys(
priority_service._AI_CANONICAL_LEARNING_REQUIRED_CONTROL_IDS,
True,
),
"active_blockers": [],
}
return payload
@@ -2143,6 +2156,12 @@ def test_ai_automation_single_writer_runtime_receipt_advances_order() -> None:
assert single_writer["completion_evidence"]["single_writer_executor"] == (
"awoooi-ansible-executor-broker"
)
assert single_writer["completion_evidence"]["source_compatibility"][
"status"
] == "contract_compatible"
assert single_writer["runtime_progress"]["source_compatibility"][
"exact_sha_match"
] is False
assert program["summary"]["next_work_item_id"] == "AIA-P0-003"
assert program["summary"]["done_count"] == 3
assert program["summary"]["completion_percent"] == 15
@@ -2176,6 +2195,9 @@ def test_ai_automation_independent_post_verifier_advances_order() -> None:
)
assert verifier["completion_evidence"]["required_postcondition_count"] == 5
assert verifier["completion_evidence"]["passed_postcondition_count"] == 5
assert verifier["completion_evidence"]["source_compatibility"][
"status"
] == "contract_compatible"
assert program["summary"]["next_work_item_id"] == "AIA-P0-004"
assert program["summary"]["done_count"] == 4
assert program["summary"]["completion_percent"] == 20
@@ -2235,6 +2257,9 @@ def test_ai_automation_canonical_learning_receipt_advances_order() -> None:
"PB-ANSIBLE-188-MOMO-BACKUP-USER"
)
assert learning["completion_evidence"]["playbook_row_version"] == 2
assert learning["completion_evidence"]["source_compatibility"][
"status"
] == "contract_compatible"
assert program["summary"]["next_work_item_id"] == "AIA-P0-005"
assert program["summary"]["done_count"] == 5
assert program["summary"]["completion_percent"] == 25

5
apps/api/tests/test_executor_network_policy_boundary.py
View File

@@ -90,7 +90,10 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
assert "02-network-policy.yaml" in workflow
assert "NETWORK_POLICY_ROLLBACK_FILE" in workflow
assert "get networkpolicy ${NETWORK_POLICY_NAMES[*]}" in workflow
assert "rollback_network_policy_on_exit" in workflow
assert "rollback_deploy_controls_on_exit" in workflow
assert "restore_deploy_controls" in workflow
assert "restore_workload_database_projection" in workflow
assert "restore_network_policy" in workflow
assert "git show HEAD^:k8s/awoooi-prod/02-network-policy.yaml" not in workflow
assert "BROKER_POLICY_EXISTED" in workflow
assert "NETWORK_POLICY_NAMES" in workflow