From de5e29360f3d1808daf0e0d0991aa3cce233f124 Mon Sep 17 00:00:00 2001 From: ogt Date: Sat, 11 Jul 2026 01:36:41 +0800 Subject: [PATCH] fix(agent): preserve executor boundary runtime proof --- .gitea/workflows/cd.yaml | 5 ++ .../ai_agent_autonomous_runtime_control.py | 74 ++++++++++++++----- .../executor_trust_boundary_readback.py | 8 +- ...est_ai_agent_autonomous_runtime_control.py | 10 ++- ..._signal_worker_ansible_executor_binding.py | 2 + 5 files changed, 74 insertions(+), 25 deletions(-) diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index e2734be97..e5a4f46d7 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -2567,6 +2567,11 @@ jobs: --from-literal=legacy_executor_binding_absent=true \ --dry-run=client -o yaml \ | $KUBECTL apply -f - + $KUBECTL annotate configmap \ + awoooi-executor-boundary-verification -n awoooi-prod \ + argocd.argoproj.io/sync-options=Prune=false \ + argocd.argoproj.io/compare-options=IgnoreExtraneous \ + --overwrite RECEIPT_SOURCE_SHA=$($KUBECTL get configmap \ awoooi-executor-boundary-verification -n awoooi-prod \ -o jsonpath='{.data.verified_source_sha}') diff --git a/apps/api/src/services/ai_agent_autonomous_runtime_control.py b/apps/api/src/services/ai_agent_autonomous_runtime_control.py index fadc10a28..010fdfe78 100644 --- a/apps/api/src/services/ai_agent_autonomous_runtime_control.py +++ b/apps/api/src/services/ai_agent_autonomous_runtime_control.py @@ -6309,7 +6309,25 @@ _RUNTIME_OPERATION_LATEST_SQL = """ duration_ms, created_at FROM automation_operation_log operation_row - WHERE coalesce(input ->> 'semantic_operation_type', operation_type) IN ( + LEFT JOIN latest_apply_chain ON TRUE + WHERE operation_row.operation_type IN ( + 'ansible_candidate_matched', + 'ansible_check_mode_executed', + 'ansible_apply_executed', + 'ansible_learning_writeback_recorded', + 'ansible_rollback_executed', + 'ansible_execution_skipped', + 'ansible_executor_capability_issued', + 'ansible_executor_capability_revoked', + 'ansible_executor_capability_expired', + 'log_controlled_writeback_dispatched', + 'remediation_executed', + 'km_linked' + ) + AND coalesce( + operation_row.input ->> 'semantic_operation_type', + operation_row.operation_type + ) IN ( 'ansible_candidate_matched', 'ansible_check_mode_executed', 'ansible_apply_executed', @@ -6323,15 +6341,14 @@ _RUNTIME_OPERATION_LATEST_SQL = """ ) ORDER BY CASE - WHEN EXISTS ( - SELECT 1 - FROM latest_apply_chain - WHERE operation_row.op_id::text = latest_apply_chain.apply_op_id - OR operation_row.op_id::text = latest_apply_chain.check_mode_op_id - OR operation_row.op_id::text = latest_apply_chain.candidate_op_id - OR operation_row.input ->> 'automation_run_id' - = latest_apply_chain.candidate_op_id - ) THEN 0 + WHEN operation_row.op_id::text IN ( + latest_apply_chain.apply_op_id, + latest_apply_chain.check_mode_op_id, + latest_apply_chain.candidate_op_id + ) + OR operation_row.input ->> 'automation_run_id' + = latest_apply_chain.candidate_op_id + THEN 0 WHEN coalesce( input ->> 'semantic_operation_type', operation_type @@ -6392,7 +6409,25 @@ _RUNTIME_OPERATION_LATEST_DIRECT_SQL = """ duration_ms, created_at FROM automation_operation_log operation_row - WHERE coalesce(input ->> 'semantic_operation_type', operation_type) IN ( + LEFT JOIN latest_apply_chain ON TRUE + WHERE operation_row.operation_type IN ( + 'ansible_candidate_matched', + 'ansible_check_mode_executed', + 'ansible_apply_executed', + 'ansible_learning_writeback_recorded', + 'ansible_rollback_executed', + 'ansible_execution_skipped', + 'ansible_executor_capability_issued', + 'ansible_executor_capability_revoked', + 'ansible_executor_capability_expired', + 'log_controlled_writeback_dispatched', + 'remediation_executed', + 'km_linked' + ) + AND coalesce( + operation_row.input ->> 'semantic_operation_type', + operation_row.operation_type + ) IN ( 'ansible_candidate_matched', 'ansible_check_mode_executed', 'ansible_apply_executed', @@ -6406,15 +6441,14 @@ _RUNTIME_OPERATION_LATEST_DIRECT_SQL = """ ) ORDER BY CASE - WHEN EXISTS ( - SELECT 1 - FROM latest_apply_chain - WHERE operation_row.op_id::text = latest_apply_chain.apply_op_id - OR operation_row.op_id::text = latest_apply_chain.check_mode_op_id - OR operation_row.op_id::text = latest_apply_chain.candidate_op_id - OR operation_row.input ->> 'automation_run_id' - = latest_apply_chain.candidate_op_id - ) THEN 0 + WHEN operation_row.op_id::text IN ( + latest_apply_chain.apply_op_id, + latest_apply_chain.check_mode_op_id, + latest_apply_chain.candidate_op_id + ) + OR operation_row.input ->> 'automation_run_id' + = latest_apply_chain.candidate_op_id + THEN 0 WHEN coalesce( input ->> 'semantic_operation_type', operation_type diff --git a/apps/api/src/services/executor_trust_boundary_readback.py b/apps/api/src/services/executor_trust_boundary_readback.py index 5ce3b6265..63e09f0ed 100644 --- a/apps/api/src/services/executor_trust_boundary_readback.py +++ b/apps/api/src/services/executor_trust_boundary_readback.py @@ -120,18 +120,22 @@ async def load_executor_trust_boundary_readback( configmap_name=configmap_name, ) except Exception as exc: # pragma: no cover - production readback boundary + error_status = getattr(exc, "status", None) + public_error_type = type(exc).__name__ + if isinstance(error_status, int): + public_error_type = f"{public_error_type}:{error_status}" logger.warning( "executor_trust_boundary_readback_failed", namespace=namespace, configmap_name=configmap_name, - error_type=type(exc).__name__, + error_type=public_error_type, ) payload = build_executor_trust_boundary_readback( {}, deployed_source_sha=deployed_source_sha, namespace=namespace, configmap_name=configmap_name, - error_type=type(exc).__name__, + error_type=public_error_type, ) finally: if api_client is not None: diff --git a/apps/api/tests/test_ai_agent_autonomous_runtime_control.py b/apps/api/tests/test_ai_agent_autonomous_runtime_control.py index 12270eeb8..f43df369a 100644 --- a/apps/api/tests/test_ai_agent_autonomous_runtime_control.py +++ b/apps/api/tests/test_ai_agent_autonomous_runtime_control.py @@ -2590,9 +2590,13 @@ def test_runtime_operation_latest_queries_prioritize_latest_apply_chain() -> Non for sql in (_RUNTIME_OPERATION_LATEST_SQL, _RUNTIME_OPERATION_LATEST_DIRECT_SQL): assert "WITH latest_apply_chain AS" in sql assert "AND status IN ('success', 'failed')" in sql - assert "operation_row.op_id::text = latest_apply_chain.apply_op_id" in sql - assert "operation_row.op_id::text = latest_apply_chain.check_mode_op_id" in sql - assert "operation_row.op_id::text = latest_apply_chain.candidate_op_id" in sql + assert "LEFT JOIN latest_apply_chain ON TRUE" in sql + assert "operation_row.op_id::text IN" in sql + assert "latest_apply_chain.apply_op_id" in sql + assert "latest_apply_chain.check_mode_op_id" in sql + assert "latest_apply_chain.candidate_op_id" in sql + assert "operation_row.operation_type IN" in sql + assert "'remediation_executed'" in sql def test_execution_capability_lifecycle_requires_same_run_terminal_receipt() -> None: diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py index 898f04ebb..b6a544000 100644 --- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py +++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py @@ -157,6 +157,8 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None: assert "awoooi_executor_boundary_verification_v1" in workflow assert "executor_boundary_public_readback=verified_ready" in workflow assert "verified_source_sha" in workflow + assert "argocd.argoproj.io/sync-options=Prune=false" in workflow + assert "argocd.argoproj.io/compare-options=IgnoreExtraneous" in workflow assert "github.com/kubernetes-sigs/kustomize" not in workflow assert "git checkout --force -B main FETCH_HEAD" in workflow