fix(agent): preserve executor boundary runtime proof

apps/api/src/services/ai_agent_autonomous_runtime_control.py

@@ -6309,7 +6309,25 @@ _RUNTIME_OPERATION_LATEST_SQL = """
         duration_ms,
         created_at
     FROM automation_operation_log operation_row
-    WHERE coalesce(input ->> 'semantic_operation_type', operation_type) IN (
+    LEFT JOIN latest_apply_chain ON TRUE
+    WHERE operation_row.operation_type IN (
+            'ansible_candidate_matched',
+            'ansible_check_mode_executed',
+            'ansible_apply_executed',
+            'ansible_learning_writeback_recorded',
+            'ansible_rollback_executed',
+            'ansible_execution_skipped',
+            'ansible_executor_capability_issued',
+            'ansible_executor_capability_revoked',
+            'ansible_executor_capability_expired',
+            'log_controlled_writeback_dispatched',
+            'remediation_executed',
+            'km_linked'
+        )
+      AND coalesce(
+            operation_row.input ->> 'semantic_operation_type',
+            operation_row.operation_type
+          ) IN (
             'ansible_candidate_matched',
             'ansible_check_mode_executed',
             'ansible_apply_executed',
@@ -6323,15 +6341,14 @@ _RUNTIME_OPERATION_LATEST_SQL = """
         )
     ORDER BY
         CASE
-            WHEN EXISTS (
-                SELECT 1
-                FROM latest_apply_chain
-                WHERE operation_row.op_id::text = latest_apply_chain.apply_op_id
-                   OR operation_row.op_id::text = latest_apply_chain.check_mode_op_id
-                   OR operation_row.op_id::text = latest_apply_chain.candidate_op_id
-                   OR operation_row.input ->> 'automation_run_id'
-                        = latest_apply_chain.candidate_op_id
-            ) THEN 0
+            WHEN operation_row.op_id::text IN (
+                    latest_apply_chain.apply_op_id,
+                    latest_apply_chain.check_mode_op_id,
+                    latest_apply_chain.candidate_op_id
+                 )
+              OR operation_row.input ->> 'automation_run_id'
+                    = latest_apply_chain.candidate_op_id
+            THEN 0
             WHEN coalesce(
                     input ->> 'semantic_operation_type',
                     operation_type
@@ -6392,7 +6409,25 @@ _RUNTIME_OPERATION_LATEST_DIRECT_SQL = """
         duration_ms,
         created_at
     FROM automation_operation_log operation_row
-    WHERE coalesce(input ->> 'semantic_operation_type', operation_type) IN (
+    LEFT JOIN latest_apply_chain ON TRUE
+    WHERE operation_row.operation_type IN (
+            'ansible_candidate_matched',
+            'ansible_check_mode_executed',
+            'ansible_apply_executed',
+            'ansible_learning_writeback_recorded',
+            'ansible_rollback_executed',
+            'ansible_execution_skipped',
+            'ansible_executor_capability_issued',
+            'ansible_executor_capability_revoked',
+            'ansible_executor_capability_expired',
+            'log_controlled_writeback_dispatched',
+            'remediation_executed',
+            'km_linked'
+        )
+      AND coalesce(
+            operation_row.input ->> 'semantic_operation_type',
+            operation_row.operation_type
+          ) IN (
             'ansible_candidate_matched',
             'ansible_check_mode_executed',
             'ansible_apply_executed',
@@ -6406,15 +6441,14 @@ _RUNTIME_OPERATION_LATEST_DIRECT_SQL = """
         )
     ORDER BY
         CASE
-            WHEN EXISTS (
-                SELECT 1
-                FROM latest_apply_chain
-                WHERE operation_row.op_id::text = latest_apply_chain.apply_op_id
-                   OR operation_row.op_id::text = latest_apply_chain.check_mode_op_id
-                   OR operation_row.op_id::text = latest_apply_chain.candidate_op_id
-                   OR operation_row.input ->> 'automation_run_id'
-                        = latest_apply_chain.candidate_op_id
-            ) THEN 0
+            WHEN operation_row.op_id::text IN (
+                    latest_apply_chain.apply_op_id,
+                    latest_apply_chain.check_mode_op_id,
+                    latest_apply_chain.candidate_op_id
+                 )
+              OR operation_row.input ->> 'automation_run_id'
+                    = latest_apply_chain.candidate_op_id
+            THEN 0
             WHEN coalesce(
                     input ->> 'semantic_operation_type',
                     operation_type

apps/api/src/services/executor_trust_boundary_readback.py

@@ -120,18 +120,22 @@ async def load_executor_trust_boundary_readback(
             configmap_name=configmap_name,
         )
     except Exception as exc:  # pragma: no cover - production readback boundary
+        error_status = getattr(exc, "status", None)
+        public_error_type = type(exc).__name__
+        if isinstance(error_status, int):
+            public_error_type = f"{public_error_type}:{error_status}"
         logger.warning(
             "executor_trust_boundary_readback_failed",
             namespace=namespace,
             configmap_name=configmap_name,
-            error_type=type(exc).__name__,
+            error_type=public_error_type,
         )
         payload = build_executor_trust_boundary_readback(
             {},
             deployed_source_sha=deployed_source_sha,
             namespace=namespace,
             configmap_name=configmap_name,
-            error_type=type(exc).__name__,
+            error_type=public_error_type,
         )
     finally:
         if api_client is not None:

apps/api/tests/test_ai_agent_autonomous_runtime_control.py

@@ -2590,9 +2590,13 @@ def test_runtime_operation_latest_queries_prioritize_latest_apply_chain() -> Non
     for sql in (_RUNTIME_OPERATION_LATEST_SQL, _RUNTIME_OPERATION_LATEST_DIRECT_SQL):
         assert "WITH latest_apply_chain AS" in sql
         assert "AND status IN ('success', 'failed')" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.apply_op_id" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.check_mode_op_id" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.candidate_op_id" in sql
+        assert "LEFT JOIN latest_apply_chain ON TRUE" in sql
+        assert "operation_row.op_id::text IN" in sql
+        assert "latest_apply_chain.apply_op_id" in sql
+        assert "latest_apply_chain.check_mode_op_id" in sql
+        assert "latest_apply_chain.candidate_op_id" in sql
+        assert "operation_row.operation_type IN" in sql
+        assert "'remediation_executed'" in sql
 
 
 def test_execution_capability_lifecycle_requires_same_run_terminal_receipt() -> None:

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -157,6 +157,8 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "awoooi_executor_boundary_verification_v1" in workflow
     assert "executor_boundary_public_readback=verified_ready" in workflow
     assert "verified_source_sha" in workflow
+    assert "argocd.argoproj.io/sync-options=Prune=false" in workflow
+    assert "argocd.argoproj.io/compare-options=IgnoreExtraneous" in workflow
     assert "github.com/kubernetes-sigs/kustomize" not in workflow
     assert "git checkout --force -B main FETCH_HEAD" in workflow