wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

chore(sre): reconcile k3s executor readiness

Browse Source
This commit is contained in:
Your Name
2026-07-19 01:33:01 +08:00
parent b4b273fb51
commit e48155c2d6
2 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py
View File

@@ -116,11 +116,11 @@ def test_loader_returns_fixed_architecture_provider_order_and_agent99_bridge() -
"total_items": 18,
"by_priority": {"P0": 16, "P1": 2},
"by_status": {
"source_implemented_runtime_pending": 13,
"source_implemented_runtime_pending": 14,
"in_progress": 1,
"planned": 4,
"planned": 3,
},
"source_implemented_items": 13,
"source_implemented_items": 14,
"runtime_closed_items": 0,
"program_completion_percent": 0,
"asset_coverage_status": "partial",
@@ -133,6 +133,12 @@ def test_ledger_links_confirmed_runtime_gaps_without_false_closure() -> None:
items = {item["id"]: item for item in payload["work_items"]}
assert "retired tombstone" in " ".join(items["AIA-SRE-002"]["confirmed_truth"])
assert items["AIA-SRE-007"]["status"] == (
"source_implemented_runtime_pending"
)
assert "rollout restart only" in " ".join(
items["AIA-SRE-007"]["confirmed_truth"]
)
assert "host120/host121" in " ".join(items["AIA-SRE-002"]["runtime_gaps"])
assert items["AIA-SRE-008"]["status"] == (
"source_implemented_runtime_pending"
@@ -189,7 +195,7 @@ def test_projection_keeps_program_asset_and_runtime_truth_separate() -> None:
payload = load_sre_k3s_controlled_automation_work_items()
projection = build_sre_k3s_program_projection(payload)
assert projection["rollups"]["source_implemented_items"] == 13
assert projection["rollups"]["source_implemented_items"] == 14
assert projection["rollups"]["runtime_closed_items"] == 0
assert projection["rollups"]["program_completion_percent"] == 0
assert projection["domain_count"] == 8

28
docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json
View File

@@ -464,19 +464,33 @@
"title": "K3s workload 專屬 executor 與 rollout verifier",
"owner_lane": "KubernetesAutomation",
"risk": "high",
"status": "planned",
"status": "source_implemented_runtime_pending",
"dependencies": [
"AIA-SRE-004"
],
"source_refs": [
"apps/api/src/services/executor.py",
"apps/api/src/services/post_execution_verifier.py"
"apps/api/src/services/controlled_alert_target_router.py",
"apps/api/src/services/kubernetes_controlled_executor.py",
"apps/api/src/services/kubernetes_rollout_verifier.py",
"apps/api/src/services/approval_execution.py",
"apps/api/src/services/callback_dispatcher.py",
"apps/api/src/plugins/mcp/providers/k8s_provider.py"
],
"executor": "kubernetes_controlled_executor",
"verifier": "kubernetes_rollout_verifier",
"rollback": "declarative rollout undo or previous immutable revision",
"exit_condition": "K3s incidents never enter Ansible/Agent99 fallback and close with rollout evidence",
"next_action": "inventory current kubernetes actions and bind allowlisted declarative routes"
"confirmed_truth": [
"controlled mutation accepts only an identity-verified typed kubernetes_workload route bound to kubernetes_controlled_executor and kubernetes_rollout_verifier",
"the bounded mutation catalog permits rollout restart only; scale, delete, raw shell and model-supplied capabilities cannot enter controlled execution",
"namespace, workload kind, workload name, canonical asset, action digest and incident identity are bound into one single-use claim",
"dry-run precedes the bounded apply and the independent rollout verifier compares pre-state, post-state, generation, replicas and observed revision before closure",
"wrong domain, unresolved identity, verifier drift or cross-domain fallback returns a zero-write fail-closed receipt"
],
"runtime_gaps": [
"no production K3s same-run rollout restart, independent rollout verifier, Telegram receipt and learning closure is recorded for this exact source revision"
],
"next_action": "deploy one exact source revision through the authorized release lane, execute one allowlisted K3s rollout canary with its single-use capability, then independently verify rollout state plus same-run Telegram/KM/RAG/MCP/PlayBook receipts; retain zero-write or rollback terminal on any mismatch"
},
{
"id": "AIA-SRE-008",
@@ -872,11 +886,11 @@
"P1": 2
},
"by_status": {
"source_implemented_runtime_pending": 13,
"source_implemented_runtime_pending": 14,
"in_progress": 1,
"planned": 4
"planned": 3
},
"source_implemented_items": 13,
"source_implemented_items": 14,
"runtime_closed_items": 0,
"program_completion_percent": 0,
"asset_coverage_status": "partial",