From e48155c2d636ed24dd873f60f3297f5633c363a9 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 19 Jul 2026 01:33:01 +0800 Subject: [PATCH] chore(sre): reconcile k3s executor readiness --- ...3s_controlled_automation_work_items_api.py | 14 +++++++--- ...rolled-automation-work-items.snapshot.json | 28 ++++++++++++++----- 2 files changed, 31 insertions(+), 11 deletions(-) diff --git a/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py b/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py index da481f6ca..5ef6266f3 100644 --- a/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py +++ b/apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py @@ -116,11 +116,11 @@ def test_loader_returns_fixed_architecture_provider_order_and_agent99_bridge() - "total_items": 18, "by_priority": {"P0": 16, "P1": 2}, "by_status": { - "source_implemented_runtime_pending": 13, + "source_implemented_runtime_pending": 14, "in_progress": 1, - "planned": 4, + "planned": 3, }, - "source_implemented_items": 13, + "source_implemented_items": 14, "runtime_closed_items": 0, "program_completion_percent": 0, "asset_coverage_status": "partial", @@ -133,6 +133,12 @@ def test_ledger_links_confirmed_runtime_gaps_without_false_closure() -> None: items = {item["id"]: item for item in payload["work_items"]} assert "retired tombstone" in " ".join(items["AIA-SRE-002"]["confirmed_truth"]) + assert items["AIA-SRE-007"]["status"] == ( + "source_implemented_runtime_pending" + ) + assert "rollout restart only" in " ".join( + items["AIA-SRE-007"]["confirmed_truth"] + ) assert "host120/host121" in " ".join(items["AIA-SRE-002"]["runtime_gaps"]) assert items["AIA-SRE-008"]["status"] == ( "source_implemented_runtime_pending" @@ -189,7 +195,7 @@ def test_projection_keeps_program_asset_and_runtime_truth_separate() -> None: payload = load_sre_k3s_controlled_automation_work_items() projection = build_sre_k3s_program_projection(payload) - assert projection["rollups"]["source_implemented_items"] == 13 + assert projection["rollups"]["source_implemented_items"] == 14 assert projection["rollups"]["runtime_closed_items"] == 0 assert projection["rollups"]["program_completion_percent"] == 0 assert projection["domain_count"] == 8 diff --git a/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json b/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json index 871dde2b4..0abd146f5 100644 --- a/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json +++ b/docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json @@ -464,19 +464,33 @@ "title": "K3s workload 專屬 executor 與 rollout verifier", "owner_lane": "KubernetesAutomation", "risk": "high", - "status": "planned", + "status": "source_implemented_runtime_pending", "dependencies": [ "AIA-SRE-004" ], "source_refs": [ - "apps/api/src/services/executor.py", - "apps/api/src/services/post_execution_verifier.py" + "apps/api/src/services/controlled_alert_target_router.py", + "apps/api/src/services/kubernetes_controlled_executor.py", + "apps/api/src/services/kubernetes_rollout_verifier.py", + "apps/api/src/services/approval_execution.py", + "apps/api/src/services/callback_dispatcher.py", + "apps/api/src/plugins/mcp/providers/k8s_provider.py" ], "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier", "rollback": "declarative rollout undo or previous immutable revision", "exit_condition": "K3s incidents never enter Ansible/Agent99 fallback and close with rollout evidence", - "next_action": "inventory current kubernetes actions and bind allowlisted declarative routes" + "confirmed_truth": [ + "controlled mutation accepts only an identity-verified typed kubernetes_workload route bound to kubernetes_controlled_executor and kubernetes_rollout_verifier", + "the bounded mutation catalog permits rollout restart only; scale, delete, raw shell and model-supplied capabilities cannot enter controlled execution", + "namespace, workload kind, workload name, canonical asset, action digest and incident identity are bound into one single-use claim", + "dry-run precedes the bounded apply and the independent rollout verifier compares pre-state, post-state, generation, replicas and observed revision before closure", + "wrong domain, unresolved identity, verifier drift or cross-domain fallback returns a zero-write fail-closed receipt" + ], + "runtime_gaps": [ + "no production K3s same-run rollout restart, independent rollout verifier, Telegram receipt and learning closure is recorded for this exact source revision" + ], + "next_action": "deploy one exact source revision through the authorized release lane, execute one allowlisted K3s rollout canary with its single-use capability, then independently verify rollout state plus same-run Telegram/KM/RAG/MCP/PlayBook receipts; retain zero-write or rollback terminal on any mismatch" }, { "id": "AIA-SRE-008", @@ -872,11 +886,11 @@ "P1": 2 }, "by_status": { - "source_implemented_runtime_pending": 13, + "source_implemented_runtime_pending": 14, "in_progress": 1, - "planned": 4 + "planned": 3 }, - "source_implemented_items": 13, + "source_implemented_items": 14, "runtime_closed_items": 0, "program_completion_percent": 0, "asset_coverage_status": "partial",