feat(api): expose github account suspension preflight

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -25,6 +25,9 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert data["summary"]["refs_sync_authorized"] is True
     assert data["summary"]["workflow_trigger_authorized"] is True
     assert data["summary"]["github_write_channel_ready"] is False
+    assert data["summary"]["github_account_status"] == "suspended"
+    assert data["summary"]["github_account_suspended"] is True
+    assert data["summary"]["github_api_forbidden_count"] == 6
     assert data["summary"]["github_controlled_apply_ready_count"] == 0
     assert data["summary"]["github_blocked_preflight_target_count"] == 5
     assert data["summary"]["secret_values_collected"] is False
@@ -48,13 +51,15 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert lanes["github"]["blocker_count"] == 5
     assert (
         lanes["github"]["status"]
-        == "blocked_github_write_channel_and_source_preflight_required"
+        == "blocked_github_account_suspended_and_write_channel_required"
     )
     assert lanes["github"]["metric"]["verified"] == 4
     assert lanes["github"]["metric"]["total"] == 9
     assert lanes["github"]["metric"]["controlled_apply_ready"] == 0
     assert lanes["github"]["metric"]["blocked_preflight"] == 5
     assert lanes["github"]["metric"]["write_channel_ready"] is False
+    assert lanes["github"]["metric"]["github_account_status"] == "suspended"
+    assert lanes["github"]["metric"]["github_account_suspended"] is True
     assert all(0 <= lane["completion_percent"] <= 100 for lane in lanes.values())
     assert all(lane["tone"] in {"ok", "warn", "danger"} for lane in lanes.values())
 

apps/api/tests/test_github_target_private_backup_evidence_gate.py

@@ -70,7 +70,10 @@ def test_load_github_target_private_backup_evidence_gate_from_committed_snapshot
         snapshot["summary"]["github_missing_target_controlled_apply_ready_count"] == 0
     )
     assert snapshot["summary"]["github_missing_target_blocked_preflight_count"] == 5
-    assert snapshot["summary"]["github_missing_target_github_404_count"] == 5
+    assert snapshot["summary"]["github_missing_target_github_404_count"] == 0
+    assert snapshot["summary"]["github_account_status"] == "suspended"
+    assert snapshot["summary"]["github_account_suspended"] is True
+    assert snapshot["summary"]["github_api_forbidden_count"] == 6
     assert snapshot["summary"]["private_backup_verified_count"] == 4
     assert snapshot["summary"]["private_visibility_verified_count"] == 4
     assert snapshot["summary"]["safe_credential_required_count"] == 9
@@ -228,14 +231,18 @@ def test_load_github_target_private_backup_evidence_gate_from_committed_snapshot
         == "github_target_controlled_execution_preflight_v1"
     )
     assert controlled_preflight["status"] == (
-        "blocked_github_write_channel_and_source_preflight_required"
+        "blocked_github_account_suspended_and_write_channel_required"
     )
     assert controlled_preflight["authorization_ready"] is True
     assert controlled_preflight["preflight_ready"] is False
     assert controlled_preflight["github_write_channel_ready"] is False
+    assert controlled_preflight["github_account_status"] == "suspended"
+    assert controlled_preflight["github_account_suspended"] is True
+    assert controlled_preflight["github_api_forbidden_count"] == 6
     assert controlled_preflight["github_create_repo_channel_ready"] is False
     assert controlled_preflight["github_refs_sync_channel_ready"] is False
-    assert controlled_preflight["github_connector_missing_target_404_count"] == 5
+    assert controlled_preflight["source_preflight_ready_count"] == 5
+    assert controlled_preflight["github_connector_missing_target_404_count"] == 0
     assert controlled_preflight["blocked_preflight_target_count"] == 5
     assert controlled_preflight["controlled_apply_ready_count"] == 0
     assert (
@@ -315,10 +322,14 @@ def test_load_github_target_private_backup_evidence_gate_from_committed_snapshot
     assert targets["owenhytsai/ewoooc"]["refs_sync_authorized"] is True
     assert targets["owenhytsai/ewoooc"]["execution_ready"] is True
     assert targets["owenhytsai/ewoooc"]["controlled_apply_ready"] is False
-    assert targets["owenhytsai/ewoooc"]["source_preflight_ready"] is False
-    assert targets["owenhytsai/ewoooc"]["canonical_source_ready"] is False
+    assert targets["owenhytsai/ewoooc"]["source_preflight_ready"] is True
+    assert targets["owenhytsai/ewoooc"]["canonical_source_ready"] is True
     assert (
-        "github_create_repo_channel_unavailable"
+        targets["owenhytsai/ewoooc"]["canonical_source_sha"]
+        == "f3e412cd211f5e4601204b256aeb95eae073b441"
+    )
+    assert (
+        "github_account_suspended_403"
         in targets["owenhytsai/ewoooc"]["controlled_apply_blockers"]
     )
     assert targets["owenhytsai/ewoooc"]["private_backup_verified"] is False
@@ -362,17 +373,20 @@ def test_load_github_target_controlled_execution_preflight_from_committed_snapsh
     )
     assert (
         preflight["status"]
-        == "blocked_github_write_channel_and_source_preflight_required"
+        == "blocked_github_account_suspended_and_write_channel_required"
     )
     assert preflight["authorization_ready"] is True
     assert preflight["preflight_ready"] is False
     assert preflight["github_write_channel_ready"] is False
+    assert preflight["github_account_status"] == "suspended"
+    assert preflight["github_account_suspended"] is True
+    assert preflight["github_api_forbidden_count"] == 6
     assert preflight["github_create_repo_channel_ready"] is False
     assert preflight["github_refs_sync_channel_ready"] is False
-    assert preflight["source_preflight_ready_count"] == 0
+    assert preflight["source_preflight_ready_count"] == 5
     assert preflight["controlled_apply_ready_count"] == 0
     assert preflight["blocked_preflight_target_count"] == 5
-    assert preflight["github_connector_missing_target_404_count"] == 5
+    assert preflight["github_connector_missing_target_404_count"] == 0
     assert preflight["operation_boundaries"]["controlled_apply_allowed"] is False
     assert preflight["operation_boundaries"]["secret_value_collection_allowed"] is False
     assert "private_clone_url_credential" in preflight["still_forbidden"]
@@ -381,9 +395,13 @@ def test_load_github_target_controlled_execution_preflight_from_committed_snapsh
         target_by_repo["owenhytsai/bitan-pharmacy"]["controlled_apply_ready"] is False
     )
     assert (
-        "local_worktree_has_tracked_changes"
+        "github_account_suspended_403"
         in target_by_repo["owenhytsai/bitan-pharmacy"]["blockers"]
     )
+    assert (
+        target_by_repo["owenhytsai/bitan-pharmacy"]["canonical_source_sha"]
+        == "e122c8cbd9522999fd9844c2b63790fadcc89c20"
+    )
     assert target_by_repo["owenhytsai/VibeWork"]["refs_sync_apply_ready"] is False
 
 

apps/api/tests/test_github_target_private_backup_evidence_gate_api.py

@@ -37,7 +37,10 @@ def test_github_target_private_backup_evidence_gate_endpoint_returns_read_only_g
     assert data["summary"]["github_refs_sync_channel_ready"] is False
     assert data["summary"]["github_missing_target_controlled_apply_ready_count"] == 0
     assert data["summary"]["github_missing_target_blocked_preflight_count"] == 5
-    assert data["summary"]["github_missing_target_github_404_count"] == 5
+    assert data["summary"]["github_missing_target_github_404_count"] == 0
+    assert data["summary"]["github_account_status"] == "suspended"
+    assert data["summary"]["github_account_suspended"] is True
+    assert data["summary"]["github_api_forbidden_count"] == 6
     assert data["summary"]["private_backup_verified_count"] == 4
     assert data["summary"]["private_visibility_verified_count"] == 4
     assert data["summary"]["safe_credential_evidence_intake_ready"] is True
@@ -141,22 +144,26 @@ def test_github_target_controlled_execution_preflight_endpoint_returns_write_gap
     data = response.json()
     assert data["schema_version"] == "github_target_controlled_execution_preflight_v1"
     assert (
-        data["status"] == "blocked_github_write_channel_and_source_preflight_required"
+        data["status"]
+        == "blocked_github_account_suspended_and_write_channel_required"
     )
     assert data["authorization_ready"] is True
     assert data["preflight_ready"] is False
     assert data["github_write_channel_ready"] is False
+    assert data["github_account_status"] == "suspended"
+    assert data["github_account_suspended"] is True
+    assert data["github_api_forbidden_count"] == 6
     assert data["github_create_repo_channel_ready"] is False
     assert data["github_refs_sync_channel_ready"] is False
-    assert data["source_preflight_ready_count"] == 0
+    assert data["source_preflight_ready_count"] == 5
     assert data["controlled_apply_ready_count"] == 0
     assert data["blocked_preflight_target_count"] == 5
-    assert data["github_connector_missing_target_404_count"] == 5
+    assert data["github_connector_missing_target_404_count"] == 0
     assert data["operation_boundaries"]["controlled_apply_allowed"] is False
     assert data["operation_boundaries"]["secret_value_collection_allowed"] is False
     assert data["tool_channel_readback"]["gh_cli_write_ready"] is False
     assert data["targets"][0]["controlled_apply_ready"] is False
-    assert "github_create_repo_channel_unavailable" in data["targets"][0]["blockers"]
+    assert "github_account_suspended_403" in data["targets"][0]["blockers"]
     assert "192.168.0." not in response.text