feat(governance): 新增 runtime readback promotion gate

apps/api/tests/test_ai_agent_runtime_readback_promotion_gate.py

@@ -0,0 +1,88 @@
+import copy
+import json
+from pathlib import Path
+
+import pytest
+
+from src.services.ai_agent_runtime_readback_promotion_gate import (
+    load_latest_ai_agent_runtime_readback_promotion_gate,
+)
+
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+FIXTURE = REPO_ROOT / "docs/evaluations/ai_agent_runtime_readback_promotion_gate_2026-06-13.json"
+
+
+def test_load_latest_ai_agent_runtime_readback_promotion_gate_snapshot() -> None:
+    data = load_latest_ai_agent_runtime_readback_promotion_gate()
+
+    assert data["schema_version"] == "ai_agent_runtime_readback_promotion_gate_v1"
+    assert data["program_status"]["current_task_id"] == "P2-113"
+    assert data["program_status"]["next_task_id"] == "P2-114"
+    assert data["program_status"]["overall_completion_percent"] == 100
+    assert data["program_status"]["read_only_mode"] is True
+
+    rollups = data["rollups"]
+    assert rollups["promotion_lane_count"] == 5
+    assert rollups["receipt_contract_count"] == 4
+    assert rollups["reviewer_queue_preview_count"] == 4
+    assert rollups["result_capture_preview_count"] == 4
+    assert rollups["no_write_verifier_check_count"] == 5
+    assert rollups["blocker_mapping_count"] == 5
+    assert rollups["operator_action_count"] == 5
+    assert rollups["approval_required_lane_count"] == 2
+    assert rollups["blocked_lane_count"] == 1
+    assert rollups["blocked_receipt_contract_count"] == 1
+    assert rollups["approval_required_reviewer_preview_count"] == 1
+    assert rollups["blocked_result_preview_count"] == 1
+
+    zero_fields = [
+        "owner_approval_received_count",
+        "promotion_execution_count",
+        "canonical_runtime_target_read_count",
+        "live_query_count",
+        "failure_receipt_send_count",
+        "reviewer_queue_write_count",
+        "gateway_queue_write_count",
+        "telegram_send_count",
+        "bot_api_call_count",
+        "report_receipt_write_count",
+        "result_capture_write_count",
+        "learning_write_count",
+        "playbook_trust_write_count",
+        "production_write_count",
+        "secret_read_count",
+        "destructive_operation_count",
+    ]
+    for field in zero_fields:
+        assert rollups[field] == 0
+
+
+def test_runtime_readback_promotion_gate_rejects_reviewer_queue_write(tmp_path: Path) -> None:
+    source = json.loads(FIXTURE.read_text(encoding="utf-8"))
+    source["promotion_truth"]["reviewer_queue_write_enabled"] = True
+    target = tmp_path / "ai_agent_runtime_readback_promotion_gate_2026-06-13.json"
+    target.write_text(json.dumps(source), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="live read/send/write flags"):
+        load_latest_ai_agent_runtime_readback_promotion_gate(tmp_path)
+
+
+def test_runtime_readback_promotion_gate_rejects_rollup_drift(tmp_path: Path) -> None:
+    source = json.loads(FIXTURE.read_text(encoding="utf-8"))
+    source["rollups"]["promotion_lane_count"] = 4
+    target = tmp_path / "ai_agent_runtime_readback_promotion_gate_2026-06-13.json"
+    target.write_text(json.dumps(source), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="rollup counts mismatch"):
+        load_latest_ai_agent_runtime_readback_promotion_gate(tmp_path)
+
+
+def test_runtime_readback_promotion_gate_rejects_forbidden_display_terms(tmp_path: Path) -> None:
+    source = copy.deepcopy(json.loads(FIXTURE.read_text(encoding="utf-8")))
+    source["operator_actions"][0]["operator_instruction"] = "do not expose browser_context"
+    target = tmp_path / "ai_agent_runtime_readback_promotion_gate_2026-06-13.json"
+    target.write_text(json.dumps(source), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="forbidden display terms"):
+        load_latest_ai_agent_runtime_readback_promotion_gate(tmp_path)

apps/api/tests/test_ai_agent_runtime_readback_promotion_gate_api.py

@@ -0,0 +1,41 @@
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from src.main import app
+
+
+@pytest.mark.asyncio
+async def test_get_agent_runtime_readback_promotion_gate_api() -> None:
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/agents/agent-runtime-readback-promotion-gate")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["schema_version"] == "ai_agent_runtime_readback_promotion_gate_v1"
+    assert data["program_status"]["current_task_id"] == "P2-113"
+    assert data["program_status"]["next_task_id"] == "P2-114"
+    assert data["program_status"]["overall_completion_percent"] == 100
+
+    rollups = data["rollups"]
+    assert rollups["promotion_lane_count"] == 5
+    assert rollups["receipt_contract_count"] == 4
+    assert rollups["reviewer_queue_preview_count"] == 4
+    assert rollups["result_capture_preview_count"] == 4
+    assert rollups["no_write_verifier_check_count"] == 5
+    assert rollups["blocker_mapping_count"] == 5
+    assert rollups["operator_action_count"] == 5
+    assert rollups["owner_approval_received_count"] == 0
+    assert rollups["promotion_execution_count"] == 0
+    assert rollups["canonical_runtime_target_read_count"] == 0
+    assert rollups["live_query_count"] == 0
+    assert rollups["failure_receipt_send_count"] == 0
+    assert rollups["reviewer_queue_write_count"] == 0
+    assert rollups["gateway_queue_write_count"] == 0
+    assert rollups["telegram_send_count"] == 0
+    assert rollups["bot_api_call_count"] == 0
+    assert rollups["report_receipt_write_count"] == 0
+    assert rollups["result_capture_write_count"] == 0
+    assert rollups["learning_write_count"] == 0
+    assert rollups["playbook_trust_write_count"] == 0
+    assert rollups["production_write_count"] == 0