fix(api): fail closed deploy runtime readback

apps/api/src/services/awoooi_production_deploy_readback_blocker.py

@@ -98,17 +98,49 @@ def _enrich_runtime_build_readback(payload: dict[str, Any]) -> None:
         return
 
     readback = _dict(payload.get("readback"))
+    rollups = _dict(payload.get("rollups"))
+    committed_source_sha = str(readback.get("observed_source_control_main_sha") or "")
+    committed_image_sha = str(readback.get("production_image_tag_sha") or "")
+    source_matches_runtime = committed_source_sha == build_sha
+    image_matches_runtime = committed_image_sha == build_sha
+
     readback["runtime_build_commit_sha"] = build_sha
     readback["runtime_build_commit_short_sha"] = build_sha[:10]
-    readback["observed_source_control_main_sha"] = build_sha
-    readback["observed_source_control_main_short_sha"] = build_sha[:10]
-    readback["production_image_tag_sha"] = build_sha
-    readback["production_image_tag_short_sha"] = build_sha[:10]
-    readback["production_image_tag_matches_main"] = True
+    readback["runtime_build_matches_committed_source_control_readback"] = (
+        source_matches_runtime
+    )
+    readback["runtime_build_matches_committed_production_image_tag"] = (
+        image_matches_runtime
+    )
+    readback["runtime_build_readback_status"] = (
+        "matches_committed_deploy_readback"
+        if source_matches_runtime and image_matches_runtime
+        else "runtime_build_diverges_from_committed_deploy_readback"
+    )
 
-    rollups = _dict(payload.get("rollups"))
-    rollups["source_control_main_ready"] = True
-    rollups["production_image_tag_matches_main"] = True
+    if source_matches_runtime and image_matches_runtime:
+        return
+
+    # The runtime build SHA is evidence about the currently running image, not
+    # permission to rewrite source-control truth. If it diverges from the
+    # committed deploy snapshot, fail closed so Workbench cannot report a false
+    # "image tag matches main" closure while production routes are stale.
+    readback["production_image_tag_matches_main"] = False
+    rollups["source_control_main_ready"] = False
+    rollups["production_image_tag_matches_main"] = False
+    payload["status"] = "runtime_build_readback_stale"
+    _append_unique(
+        payload,
+        "blockers",
+        "runtime_build_commit_sha_does_not_match_committed_production_readback",
+    )
+    _append_unique(
+        payload,
+        "next_actions",
+        "refresh_production_deploy_readback_from_current_main_and_runtime_route_smoke",
+    )
+    rollups["hard_blocker_count"] = len(_list(payload.get("blockers")))
+    rollups["next_action_count"] = len(_list(payload.get("next_actions")))
 
 
 def _require_no_internal_network_literals(value: Any, label: str) -> None:
@@ -125,3 +157,12 @@ def _dict(value: Any) -> dict[str, Any]:
 
 def _list(value: Any) -> list[Any]:
     return value if isinstance(value, list) else []
+
+
+def _append_unique(payload: dict[str, Any], key: str, item: str) -> None:
+    values = payload.get(key)
+    if not isinstance(values, list):
+        values = []
+        payload[key] = values
+    if item not in values:
+        values.append(item)

apps/api/src/services/delivery_closure_workbench.py

@@ -291,6 +291,26 @@ def build_delivery_closure_workbench(
                     production_deploy_readback.get("production_image_tag_short_sha")
                     or ""
                 ),
+                "runtime_build_commit_short_sha": str(
+                    production_deploy_readback.get("runtime_build_commit_short_sha")
+                    or ""
+                ),
+                "runtime_build_readback_status": str(
+                    production_deploy_readback.get("runtime_build_readback_status")
+                    or ""
+                ),
+                "runtime_build_matches_committed_source_control_readback": (
+                    production_deploy_readback.get(
+                        "runtime_build_matches_committed_source_control_readback"
+                    )
+                    is True
+                ),
+                "runtime_build_matches_committed_production_image_tag": (
+                    production_deploy_readback.get(
+                        "runtime_build_matches_committed_production_image_tag"
+                    )
+                    is True
+                ),
                 "production_image_tag_matches_main": production_deploy_readback.get(
                     "production_image_tag_matches_main"
                 )
@@ -1632,6 +1652,27 @@ def build_delivery_closure_workbench(
                 "production_image_tag_matches_main"
             )
             is True,
+            "production_deploy_runtime_build_commit_sha": str(
+                production_deploy_readback.get("runtime_build_commit_sha") or ""
+            ),
+            "production_deploy_runtime_build_commit_short_sha": str(
+                production_deploy_readback.get("runtime_build_commit_short_sha") or ""
+            ),
+            "production_deploy_runtime_build_readback_status": str(
+                production_deploy_readback.get("runtime_build_readback_status") or ""
+            ),
+            "production_deploy_runtime_build_matches_committed_source_control_readback": (
+                production_deploy_readback.get(
+                    "runtime_build_matches_committed_source_control_readback"
+                )
+                is True
+            ),
+            "production_deploy_runtime_build_matches_committed_production_image_tag": (
+                production_deploy_readback.get(
+                    "runtime_build_matches_committed_production_image_tag"
+                )
+                is True
+            ),
             "production_deploy_governance_fields_present": production_deploy_rollups.get(
                 "production_governance_fields_present"
             )