feat(smoke): monitor pchome controlled apply final preflight
Some checks failed
CD Pipeline / deploy (push) Has been cancelled
Some checks failed
CD Pipeline / deploy (push) Has been cancelled
This commit is contained in:
ogt
@@ -450,6 +450,23 @@ def build_scheduled_automation_health_summary(
|
||||
auto_policy_authorization_evidence_closeout_details = (
|
||||
auto_policy_authorization_evidence_closeout.get("details") or {}
|
||||
)
|
||||
auto_policy_controlled_apply_final_preflight = _find_check(
|
||||
source_result,
|
||||
"PChome auto-policy controlled apply final preflight",
|
||||
)
|
||||
auto_policy_controlled_apply_final_preflight_details = (
|
||||
auto_policy_controlled_apply_final_preflight.get("details") or {}
|
||||
)
|
||||
if (
|
||||
not auto_policy_controlled_apply_final_preflight
|
||||
or not auto_policy_controlled_apply_final_preflight_details
|
||||
):
|
||||
auto_policy_controlled_apply_final_preflight = (
|
||||
_pchome_auto_policy_controlled_apply_final_preflight_check()
|
||||
)
|
||||
auto_policy_controlled_apply_final_preflight_details = (
|
||||
auto_policy_controlled_apply_final_preflight.get("details") or {}
|
||||
)
|
||||
surface_readback = _find_check(source_result, "AI surface HTML readback")
|
||||
surface_details = surface_readback.get("details") or {}
|
||||
sitewide_readback = _find_check(source_result, "Sitewide UI/UX Agent readback")
|
||||
@@ -3908,6 +3925,396 @@ def build_scheduled_automation_health_summary(
|
||||
"writes_database": False,
|
||||
},
|
||||
},
|
||||
{
|
||||
"key": "pchome_auto_policy_controlled_apply_final_preflight",
|
||||
"label": "PChome auto-policy controlled apply final preflight",
|
||||
"status": (
|
||||
auto_policy_controlled_apply_final_preflight.get("status")
|
||||
or "warning"
|
||||
),
|
||||
"summary": (
|
||||
auto_policy_controlled_apply_final_preflight.get("summary")
|
||||
or (
|
||||
"PChome auto-policy controlled apply final preflight "
|
||||
"has no latest check."
|
||||
)
|
||||
),
|
||||
"next_machine_action": (
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"next_machine_action"
|
||||
)
|
||||
or (
|
||||
"continue_pchome_auto_policy_controlled_apply_final_preflight_monitoring"
|
||||
if auto_policy_controlled_apply_final_preflight.get("status")
|
||||
== "ok"
|
||||
else "refresh_pchome_auto_policy_controlled_apply_final_preflight"
|
||||
)
|
||||
),
|
||||
"details": {
|
||||
"policy": auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"policy"
|
||||
),
|
||||
"result": auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"result"
|
||||
),
|
||||
"controlled_apply_final_preflight_ready_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_ready_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_check_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_check_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_pass_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_pass_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_waiting_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_waiting_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_closeout_ready_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_closeout_ready_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_closeout_check_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_closeout_check_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_preflight_ready_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_preflight_ready_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_preflight_check_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_preflight_check_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_verifier_receipt_closeout_ready_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_verifier_receipt_closeout_ready_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"verifier_receipt_closeout_check_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"verifier_receipt_closeout_check_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"database_apply_final_verifier_gate_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"database_apply_final_verifier_gate_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"database_apply_authorization_final_verifier_gate_ready_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"database_apply_authorization_final_verifier_gate_ready_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_field_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_field_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"controlled_apply_final_preflight_acceptance_gate_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_acceptance_gate_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"rollback_binding_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_binding_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"rollback_binding_field_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_binding_field_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"post_apply_verifier_binding_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_binding_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"post_apply_verifier_binding_field_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_binding_field_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_closeout_field_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_closeout_field_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"authorization_evidence_execution_closeout_acceptance_gate_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"authorization_evidence_execution_closeout_acceptance_gate_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"post_apply_verifier_required_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_required_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"same_run_truth_required_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"same_run_truth_required_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"reads_secret_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"reads_secret_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"executes_script_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_script_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"executes_endpoint_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_endpoint_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"executes_sql_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_sql_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"writes_database_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"writes_database_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"signs_database_apply_authorization_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"signs_database_apply_authorization_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"primary_human_gate_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"primary_human_gate_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"manual_review_required_count": int(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"manual_review_required_count"
|
||||
)
|
||||
or 0
|
||||
),
|
||||
"manual_review_mode": (
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"manual_review_mode"
|
||||
)
|
||||
),
|
||||
"payload_source": auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"payload_source"
|
||||
),
|
||||
"execute_fetch": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"execute_fetch"
|
||||
)
|
||||
),
|
||||
"outbound_network": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"outbound_network"
|
||||
)
|
||||
),
|
||||
"business_data_source": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"business_data_source"
|
||||
)
|
||||
),
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight"
|
||||
)
|
||||
),
|
||||
"can_enter_future_database_apply_controlled_dry_run_package": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"can_enter_future_database_apply_controlled_dry_run_package"
|
||||
)
|
||||
),
|
||||
"controlled_apply_final_preflight_ready": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"controlled_apply_final_preflight_ready"
|
||||
)
|
||||
),
|
||||
"rollback_binding_ready": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_binding_ready"
|
||||
)
|
||||
),
|
||||
"post_apply_verifier_binding_ready": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_binding_ready"
|
||||
)
|
||||
),
|
||||
"rollback_bound": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_bound"
|
||||
)
|
||||
),
|
||||
"post_apply_verifier_bound": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_bound"
|
||||
)
|
||||
),
|
||||
"dry_run_only": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"dry_run_only"
|
||||
)
|
||||
),
|
||||
"check_mode_only": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"check_mode_only"
|
||||
)
|
||||
),
|
||||
"rollback_execution_authorized": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_execution_authorized"
|
||||
)
|
||||
),
|
||||
"rollback_executes_sql": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_executes_sql"
|
||||
)
|
||||
),
|
||||
"rollback_writes_database": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"rollback_writes_database"
|
||||
)
|
||||
),
|
||||
"post_apply_verifier_execution_authorized_in_preview": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"post_apply_verifier_execution_authorized_in_preview"
|
||||
)
|
||||
),
|
||||
"permits_future_database_apply_controlled_dry_run_package": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"permits_future_database_apply_controlled_dry_run_package"
|
||||
)
|
||||
),
|
||||
"accepts_plaintext_secret": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"accepts_plaintext_secret"
|
||||
)
|
||||
),
|
||||
"reads_secret_in_preview": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"reads_secret_in_preview"
|
||||
)
|
||||
),
|
||||
"signature_material_included": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"signature_material_included"
|
||||
)
|
||||
),
|
||||
"secret_material_included": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"secret_material_included"
|
||||
)
|
||||
),
|
||||
"secret_material_required_in_preview": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"secret_material_required_in_preview"
|
||||
)
|
||||
),
|
||||
"executes_authorization_evidence": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_authorization_evidence"
|
||||
)
|
||||
),
|
||||
"executes_database_apply": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_database_apply"
|
||||
)
|
||||
),
|
||||
"executes_endpoint": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_endpoint"
|
||||
)
|
||||
),
|
||||
"executes_sql": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"executes_sql"
|
||||
)
|
||||
),
|
||||
"ready_for_database_apply_now": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"ready_for_database_apply_now"
|
||||
)
|
||||
),
|
||||
"database_apply_authorized": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"database_apply_authorized"
|
||||
)
|
||||
),
|
||||
"issues_database_apply_authorization": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"issues_database_apply_authorization"
|
||||
)
|
||||
),
|
||||
"signs_database_apply_authorization": bool(
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"signs_database_apply_authorization"
|
||||
)
|
||||
),
|
||||
"next_machine_action": (
|
||||
auto_policy_controlled_apply_final_preflight_details.get(
|
||||
"next_machine_action"
|
||||
)
|
||||
or (
|
||||
"continue_pchome_auto_policy_controlled_apply_final_preflight_monitoring"
|
||||
if auto_policy_controlled_apply_final_preflight.get("status")
|
||||
== "ok"
|
||||
else "refresh_pchome_auto_policy_controlled_apply_final_preflight"
|
||||
)
|
||||
),
|
||||
"writes_database": False,
|
||||
},
|
||||
},
|
||||
{
|
||||
"key": "ai_surface_html_readback",
|
||||
"label": "AI surface HTML readback",
|
||||
@@ -9984,6 +10391,543 @@ def _pchome_auto_policy_authorization_evidence_execution_closeout_check() -> Dic
|
||||
)
|
||||
|
||||
|
||||
def _pchome_auto_policy_controlled_apply_final_preflight_check() -> Dict[str, Any]:
|
||||
"""Read-only monitor for the future controlled-apply final preflight."""
|
||||
try:
|
||||
from services import pchome_mapping_backlog_service as backlog
|
||||
from services.ai_exception_contract import (
|
||||
LEGACY_REVIEW_REQUIRED_COUNT_KEY,
|
||||
PRIMARY_HUMAN_GATE_COUNT_KEY,
|
||||
)
|
||||
|
||||
payload = _pchome_auto_policy_decision_preflight_contract_payload()
|
||||
preflight = (
|
||||
backlog.build_pchome_auto_policy_db_apply_controlled_apply_final_preflight(
|
||||
payload,
|
||||
batch_size=max(
|
||||
1, min(_PCHOME_AUTO_POLICY_DECISION_PREFLIGHT_BATCH_SIZE, 50)
|
||||
),
|
||||
execute_fetch=True,
|
||||
timeout_seconds=max(
|
||||
1,
|
||||
min(_PCHOME_AUTO_POLICY_DECISION_PREFLIGHT_TIMEOUT_SECONDS, 30),
|
||||
),
|
||||
http_get=_pchome_auto_policy_machine_fetch_evidence_get,
|
||||
)
|
||||
)
|
||||
summary = preflight.get("summary") or {}
|
||||
future_preflight = (
|
||||
preflight.get("future_database_apply_controlled_apply_final_preflight")
|
||||
or {}
|
||||
)
|
||||
final_preflight = preflight.get("controlled_apply_final_preflight") or {}
|
||||
contract = preflight.get("controlled_apply_final_preflight_contract") or {}
|
||||
safety = preflight.get("safety") or {}
|
||||
rollback_binding = final_preflight.get("rollback_binding") or {}
|
||||
verifier_binding = (
|
||||
final_preflight.get("post_apply_verifier_binding") or {}
|
||||
)
|
||||
preflight_fields = list(
|
||||
final_preflight.get("controlled_apply_final_preflight_fields") or []
|
||||
)
|
||||
preflight_gates = list(
|
||||
final_preflight.get("controlled_apply_final_preflight_acceptance_gates")
|
||||
or []
|
||||
)
|
||||
result = str(preflight.get("result") or "UNKNOWN")
|
||||
|
||||
ready_count = int(
|
||||
summary.get("controlled_apply_final_preflight_ready_count") or 0
|
||||
)
|
||||
check_count = int(
|
||||
summary.get("controlled_apply_final_preflight_check_count") or 0
|
||||
)
|
||||
pass_count = int(
|
||||
summary.get("controlled_apply_final_preflight_pass_count") or 0
|
||||
)
|
||||
waiting_count = int(
|
||||
summary.get("controlled_apply_final_preflight_waiting_count") or 0
|
||||
)
|
||||
evidence_closeout_ready_count = int(
|
||||
summary.get("authorization_evidence_execution_closeout_ready_count") or 0
|
||||
)
|
||||
evidence_closeout_check_count = int(
|
||||
summary.get("authorization_evidence_execution_closeout_check_count") or 0
|
||||
)
|
||||
evidence_preflight_ready_count = int(
|
||||
summary.get("authorization_evidence_execution_preflight_ready_count") or 0
|
||||
)
|
||||
evidence_preflight_check_count = int(
|
||||
summary.get("authorization_evidence_execution_preflight_check_count") or 0
|
||||
)
|
||||
verifier_closeout_ready_count = int(
|
||||
summary.get("authorization_verifier_receipt_closeout_ready_count") or 0
|
||||
)
|
||||
verifier_closeout_check_count = int(
|
||||
summary.get("verifier_receipt_closeout_check_count") or 0
|
||||
)
|
||||
final_verifier_gate_count = int(
|
||||
summary.get("database_apply_final_verifier_gate_count") or 0
|
||||
)
|
||||
final_verifier_gate_ready_count = int(
|
||||
summary.get("database_apply_authorization_final_verifier_gate_ready_count")
|
||||
or 0
|
||||
)
|
||||
final_preflight_count = int(
|
||||
summary.get("controlled_apply_final_preflight_count") or 0
|
||||
)
|
||||
final_preflight_field_count = int(
|
||||
summary.get("controlled_apply_final_preflight_field_count") or 0
|
||||
)
|
||||
final_preflight_gate_count = int(
|
||||
summary.get("controlled_apply_final_preflight_acceptance_gate_count") or 0
|
||||
)
|
||||
rollback_binding_count = int(summary.get("rollback_binding_count") or 0)
|
||||
rollback_binding_field_count = int(
|
||||
summary.get("rollback_binding_field_count") or 0
|
||||
)
|
||||
verifier_binding_count = int(
|
||||
summary.get("post_apply_verifier_binding_count") or 0
|
||||
)
|
||||
verifier_binding_field_count = int(
|
||||
summary.get("post_apply_verifier_binding_field_count") or 0
|
||||
)
|
||||
evidence_closeout_field_count = int(
|
||||
summary.get("authorization_evidence_execution_closeout_field_count") or 0
|
||||
)
|
||||
evidence_closeout_gate_count = int(
|
||||
summary.get(
|
||||
"authorization_evidence_execution_closeout_acceptance_gate_count"
|
||||
)
|
||||
or 0
|
||||
)
|
||||
verifier_required_count = int(
|
||||
summary.get("post_apply_verifier_required_count") or 0
|
||||
)
|
||||
same_run_truth_count = int(summary.get("same_run_truth_required_count") or 0)
|
||||
writes_script_count = int(summary.get("writes_script_count") or 0)
|
||||
writes_artifact_count = int(summary.get("writes_artifact_count") or 0)
|
||||
reads_secret_count = int(summary.get("reads_secret_count") or 0)
|
||||
executes_script_count = int(summary.get("executes_script_count") or 0)
|
||||
executes_migration_count = int(summary.get("executes_migration_count") or 0)
|
||||
executes_endpoint_count = int(summary.get("executes_endpoint_count") or 0)
|
||||
executes_sql_count = int(summary.get("executes_sql_count") or 0)
|
||||
writes_database_count = int(summary.get("writes_database_count") or 0)
|
||||
signs_database_apply_authorization_count = int(
|
||||
summary.get("signs_database_apply_authorization_count") or 0
|
||||
)
|
||||
primary_human_gate_count = int(summary.get(PRIMARY_HUMAN_GATE_COUNT_KEY) or 0)
|
||||
manual_review_required_count = int(
|
||||
summary.get(LEGACY_REVIEW_REQUIRED_COUNT_KEY) or 0
|
||||
)
|
||||
side_effect_count = (
|
||||
writes_script_count
|
||||
+ writes_artifact_count
|
||||
+ reads_secret_count
|
||||
+ executes_script_count
|
||||
+ executes_migration_count
|
||||
+ executes_endpoint_count
|
||||
+ executes_sql_count
|
||||
+ writes_database_count
|
||||
+ signs_database_apply_authorization_count
|
||||
)
|
||||
risk_detected = any(
|
||||
[
|
||||
side_effect_count,
|
||||
primary_human_gate_count,
|
||||
manual_review_required_count,
|
||||
safety.get("reads_secret_in_preview") is not False,
|
||||
safety.get("writes_file") is not False,
|
||||
safety.get("writes_script_in_preview") is not False,
|
||||
safety.get("writes_artifact_in_preview") is not False,
|
||||
safety.get("executes_script") is not False,
|
||||
safety.get("executes_endpoint") is not False,
|
||||
safety.get("executes_migration") is not False,
|
||||
safety.get("executes_sql") is not False,
|
||||
safety.get("writes_database") is not False,
|
||||
safety.get("signs_database_apply_authorization") is not False,
|
||||
safety.get("performs_detached_signature_verification") is not False,
|
||||
safety.get("persists_verifier_receipt") is not False,
|
||||
safety.get("executes_authorization_evidence") is not False,
|
||||
safety.get("executes_database_apply") is not False,
|
||||
future_preflight.get("ready_for_database_apply_now") is not False,
|
||||
future_preflight.get("database_apply_authorized") is not False,
|
||||
future_preflight.get("issues_database_apply_authorization") is not False,
|
||||
future_preflight.get("signs_database_apply_authorization") is not False,
|
||||
future_preflight.get("executes_authorization_evidence") is not False,
|
||||
future_preflight.get("executes_database_apply") is not False,
|
||||
future_preflight.get("executes_endpoint") is not False,
|
||||
future_preflight.get("executes_sql") is not False,
|
||||
future_preflight.get("writes_database") is not False,
|
||||
future_preflight.get("reads_secret_in_preview") is not False,
|
||||
final_preflight.get("ready_for_database_apply_now") is not False,
|
||||
final_preflight.get("database_apply_authorized") is not False,
|
||||
final_preflight.get("issues_database_apply_authorization")
|
||||
is not False,
|
||||
final_preflight.get("signs_database_apply_authorization")
|
||||
is not False,
|
||||
final_preflight.get("executes_authorization_evidence") is not False,
|
||||
final_preflight.get("executes_database_apply") is not False,
|
||||
final_preflight.get("executes_endpoint_in_preview") is not False,
|
||||
final_preflight.get("executes_sql_in_preview") is not False,
|
||||
final_preflight.get("writes_database_in_preview") is not False,
|
||||
final_preflight.get("accepts_plaintext_secret") is not False,
|
||||
final_preflight.get("reads_secret_in_preview") is not False,
|
||||
final_preflight.get("signature_material_included") is not False,
|
||||
final_preflight.get("secret_material_included") is not False,
|
||||
final_preflight.get("secret_material_required_in_preview")
|
||||
is not False,
|
||||
rollback_binding.get("rollback_execution_authorized") is not False,
|
||||
rollback_binding.get("rollback_executes_sql") is not False,
|
||||
rollback_binding.get("rollback_writes_database") is not False,
|
||||
rollback_binding.get("rollback_reads_secret") is not False,
|
||||
verifier_binding.get("verifier_execution_authorized_in_preview")
|
||||
is not False,
|
||||
verifier_binding.get("database_apply_authorized") is not False,
|
||||
contract.get("accepts_plaintext_secret") is not False,
|
||||
contract.get("performs_detached_signature_verification") is not False,
|
||||
contract.get("persists_verifier_receipt") is not False,
|
||||
contract.get("executes_authorization_evidence") is not False,
|
||||
contract.get("executes_database_apply") is not False,
|
||||
contract.get("executes_endpoint") is not False,
|
||||
contract.get("executes_sql") is not False,
|
||||
contract.get("issues_database_apply_authorization") is not False,
|
||||
contract.get("database_apply_authorized") is not False,
|
||||
contract.get("ready_for_database_apply_now") is not False,
|
||||
contract.get("signs_database_apply_authorization") is not False,
|
||||
contract.get("writes_database") is not False,
|
||||
contract.get("executes_in_preview") is not False,
|
||||
contract.get("secret_material_required_in_preview") is not False,
|
||||
]
|
||||
)
|
||||
final_preflight_contract_present = (
|
||||
result == "DB_APPLY_CONTROLLED_APPLY_FINAL_PREFLIGHT_READY"
|
||||
and ready_count == 1
|
||||
and check_count >= 12
|
||||
and pass_count == check_count
|
||||
and waiting_count == 0
|
||||
and evidence_closeout_ready_count == 1
|
||||
and evidence_closeout_check_count == 12
|
||||
and evidence_preflight_ready_count == 1
|
||||
and evidence_preflight_check_count == 12
|
||||
and verifier_closeout_ready_count == 1
|
||||
and verifier_closeout_check_count == 12
|
||||
and final_verifier_gate_count == 1
|
||||
and final_verifier_gate_ready_count == 1
|
||||
and final_preflight_count == 1
|
||||
and final_preflight_field_count == 12
|
||||
and final_preflight_gate_count == 10
|
||||
and rollback_binding_count == 1
|
||||
and rollback_binding_field_count == 8
|
||||
and verifier_binding_count == 1
|
||||
and verifier_binding_field_count == 8
|
||||
and evidence_closeout_field_count == 12
|
||||
and evidence_closeout_gate_count == 10
|
||||
and verifier_required_count == 1
|
||||
and same_run_truth_count == 1
|
||||
and "rollback_binding_id" in preflight_fields
|
||||
and "post_apply_verifier_bound" in preflight_gates
|
||||
and future_preflight.get(
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight"
|
||||
)
|
||||
is True
|
||||
and future_preflight.get(
|
||||
"can_enter_future_database_apply_controlled_dry_run_package"
|
||||
)
|
||||
is True
|
||||
and future_preflight.get("controlled_apply_final_preflight_ready")
|
||||
is True
|
||||
and future_preflight.get("rollback_binding_ready") is True
|
||||
and future_preflight.get("post_apply_verifier_binding_ready") is True
|
||||
and final_preflight.get("authorization_material_type")
|
||||
== "controlled_apply_final_preflight"
|
||||
and final_preflight.get(
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight"
|
||||
)
|
||||
is True
|
||||
and final_preflight.get("dry_run_only") is True
|
||||
and final_preflight.get("check_mode_only") is True
|
||||
and final_preflight.get("rollback_bound") is True
|
||||
and final_preflight.get("post_apply_verifier_bound") is True
|
||||
and final_preflight.get("requires_fresh_production_truth_in_same_run")
|
||||
is True
|
||||
and final_preflight.get("requires_post_apply_verifier") is True
|
||||
and final_preflight.get("hash_matches") is True
|
||||
and rollback_binding.get("rollback_execution_authorized") is False
|
||||
and rollback_binding.get("rollback_executes_sql") is False
|
||||
and rollback_binding.get("rollback_writes_database") is False
|
||||
and rollback_binding.get("rollback_reads_secret") is False
|
||||
and rollback_binding.get("rollback_requires_same_run_truth") is True
|
||||
and verifier_binding.get("verifier_must_run_after_apply") is True
|
||||
and verifier_binding.get("same_run_production_truth_required") is True
|
||||
and verifier_binding.get("verifier_execution_authorized_in_preview")
|
||||
is False
|
||||
and verifier_binding.get("database_apply_authorized") is False
|
||||
and contract.get("machine_verifiable") is True
|
||||
and contract.get("permits_future_database_apply_controlled_dry_run_package")
|
||||
is True
|
||||
and contract.get("accepts_plaintext_secret") is False
|
||||
and contract.get("executes_authorization_evidence") is False
|
||||
and contract.get("executes_database_apply") is False
|
||||
and contract.get("executes_endpoint") is False
|
||||
and contract.get("executes_sql") is False
|
||||
and contract.get("writes_database") is False
|
||||
and safety.get("manual_review_mode") == "exception_only"
|
||||
)
|
||||
|
||||
if risk_detected:
|
||||
status = "critical"
|
||||
summary_text = (
|
||||
"PChome auto-policy controlled apply final preflight "
|
||||
"偵測到 secret、execution、SQL、DB write、rollback execution、"
|
||||
"database apply、簽發授權或人工主 gate 風險"
|
||||
)
|
||||
next_machine_action = (
|
||||
"halt_pchome_auto_policy_controlled_apply_final_preflight_and_inspect_risk"
|
||||
)
|
||||
elif final_preflight_contract_present:
|
||||
status = "ok"
|
||||
summary_text = (
|
||||
"PChome auto-policy controlled apply final preflight "
|
||||
f"已自動完成 {pass_count}/{check_count} checks，rollback/verifier binding 已綁定，apply/write/sign=0"
|
||||
)
|
||||
next_machine_action = (
|
||||
"continue_to_pchome_auto_policy_controlled_dry_run_package_lane"
|
||||
)
|
||||
else:
|
||||
status = "warning"
|
||||
summary_text = (
|
||||
"PChome auto-policy controlled apply final preflight "
|
||||
"尚未達自動監控契約"
|
||||
)
|
||||
next_machine_action = (
|
||||
"refresh_pchome_auto_policy_controlled_apply_final_preflight"
|
||||
)
|
||||
|
||||
return _check(
|
||||
"PChome auto-policy controlled apply final preflight",
|
||||
status,
|
||||
summary_text,
|
||||
{
|
||||
"policy": preflight.get("policy"),
|
||||
"result": result,
|
||||
"source_policy": preflight.get("source_policy"),
|
||||
"controlled_apply_final_preflight_ready_count": ready_count,
|
||||
"controlled_apply_final_preflight_check_count": check_count,
|
||||
"controlled_apply_final_preflight_pass_count": pass_count,
|
||||
"controlled_apply_final_preflight_waiting_count": waiting_count,
|
||||
"authorization_evidence_execution_closeout_ready_count": (
|
||||
evidence_closeout_ready_count
|
||||
),
|
||||
"authorization_evidence_execution_closeout_check_count": (
|
||||
evidence_closeout_check_count
|
||||
),
|
||||
"authorization_evidence_execution_preflight_ready_count": (
|
||||
evidence_preflight_ready_count
|
||||
),
|
||||
"authorization_evidence_execution_preflight_check_count": (
|
||||
evidence_preflight_check_count
|
||||
),
|
||||
"authorization_verifier_receipt_closeout_ready_count": (
|
||||
verifier_closeout_ready_count
|
||||
),
|
||||
"verifier_receipt_closeout_check_count": (
|
||||
verifier_closeout_check_count
|
||||
),
|
||||
"database_apply_final_verifier_gate_count": final_verifier_gate_count,
|
||||
"database_apply_authorization_final_verifier_gate_ready_count": (
|
||||
final_verifier_gate_ready_count
|
||||
),
|
||||
"controlled_apply_final_preflight_count": final_preflight_count,
|
||||
"controlled_apply_final_preflight_field_count": (
|
||||
final_preflight_field_count
|
||||
),
|
||||
"controlled_apply_final_preflight_acceptance_gate_count": (
|
||||
final_preflight_gate_count
|
||||
),
|
||||
"rollback_binding_count": rollback_binding_count,
|
||||
"rollback_binding_field_count": rollback_binding_field_count,
|
||||
"post_apply_verifier_binding_count": verifier_binding_count,
|
||||
"post_apply_verifier_binding_field_count": (
|
||||
verifier_binding_field_count
|
||||
),
|
||||
"authorization_evidence_execution_closeout_field_count": (
|
||||
evidence_closeout_field_count
|
||||
),
|
||||
"authorization_evidence_execution_closeout_acceptance_gate_count": (
|
||||
evidence_closeout_gate_count
|
||||
),
|
||||
"post_apply_verifier_required_count": verifier_required_count,
|
||||
"same_run_truth_required_count": same_run_truth_count,
|
||||
"writes_script_count": writes_script_count,
|
||||
"writes_artifact_count": writes_artifact_count,
|
||||
"reads_secret_count": reads_secret_count,
|
||||
"executes_script_count": executes_script_count,
|
||||
"executes_migration_count": executes_migration_count,
|
||||
"executes_endpoint_count": executes_endpoint_count,
|
||||
"executes_sql_count": executes_sql_count,
|
||||
"writes_database_count": writes_database_count,
|
||||
"signs_database_apply_authorization_count": (
|
||||
signs_database_apply_authorization_count
|
||||
),
|
||||
"primary_human_gate_count": primary_human_gate_count,
|
||||
"manual_review_required_count": manual_review_required_count,
|
||||
"manual_review_mode": safety.get("manual_review_mode"),
|
||||
"payload_source": "local_contract_fixture",
|
||||
"machine_fetch_evidence_source": "local_schema_fixture",
|
||||
"http_get_adapter": "_pchome_auto_policy_machine_fetch_evidence_get",
|
||||
"execute_fetch": True,
|
||||
"outbound_network": False,
|
||||
"business_data_source": False,
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight": bool(
|
||||
future_preflight.get(
|
||||
"ready_for_future_database_apply_controlled_apply_final_preflight"
|
||||
)
|
||||
),
|
||||
"can_enter_future_database_apply_controlled_dry_run_package": bool(
|
||||
future_preflight.get(
|
||||
"can_enter_future_database_apply_controlled_dry_run_package"
|
||||
)
|
||||
),
|
||||
"controlled_apply_final_preflight_ready": bool(
|
||||
future_preflight.get("controlled_apply_final_preflight_ready")
|
||||
),
|
||||
"rollback_binding_ready": bool(
|
||||
future_preflight.get("rollback_binding_ready")
|
||||
),
|
||||
"post_apply_verifier_binding_ready": bool(
|
||||
future_preflight.get("post_apply_verifier_binding_ready")
|
||||
),
|
||||
"rollback_bound": bool(final_preflight.get("rollback_bound")),
|
||||
"post_apply_verifier_bound": bool(
|
||||
final_preflight.get("post_apply_verifier_bound")
|
||||
),
|
||||
"dry_run_only": bool(final_preflight.get("dry_run_only")),
|
||||
"check_mode_only": bool(final_preflight.get("check_mode_only")),
|
||||
"rollback_execution_authorized": bool(
|
||||
rollback_binding.get("rollback_execution_authorized")
|
||||
),
|
||||
"rollback_executes_sql": bool(
|
||||
rollback_binding.get("rollback_executes_sql")
|
||||
),
|
||||
"rollback_writes_database": bool(
|
||||
rollback_binding.get("rollback_writes_database")
|
||||
),
|
||||
"rollback_reads_secret": bool(
|
||||
rollback_binding.get("rollback_reads_secret")
|
||||
),
|
||||
"rollback_requires_same_run_truth": bool(
|
||||
rollback_binding.get("rollback_requires_same_run_truth")
|
||||
),
|
||||
"post_apply_verifier_must_run_after_apply": bool(
|
||||
verifier_binding.get("verifier_must_run_after_apply")
|
||||
),
|
||||
"post_apply_verifier_execution_authorized_in_preview": bool(
|
||||
verifier_binding.get("verifier_execution_authorized_in_preview")
|
||||
),
|
||||
"permits_future_database_apply_controlled_dry_run_package": bool(
|
||||
contract.get(
|
||||
"permits_future_database_apply_controlled_dry_run_package"
|
||||
)
|
||||
),
|
||||
"accepts_plaintext_secret": bool(
|
||||
final_preflight.get("accepts_plaintext_secret")
|
||||
or contract.get("accepts_plaintext_secret")
|
||||
),
|
||||
"reads_secret_in_preview": bool(
|
||||
future_preflight.get("reads_secret_in_preview")
|
||||
or final_preflight.get("reads_secret_in_preview")
|
||||
or safety.get("reads_secret_in_preview")
|
||||
),
|
||||
"signature_material_included": bool(
|
||||
final_preflight.get("signature_material_included")
|
||||
),
|
||||
"secret_material_included": bool(
|
||||
final_preflight.get("secret_material_included")
|
||||
),
|
||||
"secret_material_required_in_preview": bool(
|
||||
final_preflight.get("secret_material_required_in_preview")
|
||||
or contract.get("secret_material_required_in_preview")
|
||||
),
|
||||
"executes_authorization_evidence": bool(
|
||||
future_preflight.get("executes_authorization_evidence")
|
||||
or final_preflight.get("executes_authorization_evidence")
|
||||
or contract.get("executes_authorization_evidence")
|
||||
or safety.get("executes_authorization_evidence")
|
||||
),
|
||||
"executes_database_apply": bool(
|
||||
future_preflight.get("executes_database_apply")
|
||||
or final_preflight.get("executes_database_apply")
|
||||
or contract.get("executes_database_apply")
|
||||
or safety.get("executes_database_apply")
|
||||
),
|
||||
"executes_endpoint": bool(
|
||||
future_preflight.get("executes_endpoint")
|
||||
or contract.get("executes_endpoint")
|
||||
or safety.get("executes_endpoint")
|
||||
),
|
||||
"executes_sql": bool(
|
||||
future_preflight.get("executes_sql")
|
||||
or contract.get("executes_sql")
|
||||
or safety.get("executes_sql")
|
||||
),
|
||||
"ready_for_database_apply_now": bool(
|
||||
future_preflight.get("ready_for_database_apply_now")
|
||||
or final_preflight.get("ready_for_database_apply_now")
|
||||
or contract.get("ready_for_database_apply_now")
|
||||
),
|
||||
"database_apply_authorized": bool(
|
||||
future_preflight.get("database_apply_authorized")
|
||||
or final_preflight.get("database_apply_authorized")
|
||||
or verifier_binding.get("database_apply_authorized")
|
||||
or contract.get("database_apply_authorized")
|
||||
),
|
||||
"issues_database_apply_authorization": bool(
|
||||
future_preflight.get("issues_database_apply_authorization")
|
||||
or final_preflight.get("issues_database_apply_authorization")
|
||||
or contract.get("issues_database_apply_authorization")
|
||||
),
|
||||
"signs_database_apply_authorization": bool(
|
||||
future_preflight.get("signs_database_apply_authorization")
|
||||
or final_preflight.get("signs_database_apply_authorization")
|
||||
or contract.get("signs_database_apply_authorization")
|
||||
),
|
||||
"requires_post_apply_verifier": bool(
|
||||
final_preflight.get("requires_post_apply_verifier")
|
||||
),
|
||||
"requires_fresh_production_truth": bool(
|
||||
final_preflight.get(
|
||||
"requires_fresh_production_truth_in_same_run"
|
||||
)
|
||||
),
|
||||
"writes_database": False,
|
||||
"next_machine_action": next_machine_action,
|
||||
},
|
||||
)
|
||||
except Exception as exc:
|
||||
return _check(
|
||||
"PChome auto-policy controlled apply final preflight",
|
||||
"warning",
|
||||
(
|
||||
"PChome auto-policy controlled apply final preflight "
|
||||
f"例行監控暫時無法讀取：{exc}"
|
||||
),
|
||||
{
|
||||
"writes_database": False,
|
||||
"writes_database_count": 0,
|
||||
"signs_database_apply_authorization_count": 0,
|
||||
"primary_human_gate_count": 0,
|
||||
"execute_fetch": True,
|
||||
"outbound_network": False,
|
||||
"business_data_source": False,
|
||||
"payload_source": "local_contract_fixture",
|
||||
"next_machine_action": (
|
||||
"refresh_pchome_auto_policy_controlled_apply_final_preflight"
|
||||
),
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
def _ai_surface_html_readback_check() -> Dict[str, Any]:
|
||||
"""Read-only AI product surface guardrail readback."""
|
||||
try:
|
||||
@@ -10228,6 +11172,7 @@ def collect_ai_automation_smoke(*, record_history: bool = True, history_limit: i
|
||||
_pchome_auto_policy_verifier_receipt_closeout_check(),
|
||||
_pchome_auto_policy_authorization_evidence_execution_preflight_check(),
|
||||
_pchome_auto_policy_authorization_evidence_execution_closeout_check(),
|
||||
_pchome_auto_policy_controlled_apply_final_preflight_check(),
|
||||
_ai_surface_html_readback_check(),
|
||||
_sitewide_ui_ux_agent_check(),
|
||||
_sitewide_visual_qa_check(),
|
||||
|
||||
Reference in New Issue
Block a user