Publish curated Unraid-AppOps-Gateway source from c61e0e1e292914893b40354f904f23dd9fd4a958

backend/app/services/action_execution.py

@@ -55,6 +55,8 @@ APPROVAL_EXECUTOR_ACTIONS = {
     "runner.fleet.upgrade_v2",
     "runner.fleet.specialize",
     "runner.statistics.configure",
+    "runner.acceptance.preflight",
+    "runner.acceptance.quiesce",
     "hub.migration.prepare_permissions",
     "deployment.targets.sync",
     "deployment.runnerless.provision",
@@ -125,7 +127,12 @@ _DIRECT_STEPS = {
 def action_execution_profile(
     action: str, policy_decision: str, capability: str
 ) -> dict[str, Any]:
-    if policy_decision == "blocked":
+    if action in {"runner.acceptance.preflight", "runner.acceptance.quiesce"} and policy_decision != "blocked":
+        # The fixed MCP typed authority is separate from Command Center's
+        # manual route; do not advertise an unsupported manual executor.
+        mode = "governance_only"
+        surface = None
+    elif policy_decision == "blocked":
         mode = "blocked"
         surface = None
     elif action in GENERIC_EXECUTOR_ACTIONS:
@@ -1669,6 +1676,31 @@ def _execute_controller_artifact_promote(
     return operation_result
 
 
+def _execute_runner_acceptance(session: Session, *, action: str, target: str, source: str,
+                               risk: str, reason: str, original_policy_decision: str) -> dict[str, Any]:
+    from ..db.models import GatewayUser
+    from .user_access import actor_identity
+
+    actor = actor_identity.get()
+    admin = False
+    if actor:
+        provider, _, subject = actor.partition(":")
+        user = session.exec(select(GatewayUser).where(GatewayUser.provider == provider,
+                                                    GatewayUser.subject == subject)).first()
+        admin = bool(user and user.enabled and user.role == "admin")
+    authorized = (source == "chatgpt-mcp" and actor is None) or admin
+    if (target != "tower/ci-acceptance-residue" or not authorized
+            or source not in {"manual", "chatgpt-mcp", "approved_operator"}
+            or original_policy_decision not in {"allowed", "approval_required"}):
+        return {"success": False, "status": "blocked", "result": "blocked",
+                "message": "Fixed CI maintenance requires the authenticated administrator boundary.",
+                "policyDecision": "blocked"}
+    return _execute_runner_fleet_upgrade_v2(
+        session, source=source, risk=risk, reason=reason,
+        original_policy_decision=original_policy_decision, acceptance=action.rsplit(".", 1)[-1],
+    )
+
+
 def _execute_runner_fleet_upgrade_v2(
     session: Session,
     *,
@@ -1678,12 +1710,15 @@ def _execute_runner_fleet_upgrade_v2(
     original_policy_decision: str,
     specialized: bool = False,
     statistics_configuration: bool = False,
+    acceptance: str | None = None,
 ) -> dict[str, Any]:
     from .deployment_broker import DeploymentBrokerClient
 
-    action = ("runner.statistics.configure" if statistics_configuration else
+    action = ("runner.acceptance." + acceptance if acceptance else
+              "runner.statistics.configure" if statistics_configuration else
               "runner.fleet.specialize" if specialized else "runner.fleet.upgrade_v2")
-    target = ("tower/projectbrain-runner-statistics" if statistics_configuration else
+    target = ("tower/ci-acceptance-residue" if acceptance else
+              "tower/projectbrain-runner-statistics" if statistics_configuration else
               "tower/runner-fleet-specialized" if specialized else "tower/runner-fleet-v2")
     steps = [
         "Validate exact fixed runner-fleet target",
@@ -1697,6 +1732,9 @@ def _execute_runner_fleet_upgrade_v2(
         steps = ["Verify fixed read-only statistics target", "Prove protected controller/runtime source",
                  "Lock production configuration", "Provision private independent credential with durable CAS",
                  "Configure ProjectBrain for its governed delivery"]
+    if acceptance:
+        steps = ["Prove protected controller/runtime source", "Attest finite CI origin and complete private identities",
+                 "Verify dispatch barrier and production exclusion", "Preserve all resources and data"]
     job = create_job(
         session,
         action_id=action,
@@ -1710,26 +1748,57 @@ def _execute_runner_fleet_upgrade_v2(
     set_job_progress(session, job, 25, f"Requesting {action} through the fixed controller endpoint.")
     try:
         broker = DeploymentBrokerClient()
-        result = (broker.runner_statistics_configure(reason=reason) if statistics_configuration else
+        result = (broker.runner_acceptance(reason=reason, preflight=acceptance == "preflight") if acceptance else
+                  broker.runner_statistics_configure(reason=reason) if statistics_configuration else
                   broker.runner_fleet_specialize(reason=reason) if specialized else broker.runner_fleet_upgrade_v2(reason=reason))
+        if acceptance:
+            allowed_blockers = {
+                "terminal_origin_claim_missing", "terminal_origin_task_binding_unavailable",
+                "terminal_origin_unavailable", "active_product_receipt_exclusion_unavailable",
+                "dispatch_barrier_guard_unverified", "preflight_evidence_rejected",
+                "acceptance_evidence_rejected", "term_timeout", "controller_response_untrusted",
+                "maintenance_outcome_unknown", "maintenance_receipt_untrusted", "maintenance_execution_deadline",
+            }
+            blockers = result.get("blockers", [])
+            clean_blockers = (blockers if isinstance(blockers, list) and len(blockers) <= 20
+                              and all(isinstance(code, str) and code in allowed_blockers for code in blockers)
+                              else ["controller_response_untrusted"])
+            result = {
+                "status": result.get("status") if result.get("status") in {
+                    "ready", "blocked", "partial", "quiesced", "already_quiesced", "unknown", "in_progress"
+                } else "blocked",
+                "revision": result.get("revision") if isinstance(result.get("revision"), str)
+                and len(result["revision"]) == 40 and all(char in "0123456789abcdef" for char in result["revision"]) else None,
+                "blockers": clean_blockers,
+                "preservedContainers": 18 if result.get("preservedContainers") == 18 else None,
+                "effectsPerformed": result.get("effectsPerformed") if type(result.get("effectsPerformed")) is bool else None,
+                "noMutation": result.get("noMutation") if type(result.get("noMutation")) is bool else None,
+                "maintenancePhase": result.get("maintenance", {}).get("phase") if isinstance(result.get("maintenance"), dict)
+                and result["maintenance"].get("phase") in {"guarding", "quiescing", "restoring", "complete"} else result.get("phase")
+                if result.get("phase") in {"guarding", "quiescing", "restoring", "complete"} else None,
+            }
         status = str(result.get("status") or "error")
-        success = status in ({"configured", "already_configured"} if statistics_configuration else
+        success = status in ({"ready"} if acceptance == "preflight" else {"quiesced", "already_quiesced"} if acceptance else
+                             {"configured", "already_configured"} if statistics_configuration else
                              {"specialized", "already_applied"} if specialized else {"upgraded", "already_applied"})
         message = str(
             result.get("reason")
             or (
-                ("ProjectBrain read-only statistics configuration verified." if statistics_configuration else
+                ("Finite CI acceptance maintenance verified." if acceptance else
+                 "ProjectBrain read-only statistics configuration verified." if statistics_configuration else
                  "Tower runner specialization verified." if specialized
                  else "Tower runner-fleet v2 migration verified.")
                 if success else
-                ("ProjectBrain statistics configuration was rejected or failed." if statistics_configuration else
+                ("Maintenance outcome is unknown or still active; use read-only preflight status before any explicit resume." if acceptance and status in {"unknown", "in_progress", "partial"} else
+                 "Finite CI acceptance maintenance is blocked by required evidence." if acceptance else
+                 "ProjectBrain statistics configuration was rejected or failed." if statistics_configuration else
                  "Tower runner specialization was rejected or failed." if specialized
                  else "Tower runner-fleet v2 migration was rejected or failed.")
             )
         )
     except Exception as exc:
-        result = {"status": "error"}
-        status = "error"
+        result = {"status": "unknown" if acceptance == "quiesce" else "error", "effectsPerformed": None}
+        status = result["status"]
         success = False
         message = f"{type(exc).__name__}: fixed controller operation failed"
 
@@ -1749,7 +1818,7 @@ def _execute_runner_fleet_upgrade_v2(
         risk=risk,
         policy_decision="allowed",
         reason=reason,
-        result="success" if success else "failed",
+        result="success" if success else "unknown" if acceptance and status in {"unknown", "in_progress", "partial"} else "failed",
         execution_plan={"steps": steps, "jobId": completed.id},
         after_state={
             "status": status,
@@ -1768,7 +1837,7 @@ def _execute_runner_fleet_upgrade_v2(
     return {
         "success": success,
         "status": "success" if success else status,
-        "result": "success" if success else "failed",
+        "result": "success" if success else "unknown" if acceptance and status in {"unknown", "in_progress", "partial"} else "failed",
         "message": message,
         "jobId": completed.id,
         "auditId": audit.id,
@@ -1778,6 +1847,11 @@ def _execute_runner_fleet_upgrade_v2(
         "revision": result.get("revision"),
         "verifiedRunners": result.get("verifiedRunners"),
         "projectbrainDeliveryRequired": result.get("projectbrainDeliveryRequired"),
+        "blockers": result.get("blockers") if acceptance else None,
+        "preservedContainers": result.get("preservedContainers") if acceptance else None,
+        "effectsPerformed": result.get("effectsPerformed") if acceptance else None,
+        "noMutation": result.get("noMutation") if acceptance else None,
+        "maintenancePhase": result.get("maintenancePhase") if acceptance else None,
     }
 
 
@@ -2065,6 +2139,10 @@ def execute_governed_action(
             "originalPolicyDecision": original_policy_decision,
         }
 
+    if action in {"runner.acceptance.preflight", "runner.acceptance.quiesce"}:
+        return _execute_runner_acceptance(session, action=action, target=target, source=source,
+                                         risk=risk, reason=reason, original_policy_decision=original_policy_decision)
+
     if action == "controller.artifact.promote":
         if target.strip().lower() != "tower/deployment-controller":
             return {
@@ -2603,6 +2681,13 @@ def execute_approved_action(session: Session, approval: Approval) -> dict[str, A
             original_policy_decision="approval_required",
         )
 
+    if approval.action in {"runner.acceptance.preflight", "runner.acceptance.quiesce"}:
+        return _execute_runner_acceptance(
+            session, action=approval.action, target=approval.target, source="approved_operator",
+            risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.",
+            original_policy_decision="approval_required",
+        )
+
     if approval.action == "runner.fleet.upgrade_v2":
         if approval.target.strip().lower() != "tower/runner-fleet-v2":
             return {