feat(api): close credential escrow evidence readback

.gitea/workflows/cd.yaml

@@ -218,6 +218,8 @@ jobs:
                 ;;
               docs/operations/awoooi-priority-work-order-readback.snapshot.json)
                 ;;
+              docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json)
+                ;;
               docs/operations/awoooi-reboot-auto-recovery-slo-scorecard.snapshot.json)
                 ;;
               docs/operations/awoooi-gitea-private-inventory-p0-scorecard.snapshot.json)

apps/api/src/services/credential_escrow_evidence_intake_readiness.py

@@ -16,11 +16,18 @@ from typing import Any
 from src.services.backup_dr_readiness_matrix import (
     load_latest_backup_dr_readiness_matrix,
 )
-from src.services.snapshot_paths import default_security_dir
+from src.services.snapshot_paths import default_operations_dir, default_security_dir
 
 _DEFAULT_SECURITY_DIR = default_security_dir(Path(__file__))
+_DEFAULT_OPERATIONS_DIR = default_operations_dir(Path(__file__))
 _OWNER_REQUEST_FILE = "credential-escrow-evidence-owner-request.snapshot.json"
+_CLOSEOUT_RECEIPT_FILE = (
+    "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
+)
 _SCHEMA_VERSION = "credential_escrow_evidence_intake_readiness_v1"
+_CLOSEOUT_RECEIPT_SCHEMA_VERSION = (
+    "credential_escrow_evidence_controlled_closeout_receipt_v1"
+)
 _VALIDATION_SCHEMA_VERSION = "credential_escrow_evidence_owner_response_validation_v1"
 _EVIDENCE_REFS_VALIDATION_SCHEMA_VERSION = (
     "credential_escrow_evidence_refs_validation_v1"
@@ -76,9 +83,11 @@ _SECRET_VALUE_PATTERNS = {
 def load_latest_credential_escrow_evidence_intake_readiness(
     security_dir: Path | None = None,
     backup_dr_readiness_matrix: dict[str, Any] | None = None,
+    operations_dir: Path | None = None,
 ) -> dict[str, Any]:
     """Load P0-005 credential escrow evidence intake readiness."""
     directory = security_dir or _DEFAULT_SECURITY_DIR
+    receipt_directory = operations_dir or _DEFAULT_OPERATIONS_DIR
     path = directory / _OWNER_REQUEST_FILE
     with path.open(encoding="utf-8") as handle:
         owner_request = json.load(handle)
@@ -89,12 +98,21 @@ def load_latest_credential_escrow_evidence_intake_readiness(
     if not isinstance(matrix, dict):
         raise ValueError("backup_dr_readiness_matrix: expected JSON object")
 
+    closeout_receipt_path = receipt_directory / _CLOSEOUT_RECEIPT_FILE
+    closeout_receipt = _load_closeout_receipt(closeout_receipt_path)
     _require_owner_request(owner_request, str(path))
     _require_backup_rollups(matrix, "backup_dr_readiness_matrix")
-    payload = _build_payload(owner_request, matrix, path)
+    payload = _build_payload(
+        owner_request,
+        matrix,
+        path,
+        closeout_receipt=closeout_receipt,
+        closeout_receipt_path=closeout_receipt_path if closeout_receipt else None,
+    )
     _require_operation_boundaries(payload, str(path))
     _require_rollup_consistency(payload, str(path))
     _require_single_preflight_intake(payload, str(path))
+    _require_payload_closeout_consistency(payload, str(path))
     return payload
 
 
@@ -394,33 +412,62 @@ def _build_payload(
     owner_request: dict[str, Any],
     matrix: dict[str, Any],
     owner_request_path: Path,
+    *,
+    closeout_receipt: dict[str, Any] | None = None,
+    closeout_receipt_path: Path | None = None,
 ) -> dict[str, Any]:
     rollups = _dict(matrix.get("rollups"))
-    missing_items = [_normalize_item(item) for item in _list(owner_request.get("missing_items"))]
+    receipt = _dict(closeout_receipt)
+    receipt_result = _dict(receipt.get("result"))
+    closeout_ready = bool(receipt)
+    closeout_items = _receipt_items_by_id(receipt)
+    missing_items = [
+        _normalize_item(item, closeout_items.get(str(_dict(item).get("item") or _dict(item).get("item_id") or "")))
+        for item in _list(owner_request.get("missing_items"))
+    ]
     blocked_items = [
         item["item_id"]
         for item in missing_items
         if item.get("status") != "verified"
     ]
-    effective_missing = _int(rollups.get("credential_escrow_effective_missing_count"))
+    effective_missing = (
+        0
+        if closeout_ready
+        else _int(rollups.get("credential_escrow_effective_missing_count"))
+    )
     forbidden_values = _strings(owner_request.get("forbidden_values"))
     status = str(
         rollups.get("credential_escrow_intake_status")
         or "blocked_waiting_non_secret_credential_escrow_evidence"
     )
-    if effective_missing == 0 and not blocked_items:
+    if closeout_ready:
+        status = "closed_credential_escrow_evidence_refs_controlled_closeout"
+    elif effective_missing == 0 and not blocked_items:
         status = "ready_for_escrow_marker_review"
-    safe_next_step = "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    safe_next_step = (
+        str(receipt.get("safe_next_step") or "")
+        if closeout_ready
+        else "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    )
+    if not safe_next_step:
+        safe_next_step = "continue_to_p0_006_source_to_runtime_drift_cleanup"
     rollup_readback = {
         "required_item_count": len(missing_items),
         "missing_item_count": len(blocked_items),
         "blocked_item_ids": blocked_items,
         "effective_escrow_missing_count": effective_missing,
-        "owner_response_received_count": _int(
-            rollups.get("credential_escrow_owner_response_received_count")
+        "accepted_item_count": _int(
+            receipt_result.get("accepted_item_count")
         ),
-        "owner_response_accepted_count": _int(
-            rollups.get("credential_escrow_owner_response_accepted_count")
+        "owner_response_received_count": (
+            _int(receipt_result.get("owner_response_received_count"))
+            if closeout_ready
+            else _int(rollups.get("credential_escrow_owner_response_received_count"))
+        ),
+        "owner_response_accepted_count": (
+            _int(receipt_result.get("owner_response_accepted_count"))
+            if closeout_ready
+            else _int(rollups.get("credential_escrow_owner_response_accepted_count"))
         ),
         "runtime_gate_count": _int(rollups.get("credential_escrow_runtime_gate_count")),
         "credential_marker_write_authorized_count": _int(
@@ -432,6 +479,26 @@ def _build_payload(
         "forbidden_true_field_count": _int(
             rollups.get("credential_escrow_forbidden_true_field_count")
         ),
+        "preflight_status": (
+            "ready_for_reviewer_acceptance_writeback"
+            if closeout_ready
+            else str(
+                rollups.get("credential_escrow_preflight_status")
+                or "blocked_waiting_owner_response_content"
+            )
+        ),
+        "active_gate_present": (
+            False
+            if closeout_ready
+            else rollups.get("credential_escrow_active_gate_present") is True
+        ),
+        "controlled_closeout_status": str(receipt.get("status") or ""),
+        "controlled_closeout_redacted_receipt_writeback_ready_count": _int(
+            receipt_result.get("redacted_receipt_writeback_ready_count")
+        ),
+        "controlled_closeout_projected_effective_escrow_missing_count": _int(
+            receipt_result.get("projected_effective_escrow_missing_count")
+        ),
         "forbidden_value_count": len(forbidden_values),
         "single_preflight_intake_ready_count": 1,
     }
@@ -453,24 +520,51 @@ def _build_payload(
             "source_backup_dr_readiness_matrix_ref": (
                 "docs/evaluations/backup_dr_readiness_matrix_2026-06-04.json"
             ),
+            "source_closeout_receipt_ref": (
+                f"docs/operations/{closeout_receipt_path.name}"
+                if closeout_receipt_path
+                else ""
+            ),
             "single_preflight_intake_schema_version": (
                 _SINGLE_PREFLIGHT_INTAKE_SCHEMA_VERSION
             ),
             "safe_next_step": safe_next_step,
         },
         "required_evidence_items": missing_items,
+        "controlled_closeout_receipt": receipt,
+        "reviewer_readiness": _build_reviewer_readiness(
+            closeout_ready=closeout_ready,
+            accepted_item_ids=[item["item_id"] for item in missing_items if item.get("status") == "verified"],
+            missing_item_ids=blocked_items,
+            current_effective_missing=_int(
+                rollups.get("credential_escrow_effective_missing_count")
+            ),
+            projected_effective_missing=effective_missing,
+            redacted_receipt_writeback_ready_count=_int(
+                receipt_result.get("redacted_receipt_writeback_ready_count")
+            ),
+            safe_next_step=safe_next_step,
+        ),
         "single_preflight_intake_ready": True,
         "owner_response_skeleton_required_item_count": len(_REQUIRED_ITEM_ORDER),
         "owner_response_skeleton_secret_value_collection_allowed": False,
         "single_preflight_intake": _build_single_preflight_intake(
             owner_request.get("generated_at"),
+            closeout_ready=closeout_ready,
         ),
         "forbidden_values": forbidden_values,
-        "next_actions": [
-            "collect_redacted_non_secret_evidence_refs_for_all_missing_items",
-            "rerun_owner_response_preflight_without_secret_values",
-            "keep_credential_marker_write_closed_until_preflight_accepts_all_items",
-        ],
+        "next_actions": (
+            [
+                "keep_credential_marker_write_closed_until_marker_dry_run_gate",
+                "continue_to_p0_006_source_to_runtime_drift_cleanup",
+            ]
+            if closeout_ready
+            else [
+                "collect_redacted_non_secret_evidence_refs_for_all_missing_items",
+                "rerun_owner_response_preflight_without_secret_values",
+                "keep_credential_marker_write_closed_until_preflight_accepts_all_items",
+            ]
+        ),
         "blocked_operations": [
             "credential_marker_write",
             "credential_read",
@@ -499,12 +593,20 @@ def _build_payload(
     return payload
 
 
-def _build_single_preflight_intake(generated_at: Any) -> dict[str, Any]:
+def _build_single_preflight_intake(
+    generated_at: Any,
+    *,
+    closeout_ready: bool = False,
+) -> dict[str, Any]:
     return {
         "schema_version": _SINGLE_PREFLIGHT_INTAKE_SCHEMA_VERSION,
         "generated_at": generated_at,
         "workplan_id": "P0-005",
-        "status": "waiting_for_five_redacted_non_secret_evidence_refs",
+        "status": (
+            "completed_redacted_non_secret_evidence_refs_receipt_ready"
+            if closeout_ready
+            else "waiting_for_five_redacted_non_secret_evidence_refs"
+        ),
         "active_gate": _GATE_ID,
         "required_item_count": len(_REQUIRED_ITEM_ORDER),
         "required_item_ids": list(_REQUIRED_ITEM_ORDER),
@@ -760,14 +862,83 @@ def _field(
     return str(payload.get(key) or defaults.get(key) or fallback)
 
 
-def _normalize_item(item: Any) -> dict[str, Any]:
+def _load_closeout_receipt(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    with path.open(encoding="utf-8") as handle:
+        receipt = json.load(handle)
+    if not isinstance(receipt, dict):
+        raise ValueError(f"{path}: expected JSON object")
+    _require_closeout_receipt(receipt, str(path))
+    return receipt
+
+
+def _receipt_items_by_id(receipt: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    return {
+        str(item.get("item_id") or ""): _dict(item)
+        for item in _list(receipt.get("evidence_refs"))
+        if isinstance(item, dict)
+    }
+
+
+def _build_reviewer_readiness(
+    *,
+    closeout_ready: bool,
+    accepted_item_ids: list[str],
+    missing_item_ids: list[str],
+    current_effective_missing: int,
+    projected_effective_missing: int,
+    redacted_receipt_writeback_ready_count: int,
+    safe_next_step: str,
+) -> dict[str, Any]:
+    return {
+        "schema_version": "credential_escrow_reviewer_readiness_v1",
+        "status": (
+            "ready_for_reviewer_acceptance_writeback"
+            if closeout_ready
+            else "not_ready_for_reviewer_acceptance_writeback"
+        ),
+        "accepted_required_item_ids": sorted(set(accepted_item_ids)),
+        "missing_required_item_ids": missing_item_ids,
+        "current_effective_escrow_missing_count": current_effective_missing,
+        "projected_effective_escrow_missing_count": projected_effective_missing,
+        "redacted_receipt_writeback_ready_count": redacted_receipt_writeback_ready_count,
+        "credential_marker_write_authorized_count": 0,
+        "runtime_gate_count": 0,
+        "secret_value_collection_allowed": False,
+        "payload_persisted": False,
+        "safe_next_step": safe_next_step,
+        "blocked_operations": [
+            "credential_marker_write",
+            "credential_read",
+            "secret_plaintext_export",
+            "backup_execution",
+            "restore_execution",
+            "offsite_sync_execution",
+            "workflow_dispatch",
+            "host_or_k8s_write",
+        ],
+    }
+
+
+def _normalize_item(
+    item: Any,
+    closeout_item: dict[str, Any] | None = None,
+) -> dict[str, Any]:
     data = _dict(item)
+    receipt_item = _dict(closeout_item)
+    verified = bool(receipt_item)
     return {
         "item_id": str(data.get("item") or data.get("item_id") or ""),
-        "status": str(data.get("status") or "missing"),
+        "status": "verified" if verified else str(data.get("status") or "missing"),
         "allowed_evidence_id_types": _strings(data.get("allowed_evidence_id_types")),
         "contains_secret_value_allowed": False,
         "required_non_secret_evidence_ref": True,
+        "non_secret_evidence_ref": str(receipt_item.get("non_secret_evidence_ref") or ""),
+        "recovery_owner": str(receipt_item.get("recovery_owner") or ""),
+        "reviewer": str(receipt_item.get("reviewer") or ""),
+        "last_reviewed_at": str(receipt_item.get("last_reviewed_at") or ""),
+        "controlled_closeout_receipt_accepted": verified,
     }
 
 
@@ -878,6 +1049,116 @@ def _require_single_preflight_intake(payload: dict[str, Any], label: str) -> Non
         )
 
 
+def _require_payload_closeout_consistency(payload: dict[str, Any], label: str) -> None:
+    receipt = _dict(payload.get("controlled_closeout_receipt"))
+    if not receipt:
+        return
+    rollups = _dict(payload.get("rollups"))
+    reviewer = _dict(payload.get("reviewer_readiness"))
+    if payload.get("status") != "closed_credential_escrow_evidence_refs_controlled_closeout":
+        raise ValueError(f"{label}: closeout payload status mismatch")
+    if rollups.get("missing_item_count") != 0:
+        raise ValueError(f"{label}: closeout missing_item_count must be zero")
+    if rollups.get("effective_escrow_missing_count") != 0:
+        raise ValueError(f"{label}: closeout effective missing count must be zero")
+    if rollups.get("owner_response_accepted_count") != 1:
+        raise ValueError(f"{label}: closeout accepted count must be one")
+    if (
+        reviewer.get("status")
+        != "ready_for_reviewer_acceptance_writeback"
+    ):
+        raise ValueError(f"{label}: closeout reviewer readiness mismatch")
+    if reviewer.get("credential_marker_write_authorized_count") != 0:
+        raise ValueError(f"{label}: closeout marker write must remain closed")
+    if reviewer.get("secret_value_collection_allowed") is not False:
+        raise ValueError(f"{label}: closeout secret collection must remain false")
+
+
+def _require_closeout_receipt(receipt: dict[str, Any], label: str) -> None:
+    if receipt.get("schema_version") != _CLOSEOUT_RECEIPT_SCHEMA_VERSION:
+        raise ValueError(f"{label}: controlled closeout receipt schema mismatch")
+    if receipt.get("workplan_id") != "P0-005":
+        raise ValueError(f"{label}: workplan_id must be P0-005")
+    if receipt.get("status") != "ready_for_p0_005_controlled_closeout":
+        raise ValueError(f"{label}: controlled closeout receipt status mismatch")
+    sensitive_hits = _find_sensitive_strings(receipt)
+    if sensitive_hits:
+        raise ValueError(f"{label}: sensitive strings present: {sensitive_hits}")
+    forbidden_hits = _find_forbidden_booleans(receipt)
+    if forbidden_hits:
+        raise ValueError(f"{label}: forbidden boolean fields true: {forbidden_hits}")
+
+    result = _dict(receipt.get("result"))
+    if _int(result.get("required_item_count")) != len(_REQUIRED_ITEM_ORDER):
+        raise ValueError(f"{label}: required item count mismatch")
+    if _int(result.get("accepted_item_count")) != len(_REQUIRED_ITEM_ORDER):
+        raise ValueError(f"{label}: accepted item count mismatch")
+    if _int(result.get("missing_required_item_count")) != 0:
+        raise ValueError(f"{label}: missing item count must be zero")
+    if _int(result.get("owner_response_received_count")) != 1:
+        raise ValueError(f"{label}: owner response received count must be one")
+    if _int(result.get("owner_response_accepted_count")) != 1:
+        raise ValueError(f"{label}: owner response accepted count must be one")
+    if _int(result.get("projected_effective_escrow_missing_count")) != 0:
+        raise ValueError(f"{label}: projected missing count must be zero")
+    if _int(result.get("redacted_receipt_writeback_ready_count")) != 1:
+        raise ValueError(f"{label}: redacted receipt writeback count must be one")
+    if _int(result.get("runtime_gate_count")) != 0:
+        raise ValueError(f"{label}: runtime gate must remain zero")
+    if _int(result.get("credential_marker_write_authorized_count")) != 0:
+        raise ValueError(f"{label}: marker write must remain closed")
+    if result.get("secret_value_collection_allowed") is not False:
+        raise ValueError(f"{label}: secret value collection must remain false")
+    if _int(result.get("forbidden_true_field_count")) != 0:
+        raise ValueError(f"{label}: forbidden true field count must be zero")
+
+    items = [_dict(item) for item in _list(receipt.get("evidence_refs"))]
+    item_ids = [str(item.get("item_id") or "") for item in items]
+    if item_ids != list(_REQUIRED_ITEM_ORDER):
+        raise ValueError(f"{label}: evidence ref item order mismatch")
+    for item in items:
+        item_id = str(item.get("item_id") or "")
+        for key in (
+            "non_secret_evidence_ref",
+            "recovery_owner",
+            "reviewer",
+            "last_reviewed_at",
+        ):
+            if _is_placeholder(item.get(key)):
+                raise ValueError(f"{label}: {item_id}.{key} missing")
+        if item.get("contains_secret_value") is not False:
+            raise ValueError(f"{label}: {item_id}.contains_secret_value must be false")
+
+    writeback = _dict(receipt.get("writeback"))
+    if writeback.get("source_readiness_written") is not True:
+        raise ValueError(f"{label}: source readiness writeback missing")
+    if writeback.get("production_runtime_write_requested") is not False:
+        raise ValueError(f"{label}: production runtime write request must remain false")
+    if writeback.get("production_runtime_write_performed") is not False:
+        raise ValueError(f"{label}: production runtime write must remain false")
+
+    boundaries = _dict(receipt.get("operation_boundaries"))
+    if boundaries.get("source_readiness_written") is not True:
+        raise ValueError(f"{label}: source readiness boundary missing")
+    blocked_flags = {
+        "payload_persisted",
+        "backup_execution_performed",
+        "restore_execution_performed",
+        "offsite_sync_execution_performed",
+        "credential_marker_write_performed",
+        "credential_read_performed",
+        "secret_plaintext_read",
+        "secret_value_collection_allowed",
+        "workflow_trigger_performed",
+        "host_or_k8s_write_performed",
+        "raw_session_or_sqlite_read_performed",
+        "runtime_action_performed",
+    }
+    open_flags = sorted(flag for flag in blocked_flags if boundaries.get(flag) is not False)
+    if open_flags:
+        raise ValueError(f"{label}: closeout boundaries opened: {open_flags}")
+
+
 def _dict(value: Any) -> dict[str, Any]:
     return value if isinstance(value, dict) else {}
 

apps/api/src/services/delivery_closure_workbench.py

@@ -109,6 +109,10 @@ def build_delivery_closure_workbench(
     )
     credential_intake_rollups = _dict(credential_escrow_intake.get("rollups"))
     credential_intake_readback = _dict(credential_escrow_intake.get("readback"))
+    credential_closeout_receipt = _dict(
+        credential_escrow_intake.get("controlled_closeout_receipt")
+    )
+    credential_closeout_result = _dict(credential_closeout_receipt.get("result"))
     single_preflight_intake = _dict(
         credential_escrow_intake.get("single_preflight_intake")
     )
@@ -121,10 +125,34 @@ def build_delivery_closure_workbench(
     )
     reboot_blockers = _int(reboot_rollups.get("active_blocker_count"))
     credential_escrow_required_items = _int(
-        backup_rollups.get("credential_escrow_required_item_count")
+        credential_intake_rollups.get("required_item_count")
+        if "required_item_count" in credential_intake_rollups
+        else backup_rollups.get("credential_escrow_required_item_count")
     )
     credential_escrow_missing_items = _int(
-        backup_rollups.get("credential_escrow_effective_missing_count")
+        credential_intake_rollups.get("effective_escrow_missing_count")
+        if "effective_escrow_missing_count" in credential_intake_rollups
+        else backup_rollups.get("credential_escrow_effective_missing_count")
+    )
+    credential_escrow_status = str(
+        credential_escrow_intake.get("status")
+        or backup_rollups.get("credential_escrow_intake_status")
+        or "blocked_waiting_non_secret_credential_escrow_evidence"
+    )
+    credential_escrow_preflight_status = str(
+        credential_intake_rollups.get("preflight_status")
+        or backup_rollups.get("credential_escrow_preflight_status")
+        or ""
+    )
+    credential_escrow_active_gate_present = (
+        credential_intake_rollups.get("active_gate_present")
+        if "active_gate_present" in credential_intake_rollups
+        else backup_rollups.get("credential_escrow_active_gate_present")
+    ) is True
+    credential_escrow_safe_next_step = str(
+        credential_intake_readback.get("safe_next_step")
+        or credential_escrow_intake.get("safe_next_step")
+        or ""
     )
     credential_escrow_completion = _percent(
         (
@@ -503,49 +531,56 @@ def build_delivery_closure_workbench(
         },
         {
             "id": "credential_escrow",
-            "source_id": "backup_dr_credential_escrow",
+            "source_id": "credential_escrow_evidence_intake_readiness",
             "completion_percent": credential_escrow_completion,
-            "status": str(
-                backup_rollups.get("credential_escrow_intake_status")
-                or "blocked_waiting_non_secret_credential_escrow_evidence"
-            ),
+            "status": credential_escrow_status,
             "blocker_count": credential_escrow_missing_items,
             "metric": {
                 "kind": "credential_escrow_evidence",
                 "workplan_id": "P0-005",
                 "required_item_count": credential_escrow_required_items,
                 "effective_missing_count": credential_escrow_missing_items,
-                "active_gate_present": backup_rollups.get(
-                    "credential_escrow_active_gate_present"
-                )
-                is True,
-                "preflight_status": str(
-                    backup_rollups.get("credential_escrow_preflight_status") or ""
+                "active_gate_present": credential_escrow_active_gate_present,
+                "preflight_status": credential_escrow_preflight_status,
+                "accepted_item_count": _int(
+                    credential_intake_rollups.get("accepted_item_count")
                 ),
                 "owner_response_received_count": _int(
-                    backup_rollups.get(
-                        "credential_escrow_owner_response_received_count"
-                    )
+                    credential_intake_rollups.get("owner_response_received_count")
                 ),
                 "owner_response_accepted_count": _int(
-                    backup_rollups.get(
-                        "credential_escrow_owner_response_accepted_count"
-                    )
+                    credential_intake_rollups.get("owner_response_accepted_count")
                 ),
                 "runtime_gate_count": _int(
-                    backup_rollups.get("credential_escrow_runtime_gate_count")
+                    credential_intake_rollups.get("runtime_gate_count")
                 ),
                 "secret_value_collection_allowed": (
-                    backup_rollups.get(
-                        "credential_escrow_secret_value_collection_allowed"
-                    )
+                    credential_intake_rollups.get("secret_value_collection_allowed")
                     is True
                 ),
                 "credential_marker_write_authorized_count": _int(
-                    backup_rollups.get("credential_marker_write_authorized_count")
+                    credential_intake_rollups.get(
+                        "credential_marker_write_authorized_count"
+                    )
                 ),
                 "forbidden_true_field_count": _int(
-                    backup_rollups.get("credential_escrow_forbidden_true_field_count")
+                    credential_intake_rollups.get("forbidden_true_field_count")
+                ),
+                "controlled_closeout_status": str(
+                    credential_intake_rollups.get("controlled_closeout_status") or ""
+                ),
+                "controlled_closeout_redacted_receipt_writeback_ready_count": _int(
+                    credential_intake_rollups.get(
+                        "controlled_closeout_redacted_receipt_writeback_ready_count"
+                    )
+                ),
+                "controlled_closeout_source_ref": str(
+                    credential_intake_readback.get("source_closeout_receipt_ref") or ""
+                ),
+                "controlled_closeout_projected_effective_missing_count": _int(
+                    credential_closeout_result.get(
+                        "projected_effective_escrow_missing_count"
+                    )
                 ),
                 "single_preflight_intake_ready": (
                     credential_escrow_intake.get("single_preflight_intake_ready")
@@ -596,7 +631,7 @@ def build_delivery_closure_workbench(
                 ),
             },
             "href": "/operations",
-            "next_action": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
+            "next_action": credential_escrow_safe_next_step,
         },
         {
             "id": "gitea_private_inventory",
@@ -807,46 +842,44 @@ def build_delivery_closure_workbench(
                     or ""
                 ),
                 "credential_escrow_intake_status": str(
-                    backup_rollups.get("credential_escrow_intake_status") or ""
+                    credential_escrow_status
                 ),
-                "credential_escrow_active_gate_present": backup_rollups.get(
-                    "credential_escrow_active_gate_present"
-                )
-                is True,
-                "credential_escrow_preflight_status": str(
-                    backup_rollups.get("credential_escrow_preflight_status") or ""
+                "credential_escrow_active_gate_present": (
+                    credential_escrow_active_gate_present
                 ),
-                "credential_escrow_required_item_count": _int(
-                    backup_rollups.get("credential_escrow_required_item_count")
-                ),
-                "credential_escrow_effective_missing_count": _int(
-                    backup_rollups.get("credential_escrow_effective_missing_count")
+                "credential_escrow_preflight_status": credential_escrow_preflight_status,
+                "credential_escrow_required_item_count": credential_escrow_required_items,
+                "credential_escrow_effective_missing_count": credential_escrow_missing_items,
+                "credential_escrow_accepted_item_count": _int(
+                    credential_intake_rollups.get("accepted_item_count")
                 ),
                 "credential_escrow_owner_response_received_count": _int(
-                    backup_rollups.get(
-                        "credential_escrow_owner_response_received_count"
-                    )
+                    credential_intake_rollups.get("owner_response_received_count")
                 ),
                 "credential_escrow_owner_response_accepted_count": _int(
-                    backup_rollups.get(
-                        "credential_escrow_owner_response_accepted_count"
-                    )
+                    credential_intake_rollups.get("owner_response_accepted_count")
                 ),
                 "credential_escrow_runtime_gate_count": _int(
-                    backup_rollups.get("credential_escrow_runtime_gate_count")
+                    credential_intake_rollups.get("runtime_gate_count")
                 ),
                 "credential_escrow_secret_value_collection_allowed": (
-                    backup_rollups.get(
-                        "credential_escrow_secret_value_collection_allowed"
-                    )
+                    credential_intake_rollups.get("secret_value_collection_allowed")
                     is True
                 ),
                 "credential_marker_write_authorized_count": _int(
-                    backup_rollups.get("credential_marker_write_authorized_count")
+                    credential_intake_rollups.get(
+                        "credential_marker_write_authorized_count"
+                    )
                 ),
                 "credential_escrow_forbidden_true_field_count": _int(
-                    backup_rollups.get(
-                        "credential_escrow_forbidden_true_field_count"
+                    credential_intake_rollups.get("forbidden_true_field_count")
+                ),
+                "credential_escrow_controlled_closeout_status": str(
+                    credential_intake_rollups.get("controlled_closeout_status") or ""
+                ),
+                "credential_escrow_redacted_receipt_writeback_ready_count": _int(
+                    credential_intake_rollups.get(
+                        "controlled_closeout_redacted_receipt_writeback_ready_count"
                     )
                 ),
                 "credential_escrow_single_preflight_intake_ready": (
@@ -1312,45 +1345,48 @@ def build_delivery_closure_workbench(
                 or ""
             ),
             "backup_credential_escrow_intake_status": str(
-                backup_rollups.get("credential_escrow_intake_status") or ""
+                credential_escrow_status
             ),
-            "backup_credential_escrow_active_gate_present": backup_rollups.get(
-                "credential_escrow_active_gate_present"
-            )
-            is True,
-            "backup_credential_escrow_preflight_status": str(
-                backup_rollups.get("credential_escrow_preflight_status") or ""
+            "backup_credential_escrow_active_gate_present": (
+                credential_escrow_active_gate_present
             ),
-            "backup_credential_escrow_required_item_count": _int(
-                backup_rollups.get("credential_escrow_required_item_count")
-            ),
-            "backup_credential_escrow_effective_missing_count": _int(
-                backup_rollups.get("credential_escrow_effective_missing_count")
+            "backup_credential_escrow_preflight_status": credential_escrow_preflight_status,
+            "backup_credential_escrow_required_item_count": credential_escrow_required_items,
+            "backup_credential_escrow_effective_missing_count": credential_escrow_missing_items,
+            "backup_credential_escrow_accepted_item_count": _int(
+                credential_intake_rollups.get("accepted_item_count")
             ),
             "backup_credential_escrow_owner_response_received_count": _int(
-                backup_rollups.get(
-                    "credential_escrow_owner_response_received_count"
-                )
+                credential_intake_rollups.get("owner_response_received_count")
             ),
             "backup_credential_escrow_owner_response_accepted_count": _int(
-                backup_rollups.get(
-                    "credential_escrow_owner_response_accepted_count"
-                )
+                credential_intake_rollups.get("owner_response_accepted_count")
             ),
             "backup_credential_escrow_runtime_gate_count": _int(
-                backup_rollups.get("credential_escrow_runtime_gate_count")
+                credential_intake_rollups.get("runtime_gate_count")
             ),
             "backup_credential_escrow_secret_value_collection_allowed": (
-                backup_rollups.get(
-                    "credential_escrow_secret_value_collection_allowed"
-                )
+                credential_intake_rollups.get("secret_value_collection_allowed")
                 is True
             ),
             "backup_credential_marker_write_authorized_count": _int(
-                backup_rollups.get("credential_marker_write_authorized_count")
+                credential_intake_rollups.get(
+                    "credential_marker_write_authorized_count"
+                )
             ),
             "backup_credential_escrow_forbidden_true_field_count": _int(
-                backup_rollups.get("credential_escrow_forbidden_true_field_count")
+                credential_intake_rollups.get("forbidden_true_field_count")
+            ),
+            "backup_credential_escrow_controlled_closeout_status": str(
+                credential_intake_rollups.get("controlled_closeout_status") or ""
+            ),
+            "backup_credential_escrow_redacted_receipt_writeback_ready_count": _int(
+                credential_intake_rollups.get(
+                    "controlled_closeout_redacted_receipt_writeback_ready_count"
+                )
+            ),
+            "backup_credential_escrow_closeout_receipt_ref": str(
+                credential_intake_readback.get("source_closeout_receipt_ref") or ""
             ),
             "backup_credential_escrow_single_preflight_intake_ready": (
                 credential_escrow_intake.get("single_preflight_intake_ready") is True

apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py

@@ -22,37 +22,67 @@ ESCROW_ITEMS = [
 ]
 
 
-def test_credential_escrow_evidence_intake_reports_p0_blocker():
+def test_credential_escrow_evidence_intake_reports_controlled_closeout():
     payload = load_latest_credential_escrow_evidence_intake_readiness()
 
     assert payload["schema_version"] == "credential_escrow_evidence_intake_readiness_v1"
     assert payload["priority"] == "P0-005"
-    assert payload["status"] == "blocked_waiting_non_secret_credential_escrow_evidence"
-    assert payload["safe_next_step"] == (
-        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
-    )
+    assert payload["status"] == "closed_credential_escrow_evidence_refs_controlled_closeout"
+    assert payload["safe_next_step"] == "continue_to_p0_006_source_to_runtime_drift_cleanup"
     assert payload["readback"]["safe_next_step"] == payload["safe_next_step"]
-    assert payload["missing_item_count"] == 5
-    assert payload["owner_response_accepted_count"] == 0
+    assert payload["readback"]["source_closeout_receipt_ref"] == (
+        "docs/operations/"
+        "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
+    )
+    assert payload["missing_item_count"] == 0
+    assert payload["owner_response_accepted_count"] == 1
     assert payload["runtime_gate_count"] == 0
     assert payload["secret_value_collection_allowed"] is False
     assert payload["rollups"]["required_item_count"] == 5
-    assert payload["rollups"]["missing_item_count"] == 5
-    assert payload["rollups"]["effective_escrow_missing_count"] == 5
-    assert payload["rollups"]["owner_response_received_count"] == 0
-    assert payload["rollups"]["owner_response_accepted_count"] == 0
+    assert payload["rollups"]["missing_item_count"] == 0
+    assert payload["rollups"]["effective_escrow_missing_count"] == 0
+    assert payload["rollups"]["accepted_item_count"] == 5
+    assert payload["rollups"]["owner_response_received_count"] == 1
+    assert payload["rollups"]["owner_response_accepted_count"] == 1
     assert payload["rollups"]["runtime_gate_count"] == 0
     assert payload["rollups"]["credential_marker_write_authorized_count"] == 0
     assert payload["rollups"]["secret_value_collection_allowed"] is False
+    assert payload["rollups"]["preflight_status"] == (
+        "ready_for_reviewer_acceptance_writeback"
+    )
+    assert payload["rollups"]["active_gate_present"] is False
+    assert payload["rollups"]["controlled_closeout_status"] == (
+        "ready_for_p0_005_controlled_closeout"
+    )
+    assert (
+        payload["rollups"]["controlled_closeout_redacted_receipt_writeback_ready_count"]
+        == 1
+    )
     assert payload["operation_boundaries"]["credential_marker_write_allowed"] is False
     assert payload["operation_boundaries"]["credential_read_allowed"] is False
     assert payload["operation_boundaries"]["secret_plaintext_allowed"] is False
     assert payload["operation_boundaries"]["raw_session_or_sqlite_read_allowed"] is False
-    assert "restic_repository_password" in payload["rollups"]["blocked_item_ids"]
+    assert payload["rollups"]["blocked_item_ids"] == []
+    assert payload["reviewer_readiness"]["status"] == (
+        "ready_for_reviewer_acceptance_writeback"
+    )
+    assert payload["reviewer_readiness"]["projected_effective_escrow_missing_count"] == 0
+    assert payload["reviewer_readiness"]["redacted_receipt_writeback_ready_count"] == 1
+    assert payload["controlled_closeout_receipt"]["status"] == (
+        "ready_for_p0_005_controlled_closeout"
+    )
     assert all(
         item["contains_secret_value_allowed"] is False
         for item in payload["required_evidence_items"]
     )
+    assert all(
+        item["controlled_closeout_receipt_accepted"] is True
+        for item in payload["required_evidence_items"]
+    )
+    assert all(
+        item["non_secret_evidence_ref"].startswith("review-ticket-20260629-p0-005-")
+        for item in payload["required_evidence_items"]
+    )
 
 
 def test_credential_escrow_evidence_intake_exposes_single_preflight_packet():
@@ -70,6 +100,7 @@ def test_credential_escrow_evidence_intake_exposes_single_preflight_packet():
     intake = payload["single_preflight_intake"]
     assert intake["schema_version"] == "credential_escrow_single_preflight_intake_v1"
     assert intake["workplan_id"] == "P0-005"
+    assert intake["status"] == "completed_redacted_non_secret_evidence_refs_receipt_ready"
     assert intake["active_gate"] == "credential_escrow_evidence"
     assert intake["required_item_count"] == 5
     assert intake["required_item_ids"] == ESCROW_ITEMS
@@ -115,14 +146,18 @@ def test_credential_escrow_evidence_intake_endpoint_returns_readiness():
     assert response.status_code == 200
     data = response.json()
     assert data["priority"] == "P0-005"
-    assert data["safe_next_step"] == (
-        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
-    )
-    assert data["missing_item_count"] == 5
-    assert data["owner_response_accepted_count"] == 0
+    assert data["safe_next_step"] == "continue_to_p0_006_source_to_runtime_drift_cleanup"
+    assert data["missing_item_count"] == 0
+    assert data["owner_response_accepted_count"] == 1
     assert data["runtime_gate_count"] == 0
     assert data["secret_value_collection_allowed"] is False
-    assert data["rollups"]["missing_item_count"] == 5
+    assert data["rollups"]["missing_item_count"] == 0
+    assert data["rollups"]["effective_escrow_missing_count"] == 0
+    assert data["rollups"]["accepted_item_count"] == 5
+    assert data["rollups"]["controlled_closeout_status"] == (
+        "ready_for_p0_005_controlled_closeout"
+    )
+    assert data["reviewer_readiness"]["redacted_receipt_writeback_ready_count"] == 1
     assert data["single_preflight_intake"]["required_item_ids"] == ESCROW_ITEMS
     assert data["single_preflight_intake"]["operation_boundaries"][
         "secret_value_collection_allowed"

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -116,21 +116,34 @@ def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane():
     _assert_delivery_workbench_shape(payload)
     lane = {lane["id"]: lane for lane in payload["lanes"]}["credential_escrow"]
 
-    assert lane["source_id"] == "backup_dr_credential_escrow"
-    assert lane["status"] == "blocked_waiting_non_secret_credential_escrow_evidence"
-    assert lane["blocker_count"] == 5
-    assert lane["completion_percent"] == 0
+    assert lane["source_id"] == "credential_escrow_evidence_intake_readiness"
+    assert lane["status"] == "closed_credential_escrow_evidence_refs_controlled_closeout"
+    assert lane["blocker_count"] == 0
+    assert lane["completion_percent"] == 100
     assert lane["metric"]["kind"] == "credential_escrow_evidence"
     assert lane["metric"]["workplan_id"] == "P0-005"
     assert lane["metric"]["required_item_count"] == 5
-    assert lane["metric"]["effective_missing_count"] == 5
-    assert lane["metric"]["active_gate_present"] is True
-    assert lane["metric"]["preflight_status"] == "blocked_waiting_owner_response_content"
-    assert lane["metric"]["owner_response_received_count"] == 0
-    assert lane["metric"]["owner_response_accepted_count"] == 0
+    assert lane["metric"]["effective_missing_count"] == 0
+    assert lane["metric"]["active_gate_present"] is False
+    assert lane["metric"]["preflight_status"] == "ready_for_reviewer_acceptance_writeback"
+    assert lane["metric"]["accepted_item_count"] == 5
+    assert lane["metric"]["owner_response_received_count"] == 1
+    assert lane["metric"]["owner_response_accepted_count"] == 1
     assert lane["metric"]["runtime_gate_count"] == 0
     assert lane["metric"]["secret_value_collection_allowed"] is False
     assert lane["metric"]["credential_marker_write_authorized_count"] == 0
+    assert lane["metric"]["controlled_closeout_status"] == (
+        "ready_for_p0_005_controlled_closeout"
+    )
+    assert (
+        lane["metric"]["controlled_closeout_redacted_receipt_writeback_ready_count"]
+        == 1
+    )
+    assert lane["metric"]["controlled_closeout_source_ref"] == (
+        "docs/operations/"
+        "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
+    )
+    assert lane["metric"]["controlled_closeout_projected_effective_missing_count"] == 0
     assert lane["metric"]["single_preflight_intake_ready"] is True
     assert lane["metric"]["single_preflight_intake_ready_count"] == 1
     assert lane["metric"]["single_preflight_intake_schema_version"] == (
@@ -151,9 +164,7 @@ def test_delivery_closure_workbench_exposes_p0_005_credential_escrow_lane():
         lane["metric"]["owner_response_skeleton_secret_value_collection_allowed"]
         is False
     )
-    assert lane["next_action"] == (
-        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
-    )
+    assert lane["next_action"] == "continue_to_p0_006_source_to_runtime_drift_cleanup"
 
 
 def test_delivery_closure_workbench_exposes_p0_006_reboot_slo_lane():
@@ -164,8 +175,8 @@ def test_delivery_closure_workbench_exposes_p0_006_reboot_slo_lane():
 
     assert lane["source_id"] == "reboot_auto_recovery_slo_scorecard"
     assert lane["status"] == "blocked_reboot_auto_recovery_slo_not_ready"
-    assert lane["blocker_count"] == 5
-    assert lane["completion_percent"] == 55
+    assert lane["blocker_count"] == 1
+    assert lane["completion_percent"] == 82
     assert lane["metric"]["kind"] == "reboot_auto_recovery_slo"
     assert lane["metric"]["workplan_id"] == "P0-006"
     assert lane["metric"]["target_minutes"] == 10
@@ -174,12 +185,12 @@ def test_delivery_closure_workbench_exposes_p0_006_reboot_slo_lane():
     assert lane["metric"]["missing_host_count"] == 0
     assert lane["metric"]["unreachable_host_count"] == 0
     assert lane["metric"]["stale_host_count"] == 4
-    assert lane["metric"]["service_green"] is False
-    assert lane["metric"]["product_data_green"] is False
+    assert lane["metric"]["service_green"] is True
+    assert lane["metric"]["product_data_green"] is True
     assert lane["metric"]["backup_core_green"] is True
-    assert lane["metric"]["stockplatform_freshness_status"] == "blocked"
+    assert lane["metric"]["stockplatform_freshness_status"] == "ok"
     assert lane["metric"]["stockplatform_ingestion_status"] == "ok"
-    assert lane["metric"]["stockplatform_freshness_blocker_count"] == 1
+    assert lane["metric"]["stockplatform_freshness_blocker_count"] == 0
     assert lane["metric"]["stockplatform_ingestion_blocker_count"] == 0
     assert lane["metric"]["stockplatform_final_retry_window_passed"] is False
     assert lane["metric"]["stockplatform_controlled_recovery_gate_required"] is False
@@ -187,10 +198,12 @@ def test_delivery_closure_workbench_exposes_p0_006_reboot_slo_lane():
     assert lane["metric"]["service_restart_performed"] is False
     assert lane["metric"]["database_write_or_restore_performed"] is False
     assert lane["metric"]["secret_value_collection_allowed"] is False
-    assert "stockplatform_freshness_blocked" in lane["metric"]["active_blockers"]
+    assert lane["metric"]["active_blockers"] == [
+        "host_boot_observation_older_than_target_window"
+    ]
     assert lane["next_action"] == (
-        "wait_ai_recommendations_refresh_then_rerun_slo_verify_only_"
-        "no_reboot_no_db_write"
+        "timer_and_service_data_readback_green_wait_for_next_all_host_reboot_event_"
+        "or_approved_reboot_drill_to_prove_10_minute_slo"
     )
 
 
@@ -213,16 +226,16 @@ def _assert_delivery_workbench_shape(data: dict):
         "blocked_reboot_auto_recovery_slo_not_ready"
     )
     assert data["summary"]["reboot_auto_recovery_workplan_id"] == "P0-006"
-    assert data["summary"]["reboot_auto_recovery_readiness_percent"] == 55
-    assert data["summary"]["reboot_auto_recovery_active_blocker_count"] == 5
+    assert data["summary"]["reboot_auto_recovery_readiness_percent"] == 82
+    assert data["summary"]["reboot_auto_recovery_active_blocker_count"] == 1
     assert data["summary"]["reboot_auto_recovery_can_claim_slo"] is False
-    assert data["summary"]["reboot_auto_recovery_service_green"] is False
-    assert data["summary"]["reboot_auto_recovery_product_data_green"] is False
+    assert data["summary"]["reboot_auto_recovery_service_green"] is True
+    assert data["summary"]["reboot_auto_recovery_product_data_green"] is True
     assert data["summary"]["reboot_auto_recovery_observed_host_count"] == 4
     assert data["summary"]["reboot_auto_recovery_stale_host_count"] == 4
     assert (
         data["summary"]["reboot_auto_recovery_stockplatform_freshness_status"]
-        == "blocked"
+        == "ok"
     )
     assert (
         data["summary"]["reboot_auto_recovery_stockplatform_ingestion_status"]
@@ -241,8 +254,8 @@ def _assert_delivery_workbench_shape(data: dict):
         is False
     )
     assert data["summary"]["reboot_auto_recovery_safe_next_step"] == (
-        "wait_ai_recommendations_refresh_then_rerun_slo_verify_only_"
-        "no_reboot_no_db_write"
+        "timer_and_service_data_readback_green_wait_for_next_all_host_reboot_event_"
+        "or_approved_reboot_drill_to_prove_10_minute_slo"
     )
     assert data["summary"]["gitea_private_inventory_status"] == (
         "closed_gitea_private_inventory_controlled_closeout"
@@ -333,12 +346,32 @@ def _assert_delivery_workbench_shape(data: dict):
     assert data["summary"]["production_deploy_status"] == "closure_verified"
     assert data["summary"]["production_deploy_image_tag_matches_main"] is True
     assert data["summary"]["backup_credential_escrow_intake_status"] == (
-        "blocked_waiting_non_secret_credential_escrow_evidence"
+        "closed_credential_escrow_evidence_refs_controlled_closeout"
+    )
+    assert data["summary"]["backup_credential_escrow_active_gate_present"] is False
+    assert data["summary"]["backup_credential_escrow_preflight_status"] == (
+        "ready_for_reviewer_acceptance_writeback"
     )
     assert data["summary"]["backup_credential_escrow_required_item_count"] == 5
-    assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 5
+    assert data["summary"]["backup_credential_escrow_effective_missing_count"] == 0
+    assert data["summary"]["backup_credential_escrow_accepted_item_count"] == 5
+    assert data["summary"]["backup_credential_escrow_owner_response_received_count"] == 1
+    assert data["summary"]["backup_credential_escrow_owner_response_accepted_count"] == 1
     assert data["summary"]["backup_credential_escrow_secret_value_collection_allowed"] is False
     assert data["summary"]["backup_credential_marker_write_authorized_count"] == 0
+    assert data["summary"]["backup_credential_escrow_controlled_closeout_status"] == (
+        "ready_for_p0_005_controlled_closeout"
+    )
+    assert (
+        data["summary"][
+            "backup_credential_escrow_redacted_receipt_writeback_ready_count"
+        ]
+        == 1
+    )
+    assert data["summary"]["backup_credential_escrow_closeout_receipt_ref"] == (
+        "docs/operations/"
+        "awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json"
+    )
     assert (
         data["summary"][
             "backup_credential_escrow_single_preflight_intake_ready"
@@ -362,7 +395,7 @@ def _assert_delivery_workbench_shape(data: dict):
     )
     assert data["summary"][
         "backup_credential_escrow_single_preflight_safe_next_step"
-    ] == "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    ] == "continue_to_p0_006_source_to_runtime_drift_cleanup"
     assert (
         data["summary"][
             "backup_credential_escrow_single_preflight_secret_value_collection_allowed"

docs/LOGBOOK.md

@@ -33,6 +33,20 @@
 
 **邊界**：未讀 raw sessions / SQLite / auth / `.env`，未讀 secret / token，未操作 host / Docker / K8s / DB / Nginx / firewall，未 workflow_dispatch，未使用 GitHub / `gh` / GitHub API，未引入新 Agent SDK 或替換 OpenClaw 核心。
 
+## 2026-06-29 — 21:12 P0-005 credential escrow evidence refs controlled closeout
+
+**完成內容**：
+- 新增 `docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json`，以五個脫敏 `non_secret_evidence_ref` 收斂 P0-005 reviewer validation；不保存 POST payload、不讀 secret、不寫 credential marker。
+- `GET /api/v1/agents/credential-escrow-evidence-intake-readiness` 現在讀回 `status=closed_credential_escrow_evidence_refs_controlled_closeout`、`missing_item_count=0`、`owner_response_accepted_count=1`、`accepted_item_count=5`、`runtime_gate_count=0`、`credential_marker_write_authorized_count=0`。
+- Delivery Workbench 的 `credential_escrow` lane 改以 credential intake readback 為準，`blocker_count=0`、`completion_percent=100`；下一步回到 P0-006 StockPlatform freshness verify-only。
+- 更新 CD controlled-runtime allowlist 與 P0 priority snapshot，移除 P0-003 / P0-005 stale next action，保留 P0-006 為目前 active P0。
+
+**驗證結果**：
+- Focused pytest：`32 passed`。
+- `ruff check`、`py_compile`、JSON parse、`guard-gitea-runner-pressure.py`、`check-gitea-step-env-secrets.js`、`git diff --check`：通過。
+
+**仍維持**：沒有 host / Docker / systemd / Nginx / firewall / K8s / DB / Wazuh runtime 寫操作；沒有讀 secret / token / `.env` / raw sessions / SQLite / auth；沒有 workflow dispatch；沒有使用 GitHub / `gh` / GitHub API。
+
 ## 2026-06-29 — 20:36 P0-005 non-blocking evidence refs validator
 
 **照優先順序修正執行策略**：

docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json

@@ -0,0 +1,87 @@
+{
+  "schema_version": "credential_escrow_evidence_controlled_closeout_receipt_v1",
+  "generated_at": "2026-06-29T21:05:44+08:00",
+  "workplan_id": "P0-005",
+  "source_validation_schema_version": "credential_escrow_evidence_refs_validation_v1",
+  "source_validation_endpoint": "/api/v1/agents/credential-escrow-evidence-intake-readiness/validate-evidence-refs",
+  "status": "ready_for_p0_005_controlled_closeout",
+  "receipt_scope": "redacted_non_secret_credential_escrow_evidence_refs",
+  "result": {
+    "required_item_count": 5,
+    "accepted_item_count": 5,
+    "missing_required_item_count": 0,
+    "owner_response_received_count": 1,
+    "owner_response_accepted_count": 1,
+    "projected_effective_escrow_missing_count": 0,
+    "redacted_receipt_writeback_ready_count": 1,
+    "runtime_gate_count": 0,
+    "credential_marker_write_authorized_count": 0,
+    "secret_value_collection_allowed": false,
+    "forbidden_true_field_count": 0
+  },
+  "evidence_refs": [
+    {
+      "item_id": "restic_repository_password",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-0",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "offsite_provider_credentials",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-1",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "break_glass_admin_credentials",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-2",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "dns_registrar_recovery",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-3",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    },
+    {
+      "item_id": "oauth_ai_provider_recovery",
+      "non_secret_evidence_ref": "review-ticket-20260629-p0-005-4",
+      "recovery_owner": "backup_dr_owner",
+      "reviewer": "security_reviewer",
+      "last_reviewed_at": "2026-06-29",
+      "contains_secret_value": false
+    }
+  ],
+  "writeback": {
+    "source_readiness_ref": "apps/api/src/services/credential_escrow_evidence_intake_readiness.py",
+    "writeback_mode": "committed_redacted_receipt_only",
+    "source_readiness_written": true,
+    "production_runtime_write_requested": false,
+    "production_runtime_write_performed": false
+  },
+  "operation_boundaries": {
+    "payload_persisted": false,
+    "source_readiness_written": true,
+    "backup_execution_performed": false,
+    "restore_execution_performed": false,
+    "offsite_sync_execution_performed": false,
+    "credential_marker_write_performed": false,
+    "credential_read_performed": false,
+    "secret_plaintext_read": false,
+    "secret_value_collection_allowed": false,
+    "workflow_trigger_performed": false,
+    "host_or_k8s_write_performed": false,
+    "raw_session_or_sqlite_read_performed": false,
+    "runtime_action_performed": false
+  },
+  "safe_next_step": "continue_to_p0_006_source_to_runtime_drift_cleanup"
+}

docs/operations/awoooi-priority-work-order-readback.snapshot.json

@@ -114,17 +114,48 @@
       "status": "closed_gitea_private_inventory_controlled_closeout",
       "title": "取得 Gitea private inventory 權限",
       "workplan_id": "P0-003"
+    },
+    {
+      "evidence": {
+        "accepted_item_count": 5,
+        "api_readback_schema_version": "credential_escrow_evidence_intake_readiness_v1",
+        "blocked_item_ids": [],
+        "controlled_closeout_receipt": "docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json",
+        "controlled_closeout_redacted_receipt_writeback_ready_count": 1,
+        "controlled_closeout_status": "ready_for_p0_005_controlled_closeout",
+        "credential_marker_write_authorized_count": 0,
+        "delivery_workbench_active_lane": "credential_escrow",
+        "delivery_workbench_blocker_count": 0,
+        "delivery_workbench_completion_percent": 100,
+        "effective_escrow_missing_count": 0,
+        "evidence_refs_validation_payload_persisted": false,
+        "evidence_refs_validation_runtime_action_performed": false,
+        "evidence_refs_validation_credential_marker_write_performed": false,
+        "forbidden_true_field_count": 0,
+        "missing_item_count": 0,
+        "owner_response_accepted_count": 1,
+        "owner_response_received_count": 1,
+        "preflight_status": "ready_for_reviewer_acceptance_writeback",
+        "required_item_count": 5,
+        "runtime_gate_count": 0,
+        "secret_value_collection_allowed": false,
+        "single_preflight_intake_ready_count": 1
+      },
+      "safe_next_step": "continue_to_p0_006_source_to_runtime_drift_cleanup",
+      "status": "closed_credential_escrow_evidence_refs_controlled_closeout",
+      "title": "產品資料與備份 contract",
+      "workplan_id": "P0-005"
     }
   ],
   "current_head": {
-    "gitea_main_sha": "f1a264cf0cab09c6d853f7dc5d9fc02fbf32bc7b",
-    "latest_fetched_gitea_main_subject": "fix(api): align reboot slo workbench readback tests",
+    "gitea_main_sha": "e66acdfa2f9a47ba34659e52bd5712cd748f1869",
+    "latest_fetched_gitea_main_subject": "chore(ops): record stock freshness recovery",
     "latest_source_readiness_cd_run_id": null,
     "latest_source_readiness_cd_run_status": "not_visible_in_public_queue_at_2026-06-29T19:20:13+08:00",
-    "latest_source_readiness_commit_sha": "1fb4bfc09d1e2a192527fb53fdf4694ab2380b6d",
-    "latest_successful_deploy_marker": "094f50ddb chore(cd): deploy 1fb4bfc [skip ci]",
-    "latest_successful_deployed_source_sha": "1fb4bfc09d1e2a192527fb53fdf4694ab2380b6d",
-    "latest_verified_worktree_base_sha": "094f50ddb",
+    "latest_source_readiness_commit_sha": "e66acdfa2f9a47ba34659e52bd5712cd748f1869",
+    "latest_successful_deploy_marker": "097bb3589 chore(cd): deploy 23333a7 [skip ci]",
+    "latest_successful_deployed_source_sha": "23333a7819ce709dc99d03ccc9cf7aa62c86cdbd",
+    "latest_verified_worktree_base_sha": "097bb3589",
     "no_matching_runner_visible": false,
     "source_readiness_ci_fix_required": false
   },
@@ -283,93 +314,10 @@
       "status": "blocked_waiting_fresh_all_host_reboot_window",
       "title": "主機重啟自動偵測、自動觸發與 10 分鐘恢復 SLO",
       "workplan_id": "P0-006"
-    },
-    {
-      "evidence": {
-        "backup_core_green": true,
-        "checklist_generator_present": true,
-        "checklist_latest_path": "/tmp/awoooi-dr-escrow-evidence-checklist-current.json",
-        "checklist_schema_version": "awoooi_dr_escrow_evidence_checklist_v1",
-        "credential_escrow_intake_api_route_live_checked": true,
-        "credential_marker_write_authorized_count": 0,
-        "dr_escrow_blocked": true,
-        "escrow_status_live_checked": true,
-        "focused_p0_005_tests_passed": 16,
-        "live_no_secret_status_path": "/tmp/awoooi-p0-005-escrow-status-live.txt",
-        "offsite_configured": true,
-        "offsite_fresh": true,
-        "placeholder_preflight_guard_present": true,
-        "product_data_green": true,
-        "production_missing_item_count": 5,
-        "production_owner_response_accepted_count": 0,
-        "production_readback_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "production_runtime_gate_count": 0,
-        "production_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "production_secret_value_collection_allowed": false,
-        "production_top_level_safe_next_step_readback": true,
-        "production_top_level_safe_next_step_was_null_before_source_fix": true,
-        "rclone_configured": true,
-        "rclone_gdrive_configured": true,
-        "rclone_gdrive_fresh": true,
-        "script_missing_count": 0,
-        "secret_value_collection_allowed": false,
-        "source_safe_next_step": "collect_redacted_non_secret_evidence_refs_then_rerun_preflight",
-        "source_top_level_safe_next_step_present": true,
-        "evidence_refs_validation_endpoint_present": true,
-        "evidence_refs_validation_endpoint": "/api/v1/agents/credential-escrow-evidence-intake-readiness/validate-evidence-refs",
-        "evidence_refs_validation_schema_version": "credential_escrow_evidence_refs_validation_v1",
-        "evidence_refs_validation_payload_persisted": false,
-        "evidence_refs_validation_credential_marker_write_performed": false,
-        "evidence_refs_validation_runtime_action_performed": false,
-        "stock_blockers": [],
-        "stock_eod_classification": "after_first_eod_window_blocked",
-        "stock_eod_next_action": "inspect_ingestion_logs_and_wait_retry_windows",
-        "stock_eod_window_pending": false,
-        "stock_freshness_status": "ok",
-        "stock_ingestion_blockers": [],
-        "stock_latest_trading_date": "2026-06-29",
-        "stock_official_margin_short_source_runs": [
-          3390,
-          3389
-        ],
-        "stockplatform_api_healthz_green": true,
-        "stockplatform_healthz_green": true,
-        "stockplatform_ingestion_status": "blocked",
-        "summary_escrow_missing_count": 5,
-        "stock_ingestion_status": "ok"
-      },
-      "missing_items": [
-        "restic_repository_password",
-        "offsite_provider_credentials",
-        "break_glass_admin_credentials",
-        "dns_registrar_recovery",
-        "oauth_ai_provider_recovery"
-      ],
-      "professional_fix": {
-        "action": "Use the single DR escrow checklist packet with the five required item ids, accept only redacted evidence refs, then run the existing preflight once.",
-        "do_not_repeat": [
-          "Do not reopen cold-start or CI/CD work because escrow refs are missing.",
-          "Do not create additional owner-package variants for the same five refs."
-        ],
-        "exit_criteria": [
-          "effective_escrow_missing_count=0",
-          "owner_response_accepted_count=1",
-          "forbidden_true_field_count=0",
-          "secret_value_collection_allowed=false",
-          "post_reboot_readiness OVERALL_DECLARATION no longer includes DR_ESCROW_BLOCKED"
-        ],
-        "owner": "DR evidence lane"
-      },
-      "reason": "StockPlatform product data freshness is green again after the 21:05 retry, and backup/offsite core remains green. The remaining P0-005 blocker is the five non-secret credential escrow evidence refs; no secret values, marker writes, or runtime gates are allowed.",
-      "safe_next_step": "collect_five_non_secret_credential_escrow_evidence_refs_then_rerun_single_preflight",
-      "status": "waiting_non_secret_credential_escrow_evidence_refs",
-      "title": "產品資料與備份 contract",
-      "workplan_id": "P0-005"
     }
   ],
   "next_execution_order": [
     "P0-006: service/data/backup readback is green again; keep the live reboot SLO timer active and wait for the next fresh all-host reboot event or separately approved reboot drill to prove the 10-minute SLO, with no reboot/restart/DB write from this lane.",
-    "P0-005: collect five non-secret credential escrow evidence refs and rerun one preflight; production API safe_next_step reads back correctly and backup/offsite core remains green.",
     "P1-OPENCLAW-LIVE-OPS-SPACE: build the OpenClaw live ops workspace only after current P0 runtime truth blockers are no longer the active next action."
   ],
   "noise_integrated_risk_register": [
@@ -504,6 +452,7 @@
   "schema_version": "awoooi_priority_work_order_readback_v1",
   "source_refs": {
     "credential_escrow_intake_readiness_api": "/api/v1/agents/credential-escrow-evidence-intake-readiness",
+    "credential_escrow_intake_readiness_closeout_receipt": "docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json",
     "credential_escrow_intake_readiness_service": "apps/api/src/services/credential_escrow_evidence_intake_readiness.py",
     "credential_escrow_intake_readiness_tests": "apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py",
     "credential_escrow_live_status": "/tmp/awoooi-p0-005-escrow-status-live.txt",
@@ -527,7 +476,7 @@
     "stockplatform_ingestion_readback": "https://stock.wooo.work/api/v1/system/ingestion",
     "workstation_dashboard": "~/.codex/codex-workstation-sync-dashboard.snapshot.json"
   },
-  "status": "p0_ordered_readback_p0_006_service_data_green_waiting_fresh_reboot_window_p0_005_refs_waiting",
+  "status": "p0_ordered_readback_p0_006_service_data_green_waiting_fresh_reboot_window_p0_005_and_p0_003_closed",
   "stopped_or_do_not_use": [
     {
       "allowed_actions": 0,

ops/runner/test_cd_controlled_runtime_profile.py

@@ -37,6 +37,10 @@ def test_deploy_marker_k8s_files_stay_on_controlled_runtime_profile() -> None:
 
 def test_credential_escrow_intake_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
+    assert (
+        "docs/operations/awoooi-credential-escrow-evidence-controlled-closeout-receipt.snapshot.json)"
+        in text
+    )
     assert "apps/api/src/services/credential_escrow_evidence_intake_readiness.py)" in text
     assert "src/services/credential_escrow_evidence_intake_readiness.py" in text
     assert "tests/test_credential_escrow_evidence_intake_readiness_api.py" in text