fix(cd): keep log intelligence readback on controlled profile

.gitea/workflows/cd.yaml

@@ -234,6 +234,8 @@ jobs:
                 ;;
               docs/operations/awoooi-production-deploy-readback-blocker.snapshot.json)
                 ;;
+              docs/operations/ai-agent-log-intelligence-runtime-sample-readback.snapshot.json)
+                ;;
               apps/api/src/api/v1/agents.py)
                 ;;
               apps/api/src/api/v1/iwooos.py)
@@ -242,6 +244,8 @@ jobs:
                 ;;
               apps/api/src/services/agent_replay_normalizer.py)
                 ;;
+              apps/api/src/services/ai_agent_log_intelligence_integration_readback.py)
+                ;;
               apps/api/src/services/ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/src/services/awooop_ansible_audit_service.py)
@@ -318,6 +322,8 @@ jobs:
                 ;;
               apps/api/tests/test_agent_replay_normalizer.py)
                 ;;
+              apps/api/tests/test_ai_agent_log_intelligence_integration_readback_api.py)
+                ;;
               apps/api/tests/test_ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/tests/test_awooop_truth_chain_service.py)
@@ -491,6 +497,7 @@ jobs:
               src/models/playbook.py \
               src/services/awoooi_production_deploy_readback_blocker.py \
               src/services/agent_replay_normalizer.py \
+              src/services/ai_agent_log_intelligence_integration_readback.py \
               src/services/ai_agent_autonomous_runtime_control.py \
               src/services/awooop_ansible_audit_service.py \
               src/services/awooop_ansible_check_mode_service.py \
@@ -534,6 +541,7 @@ jobs:
             DATABASE_URL="${DATABASE_URL:-postgresql+asyncpg://ci:ci@localhost/ci}" \
             PYTHONFAULTHANDLER=1 python3.11 -m pytest \
               tests/test_agent_replay_normalizer.py \
+              tests/test_ai_agent_log_intelligence_integration_readback_api.py \
               tests/test_ai_agent_autonomous_runtime_control.py \
               tests/test_awooop_truth_chain_service.py \
               tests/test_shadow_auto_approve.py \

docs/LOGBOOK.md

@@ -17,6 +17,20 @@
 
 **邊界**：此輪沒有保存 payload、沒有讀 credential、沒有寫 escrow marker、沒有 backup / restore / offsite sync、沒有 workflow trigger、沒有 host/K8s write、沒有讀 raw session / SQLite / auth / `.env`、沒有使用 GitHub / `gh` / GitHub API。
 
+## 2026-06-29 — 20:45 CD profile fix for log intelligence runtime sample
+
+**完成內容**：
+- Gitea CD #3959 失敗定位為 `fa41bd9e feat(api): attach log intelligence runtime sample` 未納入 controlled-runtime allowlist，導致 tests job 走 full profile 並進 B5。
+- `.gitea/workflows/cd.yaml` 將 `ai_agent_log_intelligence_integration_readback.py`、對應 API test 與 `ai-agent-log-intelligence-runtime-sample-readback.snapshot.json` 納入 controlled-runtime path、py_compile 與 focused pytest。
+- `ops/runner/test_cd_controlled_runtime_profile.py` 補回歸測試，鎖住 log intelligence readback 窄修不得掉 B5。
+
+**驗證結果**：
+- `pytest apps/api/tests/test_ai_agent_log_intelligence_integration_readback_api.py`：3 passed。
+- `pytest ops/runner/test_cd_controlled_runtime_profile.py`：15 passed。
+- `guard-gitea-runner-pressure.py`、`check-gitea-step-env-secrets.js`、`git diff --check`：通過。
+
+**邊界**：未觸發 workflow_dispatch；未操作 host / Docker / K8s / DB；未使用 GitHub / `gh` / GitHub API；未讀 secret / token / raw sessions / SQLite。
+
 ## 2026-06-29 — 20:30 P0-006 CD failure closeout
 
 **照優先順序處理**：

ops/runner/test_cd_controlled_runtime_profile.py

@@ -86,6 +86,19 @@ def test_ai_autonomous_runtime_control_stays_on_controlled_runtime_profile() ->
         assert source in text
 
 
+def test_ai_log_intelligence_readback_stays_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "docs/operations/ai-agent-log-intelligence-runtime-sample-readback.snapshot.json)",
+        "apps/api/src/services/ai_agent_log_intelligence_integration_readback.py)",
+        "apps/api/tests/test_ai_agent_log_intelligence_integration_readback_api.py)",
+        "src/services/ai_agent_log_intelligence_integration_readback.py",
+        "tests/test_ai_agent_log_intelligence_integration_readback_api.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_awooop_ansible_check_mode_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     expected_sources = [