fix(gitea): surface all product dev prod repo truth

apps/api/src/services/delivery_closure_workbench.py

@@ -875,6 +875,14 @@ def build_delivery_closure_workbench(
                 "gitea_public_repo_count": _int(
                     private_inventory_rollups.get("gitea_public_repo_count")
                 ),
+                "gitea_ssh_verified_repo_count": _int(
+                    private_inventory_rollups.get("gitea_ssh_verified_repo_count")
+                ),
+                "gitea_private_or_auth_only_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "gitea_private_or_auth_only_repo_count"
+                    )
+                ),
                 "expected_product_count": _int(
                     private_inventory_rollups.get("expected_product_count")
                 ),
@@ -884,6 +892,62 @@ def build_delivery_closure_workbench(
                 "missing_product_row_count": _int(
                     private_inventory_rollups.get("missing_product_row_count")
                 ),
+                "ssh_verified_product_repo_count": _int(
+                    private_inventory_rollups.get("ssh_verified_product_repo_count")
+                ),
+                "main_branch_present_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "main_branch_present_product_repo_count"
+                    )
+                ),
+                "dev_branch_present_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "dev_branch_present_product_repo_count"
+                    )
+                ),
+                "dev_prod_environment_split_ready_count": _int(
+                    private_inventory_rollups.get(
+                        "dev_prod_environment_split_ready_count"
+                    )
+                ),
+                "public_visible_product_repo_count": _int(
+                    private_inventory_rollups.get("public_visible_product_repo_count")
+                ),
+                "private_or_auth_only_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "private_or_auth_only_product_repo_count"
+                    )
+                ),
+                "tokenless_http_404_private_or_auth_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "tokenless_http_404_private_or_auth_product_repo_count"
+                    )
+                ),
+                "missing_product_repo_count": _int(
+                    private_inventory_rollups.get("missing_product_repo_count")
+                ),
+                "missing_main_branch_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "missing_main_branch_product_repo_count"
+                    )
+                ),
+                "missing_dev_branch_product_repo_count": _int(
+                    private_inventory_rollups.get(
+                        "missing_dev_branch_product_repo_count"
+                    )
+                ),
+                "all_expected_product_repos_have_ssh_refs": (
+                    private_inventory_rollups.get(
+                        "all_expected_product_repos_have_ssh_refs"
+                    )
+                    is True
+                ),
+                "all_expected_product_repos_have_dev_and_main": (
+                    private_inventory_rollups.get(
+                        "all_expected_product_repos_have_dev_and_main"
+                    )
+                    is True
+                ),
                 "accepted_inventory_payload_count": _int(
                     private_inventory_rollups.get("accepted_inventory_payload_count")
                 ),
@@ -1601,6 +1665,12 @@ def build_delivery_closure_workbench(
             "gitea_private_inventory_public_repo_count": _int(
                 private_inventory_rollups.get("gitea_public_repo_count")
             ),
+            "gitea_private_inventory_ssh_verified_repo_count": _int(
+                private_inventory_rollups.get("gitea_ssh_verified_repo_count")
+            ),
+            "gitea_private_inventory_private_or_auth_only_repo_count": _int(
+                private_inventory_rollups.get("gitea_private_or_auth_only_repo_count")
+            ),
             "gitea_private_inventory_expected_product_count": _int(
                 private_inventory_rollups.get("expected_product_count")
             ),
@@ -1610,6 +1680,54 @@ def build_delivery_closure_workbench(
             "gitea_private_inventory_missing_product_row_count": _int(
                 private_inventory_rollups.get("missing_product_row_count")
             ),
+            "gitea_private_inventory_ssh_verified_product_repo_count": _int(
+                private_inventory_rollups.get("ssh_verified_product_repo_count")
+            ),
+            "gitea_private_inventory_main_branch_present_product_repo_count": _int(
+                private_inventory_rollups.get(
+                    "main_branch_present_product_repo_count"
+                )
+            ),
+            "gitea_private_inventory_dev_branch_present_product_repo_count": _int(
+                private_inventory_rollups.get("dev_branch_present_product_repo_count")
+            ),
+            "gitea_private_inventory_dev_prod_environment_split_ready_count": _int(
+                private_inventory_rollups.get("dev_prod_environment_split_ready_count")
+            ),
+            "gitea_private_inventory_public_visible_product_repo_count": _int(
+                private_inventory_rollups.get("public_visible_product_repo_count")
+            ),
+            "gitea_private_inventory_private_or_auth_only_product_repo_count": _int(
+                private_inventory_rollups.get(
+                    "private_or_auth_only_product_repo_count"
+                )
+            ),
+            "gitea_private_inventory_tokenless_http_404_private_or_auth_product_repo_count": _int(
+                private_inventory_rollups.get(
+                    "tokenless_http_404_private_or_auth_product_repo_count"
+                )
+            ),
+            "gitea_private_inventory_missing_product_repo_count": _int(
+                private_inventory_rollups.get("missing_product_repo_count")
+            ),
+            "gitea_private_inventory_missing_main_branch_product_repo_count": _int(
+                private_inventory_rollups.get(
+                    "missing_main_branch_product_repo_count"
+                )
+            ),
+            "gitea_private_inventory_missing_dev_branch_product_repo_count": _int(
+                private_inventory_rollups.get("missing_dev_branch_product_repo_count")
+            ),
+            "gitea_private_inventory_all_expected_product_repos_have_ssh_refs": (
+                private_inventory_rollups.get("all_expected_product_repos_have_ssh_refs")
+                is True
+            ),
+            "gitea_private_inventory_all_expected_product_repos_have_dev_and_main": (
+                private_inventory_rollups.get(
+                    "all_expected_product_repos_have_dev_and_main"
+                )
+                is True
+            ),
             "gitea_private_inventory_accepted_payload_count": _int(
                 private_inventory_rollups.get("accepted_inventory_payload_count")
             ),

apps/api/src/services/gitea_private_inventory_p0_scorecard.py

@@ -62,6 +62,10 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
     owner_response_validation = _dict(scorecard.get("owner_response_validation"))
     controlled_closeout_receipt = _dict(scorecard.get("controlled_closeout_receipt"))
     product_coverage = _dict(scorecard.get("product_row_coverage"))
+    product_environment_coverage = _dict(
+        scorecard.get("product_repo_environment_coverage")
+    )
+    dev_prod_repo_readback = _dict(scorecard.get("dev_prod_repo_readback"))
     active_blockers = _strings(scorecard.get("active_blockers"))
     exit_criteria = _strings(scorecard.get("exit_criteria"))
     met_criteria = _met_exit_criteria(scorecard, gitea_inventory, product_coverage)
@@ -94,6 +98,8 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
             "safe_next_step": str(scorecard.get("safe_next_step") or ""),
         },
         "gitea_inventory": gitea_inventory,
+        "dev_prod_repo_readback": dev_prod_repo_readback,
+        "product_repo_environment_coverage": product_environment_coverage,
         "authenticated_import_acceptance": import_acceptance,
         "authenticated_payload_validation": payload_validation,
         "authenticated_inventory_single_preflight_intake_ready": True,
@@ -119,6 +125,12 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
                 gitea_inventory.get("visibility_scope") or "unknown"
             ),
             "gitea_public_repo_count": _int(gitea_inventory.get("repo_count")),
+            "gitea_ssh_verified_repo_count": _int(
+                gitea_inventory.get("ssh_verified_repo_count")
+            ),
+            "gitea_private_or_auth_only_repo_count": _int(
+                gitea_inventory.get("private_or_auth_only_repo_count")
+            ),
             "accepted_inventory_payload_count": _int(
                 import_acceptance.get("accepted_payload_count")
             ),
@@ -203,6 +215,53 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
                 )
                 is True
             ),
+            "product_repo_environment_status": str(
+                product_environment_coverage.get("status") or ""
+            ),
+            "ssh_verified_product_repo_count": _int(
+                product_environment_coverage.get("ssh_repo_present_count")
+            ),
+            "main_branch_present_product_repo_count": _int(
+                product_environment_coverage.get("main_branch_present_count")
+            ),
+            "dev_branch_present_product_repo_count": _int(
+                product_environment_coverage.get("dev_branch_present_count")
+            ),
+            "dev_prod_environment_split_ready_count": _int(
+                product_environment_coverage.get("environment_split_ready_count")
+            ),
+            "public_visible_product_repo_count": _int(
+                product_environment_coverage.get("public_visible_count")
+            ),
+            "private_or_auth_only_product_repo_count": _int(
+                product_environment_coverage.get("private_or_auth_only_count")
+            ),
+            "tokenless_http_404_private_or_auth_product_repo_count": _int(
+                product_environment_coverage.get(
+                    "tokenless_http_404_private_or_auth_count"
+                )
+            ),
+            "missing_product_repo_count": _int(
+                product_environment_coverage.get("missing_repo_count")
+            ),
+            "missing_main_branch_product_repo_count": _int(
+                product_environment_coverage.get("missing_main_branch_count")
+            ),
+            "missing_dev_branch_product_repo_count": _int(
+                product_environment_coverage.get("missing_dev_branch_count")
+            ),
+            "all_expected_product_repos_have_ssh_refs": (
+                product_environment_coverage.get(
+                    "all_expected_product_repos_have_ssh_refs"
+                )
+                is True
+            ),
+            "all_expected_product_repos_have_dev_and_main": (
+                product_environment_coverage.get(
+                    "all_expected_product_repos_have_dev_and_main"
+                )
+                is True
+            ),
             "github_lane_excluded_from_p0_blocker_count": (
                 scorecard.get("github_lane_excluded_from_p0_blocker_count")
                 is True
@@ -402,6 +461,29 @@ def _require_source_scorecard(payload: dict[str, Any], label: str) -> None:
             f"{label}: owner response validation boundaries must remain false: "
             f"{owner_response_drift}"
         )
+    dev_prod_readback = _dict(payload.get("dev_prod_repo_readback"))
+    if dev_prod_readback:
+        if dev_prod_readback.get("source_control_authority") != "gitea":
+            raise ValueError(f"{label}: dev/prod readback must use gitea authority")
+        boundaries = _dict(dev_prod_readback.get("operation_boundaries"))
+        if boundaries.get("ssh_refs_read_only") is not True:
+            raise ValueError(f"{label}: dev/prod readback must be SSH read-only")
+        blocked_flags = {
+            "token_value_collection_allowed",
+            "secret_value_collection_allowed",
+            "gitea_api_write_allowed",
+            "gitea_repo_creation_allowed",
+            "gitea_refs_sync_allowed",
+            "gitea_visibility_change_allowed",
+            "github_api_allowed",
+            "github_cli_allowed",
+            "raw_session_or_sqlite_read_allowed",
+        }
+        opened = sorted(
+            flag for flag in blocked_flags if boundaries.get(flag) is not False
+        )
+        if opened:
+            raise ValueError(f"{label}: dev/prod readback boundaries opened: {opened}")
 
 
 def _require_operation_boundaries(payload: dict[str, Any], label: str) -> None:
@@ -452,6 +534,19 @@ def _require_rollup_consistency(payload: dict[str, Any], label: str) -> None:
         is not True
     ):
         raise ValueError(f"{label}: active product owner readiness rows incomplete")
+    if rollups.get("ssh_verified_product_repo_count") and (
+        rollups.get("ssh_verified_product_repo_count")
+        != rollups.get("expected_product_count")
+    ):
+        raise ValueError(f"{label}: SSH verified product repo count mismatch")
+    if rollups.get("missing_product_repo_count") not in {None, 0}:
+        raise ValueError(f"{label}: product repo readback must have zero missing repos")
+    if rollups.get("missing_main_branch_product_repo_count") not in {None, 0}:
+        raise ValueError(f"{label}: product repo readback must have zero missing main branches")
+    if rollups.get("missing_dev_branch_product_repo_count") not in {None, 0}:
+        raise ValueError(f"{label}: product repo readback must have zero missing dev branches")
+    if rollups.get("all_expected_product_repos_have_dev_and_main") is False:
+        raise ValueError(f"{label}: product repo readback must have dev and main")
     if (
         rollups.get("next_owner_response_validation_lane_id")
         != "s4_9_gitea_inventory_owner_attestation_response"
@@ -563,6 +658,14 @@ def _met_exit_criteria(
         is True
     ):
         met.append("all_active_product_repos_have_gitea_owner_readiness_row=true")
+    product_environment_coverage = _dict(
+        scorecard.get("product_repo_environment_coverage")
+    )
+    if (
+        product_environment_coverage.get("all_expected_product_repos_have_dev_and_main")
+        is True
+    ):
+        met.append("all_expected_product_repos_have_dev_and_main=true")
     return met
 
 

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -102,9 +102,79 @@ def test_delivery_closure_workbench_uses_gitea_private_inventory_lane():
     assert lanes["gitea_private_inventory"]["metric"]["private_inventory_source"] == "gitea"
     assert lanes["gitea_private_inventory"]["metric"]["gitea_repo_inventory_status"] == "ok"
     assert lanes["gitea_private_inventory"]["metric"]["gitea_visibility_scope"] == "admin_export"
-    assert lanes["gitea_private_inventory"]["metric"]["expected_product_count"] == 11
-    assert lanes["gitea_private_inventory"]["metric"]["present_product_row_count"] == 11
+    assert lanes["gitea_private_inventory"]["metric"]["gitea_public_repo_count"] == 6
+    assert lanes["gitea_private_inventory"]["metric"]["gitea_ssh_verified_repo_count"] == 12
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "gitea_private_or_auth_only_repo_count"
+        ]
+        == 6
+    )
+    assert lanes["gitea_private_inventory"]["metric"]["expected_product_count"] == 12
+    assert lanes["gitea_private_inventory"]["metric"]["present_product_row_count"] == 12
     assert lanes["gitea_private_inventory"]["metric"]["missing_product_row_count"] == 0
+    assert lanes["gitea_private_inventory"]["metric"]["ssh_verified_product_repo_count"] == 12
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "main_branch_present_product_repo_count"
+        ]
+        == 12
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "dev_branch_present_product_repo_count"
+        ]
+        == 12
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "dev_prod_environment_split_ready_count"
+        ]
+        == 12
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "public_visible_product_repo_count"
+        ]
+        == 6
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "private_or_auth_only_product_repo_count"
+        ]
+        == 6
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "tokenless_http_404_private_or_auth_product_repo_count"
+        ]
+        == 6
+    )
+    assert lanes["gitea_private_inventory"]["metric"]["missing_product_repo_count"] == 0
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "missing_main_branch_product_repo_count"
+        ]
+        == 0
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "missing_dev_branch_product_repo_count"
+        ]
+        == 0
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "all_expected_product_repos_have_ssh_refs"
+        ]
+        is True
+    )
+    assert (
+        lanes["gitea_private_inventory"]["metric"][
+            "all_expected_product_repos_have_dev_and_main"
+        ]
+        is True
+    )
     assert (
         lanes["gitea_private_inventory"]["metric"][
             "authenticated_inventory_single_preflight_intake_ready"
@@ -124,7 +194,7 @@ def test_delivery_closure_workbench_uses_gitea_private_inventory_lane():
         lanes["gitea_private_inventory"]["metric"][
             "authenticated_inventory_payload_skeleton_repo_count_floor"
         ]
-        == 4
+        == 6
     )
     assert (
         lanes["gitea_private_inventory"]["metric"][
@@ -520,9 +590,74 @@ def _assert_delivery_workbench_shape(data: dict):
     assert data["summary"]["gitea_private_inventory_active_blocker_count"] == 0
     assert data["summary"]["gitea_private_inventory_repo_inventory_status"] == "ok"
     assert data["summary"]["gitea_private_inventory_visibility_scope"] == "admin_export"
-    assert data["summary"]["gitea_private_inventory_expected_product_count"] == 11
-    assert data["summary"]["gitea_private_inventory_present_product_row_count"] == 11
+    assert data["summary"]["gitea_private_inventory_public_repo_count"] == 6
+    assert data["summary"]["gitea_private_inventory_ssh_verified_repo_count"] == 12
+    assert data["summary"]["gitea_private_inventory_private_or_auth_only_repo_count"] == 6
+    assert data["summary"]["gitea_private_inventory_expected_product_count"] == 12
+    assert data["summary"]["gitea_private_inventory_present_product_row_count"] == 12
     assert data["summary"]["gitea_private_inventory_missing_product_row_count"] == 0
+    assert data["summary"]["gitea_private_inventory_ssh_verified_product_repo_count"] == 12
+    assert (
+        data["summary"][
+            "gitea_private_inventory_main_branch_present_product_repo_count"
+        ]
+        == 12
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_dev_branch_present_product_repo_count"
+        ]
+        == 12
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_dev_prod_environment_split_ready_count"
+        ]
+        == 12
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_public_visible_product_repo_count"
+        ]
+        == 6
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_private_or_auth_only_product_repo_count"
+        ]
+        == 6
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_tokenless_http_404_private_or_auth_product_repo_count"
+        ]
+        == 6
+    )
+    assert data["summary"]["gitea_private_inventory_missing_product_repo_count"] == 0
+    assert (
+        data["summary"][
+            "gitea_private_inventory_missing_main_branch_product_repo_count"
+        ]
+        == 0
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_missing_dev_branch_product_repo_count"
+        ]
+        == 0
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_all_expected_product_repos_have_ssh_refs"
+        ]
+        is True
+    )
+    assert (
+        data["summary"][
+            "gitea_private_inventory_all_expected_product_repos_have_dev_and_main"
+        ]
+        is True
+    )
     assert data["summary"]["gitea_private_inventory_accepted_payload_count"] == 1
     assert (
         data["summary"][
@@ -549,7 +684,7 @@ def _assert_delivery_workbench_shape(data: dict):
         data["summary"][
             "gitea_private_inventory_authenticated_payload_skeleton_repo_count_floor"
         ]
-        == 4
+        == 6
     )
     assert (
         data["summary"][

apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py

@@ -53,10 +53,7 @@ def test_gitea_private_inventory_p0_scorecard_reports_committed_closeout():
         == 8
     )
     assert payload["authenticated_inventory_single_preflight_intake_ready"] is True
-    assert (
-        payload["authenticated_inventory_payload_skeleton_repo_count_floor"]
-        == 4
-    )
+    assert payload["authenticated_inventory_payload_skeleton_repo_count_floor"] == 6
     assert payload["rollups"]["owner_coverage_attestation_received_count"] == 1
     assert payload["rollups"]["owner_coverage_attestation_accepted_count"] == 1
     assert payload["rollups"]["owner_response_validation_received_count"] == 5
@@ -70,10 +67,33 @@ def test_gitea_private_inventory_p0_scorecard_reports_committed_closeout():
         payload["rollups"]["next_owner_response_validation_lane_id"]
         == "s4_9_gitea_inventory_owner_attestation_response"
     )
-    assert payload["rollups"]["expected_product_count"] == 11
-    assert payload["rollups"]["present_product_row_count"] == 11
+    assert payload["rollups"]["gitea_public_repo_count"] == 6
+    assert payload["rollups"]["gitea_ssh_verified_repo_count"] == 12
+    assert payload["rollups"]["gitea_private_or_auth_only_repo_count"] == 6
+    assert payload["rollups"]["expected_product_count"] == 12
+    assert payload["rollups"]["present_product_row_count"] == 12
     assert payload["rollups"]["missing_product_row_count"] == 0
     assert payload["rollups"]["all_active_product_repos_have_gitea_owner_readiness_row"] is True
+    assert payload["rollups"]["product_repo_environment_status"] == (
+        "ready_all_expected_product_repos_have_dev_and_main"
+    )
+    assert payload["rollups"]["ssh_verified_product_repo_count"] == 12
+    assert payload["rollups"]["main_branch_present_product_repo_count"] == 12
+    assert payload["rollups"]["dev_branch_present_product_repo_count"] == 12
+    assert payload["rollups"]["dev_prod_environment_split_ready_count"] == 12
+    assert payload["rollups"]["public_visible_product_repo_count"] == 6
+    assert payload["rollups"]["private_or_auth_only_product_repo_count"] == 6
+    assert (
+        payload["rollups"][
+            "tokenless_http_404_private_or_auth_product_repo_count"
+        ]
+        == 6
+    )
+    assert payload["rollups"]["missing_product_repo_count"] == 0
+    assert payload["rollups"]["missing_main_branch_product_repo_count"] == 0
+    assert payload["rollups"]["missing_dev_branch_product_repo_count"] == 0
+    assert payload["rollups"]["all_expected_product_repos_have_ssh_refs"] is True
+    assert payload["rollups"]["all_expected_product_repos_have_dev_and_main"] is True
     assert payload["rollups"]["github_lane_excluded_from_p0_blocker_count"] is True
     assert payload["github_retired_context"]["status"] == "stopped_retired_do_not_use"
     assert payload["github_retired_context"]["excluded_from_active_p0_blocker_math"] is True
@@ -125,7 +145,7 @@ def test_gitea_private_inventory_p0_scorecard_exposes_single_preflight_intake():
     assert intake["workplan_id"] == "P0-003"
     assert intake["payload_schema_version"] == "gitea_repo_inventory_v1"
     assert intake["accepted_visibility_scopes"] == ["authenticated", "admin_export"]
-    assert intake["minimum_repo_count"] == 4
+    assert intake["minimum_repo_count"] == 6
     assert len(intake["required_redaction_attestations"]) == 8
     assert "no_token_value" in intake["required_redaction_attestations"]
     assert "no_gitea_db_dump" in intake["required_redaction_attestations"]
@@ -191,7 +211,10 @@ def test_gitea_private_inventory_p0_scorecard_endpoint_returns_readback():
     assert data["authenticated_inventory_single_preflight_intake_ready"] is True
     assert data["authenticated_inventory_single_preflight_intake"][
         "minimum_repo_count"
-    ] == 4
+    ] == 6
+    assert data["rollups"]["ssh_verified_product_repo_count"] == 12
+    assert data["rollups"]["dev_prod_environment_split_ready_count"] == 12
+    assert data["rollups"]["all_expected_product_repos_have_dev_and_main"] is True
     assert (
         data["controlled_closeout_receipt"]["status"]
         == "ready_for_p0_003_controlled_closeout"