fix(cicd): 保留真实 PaC bootstrap 失败

docs/MDTODO/details/pr-merge-driven-automatic-delivery/R4.1.1_Task_Report.md

@@ -29,14 +29,13 @@
   - CEL、marker、creator 与 ServiceAccount；
   - queue transition、spec/config SHA、版本与 resource epoch；
   - 默认 RBAC。
-- 上述观察项不再作为以下入口的阻断条件：
+- admission/provenance 观察项不再作为以下入口的阻断条件：
   - 业务 admission 与 bootstrap；
   - status、history 与 debug；
   - 外层 PaC delivery eligibility。
-- admission 与 consumer bootstrap 漂移统一输出结构化字段：
-  - `blocking: false`；
-  - `warning: true|false`；
-  - `warnings` / `reasons`。
+- admission 漂移输出结构化 `blocking: false` warning；真实 consumer bootstrap 缺失不降级：
+  - runner ServiceAccount、RoleBinding 或 Argo repository credential 未就绪时，status 保持 `ok: false`；
+  - 顶层 status 继续要求 `bootstrap_ready=true`，避免 false green。
 - PaC bootstrap 的 `pac-admission` 阶段在 live identity 或 generation 尚未精确收敛时显示 `state: warning`，整体结果仍可成功。
 - 外层 GitHub/Gitea PaC push event 继续作为：
   - 唯一流水线触发；
@@ -57,7 +56,7 @@
 
 - `sh -n scripts/src/platform-infra-pipelines-as-code-remote.sh`
 - `bun test scripts/src/platform-infra-pac-provenance.test.ts scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts`
-  - 结果：`23 pass, 0 fail, 234 expect()`。
+  - 结果：`23 pass, 0 fail, 239 expect()`。
 - `node` 调用 `runPacStatusFixtureChecks()`：
   - 结果：`ok=true, checks=34`。
 - `bun scripts/cli.ts platform-infra pipelines-as-code plan --target NC01`

scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts

@@ -177,6 +177,12 @@ test("PaC apply checks the Gitea repository before dry-run return and cluster mu
   expect(remote).toContain('"admission":{"applied":%s,"ready":%s}');
   expect(remote).toContain('"admissionProvenance":%s');
   expect(remote).toContain('"error":"gitea-repository-missing"');
+  const statusAction = remote.slice(remote.indexOf("status_action() {"), remote.indexOf("history_action() {"));
+  expect(statusAction).toContain('[ "$bootstrap_ready" = "true" ]');
+  expect(statusAction).toContain("output.code = 'pac-consumer-bootstrap-not-ready'");
+  expect(statusAction).toContain("output.ok = false");
+  expect(statusAction).toContain("code: 'pac-admission-provenance-not-ready'");
+  expect(statusAction).toContain("blocking: false");
 });
 
 test("platform bootstrap help advertises the composite entry before low-level apply", async () => {

scripts/src/platform-infra-pipelines-as-code-remote.sh

@@ -1612,37 +1612,26 @@ NODE
 const diagnostics = JSON.parse(process.env.UNIDESK_PAC_DIAGNOSTICS || '{}');
 const admissionProvenance = JSON.parse(process.env.UNIDESK_PAC_STATE || '{}');
 const consumerBootstrap = JSON.parse(process.env.UNIDESK_PAC_BOOTSTRAP_STATE || '{}');
+const output = { ...diagnostics, admissionProvenance, consumerBootstrap, valuesPrinted: false };
 if (process.env.UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED === '1' && admissionProvenance.ready !== true) {
-  process.stdout.write(JSON.stringify({
-    ...diagnostics,
-    warnings: [...(Array.isArray(diagnostics.warnings) ? diagnostics.warnings : []), {
+  output.warnings = [...(Array.isArray(output.warnings) ? output.warnings : []), {
       code: 'pac-admission-provenance-not-ready',
       blocking: false,
       hint: 'PaC admission policy, binding, desired RBAC, or live default-SA observation is drifted; delivery continues',
       reasons: Array.isArray(admissionProvenance.reasons) ? admissionProvenance.reasons : [],
-    }],
-    admissionProvenance,
-    valuesPrinted: false,
-  }));
-} else if (consumerBootstrap.configured === true && consumerBootstrap.ready !== true) {
-  process.stdout.write(JSON.stringify({
-    ...diagnostics,
-    warnings: [...(Array.isArray(diagnostics.warnings) ? diagnostics.warnings : []), {
-      code: 'pac-consumer-bootstrap-not-ready',
-      blocking: false,
-      hint: 'declared runner ServiceAccount/RoleBinding or Argo repository credential is missing or drifted; status remains observable',
-    }],
-    admissionProvenance,
-    consumerBootstrap,
-    valuesPrinted: false,
-  }));
-} else {
-  process.stdout.write(JSON.stringify({ ...diagnostics, admissionProvenance, consumerBootstrap, valuesPrinted: false }));
+    }];
 }
+if (consumerBootstrap.configured === true && consumerBootstrap.ready !== true) {
+  output.ok = false;
+  output.code = 'pac-consumer-bootstrap-not-ready';
+  output.phase = 'consumer-bootstrap-not-ready';
+  output.hint = 'declared runner ServiceAccount/RoleBinding or Argo repository credential is missing or drifted';
+}
+process.stdout.write(JSON.stringify(output));
 NODE
 )
   printf '{"ok":%s,"crdPresent":%s,"controllerReady":"%s","admissionProvenance":%s,"consumerBootstrap":%s,"repository":{"name":"%s","repo":"%s/%s","url":"%s","condition":"%s"},"repositoryCondition":"%s","webhooks":%s,"pipelineRuns":%s,"taskRuns":%s,"artifact":%s,"argo":%s,"runtime":%s,"diagnostics":%s,"valuesPrinted":false}\n' \
-    "$( [ -n "$crd" ] && [ "$controller_ready" != "0/0" ] && echo true || echo false )" \
+    "$( [ -n "$crd" ] && [ "$controller_ready" != "0/0" ] && [ "$bootstrap_ready" = "true" ] && echo true || echo false )" \
     "$( [ -n "$crd" ] && echo true || echo false )" \
     "$(json_string "$controller_ready")" \
     "$UNIDESK_PAC_ADMISSION_STATE_JSON" \