qa: summarize support preflight readiness

[100yenadmin]

Summary

• add a compact top-level readiness object to the support preflight artifact
• expose path-free booleans for same-SHA readiness, provider/player auth readiness, tool readiness, persona brief readiness, private-art readiness, artifact-return readiness, and blocker categories
• keep release_verdict=false; this is still a preflight, not RRI evidence

Validation

• python3 -m pytest qa/test_support_vm_preflight.py -q
• python3 -m py_compile qa/support_vm_preflight.py
• git diff --check

Safety

• no private artifacts or operator topology committed
• readiness summary intentionally omits repo/art/return paths

Summary by CodeRabbit

Release Notes

• New Features
  • Reports now include a dedicated "Readiness" section displaying whether personas can safely execute and which configuration categories block execution.
  • Added enhanced readiness validation covering tools, artifacts, and authentication configurations.
  • System readiness status is now prominently surfaced in all generated reports.

[coderabbitai]

Warning

Review limit reached

@100yenadmin, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 28 minutes and 8 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e85d57b-70ca-4261-a613-9a64b3c0c316

📥 Commits

Reviewing files that changed from the base of the PR and between 9151a75 and bd3226a.

📒 Files selected for processing (2)

• qa/support_vm_preflight.py
• qa/test_support_vm_preflight.py

📝 Walkthrough

Walkthrough

This PR adds agent-based auth readiness checks and consolidates readiness assessment into preflight reports. Two new functions compute whether agents are auth-ready and whether the overall system is ready to run personas, exposing a redacted readiness object in JSON and Markdown report outputs.

Changes

Agent Readiness Computation and Reporting

Layer / File(s)	Summary
Auth readiness computation and summary verdict qa/support_vm_preflight.py	lane_auth_ready(...) checks agent auth status (Codex requires proven auth and MCP override support; Claude requires availability). readiness_summary(...) computes a complete readiness object with per-category booleans and derives safe_to_run_personas flag and blocking_categories list.
JSON report readiness field qa/support_vm_preflight.py	build_report(...) adds a new top-level readiness field populated from readiness_summary(...), passing the computed verdict and inspected repository, tools, artifacts, and file states.
Markdown readiness section and validation test qa/support_vm_preflight.py, qa/test_support_vm_preflight.py	markdown_report(...) includes a new "Readiness" section displaying persona safety and blocking categories. test_report_includes_redacted_readiness_summary_for_agent_routing() validates the readiness structure and confirms sensitive config paths are redacted from the JSON report.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• electricsheephq/WorldOS#508: Introduced the support VM preflight artifact gating system in qa/support_vm_preflight.py that this PR extends with consolidated readiness assessment.
• electricsheephq/WorldOS#517: Changes the Codex auth probe command that produces auth readiness fields consumed by the new lane_auth_ready(...) and readiness_summary(...) functions.
• electricsheephq/WorldOS#513: Also modifies qa/support_vm_preflight.py readiness gating by adding origin/main probe checks that can block readiness and surface in preflight reports.

Poem

🐰 The bunny hops through lanes of auth,
Checking if agents are ready,
Readiness verdicts, blocking paths—
Now Markdown and JSON steady.
No secrets leak, just truth prevails! 🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the main change: adding a summarized support preflight readiness report.
Description check	✅ Passed	The description matches the template's Summary and Validation sections, but it omits the Licensing / CLA checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@qa/support_vm_preflight.py`:
- Around line 617-618: lane_auth_ready currently treats Claude as authenticated
based solely on tools["claude"].get("available") (set by which/--version) so
player_agent_auth_ready can be True without credentials; update lane_auth_ready
(and/or inspect_tools) to also verify actual auth by checking the expected
Claude/Anthropic credential sources (e.g., presence/values of ANTHROPIC_* or
CLAWDND_* env vars from env_snapshot or a credentials file) or by performing a
lightweight authenticated probe, and return True only if both the CLI is
available and credentials are present/valid; reference functions/keys:
lane_auth_ready, inspect_tools, env_snapshot, tools["claude"].get("available"),
and player_agent_auth_ready when implementing this change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3e85028-9505-4623-b3f9-3770c1faabcd

📥 Commits

Reviewing files that changed from the base of the PR and between 9fa1cd4 and 9151a75.

📒 Files selected for processing (2)

• qa/support_vm_preflight.py
• qa/test_support_vm_preflight.py