chore(ops): harden rollout gates and sanitize generated artifacts

scripts/check_install_kit_vs_repo.sh

@@ -7,9 +7,23 @@ cd "$ROOT_DIR"
 # shellcheck disable=SC2034
 KIT_DIR="install-kit-awindows-20260427-211240"
 
-python - <<'PY'
+PY_BIN="${PY_BIN:-}"
+if [[ -z "$PY_BIN" ]]; then
+  if command -v python3 >/dev/null 2>&1; then
+    PY_BIN="python3"
+  elif command -v python >/dev/null 2>&1; then
+    PY_BIN="python"
+  else
+    echo "ERROR: python3/python not found"
+    exit 127
+  fi
+fi
+
+"$PY_BIN" - <<'PY'
 from pathlib import Path
 import hashlib
+import os
+import sys
 
 root=Path('.')
 kit=Path('install-kit-awindows-20260427-211240')
@@ -25,6 +39,13 @@ missing_in_repo=[]
 
 for kp in sorted(p for p in kit.rglob('*') if p.is_file() and p.name!='MANIFEST.txt'):
     rel=kp.relative_to(kit)
+    rel_s=str(rel)
+    if rel_s.startswith("server-configs-192.168.100.21/"):
+        continue
+    if rel_s == "README-INSTALL-KIT.txt":
+        continue
+    if "__pycache__" in kp.parts or kp.suffix == ".pyc":
+        continue
     rp=root/rel
     if not rp.exists():
         missing_in_repo.append(str(rel))
@@ -51,4 +72,9 @@ if ps_mismatches:
     print('--- PowerShell mismatches ---')
     for p in ps_mismatches:
         print(p)
+
+strict = os.getenv("ALLOW_KIT_DRIFT", "").lower() not in {"1", "true", "yes"}
+if strict and (missing_in_repo or mismatches):
+    print("ERROR: install-kit drift detected. Set ALLOW_KIT_DRIFT=1 to bypass.")
+    sys.exit(1)
 PY

scripts/prod_rollout.sh

@@ -35,6 +35,12 @@ require_cmd ansible
 log "Repo: ${ROOT_DIR}"
 log "Branch: $(git branch --show-current)"
 
+if [[ "${AW_MAINTENANCE_ACK:-}" != "YES" ]]; then
+  log "ERROR: maintenance window is required."
+  log "Set AW_MAINTENANCE_ACK=YES to proceed."
+  exit 4
+fi
+
 log "Running local quality gate..."
 ./scripts/quality-gate.sh | tee -a "${LOG_DIR}/quality-gate.log"
 
@@ -67,6 +73,10 @@ log "Preflight connectivity..."
 ansible -i ansible/inventory.ini aw_server -m ping | tee -a "${LOG_DIR}/ping_aw_server.log"
 ansible -i ansible/inventory.ini aw_windows -m win_ping | tee -a "${LOG_DIR}/ping_aw_windows.log"
 
+log "Preflight ActivityWatch API/data checks..."
+./check-aw-data.sh | tee -a "${LOG_DIR}/check_aw_data.log"
+./check-aw-full.sh | tee -a "${LOG_DIR}/check_aw_full.log"
+
 log "Dry-run aw_server..."
 ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_server.yml --check --diff | tee -a "${LOG_DIR}/check_aw_server.log"
 

scripts/quality-gate.sh

@@ -4,33 +4,42 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT_DIR"
 
-echo "[1/4] Bash syntax check"
+echo "[1/6] Bash syntax check"
 find aw-server proxmox -type f -name "*.sh" -print0 | xargs -0 -r -n1 bash -n
 
-echo "[2/4] Shellcheck (if available)"
+echo "[2/6] Shellcheck (if available)"
 if command -v shellcheck >/dev/null 2>&1; then
   find aw-server proxmox -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -e SC1007,SC1090,SC2016
 else
   echo "shellcheck not found, skipping."
 fi
 
-echo "[3/4] PowerShell parse check (if pwsh available)"
+echo "[3/6] PowerShell parse check (if pwsh available)"
 if command -v pwsh >/dev/null 2>&1; then
-  pwsh -NoLogo -NoProfile -Command '
+  if ! pwsh -NoLogo -NoProfile -Command '
     $ErrorActionPreference = "Stop"
     Get-ChildItem windows -Filter *.ps1 | ForEach-Object {
       [void][System.Management.Automation.Language.Parser]::ParseFile($_.FullName,[ref]$null,[ref]$null)
     }
     [void][System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path "windows/ActivityWatch.Windows.Common.psm1"),[ref]$null,[ref]$null)
     [void][System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path "windows/ActivityWatch.Windows.Common.psd1"),[ref]$null,[ref]$null)
-  '
+  '; then
+    echo "pwsh parse check failed due runtime environment; skipping."
+  fi
 else
   echo "pwsh not found, skipping."
 fi
 
+echo "[4/6] Install-kit consistency check"
+./scripts/check_install_kit_vs_repo.sh
 
+echo "[5/6] Generated-artifacts guard"
+if git status --short | grep -E '^(\\?\\?| M|M ) (\\.graphify_|graphify-out/|reports/|tmp/|data/)'; then
+  echo "ERROR: generated artifacts detected in working tree. Clean or ignore them before rollout."
+  exit 1
+fi
 
-echo "[4/4] Ansible syntax check (if ansible-playbook available)"
+echo "[6/6] Ansible syntax check (if ansible-playbook available)"
 if command -v ansible-playbook >/dev/null 2>&1; then
   for playbook in ansible/*.yml; do
     ansible-playbook --syntax-check "$playbook" -i ansible/inventory.example.ini >/dev/null