Consume governed recipients and add operational checks

src/govoplan_campaign/backend/operational_checks.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import os
+import secrets
+from pathlib import Path
+
+from govoplan_core.core.operations import OperationalCheck
+from govoplan_campaign.backend.persistence.campaigns import BUILD_OUTPUT_DIR
+
+
+def generated_eml_storage_check() -> OperationalCheck:
+    """Verify the current EML evidence path and report its node-local boundary."""
+
+    root = Path(BUILD_OUTPUT_DIR)
+    probe = root / ".govoplan-health" / f"{secrets.token_hex(16)}.probe"
+    payload = secrets.token_bytes(64)
+    try:
+        probe.parent.mkdir(parents=True, mode=0o700, exist_ok=True)
+        with probe.open("xb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if probe.read_bytes() != payload:
+            raise OSError("generated EML persistence returned different bytes")
+    except OSError as exc:
+        return OperationalCheck(
+            id="campaign.generated_eml_storage",
+            label="Generated Campaign EML evidence",
+            state="error",
+            detail=(
+                "The generated EML evidence path failed a bounded durable-write probe "
+                f"({type(exc).__name__})."
+            ),
+            readiness_critical=True,
+            metrics={"backend": "node_local_filesystem"},
+        )
+    finally:
+        try:
+            probe.unlink(missing_ok=True)
+            probe.parent.rmdir()
+        except OSError:
+            pass
+
+    return OperationalCheck(
+        id="campaign.generated_eml_storage",
+        label="Generated Campaign EML evidence",
+        state="warning",
+        detail=(
+            "Generated EML passed a local write/fsync/read probe, but remains node-local. "
+            "Use one shared runtime volume and include it in coordinated backups until "
+            "Campaign evidence is migrated to managed object storage."
+        ),
+        metrics={"backend": "node_local_filesystem"},
+    )
+