feat(ops): show worker and queue readiness

src/govoplan_ops/backend/manifest.py

@@ -20,6 +20,8 @@ from govoplan_core.core.provider_governance import (
     ModuleArchitectureDocumentation,
     ModuleMaturityEvidence,
 )
+from govoplan_core.core.operations import RuntimeWorkStatusProviderRegistration
+from govoplan_core.core.runtime_work import celery_runtime_work_status
 from govoplan_core.core.views import ViewSurface
 
 OPS_READ_SCOPE = "ops:operations:read"
@@ -124,12 +126,20 @@ manifest = ModuleManifest(
             level="system",
         ),
     ),
+    runtime_work_status_providers=(
+        RuntimeWorkStatusProviderRegistration(
+            module_id="ops",
+            provider_id="core.celery",
+            provider=celery_runtime_work_status,
+            cache_seconds=15,
+        ),
+    ),
     documentation=(
         DocumentationTopic(
             id="ops.health-governance-and-sizing",
             title="Inspect platform health and deployment posture",
             summary="Ops combines module-owned health checks with deployment profile, governance inventory, worker assumptions, and sizing guidance.",
-            body="Read-only status distinguishes configured capabilities from healthy integrations. When the deployment mounts a signed or locally generated non-secret infrastructure capability receipt, Ops shows whether PostgreSQL, Redis, SMTP, file storage, load balancing, and ingress are configured, externally supplied, available but unconfigured, or unavailable. Secret values never cross this boundary; only stable environment or credential-envelope references may be disclosed. Pending post-install tasks remain visible with a stable resume key. Authorized operators can run bounded probes; a probe must not perform unbounded business work or silently repair data. Use readiness and worker results when diagnosing a node, and use the deployment profile and sizing assumptions when planning horizontal capacity.",
+            body="Read-only status distinguishes configured capabilities from healthy integrations. Worker and queue providers use a Core runtime-status contract, so Ops never imports a provider backend. The surface distinguishes intentionally disabled, unconfigured, starting, healthy with unsupported queue depth, measured idle, busy, degraded, stale, and unreachable states. It shows enabled/configured state, backend, workers, heartbeat age and stale threshold, queue depth, active/reserved work, and failures only when each value is actually reported; unavailable values are never rendered as zero or healthy. Local development treats intentionally disabled workers as expected, while production profiles require an enabled, configured, reachable provider before queue-backed work is accepted. Polling is bounded to one request, pauses while the page is hidden, and refreshes on return. When the deployment mounts a signed or locally generated non-secret infrastructure capability receipt, Ops shows whether PostgreSQL, Redis, SMTP, file storage, load balancing, and ingress are configured, externally supplied, available but unconfigured, or unavailable. Secret values never cross this boundary; only stable environment or credential-envelope references may be disclosed. Pending post-install tasks remain visible with a stable resume key. Authorized operators can run bounded probes; a probe must not perform unbounded business work or silently repair data. Use readiness and worker results when diagnosing a node, and use the deployment profile and sizing assumptions when planning horizontal capacity.",
             documentation_types=("admin", "user"),
             audience=("operator", "system_admin"),
             related_modules=("audit", "docs", "notifications"),
@@ -139,6 +149,7 @@ manifest = ModuleManifest(
                     "ops.page",
                     "ops.page.summary",
                     "ops.page.health",
+                    "ops.page.runtime",
                     "ops.page.governance",
                     "ops.page.deployment",
                     "ops.page.sizing",