Add GE-Enforce observed-state reporting: receipt + self-heal from PCs

PCs now report enforcement results back to shopdb, closing the desired-vs-observed
loop.

- POST /api/geenforce/report (geenforce.report service token): each cycle a PC
  posts the published version it applied, install/skip/fail/filtered counts, and
  per-entry outcomes.
- Two tables: manifestenforcementreports (latest-per-host + history: applied
  version, enforcer version, counts, derived status ok/selfhealed/failed) and
  manifestenforcementresults (per entry: action installed/skipped/failed,
  selfhealed flag, exit code, warning/error message).
- RECEIVED: reports carry the applied version; the admin view derives
  receivedlatest by comparing it to the scope's current published version, so
  the fleet view shows which PCs picked up an update.
- SELF-HEAL: per-entry action captures drift correction (installed when it
  should already be present) vs skipped (already good) vs failed, with messages.
- Admin reads: GET /reports (fleet compliance rollup) and GET /reports/<id>
  (per-entry detail). New geenforce.report permission.
- Tables added to the (undeployed) 0001 baseline; geenforce.post_report is a
  service-token endpoint so it is exempt from the JWT authz sweep, like the
  collector blueprint. 8 reporting tests; full suite green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/service.py

@@ -14,7 +14,10 @@ from sqlalchemy import func
 
 from shopdb.api import db
 
-from .models import ManifestScope, ManifestPublishedVersion
+from .models import (
+    ManifestScope, ManifestPublishedVersion, ManifestEnforcementReport,
+    ManifestEnforcementResult,
+)
 from .importer import build_entry
 from .serializer import scope_to_json
 
@@ -90,6 +93,76 @@ def rollback_scope(scopename, phase, versionnumber):
     return versionnumber
 
 
+def record_enforcement_report(payload):
+    """Record one PC's enforcement cycle (observed state). Upserts the latest
+    report per (hostname, scopename, phase) and keeps prior ones as history.
+
+    Payload (all but hostname optional):
+      hostname, scopename, phase, appliedversion, enforcerversion, lastcheckin,
+      counts {installed, skipped, failed, filtered},
+      results [{name, action, selfhealed, exitcode, message}]
+
+    Returns the new ManifestEnforcementReport (uncommitted).
+    """
+    hostname = (payload.get('hostname') or '').strip()
+    if not hostname:
+        raise ValueError('hostname is required')
+    scopename = (payload.get('scopename') or '').strip()
+    phase = (payload.get('phase') or 'runtime').strip()
+    counts = payload.get('counts') or {}
+    results = payload.get('results') or []
+
+    failed = int(counts.get('failed', 0))
+    installed = int(counts.get('installed', 0))
+    # Derive status: any failure wins; else drift-corrected installs = selfhealed.
+    if failed > 0:
+        status = 'failed'
+    elif installed > 0 or any(r.get('selfhealed') for r in results):
+        status = 'selfhealed'
+    else:
+        status = 'ok'
+
+    # Demote the prior current report for this host+scope.
+    ManifestEnforcementReport.query.filter_by(
+        hostname=hostname, scopename=scopename, phase=phase, iscurrent=True
+    ).update({'iscurrent': False})
+
+    report = ManifestEnforcementReport(
+        hostname=hostname,
+        scopename=scopename,
+        phase=phase,
+        appliedversion=payload.get('appliedversion'),
+        enforcerversion=payload.get('enforcerversion'),
+        installedcount=installed,
+        skippedcount=int(counts.get('skipped', 0)),
+        failedcount=failed,
+        filteredcount=int(counts.get('filtered', 0)),
+        status=status,
+        lastcheckin=_parse_dt(payload.get('lastcheckin')),
+        receivedat=_utcnow(),
+        iscurrent=True)
+    for item in results:
+        report.results.append(ManifestEnforcementResult(
+            entryname=item.get('name', ''),
+            action=item.get('action', ''),
+            selfhealed=bool(item.get('selfhealed',
+                                     item.get('action') == 'installed')),
+            exitcode=item.get('exitcode'),
+            message=item.get('message')))
+    db.session.add(report)
+    return report
+
+
+def _parse_dt(value):
+    if not value:
+        return None
+    try:
+        return datetime.fromisoformat(str(value).replace('Z', '+00:00')).replace(
+            tzinfo=None)
+    except (ValueError, TypeError):
+        return None
+
+
 def export_scope_to_share(scopename, phase, shareroot):
     """Write a scope's current published JSON to the share, backing up the old
     file to _meta/history first. Returns the written path."""