From 708bf57d4eb270de8a06726eab37c7bbebb10526 Mon Sep 17 00:00:00 2001
From: yuqei <cyuqei@gmail.com>
Date: Wed, 13 May 2026 09:12:56 +0800
Subject: [PATCH] fix: load launch gate admin credential file

---
 .../run-formal-launch-preparation-gate.ps1    | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/scripts/run-formal-launch-preparation-gate.ps1 b/scripts/run-formal-launch-preparation-gate.ps1
index ed0661a9..a409d532 100644
--- a/scripts/run-formal-launch-preparation-gate.ps1
+++ b/scripts/run-formal-launch-preparation-gate.ps1
@@ -8,6 +8,7 @@ param(
   [string]$LibraryRoot = "",
   [string]$MaterialsRoot = "",
   [string]$ArtifactRoot = "",
+  [string]$AdminPasswordFile = "",
   [int]$MinTemplates = 10,
   [int]$MinMaterials = 7,
   [switch]$FailOnBlocked
@@ -27,12 +28,18 @@ if ([string]::IsNullOrWhiteSpace($MaterialsRoot)) {
 if ([string]::IsNullOrWhiteSpace($ArtifactRoot)) {
   $ArtifactRoot = Join-Path $repoRoot "project-docs\qa-artifacts\formal-launch-preparation-gate"
 }
+if ([string]::IsNullOrWhiteSpace($AdminPasswordFile)) {
+  $AdminPasswordFile = Join-Path $HOME ".ai-contract-platform\production-admin-password.txt"
+}
 foreach ($pathName in @("LibraryRoot", "MaterialsRoot", "ArtifactRoot")) {
   $value = Get-Variable -Name $pathName -ValueOnly
   if (-not [System.IO.Path]::IsPathRooted($value)) {
     Set-Variable -Name $pathName -Value (Join-Path $repoRoot $value)
   }
 }
+if (-not [System.IO.Path]::IsPathRooted($AdminPasswordFile)) {
+  $AdminPasswordFile = Join-Path $repoRoot $AdminPasswordFile
+}
 
 $artifactDir = Join-Path $ArtifactRoot $timestamp
 New-Item -ItemType Directory -Force -Path $artifactDir | Out-Null
@@ -161,6 +168,18 @@ $remoteUrl = (git -C $repoRoot remote get-url origin).Trim()
 $gitStatus = git -C $repoRoot status --short
 ($gitStatus -join [Environment]::NewLine) | Set-Content -Encoding UTF8 -Path $gitStatusPath
 
+$adminPasswordSource = "environment"
+if ([string]::IsNullOrWhiteSpace($env:AI_CONTRACT_ADMIN_PASSWORD)) {
+  $adminPasswordSource = "missing"
+  if (Test-Path -LiteralPath $AdminPasswordFile -PathType Leaf) {
+    $filePassword = (Get-Content -LiteralPath $AdminPasswordFile -Raw -Encoding UTF8).Trim()
+    if (-not [string]::IsNullOrWhiteSpace($filePassword)) {
+      $env:AI_CONTRACT_ADMIN_PASSWORD = $filePassword
+      $adminPasswordSource = "local credential file"
+    }
+  }
+}
+
 $pcGitStatus = @($gitStatus | Where-Object {
   $_ -notmatch "^\?\?\s+mobile/" -and
   $_ -notmatch "^\s*M\s+mobile/" -and
@@ -184,7 +203,7 @@ if ($pcGitStatus.Count -eq 0) {
 if ([string]::IsNullOrWhiteSpace($env:AI_CONTRACT_ADMIN_PASSWORD)) {
   Add-Check -Key "admin_password_env" -Label "production regression secret" -Status "blocked" -Detail "AI_CONTRACT_ADMIN_PASSWORD is not set in current process"
 } else {
-  Add-Check -Key "admin_password_env" -Label "production regression secret" -Status "pass" -Detail "AI_CONTRACT_ADMIN_PASSWORD is set in current process"
+  Add-Check -Key "admin_password_env" -Label "production regression secret" -Status "pass" -Detail "AI_CONTRACT_ADMIN_PASSWORD is available via $adminPasswordSource"
 }
 
 $templates = Import-CsvRows -Path (Join-Path $LibraryRoot "inventories\contract-template-inventory.csv")