feat(observatory): install local M49 worker path

src/k1link/web/app.py

@@ -68,10 +68,12 @@ from k1link.observatory.portable_setup_projection import (
     portable_calculation_profile_registry,
 )
 from k1link.observatory.portable_worker_integration import (
+    OBSERVATORY_WORKER_LOCAL_ENABLED_ENV,
     PortableObservatoryWorkerIntegration,
     PortableWorkerIntegrationError,
     PortableWorkerStorageRoots,
     build_portable_observatory_worker_integration,
+    observatory_worker_local_enabled,
     portable_result_validator_registry,
 )
 from k1link.observatory.recorded_jobs import (
@@ -385,9 +387,15 @@ except (M49QueueBindingError, ObservatoryRecordedQueueError, OSError, ValueError
     OBSERVATORY_RECORDED_JOB_QUEUE = None
     OBSERVATORY_RECORDED_JOB_QUEUE_ERROR = str(exc)
 OBSERVATORY_WORKER_TOKEN_PATH = session_store.data_dir / "worker-auth" / "observatory-worker.token"
-OBSERVATORY_WORKER_CLAIM_LEASE_READY = False
-OBSERVATORY_WORKER_VERIFIED_RESULT_PUBLISHER_READY = False
 OBSERVATORY_WORKER_PRODUCTION_API_ENABLED = False
+OBSERVATORY_WORKER_LOCAL_ENABLED: bool
+OBSERVATORY_WORKER_LOCAL_ENABLED_ERROR: str | None
+try:
+    OBSERVATORY_WORKER_LOCAL_ENABLED = observatory_worker_local_enabled()
+    OBSERVATORY_WORKER_LOCAL_ENABLED_ERROR = None
+except PortableWorkerIntegrationError as exc:
+    OBSERVATORY_WORKER_LOCAL_ENABLED = False
+    OBSERVATORY_WORKER_LOCAL_ENABLED_ERROR = str(exc)
 OBSERVATORY_WORKER_AUTHENTICATION: ObservatoryWorkerAuthentication | None
 OBSERVATORY_WORKER_AUTHENTICATION_ERROR: str | None
 OBSERVATORY_WORKER_API_ERROR: str | None
@@ -470,32 +478,47 @@ except (PortableWorkerIntegrationError, OSError, ValueError) as exc:
     # Failure remains isolated from K1, Simulation and legacy LAB.
     OBSERVATORY_PORTABLE_WORKER_INTEGRATION = None
     OBSERVATORY_PORTABLE_WORKER_INTEGRATION_ERROR = str(exc)
-OBSERVATORY_WORKER_API_ERROR = (
-    "Worker pull API is hard-disabled pending sealed installed executors, "
-    "a configured Worker credential, explicit integration acceptance and the "
-    "production gate"
-    + (
-        ""
-        if OBSERVATORY_WORKER_AUTHENTICATION_ERROR is None
-        else (
-            "; authentication unavailable: "
-            f"{OBSERVATORY_WORKER_AUTHENTICATION_ERROR}"
-        )
-    )
-    + (
-        ""
-        if OBSERVATORY_PORTABLE_WORKER_INTEGRATION_ERROR is None
-        else f"; integration unavailable: {OBSERVATORY_PORTABLE_WORKER_INTEGRATION_ERROR}"
-    )
+OBSERVATORY_WORKER_API_GATE_ENABLED = OBSERVATORY_WORKER_LOCAL_ENABLED
+OBSERVATORY_WORKER_CLAIM_LEASE_READY = (
+    OBSERVATORY_WORKER_API_GATE_ENABLED
+    and OBSERVATORY_RECORDED_JOB_QUEUE is not None
+)
+OBSERVATORY_WORKER_VERIFIED_RESULT_PUBLISHER_READY = (
+    OBSERVATORY_WORKER_API_GATE_ENABLED
+    and OBSERVATORY_PORTABLE_WORKER_INTEGRATION is not None
 )
 OBSERVATORY_WORKER_DISPATCH_READY = (
-    OBSERVATORY_WORKER_PRODUCTION_API_ENABLED
-    and OBSERVATORY_WORKER_CLAIM_LEASE_READY
+    OBSERVATORY_WORKER_CLAIM_LEASE_READY
     and OBSERVATORY_WORKER_VERIFIED_RESULT_PUBLISHER_READY
     and OBSERVATORY_RECORDED_JOB_QUEUE is not None
     and OBSERVATORY_WORKER_AUTHENTICATION is not None
     and OBSERVATORY_PORTABLE_WORKER_INTEGRATION is not None
 )
+if OBSERVATORY_WORKER_DISPATCH_READY:
+    OBSERVATORY_WORKER_API_ERROR = None
+else:
+    worker_api_errors: list[str] = []
+    if not OBSERVATORY_WORKER_API_GATE_ENABLED:
+        worker_api_errors.append(
+            OBSERVATORY_WORKER_LOCAL_ENABLED_ERROR
+            or (
+                "local-only Worker API gate is disabled; set "
+                f"{OBSERVATORY_WORKER_LOCAL_ENABLED_ENV}=1 to enable it"
+            )
+        )
+    if OBSERVATORY_WORKER_AUTHENTICATION_ERROR is not None:
+        worker_api_errors.append(
+            "authentication unavailable: "
+            f"{OBSERVATORY_WORKER_AUTHENTICATION_ERROR}"
+        )
+    if OBSERVATORY_PORTABLE_WORKER_INTEGRATION_ERROR is not None:
+        worker_api_errors.append(
+            "integration unavailable: "
+            f"{OBSERVATORY_PORTABLE_WORKER_INTEGRATION_ERROR}"
+        )
+    OBSERVATORY_WORKER_API_ERROR = "Worker pull API is disabled; " + "; ".join(
+        worker_api_errors
+    )
 OBSERVATORY_PORTABLE_BINDING_SERVICE: PortableRecordedQueueBindingService | None
 OBSERVATORY_PORTABLE_SETUP_PROJECTOR: PortableSetupProjector | None
 OBSERVATORY_PORTABLE_SETUP_PROJECTOR_ERROR: str | None