App 下架或停止维护时，加固产物、签名身份与交付证据怎样收尾

import json
import sys
from pathlib import Path

REQUIRED_STEPS = {
    'channels',
    'final_candidate',
    'signing_control',
    'update_path',
    'user_migration',
    'evidence_handoff',
    'access_offboarding',
    'final_approval',
}
SENSITIVE_FIELDS = {'privateKey', 'token', 'userData', 'password'}
ALLOWED_STATUS = {'planned', 'blocked', 'hold', 'completed'}

if len(sys.argv) != 2:
    raise SystemExit('usage: validate_decommission.py closeout.json')
input_path = Path(sys.argv[1])
if not input_path.is_file():
    raise SystemExit('closeout file is missing')
data = json.loads(input_path.read_text(encoding='utf-8'))
steps = data.get('steps')
if not isinstance(steps, list) or not steps:
    raise SystemExit('steps array is missing')
records = {}
for index, step in enumerate(steps):
    if not isinstance(step, dict):
        raise SystemExit(f'step {index} is not an object')
    leaked = SENSITIVE_FIELDS.intersection(step)
    if leaked:
        raise SystemExit(f'step {index} contains sensitive fields: {sorted(leaked)}')
    required = {'id', 'owner', 'status', 'evidenceRef', 'dependsOn'}
    if not required.issubset(step):
        raise SystemExit(f'step {index} is missing required fields')
    step_id = str(step['id']).strip()
    if not step_id or step_id in records:
        raise SystemExit(f'step {index} has an invalid or duplicate id')
    if step['status'] not in ALLOWED_STATUS:
        raise SystemExit(f'step {step_id} has an invalid status')
    if not str(step['owner']).strip():
        raise SystemExit(f'step {step_id} has no owner')
    if not isinstance(step['dependsOn'], list):
        raise SystemExit(f'step {step_id} has invalid dependencies')
    records[step_id] = step
missing = sorted(REQUIRED_STEPS - records.keys())
if missing:
    raise SystemExit(f'closeout lacks required steps: {missing}')
for step_id, step in records.items():
    unknown = sorted(set(step['dependsOn']) - records.keys())
    if unknown:
        raise SystemExit(f'step {step_id} has unknown dependencies: {unknown}')
    if step['status'] == 'completed':
        incomplete = [item for item in step['dependsOn'] if records[item]['status'] != 'completed']
        if incomplete:
            raise SystemExit(f'step {step_id} completed before dependencies: {incomplete}')
    if step['status'] == 'completed' and not str(step['evidenceRef']).strip():
        raise SystemExit(f'step {step_id} completed without evidence')
delete_request = data.get('deleteRequest')
if delete_request is not None:
    if not isinstance(delete_request, dict):
        raise SystemExit('deleteRequest is not an object')
    if delete_request.get('activeHolds'):
        raise SystemExit('deletion is blocked by active holds')
    if not str(delete_request.get('deletionApprovedBy', '')).strip():
        raise SystemExit('deletion has no approver')
print(json.dumps({'steps': len(records), 'requiredComplete': True, 'status': 'pass'}))