[AAP-86051] Wire DAB validation bypass observability for Controller

Register ORM bypass signals and AWX caller prefixes at startup, and audit
bulk host create before bulk_create.

Co-authored-by: Cursor <cursoragent@cursor.com>

awx/api/serializers.py

@@ -44,6 +44,7 @@ from polymorphic.models import PolymorphicModel
 
 # django-ansible-base
 from ansible_base.lib.serializers.mixins import CleanTextMixin
+from ansible_base.lib.utils.bulk_validation_audit import audit_bulk_model_instances
 from ansible_base.lib.utils.models import get_type_for_model
 from ansible_base.lib.utils.settings import get_setting
 from ansible_base.lib.utils.validation import DEFAULT_NAME_FIELDS
@@ -2277,6 +2278,7 @@ class BulkHostCreateSerializer(serializers.Serializer):
         old_total_hosts = validated_data['inventory'].total_hosts
         result = [Host(**attrs) for attrs in validated_data['hosts']]
         try:
+            audit_bulk_model_instances(result, operation='bulk_create')
             Host.objects.bulk_create(result)
         except Exception as e:
             raise serializers.ValidationError({"detail": _(f"cannot create host, host creation error {e}")})

awx/main/apps.py

@@ -67,4 +67,9 @@ class MainConfig(AppConfig):
 
         self.configure_dispatcherd()
         self.load_named_url_feature()
+        from awx.main.utils.validation_bypass_observability import configure_validation_bypass_observability
+
+        configure_validation_bypass_observability()
+        import awx.api.serializers  # noqa: F401 — register CleanTextMixin models for ORM bypass signal
+
         pre_migrate.connect(self.check_db_requirement, sender=self)

awx/main/utils/validation_bypass_observability.py

@@ -0,0 +1,28 @@
+"""Register django-ansible-base ORM bypass caller attribution for AWX."""
+
+from ansible_base.lib.utils.validation_signals import (
+    extend_caller_allowlist_prefixes,
+    extend_internal_caller_prefixes,
+    register_validation_signals,
+)
+
+
+def configure_validation_bypass_observability() -> None:
+    """Call from AppConfig.ready() so ORM bypass logs show AWX entry points."""
+    register_validation_signals()
+    extend_caller_allowlist_prefixes(
+        [
+            "awx.api.views",
+            "awx.api.serializers",
+            "awx.main.tasks",
+            "awx.main.management",
+            "awx.main.utils",
+        ]
+    )
+    extend_internal_caller_prefixes(
+        [
+            "awx.main.models",
+            "awx.main.signals",
+            "awx.main.dispatch",
+        ]
+    )