From 069d93b23a0d60a4b4c3b31a2ed87e7ded1bb1f0 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 14 Jun 2026 20:08:53 +0800 Subject: [PATCH] =?UTF-8?q?docs(security):=20=E6=96=B0=E5=A2=9E=20Monitori?= =?UTF-8?q?ng=20owner=20request=20draft=20[skip=20ci]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/LOGBOOK.md | 29 + .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 4 +- .../IWOOOS-CONFIG-CONTROL-INVENTORY.md | 13 +- ...TORING-ALERTING-OBSERVABILITY-INVENTORY.md | 3 + .../MONITORING-OWNER-REQUEST-DRAFT.md | 127 + .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 2 + ...nitoring-owner-request-draft.snapshot.json | 8463 +++++++++++++++++ ...-04-15-MASTER-ai-autonomous-flywheel-v2.md | 15 + ...026-06-04-iwooos-security-governance-p0.md | 3 + .../monitoring-owner-request-draft.py | 329 + .../security-mirror-progress-guard.py | 156 + 11 files changed, 9138 insertions(+), 6 deletions(-) create mode 100644 docs/security/MONITORING-OWNER-REQUEST-DRAFT.md create mode 100644 docs/security/monitoring-owner-request-draft.snapshot.json create mode 100644 scripts/security/monitoring-owner-request-draft.py diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 1054adeb6..8b4533290 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,32 @@ +## 2026-06-14｜Monitoring / Alerting / Observability owner request draft 本地完成 + +**背景**：Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 都會影響告警可用性、通知噪音與 incident 判讀。既有 repo-only 清冊已納入 60 個 surface；本段先建立 owner request draft，要求 owner 提供脫敏 live config hash、receiver diff、route smoke plan、noise budget、maintenance window、rollback owner 與 validation plan，不執行任何 reload / deploy / notification。 + +**完成項目**： +- 新增 `scripts/security/monitoring-owner-request-draft.py`，從 `monitoring-alerting-observability-inventory.snapshot.json` 產生 metadata-only owner request draft。 +- 新增 `docs/security/monitoring-owner-request-draft.snapshot.json`，固定 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=24`。 +- 新增 `docs/security/MONITORING-OWNER-REQUEST-DRAFT.md`，說明 request draft 類型、owner 必填欄位、blocked actions、完成度與 0 / false 邊界。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、request ids、blocked actions 與每份草稿 false flags。 +- `MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md`、`HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md`、`IWOOOS-CONFIG-CONTROL-INVENTORY.md`、`SECURITY-SUPPLY-CHAIN-PROGRESS.md`、P0 主控板與 MASTER 已同步。 + +**本地驗證**： +- `python3 -m json.tool docs/security/monitoring-owner-request-draft.snapshot.json` 通過。 +- `python3 -m json.tool docs/security/monitoring-alerting-observability-inventory.snapshot.json` 通過。 +- `python3 -m py_compile scripts/security/monitoring-owner-request-draft.py scripts/security/monitoring-alerting-observability-inventory.py scripts/security/security-mirror-progress-guard.py` 通過。 +- 產生器 smoke：`MONITORING_OWNER_REQUEST_DRAFT_OK drafts=60 write_capable=11 fields=14 sent=0 runtime_gate=0`。 +- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。 +- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。 +- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=832`。 +- `git diff --check` 通過。 +- diff-only 新增行工作溝通片語掃描通過；未加入工作溝通原文、委派 XML、內嵌瀏覽器上下文或內部抱怨內容。 +- Snapshot assertion 通過：`MONITORING_OWNER_REQUEST_DRAFT_ASSERTIONS_OK drafts=60 write_capable=11 fields=14 sent=0 runtime_gate=0`。 + +**完成度與邊界**： +- Monitoring / Alerting / Observability owner request draft artifact：`100%`。 +- Monitoring / alerting 類別成熟度：維持 `62%`，因為尚未收到 owner response 或 live evidence。 +- Production browser verification：不適用；本輪只改 repo 內文件、snapshot、guard 與產生器，不變更前端 bundle 或 runtime。 +- request sent、recipient confirmed、owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana dashboard apply、SigNoz rule apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、notification route change、webhook receiver change、remote write change、exporter deploy、live alert fire、alert chain smoke、SSH、kubectl、secret collection、host write、active scan、runtime gate、action buttons、production write 全部維持 `0 / false`。 + ## 2026-06-14｜Backup / Restore / Escrow owner request draft 本地完成 **背景**：配置亂動後能否安全恢復，取決於備份、還原、offsite、credential escrow、retention 與 DR runbook 是否被同一套資安流程控管。既有 repo-only 清冊已納入 38 個 surface；本段先建立 owner request draft，要求 owner 提供非敏感 evidence id、最新備份狀態、restore drill plan、maintenance window、rollback owner 與 validation plan，不執行任何 backup / restore。 diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index 8695ee5de..fda164d55 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -56,7 +56,7 @@ | P1-1 | Docker Compose / systemd / host service config | `50%` | repo-only 清冊已納入 9 個 surface，owner request draft 已轉成 9 份草稿；仍缺 owner response、110 / 188 live hash、restart window、rollback owner 與 post-check 指標 | | P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `54%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner request draft 已轉成 16 份草稿；仍缺 owner response、live access state、allowed source CIDR、maintenance window、rollback owner 與 validation plan | | P1-3 | Backup / restore / escrow / retention | `58%` | repo-only 清冊已納入 38 個 surface，owner request draft 已轉成 38 份草稿；仍缺 owner response、restore drill approval package、offsite / escrow owner、retention owner、rollback owner 與 no-secret-value evidence | -| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof | +| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface，owner request draft 已轉成 60 份草稿；仍缺 owner response、live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof | ## 4. 固定 0 / false 邊界 @@ -173,6 +173,8 @@ python3 scripts/security/high-value-config-control-coverage.py \ `monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入 repo-only 清冊，共 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface。此更新只讓 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`。 +2026-06-14 再新增 `monitoring_owner_request_draft_v1`，把 60 個 surface 轉成 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`required_owner_field_count=14`、`blocked_action_count=24` 的人工送件前草稿。此更新仍不調高類別成熟度，因為 request sent、owner response received / accepted、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke、runtime gate 與 action button 仍全部為 `0`。 + ## 12. P0 Public Gateway Preflight 清冊更新 `public_gateway_preflight_inventory_v1` 已把 Nginx public gateway reload / route change 前置 Gate 固定成只讀清冊，共 `3` 份 source config、`14` 個 route impact、`14` 個 unique upstream、`12` 個 preflight gate，其中 `2` 個 gate 只代表 repo-only ready，`10` 個 gate 仍需 owner acceptance。此更新只讓 `nginx_public_gateway` 從 `78%` 推進到 `84%`；owner response、owner-provided live conf、rendered diff、`nginx -t` evidence、route smoke、maintenance window、rollback owner、runtime gate 與 action button 仍全部為 `0`。 diff --git a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md index 28d809e24..9d9bc1d1d 100644 --- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md +++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md @@ -69,6 +69,8 @@ 此更新仍不是 live alert chain truth：owner response、live evidence、reload owner、receiver owner、route smoke、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 Prometheus reload、Alertmanager reload、Grafana import、SigNoz rule apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH 或 kubectl。 +2026-06-14 已新增 `monitoring_owner_request_draft_v1`，把 60 個 monitoring / alerting / observability surface 轉成人工送件前 owner request draft。固定 `drafts=60`、`write_capable=11`、`live_evidence_required=60`、`owner_fields=14`、`blocked_actions=24`，但 request sent、owner response received / accepted、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke、host write、runtime gate 仍全部為 `0 / false`。 + ### 0.6 2026-06-12 Public Gateway Preflight repo-only 清冊 `public_gateway_preflight_inventory_v1` 已把 Nginx public gateway reload / route change 前置 Gate 固定成只讀 snapshot。清冊目前共有 `3` 份 Nginx source config、`2` 份 C0 source config、`14` 個 route impact、`14` 個 unique upstream、`10` 條 TLS certificate path、`4` 個 certificate owner 確認缺口、`7` 個 ACME challenge domain、`1` 個 admin route domain、`6` 個 WebSocket route domain 與 `12` 個 preflight gate，讓 Nginx public gateway 類別成熟度從 `78%` 推進到 `84%`。 @@ -137,8 +139,8 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | P0 | Public admin / API route config | Nginx templates、`apps/web/src/lib/config.ts`、`apps/api/src/core/config.py` | Product owner + runtime owner | auth boundary、CORS、public URL、admin path smoke、frontend internal IP ban | | P0 | Backup / restore credential | `scripts/backup/*`、`k8s/velero/*`、DR runbooks、`docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md`、`docs/security/BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md` | MinIO / restic / offsite escrow | owner request draft 已固定；credential value absent、restore drill gate、offsite owner、escrow owner、retention policy、rollback owner | | P0 | agent-bounty-protocol treasury / MCP / A2A | `docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md` | agent-bounty owner response | no payout / claim / submit / daemon / webhook until explicit runtime approval | -| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 monitoring stack | repo-only 清冊、rule diff、receiver diff、reload gate、failure-only notification policy | -| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window | +| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md`、`docs/security/MONITORING-OWNER-REQUEST-DRAFT.md` | 110 monitoring stack | repo-only 清冊與 owner request draft 已固定；仍缺 rule diff、receiver diff、reload owner、receipt proof 與 live evidence | +| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md`、`docs/security/MONITORING-OWNER-REQUEST-DRAFT.md` | 110 compose / public gateway | owner request draft 已固定；仍缺 admin secret owner、public route proof、backup owner、smoke plan、upgrade window 與 rollback owner | | P1 | Harbor / registry | Nginx templates、backup scripts、CD workflows | 110 Harbor / registry domains | robot account owner、image tag immutability、scan policy、TLS | | P1 | PostgreSQL / Redis / MinIO | app config、backup scripts、monitoring config | 188 / 110 / K3s | no plaintext DSN, access boundary, backup, restore, metrics auth | | P1 | Docker Compose / systemd | `docker-compose.yml`、`ops/*/docker-compose.yml`、`scripts/reboot-recovery/*.service` | 110 / 188 / agent-bounty hosts | port / volume / env diff、restart window、rollback owner | @@ -193,6 +195,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | 全域配置覆蓋矩陣 | `100%` | 已新增 `scripts/security/high-value-config-control-coverage.py`、snapshot 與 schema，14 類高價值配置可重跑檢查 | | Backup / restore / escrow 清冊 | `100%` | 已新增 `backup_restore_escrow_inventory_v1`，納入 38 個 repo-only surface；成熟度 `52% -> 58%` | | Monitoring / alerting / observability 清冊 | `100%` | 已新增 `monitoring_alerting_observability_inventory_v1`，納入 60 個 repo-only surface；成熟度 `56% -> 62%` | +| Monitoring / alerting / observability owner request draft | `100%` | 已將 60 個 monitoring surface 轉成 owner request draft；request sent / received / accepted、reload、receiver route change、Telegram send、alert chain smoke 仍為 0 | | owner packet 前台只讀接入 | `100%` | `/zh-TW/iwooos` 已顯示高價值配置 owner packet 草案、C0/C1 packet 數、request / received / accepted 仍為 0 與禁止執行邊界 | | owner response request / received / accepted | `0%` | Packet 只是草案；尚未送件、尚未收件、尚未 reviewer accepted | | Docker / systemd owner request draft | `100%` | 已將 9 個 host service surface 轉成 owner request draft；request sent / received / accepted 仍為 0 | @@ -215,9 +218,9 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 6. P1：向 owner 收 110 / 188 Docker Compose 與 systemd 脫敏 live hash、restart window、rollback owner 與 post-check 指標；不主動 SSH、不重啟、不跑 repair-bot。 7. P1：向 owner 收 SSH / firewall / WireGuard / NodePort 脫敏 live access state、allowed source CIDR、maintenance window、rollback owner 與 validation plan；不主動 keyscan、不改 firewall、不開關端口。 8. P1：向 owner 收 backup / restore / offsite / escrow 非敏感 evidence id、最新備份狀態、restore drill plan、maintenance window、rollback owner 與 validation plan；驗收前 backup run、restore drill、offsite sync、remote delete、escrow marker write、retention change 全部維持 `0 / false`。 -8. P1：把 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse owner response packet 接入 AwoooP 只讀狀態；驗收前 reload、receiver route change、silence change、Telegram send 與 alert chain smoke 全部維持 `0 / false`。 -9. P1：補 Kali 112、111、168 維護窗口 owner 欄位，仍不做 upgrade / restart / scan。 -10. P2：持續精簡 `/zh-TW/iwooos` 配置控管摘要，但不得顯示內部工作對話、token、secret 或可執行按鈕。 +9. P1：把 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse owner request draft 接入 AwoooP 只讀狀態；驗收前 reload、receiver route change、silence change、Telegram send 與 alert chain smoke 全部維持 `0 / false`。 +10. P1：補 Kali 112、111、168 維護窗口 owner 欄位，仍不做 upgrade / restart / scan。 +11. P2：持續精簡 `/zh-TW/iwooos` 配置控管摘要，但不得顯示內部工作對話、token、secret 或可執行按鈕。 ## 8. 邊界 diff --git a/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md b/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md index 4ce3ac96d..b64ff2f68 100644 --- a/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md +++ b/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md @@ -15,6 +15,8 @@ 本階段仍是 repo-only source inventory：只讀已提交檔案、計算 SHA256、整理 owner gate 與 live evidence 缺口。不連 live Prometheus、不 reload Alertmanager、不改 Grafana、不套用 SigNoz rule、不部署 Sentry、不發 Telegram、不建立 silence、不 SSH、不 kubectl、不讀 secret value。 +2026-06-14 已新增 `docs/security/MONITORING-OWNER-REQUEST-DRAFT.md` 與 `docs/security/monitoring-owner-request-draft.snapshot.json`，將 60 個 surface 轉成 owner request draft。此更新只代表人工送件前欄位包已完成；request sent、owner response received / accepted、live evidence、reload、receiver route change、Telegram send、alert chain smoke、runtime gate 與 action button 仍全部為 `0 / false`。 + ## 2. 覆蓋摘要 | 指標 | 目前值 | 說明 | @@ -103,6 +105,7 @@ action_buttons_allowed=false | P1-4 repo-only surface 註冊 | `100%` | `60` 個 surface 已納入 snapshot | | source existence / SHA256 | `100%` | `60 / 60` source path 存在 | | monitoring / alerting 高價值配置成熟度 | `56% -> 62%` | 只代表清冊與 guard 準備度 | +| owner request draft artifact | `100%` | `60` 份 request draft 已完成；不代表已送件或已授權 | | owner response 收件 / 接受 | `0%` | 尚未收到或接受任何 owner response | | live evidence collection | `0%` | 未讀 live monitoring stack | | reload / receiver / route smoke gate | `0%` | 未授權、未執行 | diff --git a/docs/security/MONITORING-OWNER-REQUEST-DRAFT.md b/docs/security/MONITORING-OWNER-REQUEST-DRAFT.md new file mode 100644 index 000000000..8a6fe1492 --- /dev/null +++ b/docs/security/MONITORING-OWNER-REQUEST-DRAFT.md @@ -0,0 +1,127 @@ +# IwoooS Monitoring / Alerting / Observability owner request draft + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-14 | +| 狀態 | `owner_request_draft_ready_not_dispatched` | +| 工具 | `scripts/security/monitoring-owner-request-draft.py` | +| Snapshot | `docs/security/monitoring-owner-request-draft.snapshot.json` | +| Source inventory | `docs/security/monitoring-alerting-observability-inventory.snapshot.json` | +| runtime gate | `0` | + +## 1. 目的 + +本文件把 Monitoring / Alerting / Observability repo-only 清冊中的 60 個 surface 轉成人工送件前 owner request draft，讓 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload script 與 alert chain smoke script 都有一致的 owner 回覆欄位。 + +本階段仍是 metadata-only request draft：不連 live Prometheus、不 reload Alertmanager、不套用 Grafana / SigNoz、不部署 Sentry、不改 Langfuse、不 reload OTEL、不改 receiver route、不建立 silence、不送 Telegram、不 fire live alert、不跑 alert chain smoke、不 SSH、不 kubectl、不讀 secret value、不寫 production。 + +## 2. 摘要 + +| 指標 | 目前值 | 說明 | +|------|--------|------| +| request draft | `60` | 全部由 committed monitoring inventory surface 轉換 | +| write-capable request draft | `11` | 可能 reload、deploy、send notification、fire alert 或 restart exporter 的 surface | +| live evidence required request | `60` | 每份 request 都需要 owner 提供脫敏 live evidence ref | +| request field | `24` | 每份草稿固定欄位數 | +| required owner field | `14` | owner 必須補齊的欄位數 | +| blocked action | `24` | 驗收前全部禁止 | +| request sent / recipient confirmed | `0 / 0` | 尚未送件，收件人也未確認 | +| owner response received / accepted | `0 / 0` | 不得假性拉高 | +| live evidence received | `0` | 未收到 live config hash、receiver diff 或 route smoke proof | +| reload / receiver / route smoke accepted | `0 / 0 / 0` | 未授權 reload、receiver route change 或 live smoke | +| runtime gate / action button | `0 / 0` | 不開任何執行入口 | + +## 3. Request Draft 類型 + +| 類型 | 範圍 | 目前邊界 | +|------|------|----------| +| Prometheus config / rules | base config、remote write、generated target、service registry、alert rules、drift guard | 只收 owner ref；不 reload、不 remote write change | +| Alertmanager receiver | route、receiver、grouping source | 只收 receiver owner / diff ref；不改 receiver、不 reload | +| Grafana dashboard / rules | dashboard JSON、alert rule | 只收 dashboard owner / rollback ref；不 import、不 apply | +| SigNoz / OTEL | alert rule、log rule、API client、collector config | 只收 pipeline owner / data export boundary；不 apply、不 reload | +| Sentry / Langfuse | compose、deploy、webhook receiver、API client、runbook | 只收 live hash / upgrade window；不 deploy、不 restart | +| Telegram / notification | gateway service、failure-only policy、notification matrix、recurrence notifier | 只收 receiver / receipt / noise budget owner；不送訊息 | +| deploy / reload scripts | Alertmanager、Prometheus、Sentry、exporter deploy 或 reload-capable script | 只建立 request draft；不執行腳本 | +| alert smoke | live alert、test alert、alert chain smoke | 只收 allowed receiver、execution window、cleanup owner；不 fire alert | + +## 4. Owner 必填欄位 + +| 欄位 | 說明 | +|------|------| +| `owner_role_or_team` | 負責角色或團隊 | +| `decision` | owner 對此 surface 的判定 | +| `decision_reason` | 決策理由摘要，不得包含機敏值 | +| `affected_scope` | 受影響的 monitoring / notification / product scope | +| `redacted_evidence_refs` | 脫敏 evidence id、文件路徑、ticket id 或 hash | +| `live_config_hash_ref` | 脫敏 live config hash 或 owner-provided ref | +| `reload_owner` | reload / deploy decision owner | +| `receiver_owner` | receiver / route / receipt owner | +| `route_smoke_plan` | route smoke 或 receipt proof 計畫 | +| `maintenance_window` | 維護窗口或禁止窗口 | +| `rollback_owner` | rollback 負責人與 rollback ref | +| `validation_plan` | 驗證與 post-check plan | +| `noise_budget_owner` | 告警噪音、silence、dedup 與測試通知負責人 | +| `followup_owner` | 後續補件或決策負責人 | + +## 5. 禁止動作 + +```text +prometheus_reload +alertmanager_reload +grafana_dashboard_apply +signoz_rule_apply +sentry_deploy +langfuse_config_change +otel_collector_reload +receiver_route_change +silence_policy_change +telegram_send +notification_route_change +webhook_receiver_change +remote_write_change +exporter_deploy +live_alert_fire +alert_chain_smoke +ssh_read +ssh_write +kubectl_action +secret_value_collection +host_write +active_scan +production_write +runtime_gate_open +``` + +## 6. 指令 + +固定 committed snapshot 時間： + +```bash +python3 scripts/security/monitoring-owner-request-draft.py \ + --root . \ + --inventory-report docs/security/monitoring-alerting-observability-inventory.snapshot.json \ + --output docs/security/monitoring-owner-request-draft.snapshot.json \ + --generated-at 2026-06-14T23:25:00+08:00 +``` + +只讀 guard： + +```bash +python3 scripts/security/security-mirror-progress-guard.py --root . +python3 scripts/security/source-control-owner-response-guard.py --root . +``` + +## 7. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| owner request draft artifact | `100%` | 60 份 request draft 已由 committed inventory 產生 | +| request dispatch | `0%` | 尚未送件，recipient 未確認 | +| owner response received / accepted | `0%` | 尚未收到或接受任何 owner response | +| live evidence collection | `0%` | 未讀 live monitoring stack | +| reload / receiver / route smoke acceptance | `0%` | 未授權、未執行 | +| runtime / production write | `0%` | 無 action button，無 production write | + +## 8. 邊界 + +這份 owner request draft 不是資安批准、不是 runtime approval、不是 alert chain smoke proof，也不是 live monitoring truth。不得把 request draft、snapshot、IwoooS UI、AwoooP approval、LOGBOOK 或 committed source visibility 解讀成 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、SSH、kubectl、active scan、secret collection、host write 或 production write 授權。 diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index c58795701..de251480e 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -8,6 +8,7 @@ | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | | P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；Public Gateway live conf 匯出請求包已新增 `requests=3 / c0=2 / redaction_rules=8 / received=0`；Public Gateway redacted export 收件預檢已新增 `candidates=3 / c0=2 / checks=10 / rejection_guards=12 / received=0 / accepted=0`；Public Gateway rendered diff / nginx gate 草稿已新增 `candidates=3 / c0=2 / stages=7 / blocked=14 / rendered_diff=0 / runtime=0`；DNS / TLS / certbot Owner Confirmation Request 已新增 `requests=4 / c0=4 / fields=9 / questions=5 / guards=12 / received=0 / accepted=0`；K8s / ArgoCD manifest repo-only 清冊已新增 `files=49 / c0=36 / yaml=45 / kinds=20 / blocked=13 / runtime=0`；K8s / ArgoCD Owner Request Draft 已新增 `drafts=4 / c0=3 / fields=11 / sent=0 / runtime=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | +| P1 追加 | Docker / systemd / Host Service Owner Request Draft 已新增 `drafts=9 / write_capable=3 / fields=12 / blocked=14 / sent=0 / runtime=0`；SSH / Firewall / Network Access Owner Request Draft 已新增 `drafts=16 / write_capable=6 / fields=13 / blocked=16 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Request Draft 已新增 `drafts=38 / write_capable=27 / fields=14 / blocked=18 / sent=0 / runtime=0`；Monitoring / Alerting / Observability Owner Request Draft 已新增 `drafts=60 / write_capable=11 / fields=14 / blocked=24 / sent=0 / runtime=0`；上述全部仍是人工送件前草稿，不是 owner response、live evidence、reload、restart、backup、restore、Telegram send、alert smoke、host write 或 runtime gate | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | @@ -398,6 +399,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons | Docker / systemd / Host Service Owner Request Draft | 本地完成 | `host-service-owner-request-draft.snapshot.json` 已固定 `request_draft_count=9`、`write_capable_request_draft_count=3`、`live_evidence_required_request_count=8`、`request_field_count=22`、`required_owner_field_count=12`、`blocked_action_count=14`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 Docker Compose、systemd / repair-bot、Ansible role 與 host config backup 的人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、Docker Compose action、systemctl action、repair-bot execution、Ansible apply、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | SSH / Firewall / Network Access Owner Request Draft | 本地完成 | `ssh-network-owner-request-draft.snapshot.json` 已固定 `request_draft_count=16`、`write_capable_request_draft_count=6`、`live_evidence_required_request_count=16`、`request_field_count=23`、`required_owner_field_count=13`、`blocked_action_count=16`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 SSH target、known_hosts、CI deploy SSH、monitoring SSH、backup SSH、sudoers、NetworkPolicy、NodePort、WireGuard 與 alert SSH action 的人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | Backup / Restore / Escrow Owner Request Draft | 本地完成 | `backup-restore-owner-request-draft.snapshot.json` 已固定 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=18`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook 的人工送件前 request draft，不是 request sent、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | +| Monitoring / Alerting / Observability Owner Request Draft | 本地完成 | `monitoring-owner-request-draft.snapshot.json` 已固定 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=24`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke 的人工送件前 request draft，不是 request sent、owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate | | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item | | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 | diff --git a/docs/security/monitoring-owner-request-draft.snapshot.json b/docs/security/monitoring-owner-request-draft.snapshot.json new file mode 100644 index 000000000..9b8be9b2e --- /dev/null +++ b/docs/security/monitoring-owner-request-draft.snapshot.json @@ -0,0 +1,8463 @@ +{ + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "execution_boundaries": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "exporter_deploy_authorized": false, + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_evidence_received": false, + "not_authorization": true, + "notification_route_change_authorized": false, + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "remote_write_change_authorized": false, + "request_sent": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "telegram_send_authorized": false, + "webhook_receiver_change_authorized": false + }, + "generated_at": "2026-06-14T23:25:00+08:00", + "git_commit": "d7b71ddc", + "next_steps": [ + "人工送件前確認 monitoring / alerting / notification owner role 與回覆窗口。", + "owner 只能提供脫敏 live config hash、receiver diff、route smoke plan、noise budget、maintenance window 與 rollback owner。", + "收到回覆後先做欄位完整性、敏感 payload 隔離、reload / receiver / route smoke gate 檢查，不得直接 reload、send Telegram 或 fire alert。" + ], + "request_drafts": [ + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "k8s_monitoring_prometheus_base", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "K8s Prometheus base config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "scrape config", + "service discovery", + "alert rule includes" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "5ea5ec736686dabb05bff0691dd45196eae4d2ab645c14b3f812748186ad6da9", + "repo_source_path": "k8s/monitoring/prometheus.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_k8s_base_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 208, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_k8s_base_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "k8s_monitoring_prometheus_additions", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "K8s Prometheus additions", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "supplemental scrape", + "additional rule paths" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "67bd6ef7b9da39fd4decb5254dc9bea1980f54fcd162f8468ac98f49258a39b4", + "repo_source_path": "k8s/monitoring/prometheus-config-additions.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_k8s_additions_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 112, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_k8s_additions_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "phase_o_prometheus_config", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Prometheus Phase O config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Phase O monitoring", + "baseline scrape" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "7bdb94a23f6f14912c89655e5313fb745a772286671647db32d7ee2f07b50d9d", + "repo_source_path": "k8s/monitoring/prometheus-config-phase-o.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_phase_o_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 83, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_phase_o_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_remote_write", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "prometheus_remote_write_signoz", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Prometheus remote write to SigNoz", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "remote write", + "SigNoz ingestion", + "data export boundary" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "da6ae1ef0be420b07fc0f56861e548d049ec53fd0f601ee913797304315fbcc7", + "repo_source_path": "k8s/monitoring/prometheus-remote-write-signoz.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_remote_write_signoz", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 89, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_remote_write_signoz", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "generated_scrape_targets", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Generated Prometheus scrape config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "generated targets", + "service registry" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "6c1fb1ef0b672e016584a26b3dd1c1fb62904d9a4d26ec30e35f5493e23b0f9b", + "repo_source_path": "ops/monitoring/generated/prometheus-scrape-generated.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_generated_scrape_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 192, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_generated_scrape_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "generated_blackbox_targets", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Generated blackbox targets", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "blackbox targets", + "public route smoke candidates" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "e375aec2fe6b602157de4d187d66c8a4b0dc237c1ba2ae8c9ad3f598f4730e79", + "repo_source_path": "ops/monitoring/generated/blackbox-targets-generated.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_generated_blackbox_targets", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 110, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_generated_blackbox_targets", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "monitoring_service_registry", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "monitoring_service_registry", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Monitoring service registry", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "service registry", + "target generation" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "e01aa01299381506ac901229ab3154329c978358d40882618cfbaa134c007418", + "repo_source_path": "ops/monitoring/service-registry.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:monitoring_service_registry", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 830, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "monitoring_service_registry", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "exporter_query_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "postgres_exporter_queries", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Postgres exporter query config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "PostgreSQL metrics", + "custom exporter queries" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "50102b017c91d24c1dcae79779b4da39ce44628a2bd89250f5145411f0ac6f21", + "repo_source_path": "ops/monitoring/postgres-exporter-queries.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:postgres_exporter_queries", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 215, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "postgres_exporter_queries", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "192.168.0.110_monitoring_stack", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "110 monitoring compose", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Prometheus", + "Grafana", + "Alertmanager", + "blackbox", + "cadvisor" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "00126e9a5cb7a3cf2bf02cfddefea11f05849b46835a4e602eac4777fcb25281", + "repo_source_path": "k8s/monitoring/docker-compose-110.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:monitoring_110_compose", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 148, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "monitoring_110_compose", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "192.168.0.188_exporters", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "188 monitoring exporters compose", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "postgres-exporter", + "redis-exporter" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "3ffb3bd2e98091d18e60b74721904777c27f279c37ab6e873b82e6ef73eb87d4", + "repo_source_path": "ops/monitoring/docker-compose.exporters.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:monitoring_exporters_compose", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 69, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "monitoring_exporters_compose", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "alertmanager_receiver_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "alertmanager_routes_receivers", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Alertmanager receiver config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "routes", + "receivers", + "grouping", + "Telegram / webhook receiver boundary" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "7ee436fbe114bd2fffa616d8d87c42dd0cc7f59151dc03ab09258dfa83a1de86", + "repo_source_path": "ops/alertmanager/alertmanager.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:alertmanager_receiver_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 146, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "alertmanager_receiver_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ops_prometheus_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Ops Prometheus alerts", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "infrastructure alerts", + "backup alerts", + "route alerts" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "94d439a2ea599995601a5022dc0a001cc09f405964cd1308b103f86e2af14e90", + "repo_source_path": "ops/monitoring/alerts.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_alerts_ops", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 1355, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_alerts_ops", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "unified_prometheus_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Unified Prometheus alerts", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "unified alerts", + "routing labels" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "97b5be44a5af982c8013323d353c67748f87a7336d22a7c8270d7d6a1546bf45", + "repo_source_path": "ops/monitoring/alerts-unified.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_alerts_unified", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 2031, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_alerts_unified", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "prometheus_slo_rules", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Prometheus SLO rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "SLO burn rate", + "availability indicators" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "31b7cbe0af22c5ad2320cf23fd06cce73a93194acff0e1d4045ed0acb7b3b3bd", + "repo_source_path": "ops/monitoring/slo-rules.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_slo_rules", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 257, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_slo_rules", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ollama_health_rules", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Ollama health alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Ollama health", + "AI provider availability" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "9f994c654d8a8c6c7d570fec0ba0418f8d4cc7fe4e4a83cb1bb80988a3cd0b55", + "repo_source_path": "ops/monitoring/ollama_health_rules.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_ollama_health_rules", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 149, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_ollama_health_rules", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "k3s_cluster_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "K3s alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "K3s workloads", + "cluster health" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "be1a4e796f6f6363566898ffd07ac37a938255b895cde11743fe0770d9946663", + "repo_source_path": "k8s/monitoring/k3s-alerts.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_k3s_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 203, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_k3s_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "k3s_supplemental_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "K3s supplemental alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "K3s supplemental health", + "gap alerts" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "14fd4f8c7deaf22c6828ffbf66400e6d0e274f03db1999197af26311bdb6d203", + "repo_source_path": "k8s/monitoring/k3s-alerts-supplemental.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_k3s_supplemental_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 290, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_k3s_supplemental_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "database_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Database alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "PostgreSQL", + "Redis", + "DB availability" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "6077aa4e061c6604519eaede01144ffec46c39a6715a296a1ae54ff5484a0111", + "repo_source_path": "k8s/monitoring/database-alerts.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_database_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 264, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_database_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "nvidia_gpu_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "NVIDIA alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "GPU health", + "AI workload capacity" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "c43a6413269dadc8269b9724ee905650f39926249a37c7339179ec88facdf972", + "repo_source_path": "k8s/monitoring/nvidia-alerts.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_nvidia_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 122, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_nvidia_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "minio_kali_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "MinIO / Kali alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "MinIO", + "Kali scanner", + "read-only scanner status" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "3f3ca8c012a40f5a9983b6f587dfd60ffd0a8fb3dcea6b793cb1d5fbad0fe50b", + "repo_source_path": "k8s/monitoring/minio-kali-alerts.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_minio_kali_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 67, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_minio_kali_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ai_flywheel_alerts", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "AI flywheel alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "AI flywheel", + "learning / runtime health" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "74334919400623ff4115472e39ba30a6bbc5383bc7dfd6a3fae7bd06531e7cc6", + "repo_source_path": "k8s/monitoring/flywheel-alerts.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_flywheel_alerts", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 219, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_flywheel_alerts", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "alert_chain_monitor", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Alert chain monitor", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Alertmanager chain", + "E2E alert visibility" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "03ad55d72425f27071ba3afa8d43959a7ee361cc8f76fcf2ca295a33297bbf54", + "repo_source_path": "k8s/monitoring/alert-chain-monitor.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_alert_chain_monitor", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 202, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_alert_chain_monitor", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "app_alert_rule_contract", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "api_alert_rule_engine", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "API alert rule engine rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "alert classification", + "approval recommendations", + "playbook matching" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "5786505aa05073bbb2069203a443a75c8337a289dc015630792d0c201c85cafb", + "repo_source_path": "apps/api/alert_rules.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:app_alert_rules_yaml", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 889, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "app_alert_rules_yaml", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_agent_step_latency_rules", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana agent step latency rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "agent step latency", + "Grafana alerting" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "24b086bdf0eaca72c90fc323e562de4b47708c25f2427c0fc0b350e883431564", + "repo_source_path": "ops/monitoring/grafana/agent_step_latency_rules.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_agent_step_latency_rules", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 201, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_agent_step_latency_rules", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_ai_slo_dashboard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana AI SLO dashboard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "AI SLO", + "dashboard panels" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "e7518d6c234330d4b19c056a1810cb8037fbe1572f5a7968ac623dbee3630db3", + "repo_source_path": "ops/monitoring/grafana/dashboards/ai-slo-dashboard.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_ai_slo_dashboard", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 496, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_ai_slo_dashboard", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_ollama_failover_dashboard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana Ollama failover dashboard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Ollama failover", + "AI provider health" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "f583bc00a8af0c87f9594fb2452b9835e90a7c1473131bf8fb4b6709887a7a5b", + "repo_source_path": "ops/monitoring/grafana/dashboards/ollama_failover.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_ollama_failover_dashboard", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 295, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_ollama_failover_dashboard", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_ai_monitoring_dashboard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana AI monitoring dashboard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "AI monitoring", + "runtime health" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "acf865af021100244b91358c423e9d73d8bf2d58221cf274ea7ad7ae2fc933fd", + "repo_source_path": "ops/grafana/dashboards/ai-monitoring.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_ai_monitoring_dashboard", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 347, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_ai_monitoring_dashboard", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_infra_monitoring_dashboard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana infra monitoring dashboard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "infrastructure monitoring", + "host health" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "40c696e140585bd1889c4e07cbd8f9be302c1653b5d0736cd93c8d9c29c2beb0", + "repo_source_path": "ops/grafana/dashboards/infra-monitoring.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_infra_monitoring_dashboard", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 306, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_infra_monitoring_dashboard", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "grafana_nvidia_nemotron_dashboard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Grafana NVIDIA / NemoTron dashboard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "NVIDIA", + "NemoTron", + "GPU AI route" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "f47280987546c8546058d61b25a41f14bbb573e33a9c08f45b138d8176397d82", + "repo_source_path": "ops/grafana/dashboards/nvidia-nemotron.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:grafana_nvidia_nemotron_dashboard", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 1426, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "grafana_nvidia_nemotron_dashboard", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "otel_collector_config", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "signoz_otel_collector_phase_o", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "SigNoz OTEL collector config", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "OTEL collector", + "traces / metrics / logs routing" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "85abede3243b0775da600d1a5e092df3ff8c79eea56131b0da52a51aa7f668b9", + "repo_source_path": "ops/signoz/otel-collector-config-phase-o.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:signoz_otel_collector_config", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 188, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "signoz_otel_collector_config", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "signoz_alert_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "signoz_alerting_rules", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "SigNoz alerting rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "SigNoz alert rules", + "logs / traces alerting" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "a70519216e354ff78e323b1d77898e9d55b19eea5704fd8a8e9dd928196881e4", + "repo_source_path": "ops/signoz/alerting/rules.yaml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:signoz_alerting_rules", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 165, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "signoz_alerting_rules", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "signoz_log_rules", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "signoz_log_alert_rules", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "SigNoz log alert rules", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "log alerting", + "manual rule translation" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "f4e77c4e8e6fa149df5a4b5ef4651e514f9e0142f66f3f27dbd951fe3abed533", + "repo_source_path": "ops/signoz/alerting/log-rules.md", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:signoz_log_rules", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 107, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "signoz_log_rules", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "sentry_runtime_compose", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "sentry_self_hosted_runtime", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Sentry self-hosted compose", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Sentry self-hosted", + "ClickHouse / Postgres / Redis boundary" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "bba852dc0d73934998fa375130168615f9ac7611ce3f3efaa901e3b7e222eae3", + "repo_source_path": "ops/sentry-self-hosted/docker-compose.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:sentry_self_hosted_compose", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 49, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "sentry_self_hosted_compose", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "sentry_deploy_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "sentry_self_hosted_deploy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Sentry self-hosted deploy script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Sentry deploy", + "compose pull / up", + "migration boundary" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "b3dfb577c398a12d8f0521b159d18413257850eed7220234fcc491ff9aee9c7a", + "repo_source_path": "ops/sentry-self-hosted/deploy.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:sentry_self_hosted_deploy", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 65, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "sentry_self_hosted_deploy", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "langfuse_runtime_compose", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "langfuse_observability_runtime", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Langfuse compose", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Langfuse", + "LLM trace storage", + "PostgreSQL dependency" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "6c703a27525e62ef4d4d3c4cba8a89d64f646b01020782e35d22a3bf73f2dc83", + "repo_source_path": "infra/langfuse/docker-compose.yml", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:langfuse_compose", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 71, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "langfuse_compose", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "langfuse_runbook", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "langfuse_observability_runbook", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Langfuse deployment README", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Langfuse deployment", + "trace governance" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "7441665bfd3ce69e643364c7e792c837641bd36ff05d1aec44f15a7be62082e1", + "repo_source_path": "infra/langfuse/README.md", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:langfuse_readme", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 69, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "langfuse_readme", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "service_health_failure_notification_policy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Service health failure notification policy", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "failure-only notification", + "redaction contract" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "210a35e3e122d4311d5d25585c0d88b46206da87baa39a3f712fba291fea6ea3", + "repo_source_path": "docs/evaluations/service_health_failure_notification_policy_2026-06-05.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:service_health_failure_policy_snapshot", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 303, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "service_health_failure_policy_snapshot", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "backup_notification_policy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Backup notification policy", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "backup failure notification", + "restore / offsite alerting" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "0b282dc88bbe140871d9e232de5ebce97168b1a38b16e46b2e90c62fea6d6c8d", + "repo_source_path": "docs/evaluations/backup_notification_policy_2026-06-04.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:backup_notification_policy_snapshot", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 276, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "backup_notification_policy_snapshot", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "observability_contract_snapshot", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "observability_contract_matrix", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Observability contract matrix", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "observability contract", + "source coverage", + "runtime evidence" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "b274f086080a4ac8d6e1786fa8d44a585ce92aadb1f6608dfb891cef7b1f05a1", + "repo_source_path": "docs/evaluations/observability_contract_matrix_2026-06-05.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:observability_contract_matrix_snapshot", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 391, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "observability_contract_matrix_snapshot", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ai_agent_telegram_digest_policy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Telegram action required digest policy", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Telegram digest", + "action required routing" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "2f8d00a8d697720e3198678dbaecca9fc618aa7957a348d89fd1bce250be842e", + "repo_source_path": "docs/evaluations/ai_agent_telegram_action_required_digest_policy_2026-06-11.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:telegram_action_required_digest_snapshot", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 405, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "telegram_action_required_digest_snapshot", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ai_agent_telegram_receipt_policy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Telegram receipt approval package", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "delivery receipt", + "ack / retry policy" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "4fcb0f5a9ab809df3ea2ea1e384aa1f9c09544af0a12274029fc52c21c15e857", + "repo_source_path": "docs/evaluations/ai_agent_telegram_receipt_approval_package_2026-06-11.json", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:telegram_receipt_approval_snapshot", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 179, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "telegram_receipt_approval_snapshot", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "telegram_runtime_sender", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "telegram_gateway_runtime_sender", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Telegram gateway service", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Telegram Bot API", + "dedup", + "delivery queue" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "bf8727f1fcb8cfbdda0997dbd6e1d5f9298a09d10bebf719a3d3b70a23e3633c", + "repo_source_path": "apps/api/src/services/telegram_gateway.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:telegram_gateway_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 9452, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "telegram_gateway_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "notification_runtime_routing", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Notification manager", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "notification channel routing", + "Telegram / Discord manager" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "f3b61e55dba30aca4be16282681445671559467ddc21b946f76762ad829cfeb2", + "repo_source_path": "apps/api/src/services/notifications/manager.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:notification_manager_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 172, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "notification_manager_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "notification_policy_code", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "notification_matrix_policy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Notification matrix", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "notification policy", + "recipient / channel mapping" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "5881a477e7fe6b7f60af9ad1e880197b01474bc08749977d46fd541764d81442", + "repo_source_path": "apps/api/src/services/notification_matrix.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:notification_matrix_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 66, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "notification_matrix_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "alert_metrics_service", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "alert_chain_metrics", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Alert chain metrics service", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "alert chain metrics", + "delivery visibility" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "4eee6ac9e7228183a6fbc05179b85c0d8aca001bf7cc15736d480b3dd1d6f96d", + "repo_source_path": "apps/api/src/services/alert_chain_metrics_service.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:alert_chain_metrics_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 160, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "alert_chain_metrics_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "recurrence_notification_runtime", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Converged alert recurrence notifier", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "recurrence notification", + "dedup", + "escalation routing" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "66e7026bd8b6662c6daaaeb004cb5b58a9ffe81b705b227e2ad1f50e84bc6856", + "repo_source_path": "apps/api/src/services/converged_alert_recurrence_notifier.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:converged_alert_recurrence_notifier", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 215, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "converged_alert_recurrence_notifier", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "webhook_receiver", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "sentry_webhook_receiver", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Sentry webhook service", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Sentry webhook", + "signature validation", + "triage route" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "00c192d55a56f4dafd4e11a4fa7d3950a8938ab158f066bb7d49ab70c4c19d06", + "repo_source_path": "apps/api/src/services/sentry_webhook_service.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:sentry_webhook_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 452, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "sentry_webhook_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "signoz_observability_client", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "signoz_api_client", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "SigNoz client service", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "SigNoz API", + "log query", + "trace query" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "3eceb5f6d2a611390024215e12c8ff634b1eafc7ee9ca697dcde81cf7927de5c", + "repo_source_path": "apps/api/src/services/signoz_client.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:signoz_client_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 577, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "signoz_client_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "sentry_observability_client", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "sentry_api_client", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Sentry service client", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Sentry API", + "issue query", + "AI triage" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "8287af9f12a5fbc991f2a8e369559075d863f4d36e4384a0616dc06e0919c05f", + "repo_source_path": "apps/api/src/services/sentry_service.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:sentry_service_client", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 464, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "sentry_service_client", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "langfuse_observability_client", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "langfuse_api_client", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Langfuse client service", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Langfuse API", + "AI trace", + "prompt / output privacy" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "fdd232688d58d31d38d1c8545b75a34f3afc53076c5c13bfe318d4d13cffc7cb", + "repo_source_path": "apps/api/src/services/langfuse_client.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:langfuse_client_service", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 347, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "langfuse_client_service", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "reload_capable_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "alertmanager_config_deploy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Alertmanager config deploy script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Alertmanager config copy", + "reload" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "861ce84b7abea40d279e9c346baa4388b6962416914ad39fbd388ef0613c2c30", + "repo_source_path": "scripts/ops/deploy-alertmanager-config.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:deploy_alertmanager_config_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 145, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "deploy_alertmanager_config_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "reload_capable_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "prometheus_alerts_deploy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Prometheus alerts deploy script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Prometheus alert rule deploy", + "reload" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "302df2ac135a8b360684797cc6210584120f115896859435ddd15a0d3c1cf883", + "repo_source_path": "scripts/ops/deploy-alerts.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:deploy_prometheus_alerts_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 164, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "deploy_prometheus_alerts_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "drift_guard_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "prometheus_rule_drift_guard", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Prometheus rule drift guard", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "rule diff", + "drift evidence", + "reload guard" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "c284f7abe4f511f4670f03f78b945f4506d277fe8a9c382e1bfedae48dfde61a", + "repo_source_path": "scripts/ops/prometheus-rule-drift-guard.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:prometheus_rule_drift_guard_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 149, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "prometheus_rule_drift_guard_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "reload_capable_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "k8s_prometheus_config_deploy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "K8s Prometheus config deploy script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "K8s config apply", + "Prometheus reload" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "5511681efdd5563aa980396b2ebb37b7d28e43092feda48f3cba014a4b863adf", + "repo_source_path": "k8s/monitoring/deploy-prometheus-config.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:k8s_deploy_prometheus_config_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 118, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "k8s_deploy_prometheus_config_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "reload_capable_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "api_prometheus_config_apply", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "API Prometheus config apply script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "Prometheus config apply", + "API-owned alert deploy" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "dfc154732a7858116fab423655eff8bc0b6e36f135cbd7f5e5f23745c7402aef", + "repo_source_path": "apps/api/scripts/apply_prometheus_config.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:api_apply_prometheus_config_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 198, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "api_apply_prometheus_config_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "host_deploy_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "monitoring_exporter_deploy", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Monitoring exporter deploy script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "exporter deploy", + "host service restart" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "dbcbca21cf6fd5083177cb8a12c008c1aefed8e6ed05b70d738b3db37699cef3", + "repo_source_path": "ops/monitoring/deploy-exporters.sh", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:monitoring_exporter_deploy_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 76, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "monitoring_exporter_deploy_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "live_alert_sender", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "live_alert_fire_script", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Live alert firing script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "live alert", + "Alertmanager ingestion", + "notification route" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "ec79532dd23559103c8e436b73311d4a2b04be8655c1a804787da6e18c510acf", + "repo_source_path": "apps/api/scripts/fire_live_alert.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:fire_live_alert_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 369, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "fire_live_alert_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "live_alert_sender", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "test_alert_fire_script", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Test alert firing script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "test alert", + "notification chain smoke" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "62623a452644aaad1b0997d59f7b120839a1e3605e4cbd0b58bbab2dcb727fe6", + "repo_source_path": "apps/api/scripts/fire_test_alert.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:fire_test_alert_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 318, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "fire_test_alert_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "smoke_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "alert_chain_smoke", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Alert chain smoke script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "alert chain E2E", + "notification delivery" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "033506075fbdad8cb6b712712fb9af28f2c03fd676889597353f2827cfb5b9d9", + "repo_source_path": "scripts/alert_chain_smoke_test.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:alert_chain_smoke_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 1245, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "alert_chain_smoke_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "affected_scope": "pending_affected_scope", + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "blocked_actions": [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open" + ], + "config_kind": "smoke_script", + "control_tier": "C1", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "expected_scope": "ops_alert_chain_smoke", + "exporter_deploy_authorized": false, + "followup_owner": "pending_followup_owner", + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "label": "Ops alert chain smoke script", + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "live_config_hash_ref": null, + "live_evidence_received": false, + "maintenance_window": "pending_maintenance_window", + "maintenance_window_accepted": false, + "noise_budget_owner": "pending_noise_budget_owner", + "not_approval": true, + "notification_route_change_authorized": false, + "observability_scope": [ + "ops alert chain", + "Alertmanager / Telegram smoke" + ], + "otel_collector_reload_authorized": false, + "owner_response_accepted": false, + "owner_response_received": false, + "owner_role_or_team": "pending_owner_role_or_team", + "production_write_authorized": false, + "prometheus_reload_authorized": false, + "receiver_owner": "pending_receiver_owner", + "receiver_owner_accepted": false, + "receiver_route_change_authorized": false, + "recipient_confirmed": false, + "redacted_evidence_refs": [], + "reload_owner": "pending_reload_owner", + "reload_owner_accepted": false, + "remote_write_change_authorized": false, + "repo_sha256": "473189af791d6df3dfa75c00b3702b7179a5db0bd61692250bcaa79e25f1bc35", + "repo_source_path": "ops/scripts/alert_chain_smoke_test.py", + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "request_id": "monitoring_owner_request:ops_alert_chain_smoke_script", + "request_sent": false, + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "requires_live_evidence": true, + "rollback_owner": "pending_rollback_owner", + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "route_smoke_plan": "pending_route_smoke_plan", + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "source_line_count": 267, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "draft_not_dispatched", + "surface_id": "ops_alert_chain_smoke_script", + "telegram_send_authorized": false, + "validation_plan": "pending_validation_plan", + "validation_plan_accepted": false, + "webhook_receiver_change_authorized": false, + "write_capable_surface": false + } + ], + "request_fields": [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval" + ], + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner" + ], + "schema_version": "monitoring_owner_request_draft_v1", + "source_inventory_schema_version": "monitoring_alerting_observability_inventory_v1", + "source_inventory_status": "repo_only_inventory_ready", + "status": "owner_request_draft_ready_not_dispatched", + "summary": { + "action_button_count": 0, + "active_scan_authorized_count": 0, + "alert_chain_smoke_authorized_count": 0, + "alertmanager_reload_authorized_count": 0, + "blocked_action_count": 24, + "exporter_deploy_authorized_count": 0, + "grafana_dashboard_apply_authorized_count": 0, + "host_write_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "langfuse_config_change_authorized_count": 0, + "live_alert_fire_authorized_count": 0, + "live_evidence_received_count": 0, + "live_evidence_required_request_count": 60, + "maintenance_window_accepted_count": 0, + "notification_route_change_authorized_count": 0, + "otel_collector_reload_authorized_count": 0, + "owner_response_accepted_count": 0, + "owner_response_received_count": 0, + "production_write_authorized_count": 0, + "prometheus_reload_authorized_count": 0, + "receiver_owner_accepted_count": 0, + "receiver_route_change_authorized_count": 0, + "recipient_confirmed_count": 0, + "reload_owner_accepted_count": 0, + "remote_write_change_authorized_count": 0, + "request_draft_count": 60, + "request_field_count": 24, + "request_sent_count": 0, + "required_owner_field_count": 14, + "rollback_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "runtime_gate_count": 0, + "secret_value_collection_allowed_count": 0, + "sentry_deploy_authorized_count": 0, + "signoz_rule_apply_authorized_count": 0, + "silence_policy_change_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "telegram_send_authorized_count": 0, + "validation_plan_accepted_count": 0, + "webhook_receiver_change_authorized_count": 0, + "write_capable_request_draft_count": 11 + } +} diff --git a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md index c63df3625..beee87711 100644 --- a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md +++ b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md @@ -698,6 +698,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator | `docs/security/host-service-owner-request-draft.snapshot.json` + `scripts/security/host-service-owner-request-draft.py` | Docker / systemd / Host Service Owner Request Draft 已本地完成；承接 host-service repo-only 清冊，固定 9 份 request draft、3 份 write-capable request draft、8 份需 live evidence request、22 欄 request fields、12 欄 required owner fields 與 14 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live evidence、restart window、rollback owner、host write、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、Docker Compose action、systemctl action、repair-bot execution、Ansible apply、secret collection、host write、production write 或 runtime gate | | `docs/security/ssh-network-owner-request-draft.snapshot.json` + `scripts/security/ssh-network-owner-request-draft.py` | SSH / Firewall / Network Access Owner Request Draft 已本地完成；承接 SSH / network repo-only 清冊，固定 16 份 request draft、6 份 write-capable request draft、16 份需 live evidence request、23 欄 request fields、13 欄 required owner fields 與 16 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live access state、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、host write、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、production write 或 runtime gate | | `docs/security/backup-restore-owner-request-draft.snapshot.json` + `scripts/security/backup-restore-owner-request-draft.py` | Backup / Restore / Escrow Owner Request Draft 已本地完成；承接 backup / restore repo-only 清冊，固定 38 份 request draft、27 份 write-capable request draft、38 份需 live evidence request、24 欄 request fields、14 欄 required owner fields 與 18 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、escrow marker write、retention change、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate | +| `docs/security/monitoring-owner-request-draft.snapshot.json` + `scripts/security/monitoring-owner-request-draft.py` | Monitoring / Alerting / Observability Owner Request Draft 已本地完成；承接 monitoring repo-only 清冊，固定 60 份 request draft、11 份 write-capable request draft、60 份需 live evidence request、24 欄 request fields、14 欄 required owner fields 與 24 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate | | `docs/evaluations/ai_agent_live_read_model_gate_2026-06-11.json` + `GET /api/v1/agents/agent-live-read-model-gate` | P2-403B AgentSession / Redis Streams live read model gate；定義 safe fields、Redis envelope、worker gate、rollback plan 與 no-write smoke，不連 DB、不讀寫 Redis、不啟動 worker | #### 3.2.1c 2026-06-11 AI Agent 主動營運委派與版本生命週期契約 @@ -847,6 +848,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence 79. 建立 Docker / systemd / Host Service Owner Request Draft。✅ 本地完成；新增 `host-service-owner-request-draft.py`、snapshot 與說明文件，將 9 個 host service surface 轉成 `request_draft_count=9`、`write_capable_request_draft_count=3`、`live_evidence_required_request_count=8`、`request_field_count=22`、`required_owner_field_count=12`、`blocked_action_count=14` 的人工送件前草稿；request sent、recipient confirmed、owner response received / accepted、live evidence、restart window、rollback owner、post-check、host write、Docker Compose action、systemctl action、repair-bot execution、Ansible apply、secret collection、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、live host read、Docker Compose action、systemctl action、repair-bot execution、Ansible apply、secret collection、host write、production write 或 runtime gate。 80. 建立 SSH / Firewall / Network Access Owner Request Draft。✅ 本地完成；新增 `ssh-network-owner-request-draft.py`、snapshot 與說明文件，將 16 個 SSH / network access surface 轉成 `request_draft_count=16`、`write_capable_request_draft_count=6`、`live_evidence_required_request_count=16`、`request_field_count=23`、`required_owner_field_count=13`、`blocked_action_count=16` 的人工送件前草稿；request sent、recipient confirmed、owner response received / accepted、live access state、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、production write 或 runtime gate。 81. 建立 Backup / Restore / Escrow Owner Request Draft。✅ 本地完成；新增 `backup-restore-owner-request-draft.py`、snapshot 與說明文件，將 38 個 backup / restore / escrow surface 轉成 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=18` 的人工送件前草稿；request sent、recipient confirmed、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate。 +82. 建立 Monitoring / Alerting / Observability Owner Request Draft。✅ 本地完成；新增 `monitoring-owner-request-draft.py`、snapshot 與說明文件，將 60 個 monitoring / alerting / observability surface 轉成 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=24` 的人工送件前草稿；request sent、recipient confirmed、owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、reload、deploy、receiver route change、silence change、Telegram send、alert chain smoke、host write、production write 或 runtime gate。 #### 3.2.1d 2026-06-11 Agent 互動、學習與成長證據面 @@ -4810,3 +4812,16 @@ Trigger commit `f5cd37b7` 與 deploy marker `0ba92357` 已把 governance UI 的 - P0 總帳、供應鏈進度、K8s manifest 清冊、IwoooS 配置控管總清單、coverage 矩陣與 MASTER artifact 表已同步 P0-21。 **裁決：** 這是人工送件前 request draft，不是 request sent、recipient confirmed、owner response received / accepted、rendered manifest diff、ArgoCD API read、ArgoCD sync、kubectl action、live cluster read、secret collection、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 + +### 2026-06-14 23:25 (台北) — §3.2 / §5 — 新增 Monitoring / Alerting / Observability Owner Request Draft — 把告警與觀測清冊轉成人工送件草稿 + +**觸發**：P1-4 已建立 monitoring / alerting / observability repo-only 清冊；下一步需要將 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 轉成人工可核對的 owner request draft，但仍不得送件、不得 reload、不得改 receiver、不得送 Telegram 或 fire alert。 + +**已推進：** +- 新增 `scripts/security/monitoring-owner-request-draft.py`，讀取 `docs/security/monitoring-alerting-observability-inventory.snapshot.json`，產生 60 份 owner request draft。 +- 新增 `docs/security/monitoring-owner-request-draft.snapshot.json`，固定 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=24`。 +- 新增 `docs/security/MONITORING-OWNER-REQUEST-DRAFT.md`，說明 request draft 類型、owner 必填欄位、blocked actions、完成度與 0 / false 邊界。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、request ids、blocked actions 與每份草稿 false flags。 +- P0 總帳、供應鏈進度、Monitoring 清冊、IwoooS 配置控管總清單、coverage 矩陣與 MASTER artifact 表已同步 P1-13。 + +**裁決：** 這是人工送件前 request draft，不是 request sent、recipient confirmed、owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index 4e736cb3c..0226ad38a 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -25,6 +25,7 @@ | 最新 P1 Docker / systemd / Host Service 配置控管基準 | repo-only inventory 已固定 `surface=9`、`write_capable=3`、`live_evidence_required=8`、成熟度 `42% -> 50%`；本輪新增 owner request draft，固定 `drafts=9`、`owner_fields=12`、`blocked_actions=14`、request sent / received / accepted / live evidence / restart window / rollback owner / host write / runtime gate 全部 `0` | | 最新 P1 SSH / Firewall / Network Access 配置控管基準 | repo-only inventory 已固定 `surface=16`、`write_capable=6`、`live_evidence_required=16`、成熟度 `48% -> 54%`；本輪新增 owner request draft，固定 `drafts=16`、`owner_fields=13`、`blocked_actions=16`、request sent / received / accepted / live access state / firewall / port change / NetworkPolicy / NodePort / WireGuard / host write / runtime gate 全部 `0` | | 最新 P1 Backup / Restore / Escrow 配置控管基準 | repo-only inventory 已固定 `surface=38`、`write_capable=27`、`live_evidence_required=38`、成熟度 `52% -> 58%`；本輪新增 owner request draft，固定 `drafts=38`、`owner_fields=14`、`blocked_actions=18`、request sent / received / accepted / backup run / restore run / offsite sync / remote delete / escrow marker / retention change / runtime gate 全部 `0` | +| 最新 P1 Monitoring / Alerting / Observability 配置控管基準 | repo-only inventory 已固定 `surface=60`、`write_capable=11`、`live_evidence_required=60`、成熟度 `56% -> 62%`；本輪新增 owner request draft，固定 `drafts=60`、`owner_fields=14`、`blocked_actions=24`、request sent / received / accepted / live evidence / reload / receiver route change / Telegram send / alert chain smoke / runtime gate 全部 `0` | | 最新 AI Agent automation P1-305 / P1-306 基準 | code `4f0787f8`、deploy marker `af3a9d48`、CD `2592`、code-review `2593`；任務批准邊界與進度彙總已正式驗證；backlog `70%`、done `16/23`、下一步 `P1-001` | | 最新 AI Agent automation P1-001 基準 | code `de3007b7`、stability fix `fd33591c`、deploy marker `8caba233`、LOGBOOK / marker 對齊 `37c0e171`；runtime surface `22`、Secret surface `4`、live gaps `6`、backlog `74%`、done `17/23`、下一步 `P1-002` | | 最新 AI Agent automation P1-002 基準 | code `943faaee`、stability fix `ff266926`、deploy marker `01b8712d`、LOGBOOK / marker 對齊 `70c01003`；Gitea workflows `9`、runner contracts `4`、需 runner attestation workflows `8`、backlog `78%`、done `18/23`、下一步 `P1-003` | @@ -230,6 +231,7 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count | P1 | Docker / systemd / Host Service owner request draft | 9 個 repo-only surface 已轉成人工送件前草稿，涵蓋 110 / 188 Docker Compose、repair-bot、Ansible role 與 host config backup capture | request sent、owner response、live hash、restart、repair-bot、Ansible apply、host write、runtime gate 全部維持 0 / false | | P1 | SSH / Firewall / Network Access owner request draft | 16 個 repo-only surface 已轉成人工送件前草稿，涵蓋 SSH target、known_hosts、CI deploy SSH、sudoers、NetworkPolicy、NodePort、WireGuard 與 alert SSH action | request sent、owner response、live access state、keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change 全部維持 0 / false | | P1 | Backup / Restore / Escrow owner request draft | 38 個 repo-only surface 已轉成人工送件前草稿，涵蓋 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook | request sent、owner response、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change 全部維持 0 / false | +| P1 | Monitoring / Alerting / Observability owner request draft | 60 個 repo-only surface 已轉成人工送件前草稿，涵蓋 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification 與 alert smoke | request sent、owner response、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke 全部維持 0 / false | | P1 | Kali 112 維護窗口草案 | 1994 pending updates、`networking.service` failed、服務硬化 0/4、rollback、post-check | P1-7 草案已完成；不 `apt upgrade`、不 restart | | P1 | 111 / 168 主機 scope 補強 | P1-8 已補 `DEV-HOSTS-111-168-SCOPE-HANDOFF.md`、snapshot 與 schema；scope、maintenance window、credential handling、rollback owner、validation 指標已可交接 | observe-only；不 credentialed scan、不改 route / CORS / firewall / service | | P1 | VibeWork 納入 IwoooS | P1-9 已補 `VIBEWORK-IWOOOS-ONBOARDING-HANDOFF.md`、snapshot 與 schema；repo、product、surface、owner、evidence refs、資料分級、部署邊界與獨立產品邊界已可交接 | 繁中 docs/specs；不合併產品責任、不部署、不改 refs | @@ -303,6 +305,7 @@ P1 只讀重盤階段整體完成度：`70%`。它代表 freshness / inventory / | P1-10 | Docker / systemd / Host Service owner request draft | 已新增 `HOST-SERVICE-OWNER-REQUEST-DRAFT.md`、`host-service-owner-request-draft.snapshot.json` 與產生器；9 個 surface、3 個 write-capable、8 個需 live evidence、12 個 owner 必填欄位、14 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live evidence、restart window、rollback owner、host write、runtime gate 仍全部 `0 / false` | | P1-11 | SSH / Firewall / Network Access owner request draft | 已新增 `SSH-NETWORK-OWNER-REQUEST-DRAFT.md`、`ssh-network-owner-request-draft.snapshot.json` 與產生器；16 個 surface、6 個 write-capable、16 個需 live evidence、13 個 owner 必填欄位、16 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live access state、keyscan、known_hosts patch、firewall / port change、NetworkPolicy / NodePort / WireGuard 變更、host write、runtime gate 仍全部 `0 / false` | | P1-12 | Backup / Restore / Escrow owner request draft | 已新增 `BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md`、`backup-restore-owner-request-draft.snapshot.json` 與產生器；38 個 surface、27 個 write-capable、38 個需 live evidence、14 個 owner 必填欄位、18 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、runtime gate 仍全部 `0 / false` | +| P1-13 | Monitoring / Alerting / Observability owner request draft | 已新增 `MONITORING-OWNER-REQUEST-DRAFT.md`、`monitoring-owner-request-draft.snapshot.json` 與產生器；60 個 surface、11 個 write-capable、60 個需 live evidence、14 個 owner 必填欄位、24 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live evidence、Prometheus / Alertmanager reload、receiver route change、silence change、Telegram send、alert chain smoke、runtime gate 仍全部 `0 / false` | ## 7. 2026-06-04 本輪驗證紀錄 diff --git a/scripts/security/monitoring-owner-request-draft.py b/scripts/security/monitoring-owner-request-draft.py new file mode 100644 index 000000000..21713edcf --- /dev/null +++ b/scripts/security/monitoring-owner-request-draft.py @@ -0,0 +1,329 @@ +#!/usr/bin/env python3 +""" +IwoooS Monitoring / Alerting / Observability owner request draft 產生器。 + +本工具讀取 monitoring-alerting-observability repo-only 清冊，將 60 個 surface +轉成人工送件前 request draft。它不連 live Prometheus、不 reload Alertmanager、 +不改 Grafana / SigNoz / Sentry / Langfuse、不發 Telegram、不建立 silence。 +""" + +from __future__ import annotations + +import argparse +import json +import subprocess +import sys +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + +REQUEST_FIELDS = [ + "request_id", + "surface_id", + "label", + "expected_scope", + "config_kind", + "observability_scope", + "control_tier", + "repo_source_path", + "repo_sha256", + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", + "not_approval", +] + +REQUIRED_OWNER_FIELDS = [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "live_config_hash_ref", + "reload_owner", + "receiver_owner", + "route_smoke_plan", + "maintenance_window", + "rollback_owner", + "validation_plan", + "noise_budget_owner", + "followup_owner", +] + +BLOCKED_ACTIONS = [ + "prometheus_reload", + "alertmanager_reload", + "grafana_dashboard_apply", + "signoz_rule_apply", + "sentry_deploy", + "langfuse_config_change", + "otel_collector_reload", + "receiver_route_change", + "silence_policy_change", + "telegram_send", + "notification_route_change", + "webhook_receiver_change", + "remote_write_change", + "exporter_deploy", + "live_alert_fire", + "alert_chain_smoke", + "ssh_read", + "ssh_write", + "kubectl_action", + "secret_value_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", +] + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def load_json(path: Path) -> dict[str, Any]: + return json.loads(path.read_text(encoding="utf-8")) + + +def request_for(surface: dict[str, Any], write_capable_ids: set[str]) -> dict[str, Any]: + surface_id = surface["surface_id"] + write_capable = surface_id in write_capable_ids + return { + "request_id": f"monitoring_owner_request:{surface_id}", + "status": "draft_not_dispatched", + "surface_id": surface_id, + "label": surface["label"], + "expected_scope": surface["expected_scope"], + "config_kind": surface["config_kind"], + "observability_scope": surface["observability_scope"], + "control_tier": surface["control_tier"], + "repo_source_path": surface["source_path"], + "repo_sha256": surface["sha256"], + "source_line_count": surface["line_count"], + "requires_live_evidence": surface["requires_live_evidence"], + "write_capable_surface": write_capable, + "source_inventory_ref": "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "request_fields": REQUEST_FIELDS, + "required_owner_fields": REQUIRED_OWNER_FIELDS, + "blocked_actions": BLOCKED_ACTIONS, + "owner_role_or_team": "pending_owner_role_or_team", + "decision": "pending_owner_decision", + "decision_reason": "pending_decision_reason", + "affected_scope": "pending_affected_scope", + "redacted_evidence_refs": [], + "live_config_hash_ref": None, + "reload_owner": "pending_reload_owner", + "receiver_owner": "pending_receiver_owner", + "route_smoke_plan": "pending_route_smoke_plan", + "maintenance_window": "pending_maintenance_window", + "rollback_owner": "pending_rollback_owner", + "validation_plan": "pending_validation_plan", + "noise_budget_owner": "pending_noise_budget_owner", + "followup_owner": "pending_followup_owner", + "not_approval": True, + "request_sent": False, + "recipient_confirmed": False, + "owner_response_received": False, + "owner_response_accepted": False, + "live_evidence_received": False, + "reload_owner_accepted": False, + "receiver_owner_accepted": False, + "route_smoke_accepted": False, + "maintenance_window_accepted": False, + "rollback_owner_accepted": False, + "validation_plan_accepted": False, + "prometheus_reload_authorized": False, + "alertmanager_reload_authorized": False, + "grafana_dashboard_apply_authorized": False, + "signoz_rule_apply_authorized": False, + "sentry_deploy_authorized": False, + "langfuse_config_change_authorized": False, + "otel_collector_reload_authorized": False, + "receiver_route_change_authorized": False, + "silence_policy_change_authorized": False, + "telegram_send_authorized": False, + "notification_route_change_authorized": False, + "webhook_receiver_change_authorized": False, + "remote_write_change_authorized": False, + "exporter_deploy_authorized": False, + "live_alert_fire_authorized": False, + "alert_chain_smoke_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "kubectl_action_authorized": False, + "secret_value_collection_allowed": False, + "host_write_authorized": False, + "active_scan_authorized": False, + "production_write_authorized": False, + "runtime_gate": False, + "action_buttons_allowed": False, + } + + +def build_report(root: Path, inventory: dict[str, Any], generated_at: str | None) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + write_capable_ids = {surface["surface_id"] for surface in inventory["write_capable_surfaces"]} + requests = [request_for(surface, write_capable_ids) for surface in inventory["observability_surfaces"]] + write_capable_requests = [item for item in requests if item["write_capable_surface"]] + live_evidence_requests = [item for item in requests if item["requires_live_evidence"]] + + return { + "schema_version": "monitoring_owner_request_draft_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "source_inventory_schema_version": inventory.get("schema_version"), + "source_inventory_status": inventory.get("status"), + "status": "owner_request_draft_ready_not_dispatched", + "summary": { + "request_draft_count": len(requests), + "write_capable_request_draft_count": len(write_capable_requests), + "live_evidence_required_request_count": len(live_evidence_requests), + "request_field_count": len(REQUEST_FIELDS), + "required_owner_field_count": len(REQUIRED_OWNER_FIELDS), + "blocked_action_count": len(BLOCKED_ACTIONS), + "request_sent_count": 0, + "recipient_confirmed_count": 0, + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "live_evidence_received_count": 0, + "reload_owner_accepted_count": 0, + "receiver_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "maintenance_window_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "validation_plan_accepted_count": 0, + "prometheus_reload_authorized_count": 0, + "alertmanager_reload_authorized_count": 0, + "grafana_dashboard_apply_authorized_count": 0, + "signoz_rule_apply_authorized_count": 0, + "sentry_deploy_authorized_count": 0, + "langfuse_config_change_authorized_count": 0, + "otel_collector_reload_authorized_count": 0, + "receiver_route_change_authorized_count": 0, + "silence_policy_change_authorized_count": 0, + "telegram_send_authorized_count": 0, + "notification_route_change_authorized_count": 0, + "webhook_receiver_change_authorized_count": 0, + "remote_write_change_authorized_count": 0, + "exporter_deploy_authorized_count": 0, + "live_alert_fire_authorized_count": 0, + "alert_chain_smoke_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "host_write_authorized_count": 0, + "active_scan_authorized_count": 0, + "production_write_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + }, + "execution_boundaries": { + "request_sent": False, + "recipient_confirmed": False, + "owner_response_received": False, + "owner_response_accepted": False, + "live_evidence_received": False, + "prometheus_reload_authorized": False, + "alertmanager_reload_authorized": False, + "grafana_dashboard_apply_authorized": False, + "signoz_rule_apply_authorized": False, + "sentry_deploy_authorized": False, + "langfuse_config_change_authorized": False, + "otel_collector_reload_authorized": False, + "receiver_route_change_authorized": False, + "silence_policy_change_authorized": False, + "telegram_send_authorized": False, + "notification_route_change_authorized": False, + "webhook_receiver_change_authorized": False, + "remote_write_change_authorized": False, + "exporter_deploy_authorized": False, + "live_alert_fire_authorized": False, + "alert_chain_smoke_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "kubectl_action_authorized": False, + "secret_value_collection_allowed": False, + "host_write_authorized": False, + "active_scan_authorized": False, + "production_write_authorized": False, + "runtime_execution_authorized": False, + "action_buttons_allowed": False, + "not_authorization": True, + }, + "request_fields": REQUEST_FIELDS, + "required_owner_fields": REQUIRED_OWNER_FIELDS, + "blocked_actions": BLOCKED_ACTIONS, + "request_drafts": requests, + "next_steps": [ + "人工送件前確認 monitoring / alerting / notification owner role 與回覆窗口。", + "owner 只能提供脫敏 live config hash、receiver diff、route smoke plan、noise budget、maintenance window 與 rollback owner。", + "收到回覆後先做欄位完整性、敏感 payload 隔離、reload / receiver / route smoke gate 檢查，不得直接 reload、send Telegram 或 fire alert。", + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser(description="IwoooS monitoring owner request draft 產生器") + parser.add_argument("--root", default=".", help="repo root") + parser.add_argument( + "--inventory-report", + default="docs/security/monitoring-alerting-observability-inventory.snapshot.json", + help="monitoring-alerting-observability-inventory.py 輸出的 JSON", + ) + parser.add_argument("--output", help="寫出 JSON 報告") + parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") + args = parser.parse_args() + + root = Path(args.root).resolve() + inventory = load_json(root / args.inventory_report) + report = build_report(root, inventory, args.generated_at) + payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + + if args.output: + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(payload + "\n", encoding="utf-8") + else: + print(payload) + + summary = report["summary"] + print( + "MONITORING_OWNER_REQUEST_DRAFT_OK " + f"drafts={summary['request_draft_count']} " + f"write_capable={summary['write_capable_request_draft_count']} " + f"fields={summary['required_owner_field_count']} " + f"sent={summary['request_sent_count']} " + f"runtime_gate={summary['runtime_gate_count']}", + file=sys.stderr, + ) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index b47f972ad..444f17ab8 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -109,6 +109,9 @@ def validate(root: Path) -> None: monitoring_alerting_observability_inventory = load_json( security_dir / "monitoring-alerting-observability-inventory.snapshot.json" ) + monitoring_owner_request_draft = load_json( + security_dir / "monitoring-owner-request-draft.snapshot.json" + ) domain_tls_inventory = load_json(security_dir / "domain-tls-certbot-inventory.snapshot.json") domain_tls_owner_confirmation_request = load_json( security_dir / "domain-tls-certbot-owner-confirmation-request.snapshot.json" @@ -3468,6 +3471,159 @@ def validate(root: Path) -> None: [item["surface_id"] for item in monitoring_alerting_observability_inventory["write_capable_surfaces"]], surface_id, ) + assert_equal( + "monitoring_owner_request_draft.schema", + monitoring_owner_request_draft["schema_version"], + "monitoring_owner_request_draft_v1", + ) + assert_equal( + "monitoring_owner_request_draft.status", + monitoring_owner_request_draft["status"], + "owner_request_draft_ready_not_dispatched", + ) + assert_equal( + "monitoring_owner_request_draft.source_inventory_schema_version", + monitoring_owner_request_draft["source_inventory_schema_version"], + "monitoring_alerting_observability_inventory_v1", + ) + assert_equal( + "monitoring_owner_request_draft.source_inventory_status", + monitoring_owner_request_draft["source_inventory_status"], + "repo_only_inventory_ready", + ) + expected_monitoring_owner_request_summary = { + "request_draft_count": 60, + "write_capable_request_draft_count": 11, + "live_evidence_required_request_count": 60, + "request_field_count": 24, + "required_owner_field_count": 14, + "blocked_action_count": 24, + "request_sent_count": 0, + "recipient_confirmed_count": 0, + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "live_evidence_received_count": 0, + "reload_owner_accepted_count": 0, + "receiver_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "maintenance_window_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "validation_plan_accepted_count": 0, + "prometheus_reload_authorized_count": 0, + "alertmanager_reload_authorized_count": 0, + "grafana_dashboard_apply_authorized_count": 0, + "signoz_rule_apply_authorized_count": 0, + "sentry_deploy_authorized_count": 0, + "langfuse_config_change_authorized_count": 0, + "otel_collector_reload_authorized_count": 0, + "receiver_route_change_authorized_count": 0, + "silence_policy_change_authorized_count": 0, + "telegram_send_authorized_count": 0, + "notification_route_change_authorized_count": 0, + "webhook_receiver_change_authorized_count": 0, + "remote_write_change_authorized_count": 0, + "exporter_deploy_authorized_count": 0, + "live_alert_fire_authorized_count": 0, + "alert_chain_smoke_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "host_write_authorized_count": 0, + "active_scan_authorized_count": 0, + "production_write_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + } + for key, expected in expected_monitoring_owner_request_summary.items(): + assert_equal( + f"monitoring_owner_request_draft.summary.{key}", + monitoring_owner_request_draft["summary"][key], + expected, + ) + for key, value in monitoring_owner_request_draft["execution_boundaries"].items(): + if key == "not_authorization": + assert_true(f"monitoring_owner_request_draft.execution_boundaries.{key}", value) + else: + assert_false(f"monitoring_owner_request_draft.execution_boundaries.{key}", value) + assert_equal( + "monitoring_owner_request_draft.request_drafts.count", + len(monitoring_owner_request_draft["request_drafts"]), + 60, + ) + monitoring_owner_request_ids = [ + item["request_id"] for item in monitoring_owner_request_draft["request_drafts"] + ] + for request_id in [ + "monitoring_owner_request:alertmanager_receiver_config", + "monitoring_owner_request:deploy_alertmanager_config_script", + "monitoring_owner_request:telegram_gateway_service", + "monitoring_owner_request:fire_live_alert_script", + "monitoring_owner_request:sentry_self_hosted_deploy", + "monitoring_owner_request:langfuse_compose", + ]: + assert_contains( + "monitoring_owner_request_draft.request_drafts", + monitoring_owner_request_ids, + request_id, + ) + for draft in monitoring_owner_request_draft["request_drafts"]: + assert_equal( + f"monitoring_owner_request_draft.{draft['request_id']}.required_owner_fields", + len(draft["required_owner_fields"]), + 14, + ) + assert_equal( + f"monitoring_owner_request_draft.{draft['request_id']}.blocked_actions", + len(draft["blocked_actions"]), + 24, + ) + assert_true( + f"monitoring_owner_request_draft.{draft['request_id']}.not_approval", + draft["not_approval"], + ) + for false_key in [ + "request_sent", + "recipient_confirmed", + "owner_response_received", + "owner_response_accepted", + "live_evidence_received", + "reload_owner_accepted", + "receiver_owner_accepted", + "route_smoke_accepted", + "maintenance_window_accepted", + "rollback_owner_accepted", + "validation_plan_accepted", + "prometheus_reload_authorized", + "alertmanager_reload_authorized", + "grafana_dashboard_apply_authorized", + "signoz_rule_apply_authorized", + "sentry_deploy_authorized", + "langfuse_config_change_authorized", + "otel_collector_reload_authorized", + "receiver_route_change_authorized", + "silence_policy_change_authorized", + "telegram_send_authorized", + "notification_route_change_authorized", + "webhook_receiver_change_authorized", + "remote_write_change_authorized", + "exporter_deploy_authorized", + "live_alert_fire_authorized", + "alert_chain_smoke_authorized", + "ssh_read_authorized", + "ssh_write_authorized", + "kubectl_action_authorized", + "secret_value_collection_allowed", + "host_write_authorized", + "active_scan_authorized", + "production_write_authorized", + "runtime_gate", + "action_buttons_allowed", + ]: + assert_false( + f"monitoring_owner_request_draft.{draft['request_id']}.{false_key}", + draft[false_key], + ) assert_equal( "public_gateway_preflight_inventory.schema", public_gateway_preflight_inventory["schema_version"],