docs(security): 新增 Monitoring owner request draft [skip ci]

docs/workplans/2026-06-04-iwooos-security-governance-p0.md

@@ -25,6 +25,7 @@
 | 最新 P1 Docker / systemd / Host Service 配置控管基準 | repo-only inventory 已固定 `surface=9`、`write_capable=3`、`live_evidence_required=8`、成熟度 `42% -> 50%`；本輪新增 owner request draft，固定 `drafts=9`、`owner_fields=12`、`blocked_actions=14`、request sent / received / accepted / live evidence / restart window / rollback owner / host write / runtime gate 全部 `0` |
 | 最新 P1 SSH / Firewall / Network Access 配置控管基準 | repo-only inventory 已固定 `surface=16`、`write_capable=6`、`live_evidence_required=16`、成熟度 `48% -> 54%`；本輪新增 owner request draft，固定 `drafts=16`、`owner_fields=13`、`blocked_actions=16`、request sent / received / accepted / live access state / firewall / port change / NetworkPolicy / NodePort / WireGuard / host write / runtime gate 全部 `0` |
 | 最新 P1 Backup / Restore / Escrow 配置控管基準 | repo-only inventory 已固定 `surface=38`、`write_capable=27`、`live_evidence_required=38`、成熟度 `52% -> 58%`；本輪新增 owner request draft，固定 `drafts=38`、`owner_fields=14`、`blocked_actions=18`、request sent / received / accepted / backup run / restore run / offsite sync / remote delete / escrow marker / retention change / runtime gate 全部 `0` |
+| 最新 P1 Monitoring / Alerting / Observability 配置控管基準 | repo-only inventory 已固定 `surface=60`、`write_capable=11`、`live_evidence_required=60`、成熟度 `56% -> 62%`；本輪新增 owner request draft，固定 `drafts=60`、`owner_fields=14`、`blocked_actions=24`、request sent / received / accepted / live evidence / reload / receiver route change / Telegram send / alert chain smoke / runtime gate 全部 `0` |
 | 最新 AI Agent automation P1-305 / P1-306 基準 | code `4f0787f8`、deploy marker `af3a9d48`、CD `2592`、code-review `2593`；任務批准邊界與進度彙總已正式驗證；backlog `70%`、done `16/23`、下一步 `P1-001` |
 | 最新 AI Agent automation P1-001 基準 | code `de3007b7`、stability fix `fd33591c`、deploy marker `8caba233`、LOGBOOK / marker 對齊 `37c0e171`；runtime surface `22`、Secret surface `4`、live gaps `6`、backlog `74%`、done `17/23`、下一步 `P1-002` |
 | 最新 AI Agent automation P1-002 基準 | code `943faaee`、stability fix `ff266926`、deploy marker `01b8712d`、LOGBOOK / marker 對齊 `70c01003`；Gitea workflows `9`、runner contracts `4`、需 runner attestation workflows `8`、backlog `78%`、done `18/23`、下一步 `P1-003` |
@@ -230,6 +231,7 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count
 | P1 | Docker / systemd / Host Service owner request draft | 9 個 repo-only surface 已轉成人工送件前草稿，涵蓋 110 / 188 Docker Compose、repair-bot、Ansible role 與 host config backup capture | request sent、owner response、live hash、restart、repair-bot、Ansible apply、host write、runtime gate 全部維持 0 / false |
 | P1 | SSH / Firewall / Network Access owner request draft | 16 個 repo-only surface 已轉成人工送件前草稿，涵蓋 SSH target、known_hosts、CI deploy SSH、sudoers、NetworkPolicy、NodePort、WireGuard 與 alert SSH action | request sent、owner response、live access state、keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change 全部維持 0 / false |
 | P1 | Backup / Restore / Escrow owner request draft | 38 個 repo-only surface 已轉成人工送件前草稿，涵蓋 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook | request sent、owner response、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change 全部維持 0 / false |
+| P1 | Monitoring / Alerting / Observability owner request draft | 60 個 repo-only surface 已轉成人工送件前草稿，涵蓋 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification 與 alert smoke | request sent、owner response、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke 全部維持 0 / false |
 | P1 | Kali 112 維護窗口草案 | 1994 pending updates、`networking.service` failed、服務硬化 0/4、rollback、post-check | P1-7 草案已完成；不 `apt upgrade`、不 restart |
 | P1 | 111 / 168 主機 scope 補強 | P1-8 已補 `DEV-HOSTS-111-168-SCOPE-HANDOFF.md`、snapshot 與 schema；scope、maintenance window、credential handling、rollback owner、validation 指標已可交接 | observe-only；不 credentialed scan、不改 route / CORS / firewall / service |
 | P1 | VibeWork 納入 IwoooS | P1-9 已補 `VIBEWORK-IWOOOS-ONBOARDING-HANDOFF.md`、snapshot 與 schema；repo、product、surface、owner、evidence refs、資料分級、部署邊界與獨立產品邊界已可交接 | 繁中 docs/specs；不合併產品責任、不部署、不改 refs |
@@ -303,6 +305,7 @@ P1 只讀重盤階段整體完成度：`70%`。它代表 freshness / inventory /
 | P1-10 | Docker / systemd / Host Service owner request draft | 已新增 `HOST-SERVICE-OWNER-REQUEST-DRAFT.md`、`host-service-owner-request-draft.snapshot.json` 與產生器；9 個 surface、3 個 write-capable、8 個需 live evidence、12 個 owner 必填欄位、14 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live evidence、restart window、rollback owner、host write、runtime gate 仍全部 `0 / false` |
 | P1-11 | SSH / Firewall / Network Access owner request draft | 已新增 `SSH-NETWORK-OWNER-REQUEST-DRAFT.md`、`ssh-network-owner-request-draft.snapshot.json` 與產生器；16 個 surface、6 個 write-capable、16 個需 live evidence、13 個 owner 必填欄位、16 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live access state、keyscan、known_hosts patch、firewall / port change、NetworkPolicy / NodePort / WireGuard 變更、host write、runtime gate 仍全部 `0 / false` |
 | P1-12 | Backup / Restore / Escrow owner request draft | 已新增 `BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md`、`backup-restore-owner-request-draft.snapshot.json` 與產生器；38 個 surface、27 個 write-capable、38 個需 live evidence、14 個 owner 必填欄位、18 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、runtime gate 仍全部 `0 / false` |
+| P1-13 | Monitoring / Alerting / Observability owner request draft | 已新增 `MONITORING-OWNER-REQUEST-DRAFT.md`、`monitoring-owner-request-draft.snapshot.json` 與產生器；60 個 surface、11 個 write-capable、60 個需 live evidence、14 個 owner 必填欄位、24 類 blocked action | 草稿 artifact `100%`；request sent / received / accepted、live evidence、Prometheus / Alertmanager reload、receiver route change、silence change、Telegram send、alert chain smoke、runtime gate 仍全部 `0 / false` |
 
 ## 7. 2026-06-04 本輪驗證紀錄