wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(governance): 新增服務健康缺口矩陣
All checks were successful
CD Pipeline / tests (push) Successful in 1m28s
Details
Code Review / ai-code-review (push) Successful in 13s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m50s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m55s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-05 14:22:30 +08:00
parent 24d4342e11
commit 1007a1bc04
17 changed files with 1941 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

134
docs/evaluations/ai_agent_automation_backlog_2026-06-04.json
View File

@@ -1,34 +1,34 @@
{
"schema_version": "ai_agent_automation_backlog_v1",
"generated_at": "2026-06-05T13:28:00+08:00",
"generated_at": "2026-06-05T14:05:00+08:00",
"source_inventory_snapshot_ref": "docs/evaluations/ai_agent_automation_inventory_snapshot_2026-06-04_static_seed.json",
"program_status": {
"overall_completion_percent": 87,
"overall_completion_percent": 88,
"current_priority": "P1",
"current_task_id": "P1-004",
"next_task_id": "P1-005",
"current_task_id": "P1-005",
"next_task_id": "P1-006",
"read_only_mode": true
},
"rollups": {
"total_items": 23,
"total_items": 24,
"by_priority": {
"P1": 21,
"P1": 22,
"P2": 1,
"P3": 1
},
"by_status": {
"done": 20,
"done": 21,
"planned": 3
},
"by_gate_status": {
"read_only_allowed": 20,
"read_only_allowed": 21,
"production_change_blocked": 1,
"cost_approval_required": 1,
"blocked_by_evidence": 1
},
"by_owner_agent": {
"hermes": 12,
"openclaw": 10,
"openclaw": 11,
"nemotron": 1
}
},
@@ -421,6 +421,63 @@
]
}
},
{
"item_id": "AUTO-P1-005",
"priority": "P1",
"status": "done",
"workstream_id": "WS3",
"source_asset_id": "service_health_gap_matrix",
"source_signal_kind": "runtime_evidence_gap",
"title": "偵測服務健康缺口與過期端點",
"owner_agent": "openclaw",
"recommended_action": "已建立 service health gap matrix，只整理 committed health / endpoint / stale evidence；不做 live probe、不重啟、不改 endpoint。",
"action_class": "observe",
"gate_status": "read_only_allowed",
"risk_level": "critical",
"evidence_refs": [
"docs/evaluations/service_health_gap_matrix_2026-06-05.json",
"GET /api/v1/agents/service-health-gap-matrix",
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"docs/evaluations/observability_contract_matrix_2026-06-05.json",
"docs/evaluations/gitea_workflow_runner_health_2026-06-05.json"
],
"acceptance_criteria": [
"不做 live probe 或 external health probe",
"不重啟 service / pod / host，不 rollout restart",
"不修改 endpoint / ConfigMap / public URL",
"不讀 Secret payload、不發通知、不觸發 workflow / deploy / runtime execution"
],
"next_review": "P1-006",
"approval_boundary": {
"mode": "read_only_allowed",
"display_summary": "只允許整理 committed service health gap evidence 與需處置清單；不得 live probe、重啟、改 endpoint 或發通知。",
"allowed_actions": [
"讀取 committed snapshot",
"整理健康缺口",
"顯示治理 UI",
"準備 operator review 清單"
],
"blocked_actions": [
"production_write",
"runtime_execution",
"destructive_operation",
"secret_plaintext_collection",
"live_probe",
"service_restart",
"endpoint_change",
"notification_send"
],
"requires_operator_approval_for": [
"live probe",
"服務重啟",
"endpoint / ConfigMap 修改",
"Telegram / AwoooP 通知發送",
"runtime execution"
]
}
},
{
"item_id": "AUTO-P1-007",
"priority": "P1",
@@ -1142,9 +1199,9 @@
"destructive_operation_allowed": false
},
"item_approval_boundary_rollup": {
"total_items": 23,
"total_items": 24,
"by_mode": {
"read_only_allowed": 20,
"read_only_allowed": 21,
"production_change_blocked": 1,
"cost_approval_required": 1,
"blocked_by_evidence": 1
@@ -1155,14 +1212,11 @@
"AUTO-P3-001"
],
"items_with_blocked_operations": [
"AUTO-P1-303",
"AUTO-P1-304",
"AUTO-P1-305",
"AUTO-P1-306",
"AUTO-P1-001",
"AUTO-P1-002",
"AUTO-P1-003",
"AUTO-P1-004",
"AUTO-P1-005",
"AUTO-P1-007",
"AUTO-P1-101",
"AUTO-P1-102",
@@ -1176,22 +1230,26 @@
"AUTO-P1-204",
"AUTO-P1-205",
"AUTO-P1-206",
"AUTO-P1-303",
"AUTO-P1-304",
"AUTO-P1-305",
"AUTO-P1-306",
"AUTO-P2-004",
"AUTO-P3-001"
]
},
"progress_summary": {
"overall_percent": 87,
"done_items": 20,
"overall_percent": 88,
"done_items": 21,
"planned_items": 3,
"total_items": 23,
"total_items": 24,
"formula": "round(done_items / total_items * 100)，只有 status=done 計入完成；planned/in_progress/blocked/deferred/rejected 不計入。",
"by_priority": [
{
"priority": "P1",
"completion_percent": 95,
"done_items": 20,
"total_items": 21
"done_items": 21,
"total_items": 22
},
{
"priority": "P2",
@@ -1215,14 +1273,30 @@
"total_items": 3,
"next_task_id": "P3-001"
},
{
"workstream_id": "WS8",
"display_name": "產品 UI",
"completion_percent": 100,
"done_items": 2,
"total_items": 2,
"next_task_id": "complete"
},
{
"workstream_id": "WS3",
"display_name": "監控自動化",
"completion_percent": 100,
"done_items": 4,
"total_items": 4,
"done_items": 5,
"total_items": 5,
"next_task_id": "complete"
},
{
"workstream_id": "WS7",
"display_name": "安全執行關卡",
"completion_percent": 0,
"done_items": 0,
"total_items": 1,
"next_task_id": "P1-007"
},
{
"workstream_id": "WS4",
"display_name": "備份與 DR 自動化",
@@ -1246,22 +1320,6 @@
"done_items": 0,
"total_items": 1,
"next_task_id": "P2-004"
},
{
"workstream_id": "WS7",
"display_name": "安全執行關卡",
"completion_percent": 0,
"done_items": 0,
"total_items": 1,
"next_task_id": "P1-007"
},
{
"workstream_id": "WS8",
"display_name": "產品 UI",
"completion_percent": 100,
"done_items": 2,
"total_items": 2,
"next_task_id": "complete"
}
]
}

90
docs/evaluations/ai_agent_automation_inventory_snapshot_2026-06-04_static_seed.json
View File

@@ -1,11 +1,11 @@
{
"schema_version": "ai_agent_automation_inventory_snapshot_v1",
"generated_at": "2026-06-05T13:28:00+08:00",
"generated_at": "2026-06-05T14:05:00+08:00",
"program_status": {
"overall_completion_percent": 100,
"current_priority": "P1",
"current_task_id": "P1-004",
"next_task_id": "P1-005",
"current_task_id": "P1-005",
"next_task_id": "P1-006",
"read_only_mode": true
},
"status_taxonomy": {
@@ -451,6 +451,21 @@
"docs/evaluations/docker_build_surface_inventory_2026-06-04.json"
],
"next_action": "P1-206 產生 Docker base image digest、binary source、CVE 與 rebuild approval package。"
},
{
"asset_id": "service_health_gap_matrix",
"domain_id": "services",
"display_name": "服務健康缺口與過期端點矩陣",
"asset_type": "read_only_health_gap_matrix",
"status": "ready_for_review",
"gate_status": "read_only_allowed",
"owner_agent": "openclaw",
"risk_level": "high",
"evidence_refs": [
"docs/evaluations/service_health_gap_matrix_2026-06-05.json",
"GET /api/v1/agents/service-health-gap-matrix"
],
"next_action": "P1-006 在治理頁顯示 service health 證據卡；不得做 live probe、重啟或改 endpoint。"
}
],
"workstreams": [
@@ -1484,6 +1499,44 @@
"付費 API 呼叫"
]
}
},
{
"task_id": "P1-005",
"priority": "P1",
"status": "done",
"completion_percent": 100,
"owner_agent": "openclaw",
"title": "偵測服務健康缺口與過期端點",
"output": "docs/evaluations/service_health_gap_matrix_2026-06-05.json + GET /api/v1/agents/service-health-gap-matrix",
"gate_status": "read_only_allowed",
"next_action": "完成 committed service health gap matrix；下一步 P1-006 在 UI 顯示 service health 證據卡。",
"approval_boundary": {
"mode": "read_only_allowed",
"display_summary": "只允許整理 committed service health gap evidence 與需處置清單；不得 live probe、重啟、改 endpoint 或發通知。",
"allowed_actions": [
"讀取 committed snapshot",
"整理健康缺口",
"顯示治理 UI",
"準備 operator review 清單"
],
"blocked_actions": [
"production_write",
"runtime_execution",
"destructive_operation",
"secret_plaintext_collection",
"live_probe",
"service_restart",
"endpoint_change",
"notification_send"
],
"requires_operator_approval_for": [
"live probe",
"服務重啟",
"endpoint / ConfigMap 修改",
"Telegram / AwoooP 通知發送",
"runtime execution"
]
}
}
],
"evidence": [
@@ -1818,6 +1871,18 @@
"source_ref": "GET /api/v1/agents/ai-provider-route-matrix",
"status": "done",
"summary": "只讀呈現 AI Router / Ollama / OpenClaw / Nemotron / Gemini provider route、候選 Gate、來源缺口與不可誤讀合約；不切 provider、不呼叫付費 API、不讀 Secret。"
},
{
"evidence_id": "service_health_gap_matrix_snapshot",
"kind": "committed_snapshot",
"ref": "docs/evaluations/service_health_gap_matrix_2026-06-05.json",
"result": "P1-005 committed service health gap matrix 已建立，涵蓋 10 個 service health target、3 個 stale endpoint、5 個 health gap；重啟、endpoint 修改、active probe、通知與 runtime execution 入口皆為 0。"
},
{
"evidence_id": "service_health_gap_matrix_api",
"kind": "read_only_api",
"ref": "GET /api/v1/agents/service-health-gap-matrix",
"result": "只讀 API 回傳 service_health_gap_matrix_v1；不做 live probe、不重啟服務、不改 endpoint、不讀 Secret/Redis/DB payload、不發通知。"
}
],
"approval_boundaries": {
@@ -1828,10 +1893,10 @@
"destructive_operation_allowed": false
},
"task_approval_boundary_rollup": {
"total_tasks": 30,
"total_tasks": 31,
"by_mode": {
"ready_for_operator_review": 1,
"read_only_allowed": 27,
"read_only_allowed": 28,
"approval_required": 1,
"production_change_blocked": 1
},
@@ -1852,12 +1917,8 @@
"P1-001",
"P1-002",
"P1-003",
"P1-301",
"P1-302",
"P1-303",
"P1-304",
"P1-305",
"P1-306",
"P1-004",
"P1-005",
"P1-101",
"P1-102",
"P1-103",
@@ -1870,7 +1931,12 @@
"P1-204",
"P1-205",
"P1-206",
"P1-004"
"P1-301",
"P1-302",
"P1-303",
"P1-304",
"P1-305",
"P1-306"
]
}
}

439
docs/evaluations/service_health_gap_matrix_2026-06-05.json Normal file
View File

@@ -0,0 +1,439 @@
{
"schema_version": "service_health_gap_matrix_v1",
"generated_at": "2026-06-05T14:05:00+08:00",
"program_status": {
"overall_completion_percent": 100,
"current_priority": "P1",
"current_task_id": "P1-005",
"next_task_id": "P1-006",
"read_only_mode": true
},
"source_refs": [
"docs/schemas/service_health_gap_matrix_v1.schema.json",
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/reference/ALERT-TAXONOMY-CATALOG.md",
"apps/api/src/core/config.py",
"apps/api/src/api/v1/health.py",
"apps/api/src/services/ai_provider_route_matrix.py",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"docs/evaluations/observability_contract_matrix_2026-06-05.json",
"docs/evaluations/gitea_workflow_runner_health_2026-06-05.json",
"k8s/awoooi-prod/05-deployment-web.yaml",
"apps/api/src/services/metrics_service.py",
"apps/api/src/services/ai_providers/ollama.py",
"apps/api/src/services/ai_providers/openclaw_nemo.py",
"scripts/ops/backup-health-textfile-exporter.py",
"docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md"
],
"rollups": {
"total_targets": 10,
"by_kind": {
"api_health": 1,
"web_health": 1,
"ai_provider_health": 2,
"observability_health": 3,
"devops_health": 1,
"backup_health": 1,
"security_edge_health": 1
},
"by_status": {
"verified": 5,
"action_required": 5
},
"by_freshness_status": {
"fresh_readback": 1,
"manifest_mapped": 1,
"source_mismatch": 3,
"committed_health_hook": 1,
"stale_evidence": 1,
"committed_exporter": 1,
"source_heartbeat_contract": 1,
"manifest_only": 1
},
"target_ids_requiring_action": [
"gitea_workflow_runner_health_contract",
"kali_scanner_health_reference",
"ollama_three_layer_health_contract",
"openclaw_health_endpoint_contract",
"prometheus_alertmanager_endpoint_reference"
],
"health_gap_ids": [
"endpoint_reference_stale_hosts",
"gitea_runner_attestation_health_gap",
"health_check_script_not_authoritative",
"openclaw_nemo_rca_health_review",
"security_scanner_health_evidence_gap"
],
"stale_endpoint_ids": [
"legacy_188_ollama_provider_endpoint",
"openclaw_8088_comment_vs_8089_contract",
"prometheus_alertmanager_110_188_split"
],
"critical_target_ids": [
"ollama_three_layer_health_contract",
"openclaw_health_endpoint_contract",
"production_api_health_public",
"gitea_workflow_runner_health_contract"
],
"read_only_denials_total": 10,
"service_restart_allowed_count": 0,
"endpoint_change_allowed_count": 0,
"active_probe_allowed_count": 0,
"notification_send_allowed_count": 0,
"runtime_execution_allowed_count": 0
},
"service_health_targets": [
{
"target_id": "production_api_health_public",
"display_name": "Production API Health",
"kind": "api_health",
"status": "verified",
"risk_level": "critical",
"freshness_status": "fresh_readback",
"health_contract": "`/api/v1/health` 是正式環境健康讀回入口，回傳 PostgreSQL / Redis / Ollama / OpenClaw / SigNoz 等 component 狀態與 `mock_mode=false`。",
"endpoint_contract": "正式站以 `https://awoooi.wooo.work/api/v1/health` 讀回；P1-005 只記錄現有讀回形狀，不新增 probe。",
"evidence_refs": [
"apps/api/src/api/v1/health.py",
"docs/LOGBOOK.md",
"docs/runbooks/AWOOOP-RLS-CANARY-WAVE1.md"
],
"next_action": "P1-006 只把健康證據卡顯示到 UI；不得把讀回成功解讀成可重啟或改 endpoint。"
},
{
"target_id": "awoooi_web_health_manifest",
"display_name": "AWOOOI Web /api/health",
"kind": "web_health",
"status": "verified",
"risk_level": "high",
"freshness_status": "manifest_mapped",
"health_contract": "Web deployment liveness / readiness / startup probe 皆指向 `/api/health`。",
"endpoint_contract": "只讀 K8s manifest；不 patch deployment、不 rollout restart、不改 public URL。",
"evidence_refs": [
"k8s/awoooi-prod/05-deployment-web.yaml"
],
"next_action": "P1-006 顯示 manifest health contract；任何 probe path 變更需另開部署批准。"
},
{
"target_id": "ollama_three_layer_health_contract",
"display_name": "Ollama 三層健康合約",
"kind": "ai_provider_health",
"status": "action_required",
"risk_level": "critical",
"freshness_status": "source_mismatch",
"health_contract": "目前 AI provider route truth 是 GCP-A → GCP-B → 111；Gemini 只作 final fallback。",
"endpoint_contract": "`SERVICE-ENDPOINTS.md` 仍有 188 Ollama 參考，`scripts/health_check_session.sh` 又檢查 111 / 110；需把 endpoint truth 收斂為 owner-attested source，不可直接改路由。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"apps/api/src/services/ai_providers/ollama.py"
],
"next_action": "只開 health evidence card 與 endpoint truth review；不得改 `OLLAMA_*`、不重啟 Ollama、不做 live benchmark。"
},
{
"target_id": "openclaw_health_endpoint_contract",
"display_name": "OpenClaw 健康端點合約",
"kind": "ai_provider_health",
"status": "action_required",
"risk_level": "critical",
"freshness_status": "source_mismatch",
"health_contract": "OpenClaw 仍是生產仲裁核心；health check 使用 `OPENCLAW_URL/health`。",
"endpoint_contract": "`SERVICE-ENDPOINTS.md` 已標 8089，但 `openclaw_nemo.py` 註解仍殘留 8088；需收斂註解與 runbook truth。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"apps/api/src/services/ai_providers/openclaw_nemo.py",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json"
],
"next_action": "只提出 source cleanup；不得重啟 OpenClaw、不得把 health gap 當成替換 OpenClaw 批准。"
},
{
"target_id": "prometheus_alertmanager_endpoint_reference",
"display_name": "Prometheus / Alertmanager 端點參考",
"kind": "observability_health",
"status": "action_required",
"risk_level": "high",
"freshness_status": "source_mismatch",
"health_contract": "Prometheus / Alertmanager 只允許 read-only readiness evidence；Alertmanager 仍必須走 AWOOOI API，不得指向 OpenClaw receiver。",
"endpoint_contract": "`SERVICE-ENDPOINTS.md` 記錄 188:9090 / 9093，`health_check_session.sh` 檢查 110:9090 / 9093；需要 owner attestation。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/evaluations/observability_contract_matrix_2026-06-05.json"
],
"next_action": "P1-006 顯示 source mismatch；不得改 alert rule、receiver、route 或 silence。"
},
{
"target_id": "signoz_clickhouse_health_contract",
"display_name": "SigNoz / ClickHouse 健康合約",
"kind": "observability_health",
"status": "verified",
"risk_level": "high",
"freshness_status": "committed_health_hook",
"health_contract": "metrics service 有 ClickHouse health check；observability matrix 已把 SigNoz / ClickHouse 視為 committed evidence。",
"endpoint_contract": "只讀 committed health hook 與 matrix；不改 SigNoz query、不改 ClickHouse datasource。",
"evidence_refs": [
"apps/api/src/services/metrics_service.py",
"docs/evaluations/observability_contract_matrix_2026-06-05.json"
],
"next_action": "後續若要 live query，需另開批准；P1-005 只呈現 committed evidence。"
},
{
"target_id": "sentry_source_health_contract",
"display_name": "Sentry Source Health",
"kind": "observability_health",
"status": "verified",
"risk_level": "medium",
"freshness_status": "source_heartbeat_contract",
"health_contract": "Source provider heartbeat 與 upstream canary 已被 observability matrix 納入來源證據；P1-005 不呼叫 Sentry API。",
"endpoint_contract": "只讀 source-link / heartbeat contract；不改 webhook、不讀 Sentry token。",
"evidence_refs": [
"docs/evaluations/observability_contract_matrix_2026-06-05.json",
"docs/reference/SERVICE-ENDPOINTS.md"
],
"next_action": "P1-006 顯示 source heartbeat contract；token / webhook 變更需另行批准。"
},
{
"target_id": "gitea_workflow_runner_health_contract",
"display_name": "Gitea Workflow / Runner Health",
"kind": "devops_health",
"status": "action_required",
"risk_level": "critical",
"freshness_status": "stale_evidence",
"health_contract": "Gitea workflow runner health matrix 已完成，但 runner owner attestation gap 仍需處置。",
"endpoint_contract": "只讀 Gitea workflow / runner snapshot；不重啟 runner、不停止 container、不觸發 workflow。",
"evidence_refs": [
"docs/evaluations/gitea_workflow_runner_health_2026-06-05.json",
"docs/LOGBOOK.md"
],
"next_action": "保留 owner attestation 待補；不得用 P1-005 觸發 Gitea Actions 或 runner mutation。"
},
{
"target_id": "backup_health_exporter_freshness",
"display_name": "Backup Health Exporter Freshness",
"kind": "backup_health",
"status": "verified",
"risk_level": "high",
"freshness_status": "committed_exporter",
"health_contract": "backup health textfile exporter 已定義 backup freshness、restore drill freshness、offsite freshness 與 escrow freshness metrics。",
"endpoint_contract": "只讀 exporter contract；不執行 backup / restore / offsite sync，不寫 credential marker。",
"evidence_refs": [
"scripts/ops/backup-health-textfile-exporter.py",
"docs/evaluations/backup_dr_readiness_matrix_2026-06-04.json",
"docs/evaluations/offsite_escrow_readiness_status_2026-06-05.json"
],
"next_action": "維持成功不洗版；失敗或 stale 才進 P1-007 通知合約。"
},
{
"target_id": "kali_scanner_health_reference",
"display_name": "Kali Scanner Health Reference",
"kind": "security_edge_health",
"status": "action_required",
"risk_level": "medium",
"freshness_status": "manifest_only",
"health_contract": "`SERVICE-ENDPOINTS.md` 記錄 Kali Scanner `192.168.0.112:8080`，但 P1-005 不做 live probe。",
"endpoint_contract": "只讀服務端點參考；不啟動掃描、不呼叫 scanner、不改 host 服務。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"docs/LOGBOOK.md"
],
"next_action": "P1-006 僅顯示需 owner attestation；真正掃描健康檢查需另行批准。"
}
],
"health_gaps": [
{
"gap_id": "endpoint_reference_stale_hosts",
"display_name": "端點參考存在主機 truth drift",
"status": "action_required",
"severity": "high",
"summary": "服務端點文件、health script、AI provider route matrix 對 Ollama / Prometheus / Alertmanager / OpenClaw 的主機來源不完全一致。",
"target_ids": [
"ollama_three_layer_health_contract",
"openclaw_health_endpoint_contract",
"prometheus_alertmanager_endpoint_reference"
],
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json"
],
"next_action": "建立 owner attestation / source cleanup，不直接改 endpoint。"
},
{
"gap_id": "gitea_runner_attestation_health_gap",
"display_name": "Runner 健康仍缺 owner attestation",
"status": "action_required",
"severity": "high",
"summary": "P1-002 已列 runner attestation gap；P1-005 只把它納入 service health 缺口，不觸發 runner 操作。",
"target_ids": [
"gitea_workflow_runner_health_contract"
],
"evidence_refs": [
"docs/evaluations/gitea_workflow_runner_health_2026-06-05.json"
],
"next_action": "由 P1-006 顯示，P1-007 才定義失敗限定通知。"
},
{
"gap_id": "health_check_script_not_authoritative",
"display_name": "健康檢查腳本不是唯一真相來源",
"status": "proposal_required",
"severity": "medium",
"summary": "`scripts/health_check_session.sh` 可供人工會前檢查，但它與正式 K8s / public health / provider matrix 的 truth chain 需對齊。",
"target_ids": [
"production_api_health_public",
"prometheus_alertmanager_endpoint_reference",
"kali_scanner_health_reference"
],
"evidence_refs": [
"scripts/health_check_session.sh",
"docs/reference/SERVICE-ENDPOINTS.md"
],
"next_action": "只產生 P1-006 顯示與後續 runbook cleanup 提案。"
},
{
"gap_id": "openclaw_nemo_rca_health_review",
"display_name": "OpenClaw / Nemo RCA 健康仍需複核",
"status": "action_required",
"severity": "high",
"summary": "AI provider route matrix 將 OpenClaw Nemo RCA lane 標為需處置；P1-005 不改 provider，只列健康缺口。",
"target_ids": [
"openclaw_health_endpoint_contract"
],
"evidence_refs": [
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"apps/api/src/services/ai_providers/openclaw_nemo.py"
],
"next_action": "用 replay / smoke 證據補強，不把 health review 當作 OpenClaw 替換批准。"
},
{
"gap_id": "security_scanner_health_evidence_gap",
"display_name": "Kali scanner 只有 endpoint reference",
"status": "proposal_required",
"severity": "medium",
"summary": "Security edge 目前只有服務端點參考，缺少 committed health contract 或 owner attestation。",
"target_ids": [
"kali_scanner_health_reference"
],
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md"
],
"next_action": "後續建立 read-only scanner health evidence card；不得啟動掃描。"
}
],
"stale_endpoints": [
{
"endpoint_id": "legacy_188_ollama_provider_endpoint",
"display_name": "legacy 188 Ollama endpoint reference",
"status": "action_required",
"severity": "high",
"stale_ref": "`docs/reference/SERVICE-ENDPOINTS.md` 仍列 `192.168.0.188:11434` 為 Ollama。",
"current_truth": "P1-004 provider route truth 是 GCP-A → GCP-B → 111；188 不再作為 AWOOOI Ollama provider。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"apps/api/src/services/ai_providers/ollama.py"
],
"next_action": "準備 source cleanup 批准包；不得改 `OLLAMA_URL` 或重啟 Ollama。"
},
{
"endpoint_id": "prometheus_alertmanager_110_188_split",
"display_name": "Prometheus / Alertmanager 110 與 188 參考分裂",
"status": "action_required",
"severity": "medium",
"stale_ref": "`SERVICE-ENDPOINTS.md` 使用 188，`health_check_session.sh` 使用 110。",
"current_truth": "P1-005 只判定為 source mismatch，需要 owner attestation；不判定 live service down。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"scripts/health_check_session.sh",
"docs/evaluations/observability_contract_matrix_2026-06-05.json"
],
"next_action": "只補 truth owner；不得改 Alertmanager route 或 receiver。"
},
{
"endpoint_id": "openclaw_8088_comment_vs_8089_contract",
"display_name": "OpenClaw 8088 註解與 8089 合約不一致",
"status": "action_required",
"severity": "medium",
"stale_ref": "`openclaw_nemo.py` 註解仍提到 `192.168.0.188:8088`。",
"current_truth": "`SERVICE-ENDPOINTS.md` 與設定使用 OpenClaw 8089；P1-005 只標記註解 / runbook drift。",
"evidence_refs": [
"apps/api/src/services/ai_providers/openclaw_nemo.py",
"docs/reference/SERVICE-ENDPOINTS.md",
"apps/api/src/core/config.py"
],
"next_action": "後續 source cleanup 不得改 provider route 或降級 OpenClaw。"
}
],
"latest_observations": [
{
"observation_id": "service_health_gap_matrix_seed",
"status": "verified",
"summary": "P1-005 只讀收斂 committed health / endpoint / stale evidence；不做 live probe。",
"evidence_refs": [
"docs/reference/SERVICE-ENDPOINTS.md",
"docs/evaluations/ai_provider_route_matrix_2026-06-05.json",
"docs/evaluations/observability_contract_matrix_2026-06-05.json"
]
},
{
"observation_id": "active_probe_denied",
"status": "preserved",
"summary": "本矩陣沒有呼叫任何內網、外部 provider、Sentry、SigNoz、Gitea 或 scanner health endpoint。",
"evidence_refs": [
"docs/HARD_RULES.md",
"docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md"
]
}
],
"operator_contract": {
"display_mode": "read_only_service_health_gap_matrix",
"must_not_interpret_as": [
"服務重啟批准",
"endpoint 修改批准",
"active probe 批准",
"live health check 已執行",
"Secret payload 已讀取或可輸出",
"Telegram 成功通知批准",
"workflow / deploy / reload 觸發批准",
"provider 切換批准",
"runtime execution 授權",
"OpenClaw 取代或降級批准"
],
"secret_display_policy": "只顯示來源檔案與 env var 名稱，不輸出 secret payload。",
"restart_policy": "P1-005 只能列缺口；任何 service / pod / host restart 都需另行批准。",
"endpoint_policy": "P1-005 不修改端點、不改 ConfigMap、不改 public URL，只提出 source truth cleanup。",
"notification_policy": "成功 smoke 不通知；只有失敗、stale、action-required 才進 P1-007 通知合約。"
},
"operation_boundaries": {
"read_only_api_allowed": true,
"service_restart_allowed": false,
"pod_restart_allowed": false,
"host_restart_allowed": false,
"rollout_restart_allowed": false,
"endpoint_change_allowed": false,
"configmap_patch_allowed": false,
"active_probe_allowed": false,
"external_health_probe_allowed": false,
"live_benchmark_allowed": false,
"provider_switch_allowed": false,
"paid_api_call_allowed": false,
"secret_read_allowed": false,
"secret_plaintext_allowed": false,
"notification_send_allowed": false,
"workflow_trigger_allowed": false,
"deploy_trigger_allowed": false,
"reload_trigger_allowed": false,
"runtime_execution_allowed": false
},
"approval_boundaries": {
"service_restart_approved": false,
"endpoint_change_approved": false,
"configmap_patch_approved": false,
"active_probe_approved": false,
"secret_read_approved": false,
"notification_send_approved": false,
"workflow_trigger_approved": false,
"provider_switch_approved": false,
"cost_change_approved": false
}
}