feat(governance): 新增 matched PlayBook 學習缺口證據

apps/api/src/services/ai_agent_matched_playbook_learning_gap.py

@@ -1,10 +1,10 @@
 """
 AI Agent matched PlayBook learning gap snapshot.
 
-Loads the latest committed P2-104 matched_playbook_id learning gap contract.
-This module validates repo-committed evidence only; it never reads live DB rows,
-updates PlayBook trust, writes KM, writes timelines, writes Gateway queues,
-sends Telegram messages, reads secrets, or starts runtime work.
+Loads the latest committed P2-104 matched PlayBook learning gap contract. This
+module validates repo-committed evidence only; it never writes learning state,
+updates PlayBook trust, writes KM / LOGBOOK / audit / timeline, writes Gateway
+queues, sends Telegram messages, reads secrets, or starts runtime work.
 """
 
 from __future__ import annotations
@@ -24,7 +24,7 @@ _RUNTIME_AUTHORITY = "matched_playbook_learning_gap_contract_only_no_live_trust_
 def load_latest_ai_agent_matched_playbook_learning_gap(
     evaluations_dir: Path | None = None,
 ) -> dict[str, Any]:
-    """Load the newest committed matched PlayBook learning gap contract."""
+    """Load the newest committed AI Agent matched PlayBook learning gap contract."""
     directory = evaluations_dir or _DEFAULT_EVALUATIONS_DIR
     candidates = sorted(directory.glob(_SNAPSHOT_PATTERN))
     if not candidates:
@@ -37,11 +37,11 @@ def load_latest_ai_agent_matched_playbook_learning_gap(
     if not isinstance(payload, dict):
         raise ValueError(f"{latest}: expected JSON object")
     _require_schema(payload, str(latest))
-    _require_no_live_boundaries(payload, str(latest))
-    _require_learning_checkpoints(payload, str(latest))
-    _require_gap_items(payload, str(latest))
-    _require_test_contracts(payload, str(latest))
-    _require_owner_gates(payload, str(latest))
+    _require_production_readback(payload, str(latest))
+    _require_learning_gap_truth(payload, str(latest))
+    _require_gap_lanes(payload, str(latest))
+    _require_learning_gates(payload, str(latest))
+    _require_writeback_candidates(payload, str(latest))
     _require_redaction_contract(payload, str(latest))
     _require_rollup_consistency(payload, str(latest))
     return payload
@@ -61,140 +61,160 @@ def _require_schema(payload: dict[str, Any], label: str) -> None:
         raise ValueError(f"{label}: next_task_id must be P2-105")
 
 
-def _require_no_live_boundaries(payload: dict[str, Any], label: str) -> None:
+def _require_production_readback(payload: dict[str, Any], label: str) -> None:
+    readback = payload.get("production_readback") or {}
+    if readback.get("readback_mode") != "read_only_db_readback":
+        raise ValueError(f"{label}: production_readback.readback_mode must remain read_only_db_readback")
+    if readback.get("project_id_scope") != "awoooi":
+        raise ValueError(f"{label}: production_readback.project_id_scope must remain awoooi")
+    if readback.get("rls_fail_closed_verified") is not True:
+        raise ValueError(f"{label}: production readback must verify RLS fail-closed")
+
+    total = readback.get("approval_24h_total")
+    matched = readback.get("approval_24h_matched")
+    if not isinstance(total, int) or not isinstance(matched, int):
+        raise ValueError(f"{label}: approval_24h_total and approval_24h_matched must be integers")
+    if matched > total:
+        raise ValueError(f"{label}: approval_24h_matched cannot exceed approval_24h_total")
+    expected_rate = 0 if total == 0 else round((matched / total) * 100)
+    if readback.get("matched_rate_24h_percent") != expected_rate:
+        raise ValueError(f"{label}: matched_rate_24h_percent must match approval 24h readback")
+    if matched != total:
+        raise ValueError(f"{label}: P2-104 expects matched_playbook_id to be present for all 24h approvals")
+    if readback.get("playbook_updated_24h") != 0:
+        raise ValueError(f"{label}: playbook_updated_24h must remain 0 until trust write gate is approved")
+
+
+def _require_learning_gap_truth(payload: dict[str, Any], label: str) -> None:
     truth = payload.get("learning_gap_truth") or {}
     required_true = {
-        "p2_103_result_audit_loaded",
-        "matched_playbook_source_contract_ready",
-        "approval_record_contract_ready",
-        "learning_service_contract_ready",
-        "execution_learning_await_contract_ready",
-        "e2e_test_contract_ready",
-        "owner_gate_contract_ready",
-        "all_checkpoints_have_evidence_ref",
+        "p2_103_task_result_audit_loaded",
+        "production_db_readback_completed",
+        "rls_fail_closed_verified",
+        "matched_playbook_id_present_24h",
+        "matched_playbook_id_gap_resolved",
+        "execution_learning_gap_detected",
+        "approved_without_execution_meta_detected",
+        "playbook_trust_update_gap_detected",
     }
     missing = sorted(field for field in required_true if truth.get(field) is not True)
     if missing:
         raise ValueError(f"{label}: learning gap readiness flags must remain true: {missing}")
 
     required_false = {
-        "runtime_execution_enabled",
-        "live_db_read_enabled",
+        "runtime_learning_write_enabled",
         "playbook_trust_write_enabled",
+        "approval_auto_execute_enabled",
         "km_write_enabled",
+        "logbook_runtime_write_enabled",
+        "audit_db_write_enabled",
         "timeline_write_enabled",
         "gateway_queue_write_enabled",
         "telegram_send_enabled",
         "production_write_enabled",
         "secret_value_read_enabled",
-        "host_or_cluster_command_enabled",
         "destructive_operation_enabled",
+        "work_window_transcript_display_allowed",
     }
     unsafe = sorted(field for field in required_false if truth.get(field) is not False)
     if unsafe:
-        raise ValueError(f"{label}: live read/write/send/execution flags must remain false: {unsafe}")
+        raise ValueError(f"{label}: live write/send/execution flags must remain false: {unsafe}")
 
     zero_counts = {
-        "runtime_execution_count_24h",
-        "live_db_read_count_24h",
+        "playbook_updated_24h",
+        "live_learning_write_count_24h",
         "playbook_trust_write_count_24h",
-        "km_write_count_24h",
-        "timeline_write_count_24h",
         "gateway_queue_write_count_24h",
         "telegram_send_count_24h",
         "production_write_count_24h",
         "secret_value_read_count_24h",
-        "host_or_cluster_command_count_24h",
         "destructive_operation_count_24h",
     }
     non_zero = sorted(field for field in zero_counts if truth.get(field) != 0)
     if non_zero:
-        raise ValueError(f"{label}: live read/write/send/execution counts must remain zero: {non_zero}")
+        raise ValueError(f"{label}: live learning/trust/send/write counts must remain zero: {non_zero}")
+
+    if truth.get("approval_24h_total") != truth.get("approval_24h_matched"):
+        raise ValueError(f"{label}: matched_playbook_id gap must remain resolved for 24h approvals")
+    if truth.get("approved_without_execution_meta_24h", 0) <= 0:
+        raise ValueError(f"{label}: P2-104 must expose approved_without_execution_meta_24h as the active gap")
 
 
-def _require_learning_checkpoints(payload: dict[str, Any], label: str) -> None:
-    checkpoints = payload.get("learning_checkpoints") or []
-    checkpoint_ids = {checkpoint.get("checkpoint_id") for checkpoint in checkpoints}
+def _require_gap_lanes(payload: dict[str, Any], label: str) -> None:
+    lanes = payload.get("gap_lanes") or []
+    lane_ids = {lane.get("lane_id") for lane in lanes}
     required = {
-        "checkpoint_proposal_playbook_match",
-        "checkpoint_approval_record_serialization",
-        "checkpoint_learning_service_update",
-        "checkpoint_execution_await_learning",
-        "checkpoint_repair_candidate_playbook_id",
-        "checkpoint_webhook_source_correlation",
-        "checkpoint_live_null_rate_gate",
+        "lane_matched_id_present",
+        "lane_approved_without_execution_meta",
+        "lane_pending_human_gate",
+        "lane_execution_failed_learning_candidate",
+        "lane_playbook_trust_not_updated",
     }
-    if checkpoint_ids != required:
-        raise ValueError(f"{label}: learning checkpoints must match {sorted(required)}")
+    if lane_ids != required:
+        raise ValueError(f"{label}: gap lanes must match {sorted(required)}")
 
-    valid_status = {
-        "covered_by_test",
-        "covered_by_existing_tests",
-        "source_guarded",
-        "blocked_until_live_evidence",
-    }
-    for checkpoint in checkpoints:
-        checkpoint_id = checkpoint.get("checkpoint_id")
-        if checkpoint.get("current_status") not in valid_status:
-            raise ValueError(f"{label}: checkpoint {checkpoint_id} current_status is invalid")
-        if checkpoint.get("writes_live_state") is not False:
-            raise ValueError(f"{label}: checkpoint {checkpoint_id} writes_live_state must remain false")
-        if not isinstance(checkpoint.get("requires_owner_review"), bool):
-            raise ValueError(f"{label}: checkpoint {checkpoint_id} requires_owner_review must be boolean")
-        for field in {"source_component", "evidence_ref", "expected_signal", "gap_if_missing"}:
-            if not checkpoint.get(field):
-                raise ValueError(f"{label}: checkpoint {checkpoint_id} must list {field}")
-        if not _is_redacted_sha256(checkpoint.get("evidence_hash")):
-            raise ValueError(f"{label}: checkpoint {checkpoint_id} must expose evidence_hash")
+    valid_statuses = {"passed", "blocked", "owner_review_required", "ready"}
+    valid_risks = {"low", "medium", "high", "critical"}
+    for lane in lanes:
+        lane_id = lane.get("lane_id")
+        if lane.get("status") not in valid_statuses:
+            raise ValueError(f"{label}: lane {lane_id} status is invalid")
+        if lane.get("risk_tier") not in valid_risks:
+            raise ValueError(f"{label}: lane {lane_id} risk_tier is invalid")
+        if lane.get("live_write_enabled") is not False:
+            raise ValueError(f"{label}: lane {lane_id} live_write_enabled must remain false")
+        for field in {"display_name", "owner_agent", "evidence", "next_gate"}:
+            if not lane.get(field):
+                raise ValueError(f"{label}: lane {lane_id} must list {field}")
+        if not _is_redacted_sha256(lane.get("evidence_hash")):
+            raise ValueError(f"{label}: lane {lane_id} must expose evidence_hash")
 
 
-def _require_gap_items(payload: dict[str, Any], label: str) -> None:
-    gaps = payload.get("gap_items") or []
-    if not gaps:
-        raise ValueError(f"{label}: gap_items must not be empty")
-    for gap in gaps:
-        gap_id = gap.get("gap_id")
-        if gap.get("severity") not in {"critical", "high", "medium", "low"}:
-            raise ValueError(f"{label}: gap {gap_id} severity is invalid")
-        if not isinstance(gap.get("blocks_trust_write"), bool):
-            raise ValueError(f"{label}: gap {gap_id} blocks_trust_write must be boolean")
-        for field in {"display_name", "current_state", "required_evidence", "owner_next_action"}:
-            if not gap.get(field):
-                raise ValueError(f"{label}: gap {gap_id} must list {field}")
-
-
-def _require_test_contracts(payload: dict[str, Any], label: str) -> None:
-    tests = payload.get("test_contracts") or []
-    if len(tests) < 5:
-        raise ValueError(f"{label}: test_contracts must include at least five tests")
-    for test in tests:
-        test_id = test.get("test_id")
-        if test.get("live_execution_required") is not False:
-            raise ValueError(f"{label}: test {test_id} live_execution_required must remain false")
-        if not test.get("test_ref") or "::" not in test.get("test_ref", ""):
-            raise ValueError(f"{label}: test {test_id} must expose test_ref")
-        if not test.get("expected_result"):
-            raise ValueError(f"{label}: test {test_id} must list expected_result")
-
-
-def _require_owner_gates(payload: dict[str, Any], label: str) -> None:
-    gates = payload.get("owner_gates") or []
+def _require_learning_gates(payload: dict[str, Any], label: str) -> None:
+    gates = payload.get("learning_gates") or []
     gate_ids = {gate.get("gate_id") for gate in gates}
     required = {
-        "gate_read_only_live_null_rate",
-        "gate_playbook_trust_write",
-        "gate_km_timeline_write",
+        "gate_result_capture_contract",
+        "gate_critic_reviewer_score",
+        "gate_learning_writeback_approval",
+        "gate_post_write_verifier",
+        "gate_telegram_operator_receipt",
     }
     if gate_ids != required:
-        raise ValueError(f"{label}: owner gates must match {sorted(required)}")
+        raise ValueError(f"{label}: learning gates must match {sorted(required)}")
     for gate in gates:
         gate_id = gate.get("gate_id")
-        if gate.get("approval_required") is not True:
-            raise ValueError(f"{label}: gate {gate_id} approval_required must remain true")
-        if gate.get("runtime_write_allowed") is not False:
-            raise ValueError(f"{label}: gate {gate_id} runtime_write_allowed must remain false")
-        if not gate.get("blocked_reason"):
-            raise ValueError(f"{label}: gate {gate_id} must list blocked_reason")
+        if gate.get("status") not in {"ready", "needs_owner_review", "blocked_by_policy"}:
+            raise ValueError(f"{label}: gate {gate_id} status is invalid")
+        if gate.get("creates_runtime_write") is not False:
+            raise ValueError(f"{label}: gate {gate_id} creates_runtime_write must remain false")
+        if not gate.get("required_before") or not gate.get("failure_if_missing"):
+            raise ValueError(f"{label}: gate {gate_id} must list required_before and failure_if_missing")
+
+
+def _require_writeback_candidates(payload: dict[str, Any], label: str) -> None:
+    candidates = payload.get("writeback_candidates") or []
+    candidate_ids = {candidate.get("candidate_id") for candidate in candidates}
+    required = {
+        "candidate_approval_execution_bridge",
+        "candidate_learning_service_payload",
+        "candidate_playbook_trust_update",
+        "candidate_operator_learning_report",
+    }
+    if candidate_ids != required:
+        raise ValueError(f"{label}: writeback candidates must match {sorted(required)}")
+    for candidate in candidates:
+        candidate_id = candidate.get("candidate_id")
+        if candidate.get("write_enabled") is not False:
+            raise ValueError(f"{label}: candidate {candidate_id} write_enabled must remain false")
+        if candidate.get("runtime_writer_enabled") is not False:
+            raise ValueError(f"{label}: candidate {candidate_id} runtime_writer_enabled must remain false")
+        if not candidate.get("required_fields"):
+            raise ValueError(f"{label}: candidate {candidate_id} must list required_fields")
+        if not candidate.get("blocker_summary"):
+            raise ValueError(f"{label}: candidate {candidate_id} must list blocker_summary")
+        if not _is_redacted_sha256(candidate.get("evidence_hash")):
+            raise ValueError(f"{label}: candidate {candidate_id} must expose evidence_hash")
 
 
 def _require_redaction_contract(payload: dict[str, Any], label: str) -> None:
@@ -207,67 +227,55 @@ def _require_redaction_contract(payload: dict[str, Any], label: str) -> None:
         "work_window_transcript_display_allowed",
     }
     if contract.get("redaction_required") is not True:
-        raise ValueError(f"{label}: redaction_required must be true")
+        raise ValueError(f"{label}: display redaction must remain required")
     unsafe = sorted(field for field in required_false if contract.get(field) is not False)
     if unsafe:
-        raise ValueError(f"{label}: redaction flags must remain false: {unsafe}")
-    if not contract.get("allowed_display_fields"):
-        raise ValueError(f"{label}: allowed_display_fields must not be empty")
-    if not contract.get("blocked_display_fields"):
-        raise ValueError(f"{label}: blocked_display_fields must not be empty")
+        raise ValueError(f"{label}: display redaction fields must remain false: {unsafe}")
 
 
 def _require_rollup_consistency(payload: dict[str, Any], label: str) -> None:
     rollups = payload.get("rollups") or {}
-    checkpoints = payload.get("learning_checkpoints") or []
-    gaps = payload.get("gap_items") or []
-    tests = payload.get("test_contracts") or []
-    gates = payload.get("owner_gates") or []
+    truth = payload.get("learning_gap_truth") or {}
+    readback = payload.get("production_readback") or {}
+    lanes = payload.get("gap_lanes") or []
+    gates = payload.get("learning_gates") or []
+    candidates = payload.get("writeback_candidates") or []
 
     expected = {
-        "learning_checkpoint_count": len(checkpoints),
-        "covered_by_test_count": sum(
-            1
-            for item in checkpoints
-            if item.get("current_status") in {"covered_by_test", "covered_by_existing_tests"}
-        ),
-        "source_guarded_count": sum(1 for item in checkpoints if item.get("current_status") == "source_guarded"),
-        "blocked_until_live_evidence_count": sum(1 for item in checkpoints if item.get("current_status") == "blocked_until_live_evidence"),
-        "gap_item_count": len(gaps),
-        "high_severity_gap_count": sum(1 for item in gaps if item.get("severity") == "high"),
-        "test_contract_count": len(tests),
-        "owner_gate_count": len(gates),
-        "approval_required_gate_count": sum(1 for item in gates if item.get("approval_required") is True),
+        "gap_lane_count": len(lanes),
+        "passed_lane_count": sum(1 for lane in lanes if lane.get("status") == "passed"),
+        "blocked_lane_count": sum(1 for lane in lanes if lane.get("status") == "blocked"),
+        "owner_review_lane_count": sum(1 for lane in lanes if lane.get("status") == "owner_review_required"),
+        "approval_24h_total": readback.get("approval_24h_total"),
+        "approval_24h_matched": readback.get("approval_24h_matched"),
+        "matched_rate_24h_percent": readback.get("matched_rate_24h_percent"),
+        "approved_without_execution_meta_24h": truth.get("approved_without_execution_meta_24h"),
+        "pending_with_matched_24h": truth.get("pending_with_matched_24h"),
+        "execution_failed_with_matched_24h": truth.get("execution_failed_with_matched_24h"),
+        "playbook_with_execution_stats_count": readback.get("playbook_with_execution_stats"),
+        "playbook_updated_24h_count": readback.get("playbook_updated_24h"),
+        "learning_gate_count": len(gates),
+        "writeback_candidate_count": len(candidates),
+        "live_learning_write_count": truth.get("live_learning_write_count_24h"),
+        "playbook_trust_write_count": truth.get("playbook_trust_write_count_24h"),
+        "gateway_queue_write_count": truth.get("gateway_queue_write_count_24h"),
+        "telegram_send_count": truth.get("telegram_send_count_24h"),
+        "production_write_count": truth.get("production_write_count_24h"),
+        "secret_value_read_count": truth.get("secret_value_read_count_24h"),
+        "destructive_operation_count": truth.get("destructive_operation_count_24h"),
     }
     mismatches = {
-        key: {"expected": value, "actual": rollups.get(key)}
-        for key, value in expected.items()
-        if rollups.get(key) != value
+        key: {"expected": expected_value, "actual": rollups.get(key)}
+        for key, expected_value in expected.items()
+        if rollups.get(key) != expected_value
     }
     if mismatches:
         raise ValueError(f"{label}: rollup counts mismatch: {mismatches}")
 
-    zero_rollups = {
-        "runtime_execution_count",
-        "live_db_read_count",
-        "playbook_trust_write_count",
-        "km_write_count",
-        "timeline_write_count",
-        "gateway_queue_write_count",
-        "telegram_send_count",
-        "production_write_count",
-        "secret_value_read_count",
-        "destructive_operation_count",
-    }
-    non_zero = sorted(field for field in zero_rollups if rollups.get(field) != 0)
-    if non_zero:
-        raise ValueError(f"{label}: rollup live read/write/send/execution counts must remain zero: {non_zero}")
-
 
 def _is_redacted_sha256(value: Any) -> bool:
     if not isinstance(value, str):
         return False
-    if not value.startswith("sha256:"):
+    if not value.startswith("sha256:") or len(value) != 71:
         return False
-    digest = value.removeprefix("sha256:")
-    return len(digest) == 64 and all(char in "0123456789abcdef" for char in digest)
+    return all(char in "0123456789abcdef" for char in value.removeprefix("sha256:"))