feat(sre): enforce typed controlled automation

scripts/security/ai-provider-owner-response-acceptance.py

@@ -189,19 +189,20 @@ SURFACES = [
         "requires_live_evidence": True,
     },
     {
-        "surface_id": "ollama_proxy_gateway",
-        "label": "Ollama proxy gateway / local fallback boundary",
-        "expected_scope": "proxy route、local fallback、gateway health",
-        "config_kind": "proxy_gateway",
+        "surface_id": "ollama_provider_transport_boundary",
+        "label": "Ollama direct route / mesh transport / local fallback boundary",
+        "expected_scope": "GCP direct/mesh transport、host111 local boundary、provider health",
+        "config_kind": "provider_transport",
         "source_refs": [
-            "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
+            "ops/monitoring/service-registry.yaml",
+            "k8s/awoooi-prod/04-configmap.yaml",
+            "infra/ansible/playbooks/111-ollama-fallback.yml",
             "apps/api/src/services/ollama_endpoint_resolver.py",
             "apps/api/src/services/ollama_failover_manager.py",
-            "apps/api/src/services/provider_proxy.py",
         ],
         "write_capable_surface": True,
         "paid_provider_related": False,
-        "data_egress_related": False,
+        "data_egress_related": True,
         "requires_live_evidence": True,
     },
     {

scripts/security/high-value-config-change-gate.py

@@ -337,7 +337,8 @@ CATEGORIES = [
             "apps/api/src/services/ai_providers/**",
             "apps/api/src/services/**/*model*",
             "apps/api/src/services/**/*provider*",
-            "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
+            "ops/monitoring/service-registry.yaml",
+            "k8s/awoooi-prod/04-configmap.yaml",
             "docs/ai/**",
             "docs/**/*Ollama*",
         ),

scripts/security/nginx-config-drift-detector.py

@@ -53,15 +53,6 @@ SOURCES = [
         control_tier="C0",
         owner_gate="public_tools_owner_response_required",
     ),
-    NginxSource(
-        config_id="host110_ollama_proxy",
-        host="192.168.0.110",
-        role="ollama_proxy_gateway",
-        source_path="infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
-        live_path="/etc/nginx/sites-enabled/110-ollama-proxy.conf",
-        control_tier="C1",
-        owner_gate="ai_provider_proxy_owner_response_required",
-    ),
 ]