feat(sre): close provider and telegram automation receipts

apps/api/src/services/notification_matrix.py

@@ -85,12 +85,39 @@ _SHARED_MONITORING_BOT_ALIAS = "tsenyang_bot"
 _SHARED_MONITORING_BOT_OWNER = "sre_shared_runtime"
 _SHARED_SRE_SIGNAL_FAMILIES = frozenset(
     {
+        "ai_agent",
+        "backup_restore",
+        "infrastructure",
+        "observability",
         "shared_infrastructure",
         "security_incident",
         "disaster_recovery",
         "incident_lifecycle",
     }
 )
+_SHARED_SRE_CROSS_PRODUCT_ROUTES = frozenset(
+    {
+        (
+            "stockplatform-operational-incident-lifecycle",
+            "stockplatform-v2",
+            "incident_lifecycle",
+        ),
+    }
+)
+_SHARED_SRE_DESTINATION_ROLE = "shared_sre_war_room"
+_SHARED_SRE_DURABLE_RECEIPT_BACKEND = (
+    "awoooi.alert_operation_log+telegram_outbound_receipts"
+)
+_ALERT_CATEGORY_ZH_TW_BY_SIGNAL_FAMILY = {
+    "ai_agent": "AI Agent 自動化",
+    "backup_restore": "備份與還原",
+    "infrastructure": "基礎設施",
+    "observability": "可觀測性",
+    "shared_infrastructure": "共享基礎設施",
+    "security_incident": "資安事件",
+    "disaster_recovery": "災難復原",
+    "incident_lifecycle": "事故生命週期",
+}
 _TRUSTED_ALERT_ROUTE_SOURCES = frozenset(
     {
         "hmac_alert_webhook",
@@ -360,18 +387,44 @@ def build_canonical_telegram_routing_runtime_readback(
             requested_destination=route["allowed_destination"],
             registry=registry,
         )
-        resolved_routes.append(
-            {
-                **route,
-                "decision": decision["decision"],
-                "decision_reason": decision["reason"],
-            }
-        )
+        if decision["decision"] == "allow":
+            readiness_reason = "durable_delivery_receipt_not_observed"
+        elif route["egress_status"] == "disabled":
+            readiness_reason = "policy_disabled_no_egress_expected"
+        elif route["egress_status"] == "not_implemented":
+            readiness_reason = "policy_not_implemented_no_egress_expected"
+        else:
+            readiness_reason = "policy_blocked_no_egress_expected"
+        resolved_routes.append({
+            **route,
+            "decision": decision["decision"],
+            "decision_reason": decision["reason"],
+            "alert_category_zh_tw": decision["alert_category_zh_tw"],
+            "destination_role": decision["destination_role"],
+            # This policy-only readback cannot prove a provider-acknowledged,
+            # durable delivery row.  It must never promote route readiness
+            # merely because an allowlist entry and receipt backend exist.
+            "durable_delivery_receipt_present": False,
+            "ready": False,
+            "readiness_reason": readiness_reason,
+        })
 
     allowed_route_count = sum(
         route["decision"] == "allow" for route in resolved_routes
     )
     blocked_route_count = len(resolved_routes) - allowed_route_count
+    allowed_routes = [
+        route for route in resolved_routes if route["decision"] == "allow"
+    ]
+    blocked_routes_fail_closed = all(
+        route["ready"] is False
+        and route["durable_delivery_receipt_present"] is False
+        for route in resolved_routes
+        if route["decision"] != "allow"
+    )
+    all_allowed_route_delivery_receipts_ready = bool(allowed_routes) and all(
+        route["ready"] is True for route in allowed_routes
+    )
     unknown_probe = resolve_canonical_telegram_route(
         "unknown-product",
         "unknown-signal",
@@ -396,7 +449,13 @@ def build_canonical_telegram_routing_runtime_readback(
                 "raw_numeric_destination_count"
             ],
             "destination_identity_exposed": False,
-            "all_product_delivery_receipts_ready": blocked_route_count == 0,
+            "all_product_delivery_receipts_ready": (
+                all_allowed_route_delivery_receipts_ready
+            ),
+            "all_allowed_route_delivery_receipts_ready": (
+                all_allowed_route_delivery_receipts_ready
+            ),
+            "blocked_routes_fail_closed": blocked_routes_fail_closed,
         },
         "rollups": {
             **registry["rollups"],
@@ -466,6 +525,17 @@ def resolve_canonical_telegram_route(
         )
 
     route = dict(candidates[0])
+    route["alert_category_zh_tw"] = _ALERT_CATEGORY_ZH_TW_BY_SIGNAL_FAMILY.get(
+        str(route.get("signal_family") or ""),
+        "其他營運告警",
+    )
+    route["destination_role"] = (
+        _SHARED_SRE_DESTINATION_ROLE
+        if route.get("chat_alias") == _SHARED_SRE_CHAT_ALIAS
+        else "product_owned_route"
+        if route.get("scope") == "product"
+        else "blocked_or_unresolved"
+    )
     route["decision"] = (
         "allow"
         if product is not None
@@ -495,6 +565,8 @@ def _blocked_decision(
 ) -> dict[str, Any]:
     return {
         "route_id": None,
+        "alert_category_zh_tw": "未分類告警",
+        "destination_role": "blocked_or_unresolved",
         "product_id": product_id,
         "signal_family": signal_family,
         "severity": [severity],
@@ -863,16 +935,25 @@ def _validate_shared_sre_boundary(
 ) -> None:
     if route["chat_alias"] != _SHARED_SRE_CHAT_ALIAS:
         return
+    route_identity = (
+        route_id,
+        route["product_id"],
+        route["signal_family"],
+    )
+    product_scope_allowed = route["product_id"] == "awoooi" or (
+        route_identity in _SHARED_SRE_CROSS_PRODUCT_ROUTES
+    )
     invalid = (
-        route["product_id"] != "awoooi"
+        not product_scope_allowed
         or route["scope"] != "shared"
         or route["signal_family"] not in _SHARED_SRE_SIGNAL_FAMILIES
         or not set(route["severity"]).issubset({"P0", "P1"})
         or route["bot_alias"] != _SHARED_MONITORING_BOT_ALIAS
+        or route["receipt_backend"] != _SHARED_SRE_DURABLE_RECEIPT_BACKEND
     )
     if invalid:
         raise ValueError(
-            f"{label}: {route_id} violates shared SRE P0/P1 infra/security/DR/lifecycle boundary"
+            f"{label}: {route_id} violates shared SRE P0/P1 operational allowlist boundary"
         )