From 6ff0c2e5265f7713df2416b9dd064a8ca246c797 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 12 Jun 2026 01:01:04 +0800 Subject: [PATCH] =?UTF-8?q?docs(logbook):=20=E8=A8=98=E9=8C=84=20monitorin?= =?UTF-8?q?g=20alerting=20=E6=B8=85=E5=86=8A=E6=AD=A3=E5=BC=8F=E9=A9=97?= =?UTF-8?q?=E8=AD=89=20[skip=20ci]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/LOGBOOK.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index eaf1d5845..d713a3ec5 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,60 @@ +## 2026-06-12｜IwoooS P1-4 Monitoring / alerting / observability repo-only 清冊 + +**背景**：統帥要求所有重要配置都要被資安控管；Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / OTEL / Telegram notification route 會直接影響即時資安事件是否能被發現、路由、降噪與送達。本段延續「先建立框架、只讀證據、低摩擦流程，再階段性收攏」原則，只做 repo-only 清冊，不碰 live monitoring stack、不 reload、不發 Telegram、不建立 silence。 + +**完成**： + +- 新增 `monitoring_alerting_observability_inventory_v1` 產生器、schema、snapshot 與人讀文件，納入 `60` 個 repo-only surface。 +- 清冊覆蓋 `8` 個 Prometheus config surface、`13` 個 alert rule surface、`1` 個 Alertmanager receiver surface、`6` 個 Grafana surface、`3` 個 SigNoz surface、`4` 個 Sentry surface、`3` 個 Langfuse surface、`4` 個 notification policy surface、`3` 個 Telegram surface、`1` 個 OTEL surface、`6` 個 deploy / reload surface、`1` 個 drift guard surface 與 `4` 個 smoke surface。 +- 標記 `11` 個 write-capable surface：Alertmanager / Prometheus deploy 或 reload script、monitoring exporter deploy、Sentry deploy、Telegram gateway、notification manager、recurrence notifier、live/test alert script。 +- owner response received / accepted、live evidence、reload owner、receiver owner、route smoke、maintenance window、rollback owner、runtime gate 與 action button 全部仍為 `0`。 +- 高價值配置覆蓋矩陣的 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；全域平均只讀成熟度從 `65%` 推進到 `66%`。這只代表 repo-only 清冊完成，不代表 live alert chain、reload、receiver route、Telegram receipt 或告警必到已驗證。 +- IwoooS posture projection snapshot / schema、`security-mirror-progress-guard.py`、高價值配置文件、配置控管總清冊與前端高價值配置卡已同步新口徑。 +- `/zh-TW/iwooos` 的 P1-4 卡由 `56%` 更新為 `62%`，並新增 `monitoring_alerting_observability_inventory_surface_count=60`、`monitoring_alerting_observability_inventory_alert_rule_surface_count=13`、`monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6`、`monitoring_alerting_observability_inventory_write_capable_surface_count=11`、`monitoring_alerting_observability_inventory_runtime_gate_count=0`、`prometheus_reload_authorized=false`、`alertmanager_reload_authorized=false`、`grafana_dashboard_apply_authorized=false`、`signoz_rule_apply_authorized=false`、`sentry_deploy_authorized=false`、`langfuse_config_change_authorized=false`、`otel_collector_reload_authorized=false`、`receiver_route_change_authorized=false`、`silence_policy_change_authorized=false`、`telegram_send_authorized=false`、`notification_route_change_authorized=false`、`webhook_receiver_change_authorized=false`、`remote_write_change_authorized=false`、`exporter_deploy_authorized=false`、`live_alert_fire_authorized=false`、`alert_chain_smoke_authorized=false` 等前台邊界標記；仍無任何操作按鈕。 + +**本地驗證**： + +- `python3 scripts/security/monitoring-alerting-observability-inventory.py --root . --generated-at 2026-06-12T09:00:00+08:00 --output docs/security/monitoring-alerting-observability-inventory.snapshot.json`：`MONITORING_ALERTING_OBSERVABILITY_INVENTORY_OK surfaces=60 alert_rules=13 write_capable=11 runtime_gate=0`。 +- `python3 scripts/security/high-value-config-control-coverage.py --root . --generated-at 2026-06-12T09:05:00+08:00 --output docs/security/high-value-config-control-coverage.snapshot.json`：`HIGH_VALUE_CONFIG_CONTROL_COVERAGE_OK categories=14 c0=8 avg=66 runtime_gate=0`。 +- JSON parse：monitoring / alerting snapshot / schema、高價值覆蓋 snapshot、IwoooS posture projection snapshot / schema、`zh-TW.json`、`en.json` 通過。 +- `cmp -s apps/web/messages/zh-TW.json apps/web/messages/en.json`：通過。 +- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。 +- `python3 scripts/security/source-control-owner-response-guard.py --root .`：`SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。 +- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea`：`DOC_SECRET_SANITY_OK scanned_files=698`。 +- `python3 -m py_compile scripts/security/monitoring-alerting-observability-inventory.py scripts/security/high-value-config-control-coverage.py scripts/security/security-mirror-progress-guard.py`：通過。 +- `pnpm --filter @awoooi/web typecheck`：通過；驗證產生的 `apps/web/tsconfig.tsbuildinfo` 暫態變更已排除。 +- 本次前台與新文件目標檔針對內部視窗、內部對話與請求片語掃描：命中 `0`。 +- `git diff --check` / `git diff --cached --check`：通過。 + +**Gitea / deploy**： + +- 同步另一個 Session 的 `7a7daa33 feat(governance): 新增 runtime write gate review` 與 LOGBOOK 後續補記後，再接續 P1-4，避免覆蓋 P2-403G。 +- Code commit：`8a424f0c feat(security): 新增 monitoring alerting 只讀清冊`。 +- Code-review run：`4012` 成功。 +- CD run：`4011` 成功；deploy marker：`72143ccf chore(cd): deploy 8a424f0 [skip ci]`。 + +**正式站驗證**： + +- Desktop `1440x1000`：`https://awoooi.wooo.work/zh-TW/iwooos?_v=72143ccf-monitoring-prod-desktop`，`data-testid="iwooos-high-value-config-control-coverage-board"` 與 `data-testid="iwooos-high-value-config-control-coverage-boundaries"` 存在且可見。 +- Desktop DOM：高價值配置平均 `66%`、P1-4 Monitoring 卡 `62%`、surface `60`、alert rules `13`、write-capable `11`、runtime gate `0` 均可見；卡內 button `0`；`scrollWidth - clientWidth = 0`；目標敏感片語命中 `0`。 +- Desktop boundary DOM 含 `monitoring_alerting_observability_inventory_surface_count=60`、`monitoring_alerting_observability_inventory_alert_rule_surface_count=13`、`monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6`、`monitoring_alerting_observability_inventory_write_capable_surface_count=11`、`monitoring_alerting_observability_inventory_runtime_gate_count=0`、`prometheus_reload_authorized=false`、`alertmanager_reload_authorized=false`、`grafana_dashboard_apply_authorized=false`、`signoz_rule_apply_authorized=false`、`sentry_deploy_authorized=false`、`telegram_send_authorized=false`、`alert_chain_smoke_authorized=false`。 +- Mobile `390x844`：`https://awoooi.wooo.work/zh-TW/iwooos?_v=72143ccf-monitoring-prod-mobile`，同樣可見高價值配置平均 `66%`、P1-4 Monitoring 卡 `62%`、surface `60`、alert rules `13`、write-capable `11`、runtime gate `0` 與所有 monitoring / alerting boundary；卡內 button `0`；`scrollWidth - clientWidth = 0`；目標敏感片語命中 `0`。 +- 截圖：`/tmp/awoooi-iwooos-monitoring-prod-desktop-72143ccf.png`、`/tmp/awoooi-iwooos-monitoring-prod-mobile-72143ccf.png`。 +- 驗證後已還原 in-app browser viewport 至預設。 + +**完成度同步**： + +- P1-4 repo-only surface 註冊：`100%`。 +- source existence / SHA256：`100%`。 +- Monitoring / alerting / observability 高價值配置成熟度：`56% -> 62%`。 +- 全域高價值配置平均只讀成熟度：`65% -> 66%`。 +- owner response 收件 / 接受：`0%`。 +- live evidence collection：`0%`。 +- reload / receiver / route smoke / Telegram send / silence / alert fire gate：`0%`。 +- IwoooS 整體仍維持 `64%`；active runtime gate 仍 `0`。 + +**邊界**：本段未連 live Prometheus、未 reload Prometheus / Alertmanager、未改 Grafana dashboard、未 apply SigNoz rules、未部署 Sentry、未改 Langfuse、未 reload OTEL collector、未改 receiver route、未建立 silence、未發 Telegram、未 fire live/test alert、未跑 alert chain smoke、未改 remote_write、未 deploy exporter、未 SSH、未 kubectl、未 active scan、未收 secret value、未新增任何前端執行按鈕。 + ## 2026-06-12｜P2-403G Runtime Write Gate Review **背景**：統帥指出 Telegram / AwoooP 批准後仍沒有真正自動化，也沒有清楚的人工作業選項。P2-403F 已先把 owner-approved learning dry-run preview 與 fixture-only dry-run 做成可審查證據；本段再把「批准後是否能進入真正寫入」前的最後 gate 固定成只讀 review 契約，避免把 UI 可見或 approval resolved 誤讀成 KM / PlayBook / timeline 已寫入。