wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

docs(logbook): 記錄 monitoring alerting 清冊正式驗證 [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-12 01:01:04 +08:00
parent 5ba5fe1cb4
commit 6ff0c2e526
1 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
docs/LOGBOOK.md
View File

@@ -1,3 +1,60 @@
## 2026-06-12｜IwoooS P1-4 Monitoring / alerting / observability repo-only 清冊
**背景**：統帥要求所有重要配置都要被資安控管；Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / OTEL / Telegram notification route 會直接影響即時資安事件是否能被發現、路由、降噪與送達。本段延續「先建立框架、只讀證據、低摩擦流程，再階段性收攏」原則，只做 repo-only 清冊，不碰 live monitoring stack、不 reload、不發 Telegram、不建立 silence。
**完成**：
- 新增 `monitoring_alerting_observability_inventory_v1` 產生器、schema、snapshot 與人讀文件，納入 `60` 個 repo-only surface。
- 清冊覆蓋 `8` 個 Prometheus config surface、`13` 個 alert rule surface、`1` 個 Alertmanager receiver surface、`6` 個 Grafana surface、`3` 個 SigNoz surface、`4` 個 Sentry surface、`3` 個 Langfuse surface、`4` 個 notification policy surface、`3` 個 Telegram surface、`1` 個 OTEL surface、`6` 個 deploy / reload surface、`1` 個 drift guard surface 與 `4` 個 smoke surface。
- 標記 `11` 個 write-capable surface：Alertmanager / Prometheus deploy 或 reload script、monitoring exporter deploy、Sentry deploy、Telegram gateway、notification manager、recurrence notifier、live/test alert script。
- owner response received / accepted、live evidence、reload owner、receiver owner、route smoke、maintenance window、rollback owner、runtime gate 與 action button 全部仍為 `0`。
- 高價值配置覆蓋矩陣的 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；全域平均只讀成熟度從 `65%` 推進到 `66%`。這只代表 repo-only 清冊完成，不代表 live alert chain、reload、receiver route、Telegram receipt 或告警必到已驗證。
- IwoooS posture projection snapshot / schema、`security-mirror-progress-guard.py`、高價值配置文件、配置控管總清冊與前端高價值配置卡已同步新口徑。
- `/zh-TW/iwooos` 的 P1-4 卡由 `56%` 更新為 `62%`，並新增 `monitoring_alerting_observability_inventory_surface_count=60`、`monitoring_alerting_observability_inventory_alert_rule_surface_count=13`、`monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6`、`monitoring_alerting_observability_inventory_write_capable_surface_count=11`、`monitoring_alerting_observability_inventory_runtime_gate_count=0`、`prometheus_reload_authorized=false`、`alertmanager_reload_authorized=false`、`grafana_dashboard_apply_authorized=false`、`signoz_rule_apply_authorized=false`、`sentry_deploy_authorized=false`、`langfuse_config_change_authorized=false`、`otel_collector_reload_authorized=false`、`receiver_route_change_authorized=false`、`silence_policy_change_authorized=false`、`telegram_send_authorized=false`、`notification_route_change_authorized=false`、`webhook_receiver_change_authorized=false`、`remote_write_change_authorized=false`、`exporter_deploy_authorized=false`、`live_alert_fire_authorized=false`、`alert_chain_smoke_authorized=false` 等前台邊界標記；仍無任何操作按鈕。
**本地驗證**：
- `python3 scripts/security/monitoring-alerting-observability-inventory.py --root . --generated-at 2026-06-12T09:00:00+08:00 --output docs/security/monitoring-alerting-observability-inventory.snapshot.json`：`MONITORING_ALERTING_OBSERVABILITY_INVENTORY_OK surfaces=60 alert_rules=13 write_capable=11 runtime_gate=0`。
- `python3 scripts/security/high-value-config-control-coverage.py --root . --generated-at 2026-06-12T09:05:00+08:00 --output docs/security/high-value-config-control-coverage.snapshot.json`：`HIGH_VALUE_CONFIG_CONTROL_COVERAGE_OK categories=14 c0=8 avg=66 runtime_gate=0`。
- JSON parse：monitoring / alerting snapshot / schema、高價值覆蓋 snapshot、IwoooS posture projection snapshot / schema、`zh-TW.json`、`en.json` 通過。
- `cmp -s apps/web/messages/zh-TW.json apps/web/messages/en.json`：通過。
- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
- `python3 scripts/security/source-control-owner-response-guard.py --root .`：`SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea`：`DOC_SECRET_SANITY_OK scanned_files=698`。
- `python3 -m py_compile scripts/security/monitoring-alerting-observability-inventory.py scripts/security/high-value-config-control-coverage.py scripts/security/security-mirror-progress-guard.py`：通過。
- `pnpm --filter @awoooi/web typecheck`：通過；驗證產生的 `apps/web/tsconfig.tsbuildinfo` 暫態變更已排除。
- 本次前台與新文件目標檔針對內部視窗、內部對話與請求片語掃描：命中 `0`。
- `git diff --check` / `git diff --cached --check`：通過。
**Gitea / deploy**：
- 同步另一個 Session 的 `7a7daa33 feat(governance): 新增 runtime write gate review` 與 LOGBOOK 後續補記後，再接續 P1-4，避免覆蓋 P2-403G。
- Code commit：`8a424f0c feat(security): 新增 monitoring alerting 只讀清冊`。
- Code-review run：`4012` 成功。
- CD run：`4011` 成功；deploy marker：`72143ccf chore(cd): deploy 8a424f0 [skip ci]`。
**正式站驗證**：
- Desktop `1440x1000`：`https://awoooi.wooo.work/zh-TW/iwooos?_v=72143ccf-monitoring-prod-desktop`，`data-testid="iwooos-high-value-config-control-coverage-board"` 與 `data-testid="iwooos-high-value-config-control-coverage-boundaries"` 存在且可見。
- Desktop DOM：高價值配置平均 `66%`、P1-4 Monitoring 卡 `62%`、surface `60`、alert rules `13`、write-capable `11`、runtime gate `0` 均可見；卡內 button `0`；`scrollWidth - clientWidth = 0`；目標敏感片語命中 `0`。
- Desktop boundary DOM 含 `monitoring_alerting_observability_inventory_surface_count=60`、`monitoring_alerting_observability_inventory_alert_rule_surface_count=13`、`monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6`、`monitoring_alerting_observability_inventory_write_capable_surface_count=11`、`monitoring_alerting_observability_inventory_runtime_gate_count=0`、`prometheus_reload_authorized=false`、`alertmanager_reload_authorized=false`、`grafana_dashboard_apply_authorized=false`、`signoz_rule_apply_authorized=false`、`sentry_deploy_authorized=false`、`telegram_send_authorized=false`、`alert_chain_smoke_authorized=false`。
- Mobile `390x844`：`https://awoooi.wooo.work/zh-TW/iwooos?_v=72143ccf-monitoring-prod-mobile`，同樣可見高價值配置平均 `66%`、P1-4 Monitoring 卡 `62%`、surface `60`、alert rules `13`、write-capable `11`、runtime gate `0` 與所有 monitoring / alerting boundary；卡內 button `0`；`scrollWidth - clientWidth = 0`；目標敏感片語命中 `0`。
- 截圖：`/tmp/awoooi-iwooos-monitoring-prod-desktop-72143ccf.png`、`/tmp/awoooi-iwooos-monitoring-prod-mobile-72143ccf.png`。
- 驗證後已還原 in-app browser viewport 至預設。
**完成度同步**：
- P1-4 repo-only surface 註冊：`100%`。
- source existence / SHA256：`100%`。
- Monitoring / alerting / observability 高價值配置成熟度：`56% -> 62%`。
- 全域高價值配置平均只讀成熟度：`65% -> 66%`。
- owner response 收件 / 接受：`0%`。
- live evidence collection：`0%`。
- reload / receiver / route smoke / Telegram send / silence / alert fire gate：`0%`。
- IwoooS 整體仍維持 `64%`；active runtime gate 仍 `0`。
**邊界**：本段未連 live Prometheus、未 reload Prometheus / Alertmanager、未改 Grafana dashboard、未 apply SigNoz rules、未部署 Sentry、未改 Langfuse、未 reload OTEL collector、未改 receiver route、未建立 silence、未發 Telegram、未 fire live/test alert、未跑 alert chain smoke、未改 remote_write、未 deploy exporter、未 SSH、未 kubectl、未 active scan、未收 secret value、未新增任何前端執行按鈕。
## 2026-06-12｜P2-403G Runtime Write Gate Review
**背景**：統帥指出 Telegram / AwoooP 批准後仍沒有真正自動化，也沒有清楚的人工作業選項。P2-403F 已先把 owner-approved learning dry-run preview 與 fixture-only dry-run 做成可審查證據；本段再把「批准後是否能進入真正寫入」前的最後 gate 固定成只讀 review 契約，避免把 UI 可見或 approval resolved 誤讀成 KM / PlayBook / timeline 已寫入。