From 8a424f0c566a8d30f9421a77caab0d052fa4403e Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 12 Jun 2026 00:45:08 +0800 Subject: [PATCH] =?UTF-8?q?feat(security):=20=E6=96=B0=E5=A2=9E=20monitori?= =?UTF-8?q?ng=20alerting=20=E5=8F=AA=E8=AE=80=E6=B8=85=E5=86=8A?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/web/messages/en.json | 6 +- apps/web/messages/zh-TW.json | 6 +- apps/web/src/app/[locale]/iwooos/page.tsx | 30 +- .../iwooos_posture_projection_v1.schema.json | 161 ++ ...ing_observability_inventory_v1.schema.json | 376 ++++ .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 24 +- .../IWOOOS-CONFIG-CONTROL-INVENTORY.md | 15 +- docs/security/IWOOOS-POSTURE-PROJECTION.md | 6 +- ...TORING-ALERTING-OBSERVABILITY-INVENTORY.md | 113 + ...alue-config-control-coverage.snapshot.json | 48 +- .../iwooos-posture-projection.snapshot.json | 41 +- ...ting-observability-inventory.snapshot.json | 1990 +++++++++++++++++ .../high-value-config-control-coverage.py | 29 +- ...toring-alerting-observability-inventory.py | 1039 +++++++++ .../security-mirror-progress-guard.py | 245 +- 15 files changed, 4086 insertions(+), 43 deletions(-) create mode 100644 docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json create mode 100644 docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md create mode 100644 docs/security/monitoring-alerting-observability-inventory.snapshot.json create mode 100644 scripts/security/monitoring-alerting-observability-inventory.py diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 86e089c3e..ae8246ada 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -14944,7 +14944,7 @@ "highValueConfigControlCoverage": { "eyebrow": "高價值配置覆蓋矩陣", "title": "14 類重要配置已進入同一張控管矩陣", - "subtitle": "這張卡顯示全域高價值配置控管成熟度，不是單次變更分類；Nginx、DNS / TLS、K8s、Secret、Workflow、Backup、AI provider、agent-bounty runtime 都已註冊，但 owner response 與執行期仍為 0。", + "subtitle": "這張卡顯示全域高價值配置控管成熟度，不是單次變更分類；Nginx、DNS / TLS、K8s、Secret、Workflow、Backup、Monitoring、AI provider、agent-bounty runtime 都已註冊，但 owner response 與執行期仍為 0。", "coverageLabel": "只讀成熟度", "boundaryTitle": "配置覆蓋矩陣邊界", "boundaryIntro": "以下鍵值固定：矩陣只顯示分類、證據與下一步收件順序，不代表 live evidence 已取得，也不代表 reload、sync、scan、secret rotation、agent-bounty runtime 或主機操作已授權。", @@ -14959,7 +14959,7 @@ }, "coverage": { "label": "平均成熟度", - "detail": "65% 只代表只讀框架成熟度。" + "detail": "repo-only 清冊推進後平均控管成熟度為 66%。" }, "runtimeGate": { "label": "執行期", @@ -14981,7 +14981,7 @@ }, "monitoring": { "title": "監控與告警設定", - "body": "下一步補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 的 rule diff、receiver diff 與 reload owner。" + "body": "已新增 60 個 monitoring / alerting / observability repo-only surface，含 13 個 alert rule、6 個 deploy / reload surface 與 11 個 write-capable surface；下一步補 live drift evidence、reload owner、receiver owner 與 route smoke。" } } }, diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 86e089c3e..ae8246ada 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -14944,7 +14944,7 @@ "highValueConfigControlCoverage": { "eyebrow": "高價值配置覆蓋矩陣", "title": "14 類重要配置已進入同一張控管矩陣", - "subtitle": "這張卡顯示全域高價值配置控管成熟度，不是單次變更分類；Nginx、DNS / TLS、K8s、Secret、Workflow、Backup、AI provider、agent-bounty runtime 都已註冊，但 owner response 與執行期仍為 0。", + "subtitle": "這張卡顯示全域高價值配置控管成熟度，不是單次變更分類；Nginx、DNS / TLS、K8s、Secret、Workflow、Backup、Monitoring、AI provider、agent-bounty runtime 都已註冊，但 owner response 與執行期仍為 0。", "coverageLabel": "只讀成熟度", "boundaryTitle": "配置覆蓋矩陣邊界", "boundaryIntro": "以下鍵值固定：矩陣只顯示分類、證據與下一步收件順序，不代表 live evidence 已取得，也不代表 reload、sync、scan、secret rotation、agent-bounty runtime 或主機操作已授權。", @@ -14959,7 +14959,7 @@ }, "coverage": { "label": "平均成熟度", - "detail": "65% 只代表只讀框架成熟度。" + "detail": "repo-only 清冊推進後平均控管成熟度為 66%。" }, "runtimeGate": { "label": "執行期", @@ -14981,7 +14981,7 @@ }, "monitoring": { "title": "監控與告警設定", - "body": "下一步補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 的 rule diff、receiver diff 與 reload owner。" + "body": "已新增 60 個 monitoring / alerting / observability repo-only surface，含 13 個 alert rule、6 個 deploy / reload surface 與 11 個 write-capable surface；下一步補 live drift evidence、reload owner、receiver owner 與 route smoke。" } } }, diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 50b7ede30..2a253d46e 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -2071,7 +2071,7 @@ const highValueConfigOwnerPacketSummary = [ const highValueConfigControlCoverageSummary = [ { key: 'categories', value: '14', icon: ListChecks, tone: 'steady' }, { key: 'c0', value: '8', icon: AlertTriangle, tone: 'warn' }, - { key: 'coverage', value: '65%', icon: ShieldCheck, tone: 'warn' }, + { key: 'coverage', value: '66%', icon: ShieldCheck, tone: 'warn' }, { key: 'runtimeGate', value: '0', icon: Lock, tone: 'locked' }, ] as const @@ -2079,7 +2079,7 @@ const highValueConfigControlCoverageItems: HighValueConfigControlCoverageItem[] { key: 'dockerSystemd', rank: 'P1-1', value: '50%', icon: Server, tone: 'warn' }, { key: 'sshNetwork', rank: 'P1-2', value: '54%', icon: Network, tone: 'warn' }, { key: 'backupRestore', rank: 'P1-3', value: '58%', icon: Database, tone: 'warn' }, - { key: 'monitoring', rank: 'P1-4', value: '56%', icon: Radar, tone: 'warn' }, + { key: 'monitoring', rank: 'P1-4', value: '62%', icon: Radar, tone: 'warn' }, ] const highValueConfigControlCoverageBoundaries = [ @@ -2088,7 +2088,7 @@ const highValueConfigControlCoverageBoundaries = [ 'high_value_config_control_coverage_category_count=14', 'high_value_config_control_coverage_c0_category_count=8', 'high_value_config_control_coverage_c1_category_count=4', - 'high_value_config_control_coverage_average_percent=65', + 'high_value_config_control_coverage_average_percent=66', 'high_value_config_control_coverage_needs_live_evidence_count=6', 'high_value_config_control_coverage_owner_response_required_count=14', 'high_value_config_control_coverage_owner_response_received_count=0', @@ -2108,6 +2108,14 @@ const highValueConfigControlCoverageBoundaries = [ 'backup_restore_escrow_inventory_offsite_sync_accepted_count=0', 'backup_restore_escrow_inventory_credential_escrow_accepted_count=0', 'backup_restore_escrow_inventory_retention_change_accepted_count=0', + 'monitoring_alerting_observability_inventory_surface_count=60', + 'monitoring_alerting_observability_inventory_alert_rule_surface_count=13', + 'monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6', + 'monitoring_alerting_observability_inventory_write_capable_surface_count=11', + 'monitoring_alerting_observability_inventory_runtime_gate_count=0', + 'monitoring_alerting_observability_inventory_reload_owner_accepted_count=0', + 'monitoring_alerting_observability_inventory_receiver_owner_accepted_count=0', + 'monitoring_alerting_observability_inventory_route_smoke_accepted_count=0', 'docker_compose_action_authorized=false', 'systemctl_action_authorized=false', 'repair_bot_execution_authorized=false', @@ -2136,6 +2144,22 @@ const highValueConfigControlCoverageBoundaries = [ 'restic_prune_authorized=false', 'rclone_config_authorized=false', 'velero_restore_authorized=false', + 'prometheus_reload_authorized=false', + 'alertmanager_reload_authorized=false', + 'grafana_dashboard_apply_authorized=false', + 'signoz_rule_apply_authorized=false', + 'sentry_deploy_authorized=false', + 'langfuse_config_change_authorized=false', + 'otel_collector_reload_authorized=false', + 'receiver_route_change_authorized=false', + 'silence_policy_change_authorized=false', + 'telegram_send_authorized=false', + 'notification_route_change_authorized=false', + 'webhook_receiver_change_authorized=false', + 'remote_write_change_authorized=false', + 'exporter_deploy_authorized=false', + 'live_alert_fire_authorized=false', + 'alert_chain_smoke_authorized=false', 'workflow_modification_authorized=false', 'active_scan_authorized=false', 'agent_bounty_runtime_authorized=false', diff --git a/docs/schemas/iwooos_posture_projection_v1.schema.json b/docs/schemas/iwooos_posture_projection_v1.schema.json index dcdfe8a44..faee2cdfa 100644 --- a/docs/schemas/iwooos_posture_projection_v1.schema.json +++ b/docs/schemas/iwooos_posture_projection_v1.schema.json @@ -244,6 +244,38 @@ "backup_restore_escrow_inventory_action_button_count", "backup_restore_escrow_inventory_coverage_percent_before_inventory", "backup_restore_escrow_inventory_coverage_percent_after_inventory", + "monitoring_alerting_observability_inventory_coverage_percent_after_inventory", + "monitoring_alerting_observability_inventory_coverage_percent_before_inventory", + "monitoring_alerting_observability_inventory_action_button_count", + "monitoring_alerting_observability_inventory_runtime_gate_count", + "monitoring_alerting_observability_inventory_rollback_owner_accepted_count", + "monitoring_alerting_observability_inventory_maintenance_window_accepted_count", + "monitoring_alerting_observability_inventory_route_smoke_accepted_count", + "monitoring_alerting_observability_inventory_receiver_owner_accepted_count", + "monitoring_alerting_observability_inventory_reload_owner_accepted_count", + "monitoring_alerting_observability_inventory_live_evidence_received_count", + "monitoring_alerting_observability_inventory_owner_response_accepted_count", + "monitoring_alerting_observability_inventory_owner_response_received_count", + "monitoring_alerting_observability_inventory_surfaces_requiring_live_evidence_count", + "monitoring_alerting_observability_inventory_surfaces_requiring_owner_response_count", + "monitoring_alerting_observability_inventory_write_capable_surface_count", + "monitoring_alerting_observability_inventory_smoke_surface_count", + "monitoring_alerting_observability_inventory_drift_guard_surface_count", + "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count", + "monitoring_alerting_observability_inventory_otel_surface_count", + "monitoring_alerting_observability_inventory_telegram_surface_count", + "monitoring_alerting_observability_inventory_notification_policy_surface_count", + "monitoring_alerting_observability_inventory_langfuse_surface_count", + "monitoring_alerting_observability_inventory_sentry_surface_count", + "monitoring_alerting_observability_inventory_signoz_surface_count", + "monitoring_alerting_observability_inventory_grafana_surface_count", + "monitoring_alerting_observability_inventory_alertmanager_receiver_surface_count", + "monitoring_alerting_observability_inventory_alert_rule_surface_count", + "monitoring_alerting_observability_inventory_prometheus_config_surface_count", + "monitoring_alerting_observability_inventory_expected_scope_count", + "monitoring_alerting_observability_inventory_source_exists_count", + "monitoring_alerting_observability_inventory_surface_count", + "monitoring_alerting_observability_inventory_first_layer", "high_value_config_owner_packet_first_layer", "high_value_config_owner_packet_summary_count", "high_value_config_owner_packet_item_count", @@ -1095,6 +1127,135 @@ "backup_restore_escrow_inventory_coverage_percent_after_inventory": { "type": "integer", "const": 58 + }, + "monitoring_alerting_observability_inventory_first_layer": { + "type": "boolean" + }, + "monitoring_alerting_observability_inventory_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_source_exists_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_expected_scope_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_prometheus_config_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_alert_rule_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_alertmanager_receiver_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_grafana_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_signoz_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_sentry_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_langfuse_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_notification_policy_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_telegram_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_otel_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_drift_guard_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_smoke_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_write_capable_surface_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_surfaces_requiring_owner_response_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_surfaces_requiring_live_evidence_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_owner_response_received_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_owner_response_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_live_evidence_received_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_reload_owner_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_receiver_owner_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_route_smoke_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_maintenance_window_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_rollback_owner_accepted_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_runtime_gate_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_action_button_count": { + "type": "integer", + "minimum": 0 + }, + "monitoring_alerting_observability_inventory_coverage_percent_before_inventory": { + "type": "integer", + "minimum": 0, + "maximum": 100 + }, + "monitoring_alerting_observability_inventory_coverage_percent_after_inventory": { + "type": "integer", + "minimum": 0, + "maximum": 100 } }, "additionalProperties": false diff --git a/docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json b/docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json new file mode 100644 index 000000000..e95a67205 --- /dev/null +++ b/docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json @@ -0,0 +1,376 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://awoooi.wooo.work/schemas/monitoring_alerting_observability_inventory_v1.schema.json", + "title": "IwoooS monitoring / alerting / observability repo-only 清冊", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "generated_at", + "git_commit", + "status", + "source_scope", + "summary", + "execution_boundaries", + "expected_scopes", + "observability_surfaces", + "write_capable_surfaces", + "next_collection_order", + "operator_interpretation" + ], + "properties": { + "schema_version": { + "const": "monitoring_alerting_observability_inventory_v1" + }, + "generated_at": { + "type": "string" + }, + "git_commit": { + "type": "string" + }, + "status": { + "const": "repo_only_inventory_ready" + }, + "source_scope": { + "const": "committed_repo_files_only" + }, + "summary": { + "type": "object", + "additionalProperties": false, + "required": [ + "surface_count", + "source_exists_count", + "expected_scope_count", + "prometheus_config_surface_count", + "alert_rule_surface_count", + "alertmanager_receiver_surface_count", + "grafana_surface_count", + "signoz_surface_count", + "sentry_surface_count", + "langfuse_surface_count", + "notification_policy_surface_count", + "telegram_surface_count", + "otel_surface_count", + "deploy_or_reload_surface_count", + "drift_guard_surface_count", + "smoke_surface_count", + "write_capable_surface_count", + "surfaces_requiring_owner_response_count", + "surfaces_requiring_live_evidence_count", + "owner_response_received_count", + "owner_response_accepted_count", + "live_evidence_received_count", + "reload_owner_accepted_count", + "receiver_owner_accepted_count", + "route_smoke_accepted_count", + "maintenance_window_accepted_count", + "rollback_owner_accepted_count", + "runtime_gate_count", + "action_button_count", + "coverage_percent_before_inventory", + "coverage_percent_after_inventory" + ], + "properties": { + "surface_count": { + "const": 60 + }, + "source_exists_count": { + "const": 60 + }, + "expected_scope_count": { + "const": 60 + }, + "prometheus_config_surface_count": { + "const": 8 + }, + "alert_rule_surface_count": { + "const": 13 + }, + "alertmanager_receiver_surface_count": { + "const": 1 + }, + "grafana_surface_count": { + "const": 6 + }, + "signoz_surface_count": { + "const": 3 + }, + "sentry_surface_count": { + "const": 4 + }, + "langfuse_surface_count": { + "const": 3 + }, + "notification_policy_surface_count": { + "const": 4 + }, + "telegram_surface_count": { + "const": 3 + }, + "otel_surface_count": { + "const": 1 + }, + "deploy_or_reload_surface_count": { + "const": 6 + }, + "drift_guard_surface_count": { + "const": 1 + }, + "smoke_surface_count": { + "const": 4 + }, + "write_capable_surface_count": { + "const": 11 + }, + "surfaces_requiring_owner_response_count": { + "const": 60 + }, + "surfaces_requiring_live_evidence_count": { + "const": 60 + }, + "owner_response_received_count": { + "const": 0 + }, + "owner_response_accepted_count": { + "const": 0 + }, + "live_evidence_received_count": { + "const": 0 + }, + "reload_owner_accepted_count": { + "const": 0 + }, + "receiver_owner_accepted_count": { + "const": 0 + }, + "route_smoke_accepted_count": { + "const": 0 + }, + "maintenance_window_accepted_count": { + "const": 0 + }, + "rollback_owner_accepted_count": { + "const": 0 + }, + "runtime_gate_count": { + "const": 0 + }, + "action_button_count": { + "const": 0 + }, + "coverage_percent_before_inventory": { + "const": 56 + }, + "coverage_percent_after_inventory": { + "const": 62 + } + } + }, + "execution_boundaries": { + "type": "object", + "additionalProperties": { + "const": false + }, + "required": [ + "runtime_execution_authorized", + "host_write_authorized", + "prometheus_reload_authorized", + "alertmanager_reload_authorized", + "grafana_dashboard_apply_authorized", + "signoz_rule_apply_authorized", + "sentry_deploy_authorized", + "langfuse_config_change_authorized", + "otel_collector_reload_authorized", + "receiver_route_change_authorized", + "silence_policy_change_authorized", + "telegram_send_authorized", + "notification_route_change_authorized", + "webhook_receiver_change_authorized", + "remote_write_change_authorized", + "exporter_deploy_authorized", + "live_alert_fire_authorized", + "alert_chain_smoke_authorized", + "ssh_read_authorized", + "ssh_write_authorized", + "kubectl_action_authorized", + "secret_value_collection_allowed", + "active_scan_authorized", + "action_buttons_allowed" + ] + }, + "expected_scopes": { + "type": "array", + "minItems": 60, + "maxItems": 60, + "items": { + "type": "string" + } + }, + "observability_surfaces": { + "type": "array", + "minItems": 60, + "maxItems": 60, + "items": { + "$ref": "#/$defs/observability_surface" + } + }, + "write_capable_surfaces": { + "type": "array", + "minItems": 11, + "maxItems": 11, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "surface_id", + "label", + "config_kind", + "expected_scope", + "required_gate" + ], + "properties": { + "surface_id": { + "type": "string" + }, + "label": { + "type": "string" + }, + "config_kind": { + "type": "string" + }, + "expected_scope": { + "type": "string" + }, + "required_gate": { + "const": "owner_response_plus_maintenance_window_plus_rollback_owner" + } + } + } + }, + "next_collection_order": { + "type": "array", + "minItems": 10, + "items": { + "type": "string" + } + }, + "operator_interpretation": { + "type": "array", + "items": { + "type": "string" + } + } + }, + "$defs": { + "observability_surface": { + "type": "object", + "additionalProperties": false, + "required": [ + "surface_id", + "label", + "source_path", + "expected_scope", + "config_kind", + "control_tier", + "current_state", + "observability_scope", + "requires_live_evidence", + "requires_owner_response", + "next_owner_action", + "source_exists", + "line_count", + "sha256", + "owner_response_received", + "owner_response_accepted", + "live_evidence_received", + "reload_owner_accepted", + "receiver_owner_accepted", + "route_smoke_accepted", + "maintenance_window_accepted", + "rollback_owner_accepted", + "runtime_gate_open", + "action_buttons_allowed" + ], + "properties": { + "surface_id": { + "type": "string" + }, + "label": { + "type": "string" + }, + "source_path": { + "type": "string" + }, + "expected_scope": { + "type": "string" + }, + "config_kind": { + "type": "string" + }, + "control_tier": { + "const": "C1" + }, + "current_state": { + "type": "string" + }, + "observability_scope": { + "type": "array", + "items": { + "type": "string" + } + }, + "requires_live_evidence": { + "const": true + }, + "requires_owner_response": { + "const": true + }, + "next_owner_action": { + "type": "string" + }, + "source_exists": { + "const": true + }, + "line_count": { + "type": "integer", + "minimum": 1 + }, + "sha256": { + "type": "string", + "minLength": 64, + "maxLength": 64 + }, + "owner_response_received": { + "const": false + }, + "owner_response_accepted": { + "const": false + }, + "live_evidence_received": { + "const": false + }, + "reload_owner_accepted": { + "const": false + }, + "receiver_owner_accepted": { + "const": false + }, + "route_smoke_accepted": { + "const": false + }, + "maintenance_window_accepted": { + "const": false + }, + "rollback_owner_accepted": { + "const": false + }, + "runtime_gate_open": { + "const": false + }, + "action_buttons_allowed": { + "const": false + } + } + } + } +} diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index 148dfe91d..d5fbf556e 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -24,7 +24,7 @@ | C1 類別 | `4` | 監控、Docker / systemd、SSH / network、AI provider | | C2 類別 | `1` | 產品 runtime route 與跨產品邊界 | | C3 類別 | `1` | security evidence / snapshot / guard tooling | -| 平均只讀控管成熟度 | `65%` | 僅代表框架 / evidence / owner packet 準備度，不代表 runtime 可執行 | +| 平均只讀控管成熟度 | `66%` | 僅代表框架 / evidence / owner packet 準備度，不代表 runtime 可執行 | | 需要 live evidence 的類別 | `6` | 只能等 owner-provided redacted evidence 或維護窗口，不主動修改主機 | | owner response required | `14` | 每類都需要 owner response 才能往 accepted 前進 | | owner response received / accepted | `0 / 0` | 不得假性提高 | @@ -37,7 +37,7 @@ | P1-1 | Docker Compose / systemd / host service config | `50%` | repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標 | | P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `54%` | repo-only 清冊已納入 16 個 SSH / network access surface；仍缺 live evidence、owner 與 rollback | | P1-3 | Backup / restore / escrow / retention | `58%` | repo-only 清冊已納入 38 個 surface；仍缺 restore drill approval package、offsite / escrow owner、retention owner、rollback owner 與 no-secret-value evidence | -| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `56%` | 補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke | +| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof | ## 4. 固定 0 / false 邊界 @@ -70,6 +70,22 @@ active_scan_authorized=false agent_bounty_runtime_authorized=false payout_or_withdrawal_authorized=false action_buttons_allowed=false +prometheus_reload_authorized=false +alertmanager_reload_authorized=false +grafana_dashboard_apply_authorized=false +signoz_rule_apply_authorized=false +sentry_deploy_authorized=false +langfuse_config_change_authorized=false +otel_collector_reload_authorized=false +receiver_route_change_authorized=false +silence_policy_change_authorized=false +telegram_send_authorized=false +notification_route_change_authorized=false +webhook_receiver_change_authorized=false +remote_write_change_authorized=false +exporter_deploy_authorized=false +live_alert_fire_authorized=false +alert_chain_smoke_authorized=false ``` ## 5. 判讀規則 @@ -118,3 +134,7 @@ python3 scripts/security/high-value-config-control-coverage.py \ ## 10. P1-3 Backup / restore / escrow / retention 清冊更新 `backup_restore_escrow_inventory_v1` 已把 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 納入 repo-only 清冊，共 `38` 個 surface、`15` 個 backup script surface、`8` 個 offsite / escrow surface、`5` 個 Velero surface 與 `27` 個 write-capable surface。此更新只讓 `backup_restore_credential` 從 `52%` 推進到 `58%`；owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、runtime gate 與 action button 仍全部為 `0`。 + +## 11. P1-4 Monitoring / alerting / observability 清冊更新 + +`monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入 repo-only 清冊，共 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface。此更新只讓 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`。 diff --git a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md index b819f9735..51f01dc5b 100644 --- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md +++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md @@ -32,7 +32,7 @@ | 註冊配置類別 | `14` | 代表已進 Gate 分類，不代表已批准 | | C0 類別 | `8` | Nginx、DNS / TLS、K8s、secret、workflow / runner、runtime config、backup、agent-bounty runtime | | C1 類別 | `4` | 監控、Docker / systemd、SSH / network、AI provider | -| 平均只讀控管成熟度 | `65%` | 只代表框架 / evidence / owner packet 準備度 | +| 平均只讀控管成熟度 | `66%` | 只代表框架 / evidence / owner packet 準備度 | | 需要 live evidence 類別 | `6` | 只能等 owner-provided redacted evidence 或維護窗口，不主動 SSH | | owner response required | `14` | owner response received / accepted 仍 `0 / 0` | | runtime gate | `0` | 不提供執行按鈕 | @@ -57,6 +57,12 @@ 此更新仍不是 live backup truth：owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config、Velero restore、kubectl 或 SSH。 +### 0.5 2026-06-12 Monitoring / alerting / observability repo-only 清冊 + +`monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入只讀 snapshot。清冊目前共有 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface，讓 monitoring / alerting / observability 類別成熟度從 `56%` 推進到 `62%`。 + +此更新仍不是 live alert chain truth：owner response、live evidence、reload owner、receiver owner、route smoke、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 Prometheus reload、Alertmanager reload、Grafana import、SigNoz rule apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH 或 kubectl。 + ## 1. 目前已不符合新要求的項目 | 優先 | 項目 | 現況 | 風險 | 本階段處置 | @@ -119,8 +125,8 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | P0 | Public admin / API route config | Nginx templates、`apps/web/src/lib/config.ts`、`apps/api/src/core/config.py` | Product owner + runtime owner | auth boundary、CORS、public URL、admin path smoke、frontend internal IP ban | | P0 | Backup / restore credential | `scripts/backup/*`、`k8s/velero/*`、DR runbooks、`docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md` | MinIO / restic / offsite escrow | credential value absent、restore drill gate、offsite owner、escrow owner、retention policy、rollback owner | | P0 | agent-bounty-protocol treasury / MCP / A2A | `docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md` | agent-bounty owner response | no payout / claim / submit / daemon / webhook until explicit runtime approval | -| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*` | 110 monitoring stack | rule diff、receiver diff、reload gate、failure-only notification policy | -| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window | +| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 monitoring stack | repo-only 清冊、rule diff、receiver diff、reload gate、failure-only notification policy | +| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window | | P1 | Harbor / registry | Nginx templates、backup scripts、CD workflows | 110 Harbor / registry domains | robot account owner、image tag immutability、scan policy、TLS | | P1 | PostgreSQL / Redis / MinIO | app config、backup scripts、monitoring config | 188 / 110 / K3s | no plaintext DSN, access boundary, backup, restore, metrics auth | | P1 | Docker Compose / systemd | `docker-compose.yml`、`ops/*/docker-compose.yml`、`scripts/reboot-recovery/*.service` | 110 / 188 / agent-bounty hosts | port / volume / env diff、restart window、rollback owner | @@ -171,6 +177,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | canonical owner 欄位對齊 | `100%` | 高價值配置 Gate 已對齊 S4.9 `owner_role_or_team`，並保留 `owner_role_team` 等 alias 支援 | | 全域配置覆蓋矩陣 | `100%` | 已新增 `scripts/security/high-value-config-control-coverage.py`、snapshot 與 schema，14 類高價值配置可重跑檢查 | | Backup / restore / escrow 清冊 | `100%` | 已新增 `backup_restore_escrow_inventory_v1`，納入 38 個 repo-only surface；成熟度 `52% -> 58%` | +| Monitoring / alerting / observability 清冊 | `100%` | 已新增 `monitoring_alerting_observability_inventory_v1`，納入 60 個 repo-only surface；成熟度 `56% -> 62%` | | owner packet 前台只讀接入 | `100%` | `/zh-TW/iwooos` 已顯示高價值配置 owner packet 草案、C0/C1 packet 數、request / received / accepted 仍為 0 與禁止執行邊界 | | owner response request / received / accepted | `0%` | Packet 只是草案；尚未送件、尚未收件、尚未 reviewer accepted | | CI blocking / workflow gate | `0%` | 本階段刻意不修改 `.gitea/workflows`，避免初期資安流程摩擦過大 | @@ -189,7 +196,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 5. P0：把 agent-bounty-protocol compose / MCP / A2A / treasury 高價值配置欄位接入同一個 owner packet queue；不啟用 runtime。 6. P1：盤點 110 / 188 Docker Compose 與 systemd live config，標記 Harbor、Sentry、Langfuse、Gitea、agent-bounty-protocol 影響面。 7. P1：把 backup / restore / offsite / escrow owner response packet 接入 AwoooP 只讀狀態；驗收前 backup run、restore drill、offsite sync、remote delete、escrow marker write、retention change 全部維持 `0 / false`。 -8. P1：盤點 Prometheus / Alertmanager / Grafana / SigNoz / Sentry 設定 drift 與 secret externalization。 +8. P1：把 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse owner response packet 接入 AwoooP 只讀狀態；驗收前 reload、receiver route change、silence change、Telegram send 與 alert chain smoke 全部維持 `0 / false`。 9. P1：補 Kali 112、111、168 維護窗口 owner 欄位，仍不做 upgrade / restart / scan。 10. P2：持續精簡 `/zh-TW/iwooos` 配置控管摘要，但不得顯示內部工作對話、token、secret 或可執行按鈕。 diff --git a/docs/security/IWOOOS-POSTURE-PROJECTION.md b/docs/security/IWOOOS-POSTURE-PROJECTION.md index 5a59e9aaa..1aa5518bf 100644 --- a/docs/security/IWOOOS-POSTURE-PROJECTION.md +++ b/docs/security/IWOOOS-POSTURE-PROJECTION.md @@ -2,7 +2,7 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-04 | +| 日期 | 2026-06-12 | | 狀態 | 草案；P0 governance 總帳已建立 | | Schema | `docs/schemas/iwooos_posture_projection_v1.schema.json` | | Snapshot | `docs/security/iwooos-posture-projection.snapshot.json` | @@ -89,9 +89,11 @@ IwoooS 首版只讀取或對齊以下已提交 evidence： 51. 10 個 frontend surface reverse bridge statuses，顯示既有資安入口目前是 embedded bridge、direct bridge 或 AwoooP read-only candidate；這只是連接狀態，不代表 owner response、runtime authorization、Code Review blocker、Gitea/GitHub action 或任何執行控制。 52. 6 個 source control primary readiness items，顯示 GitHub primary 前置缺口：candidate repo inventory、primary ready counter、owner response validation、refs truth、workflow / secret name inventory、rollback ADR；這只是 readiness，不代表 repo 建立、visibility 變更、refs mutation、secret value collection、primary switch 或 Gitea 停用。 53. 4 個 rollout risk read-only items，顯示風險來源部署 marker、`AWOOOI_ROLLOUT_RISK=1`、ArgoCD `Degraded` / `OutOfSync`、API health / smoke 已通過與執行期閘門仍為 0；這只是部署風險可見性，不代表 ArgoCD sync、kubectl、主機重啟、修復、部署或 runtime gate 已授權。 -54. 14 類 high-value config control coverage statuses，顯示 Nginx、DNS / TLS、K8s、secret、workflow、backup、agent-bounty runtime、monitoring、Docker / systemd、SSH / network、AI provider、產品 route 與 security evidence 的全域配置控管覆蓋矩陣；平均只讀成熟度 `65%`、C0 類別 `8`、需 live evidence 類別 `6`、owner response received / accepted 與 runtime gate 仍為 `0`，不代表 reload、sync、scan、secret rotation、payout 或主機操作授權。 +54. 14 類 high-value config control coverage statuses，顯示 Nginx、DNS / TLS、K8s、secret、workflow、backup、agent-bounty runtime、monitoring、Docker / systemd、SSH / network、AI provider、產品 route 與 security evidence 的全域配置控管覆蓋矩陣；平均只讀成熟度 `66%`、C0 類別 `8`、需 live evidence 類別 `6`、owner response received / accepted 與 runtime gate 仍為 `0`，不代表 reload、sync、scan、secret rotation、payout 或主機操作授權。 55. 9 個 host-service config repo-only inventory surfaces，顯示 Docker Compose、systemd / repair-bot、Ansible service role 與 host config backup capture 的第一層清冊；write-capable surface `3`、repair-bot whitelist `2`、systemd restart surface `1`，owner response、live evidence、restart window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 `docker compose`、`systemctl`、repair-bot 或 Ansible apply 已授權。 56. 16 個 SSH / network access repo-only inventory surfaces，顯示 SSH target、known_hosts workflow、CI deploy SSH、monitoring SSH、backup SSH capture、sudoers wrapper、NetworkPolicy、NodePort、WireGuard runbook 與 alert SSH action catalog 的第一層清冊；write-capable surface `6`、NetworkPolicy `2`、NodePort `2`、sudoers `1`、WireGuard `1`，owner response、live evidence、maintenance window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 SSH、sudo、firewall、NetworkPolicy、NodePort、WireGuard 或 known_hosts patch 已授權。 +57. 38 個 Backup / restore / escrow / retention repo-only inventory surfaces，顯示 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 的第一層清冊；write-capable surface `27`、restore drill surface `4`、offsite / escrow surface `8`，owner response、live evidence、restore drill、offsite sync、credential escrow、retention change、runtime gate 與 action button 仍全部為 `0`，不代表 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config 或 Velero restore 已授權。 +58. 60 個 Monitoring / alerting / observability repo-only inventory surfaces，顯示 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 的第一層清冊；write-capable surface `11`、alert rule surface `13`、deploy / reload surface `6`，owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`，不代表 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Telegram send、live alert fire 或 alert chain smoke 已授權。 ## 3.1 既有前端資安頁面整合 diff --git a/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md b/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md new file mode 100644 index 000000000..4ce3ac96d --- /dev/null +++ b/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md @@ -0,0 +1,113 @@ +# IwoooS Monitoring / Alerting / Observability repo-only 清冊 + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-12 | +| 狀態 | `repo_only_inventory_ready` | +| 工具 | `scripts/security/monitoring-alerting-observability-inventory.py` | +| Snapshot | `docs/security/monitoring-alerting-observability-inventory.snapshot.json` | +| Schema | `docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json` | +| runtime gate | `0` | + +## 1. 目的 + +這份清冊把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 集中納入 IwoooS 高價值配置控管。 + +本階段仍是 repo-only source inventory：只讀已提交檔案、計算 SHA256、整理 owner gate 與 live evidence 缺口。不連 live Prometheus、不 reload Alertmanager、不改 Grafana、不套用 SigNoz rule、不部署 Sentry、不發 Telegram、不建立 silence、不 SSH、不 kubectl、不讀 secret value。 + +## 2. 覆蓋摘要 + +| 指標 | 目前值 | 說明 | +|------|--------|------| +| surface | `60` | 全部為 committed repo source | +| source exists | `60` | 每個 source path 都存在並有 SHA256 | +| Prometheus config surface | `8` | 基礎設定、remote write、generated target、service registry、exporter query | +| alert rule surface | `13` | Prometheus、K8s、SLO、Ollama、app alert rule 與 Grafana alert rule | +| Alertmanager receiver surface | `1` | route / receiver / grouping source | +| Grafana surface | `6` | alert rule 與 dashboard JSON | +| SigNoz surface | `3` | alert rule、log rule、API client | +| Sentry surface | `4` | compose、deploy、webhook receiver、API client | +| Langfuse surface | `3` | compose、runbook、API client | +| notification policy surface | `4` | failure-only policy、backup policy、observability contract、notification matrix | +| Telegram surface | `3` | digest policy、receipt package、gateway service | +| OTEL surface | `1` | SigNoz OTEL collector | +| deploy / reload surface | `6` | Alertmanager / Prometheus / Sentry / exporter deploy 或 reload-capable script | +| drift guard surface | `1` | Prometheus rule drift guard | +| smoke surface | `4` | live / test alert 與 alert chain smoke script | +| write-capable surface | `11` | 可能 reload、deploy、send notification、fire alert 或 restart exporter | +| owner response received / accepted | `0 / 0` | 不得假性拉高 | +| live evidence received | `0` | 尚未驗證 live monitoring truth | +| reload owner / receiver owner / route smoke accepted | `0 / 0 / 0` | 尚未授權 reload、route change 或 live smoke | +| runtime gate / action button | `0 / 0` | 不得建立前端執行入口 | +| P1-4 成熟度 | `56% -> 62%` | 只代表 repo-only 清冊完成，不代表 live alert chain 通過 | + +## 3. Write-capable surface + +| surface | 風險 | 必要 gate | +|---------|------|-----------| +| `deploy_alertmanager_config_script` | 可影響 receiver / route / reload | owner response、維護窗口、rollback owner、receiver smoke | +| `deploy_prometheus_alerts_script` | 可影響 alert rules / reload | rule test、receiver mapping、reload owner、rollback owner | +| `k8s_deploy_prometheus_config_script` | 可觸發 K8s apply / reload | K8s owner、ArgoCD / kubectl 邊界、rollback owner | +| `api_apply_prometheus_config_script` | 可由 API side 套用 Prometheus config | API deploy owner、config source owner、reload proof | +| `monitoring_exporter_deploy_script` | 可透過 host deploy 影響 exporter / restart | host owner、SSH boundary、restart window | +| `sentry_self_hosted_deploy` | 可部署 Sentry self-hosted stack | deploy owner、backup owner、migration rollback | +| `telegram_gateway_service` | 可送 Telegram / 寫 delivery path | token injection owner、receipt owner、send approval gate | +| `notification_manager_service` | 可改通知通道與路由 | channel owner、receipt owner、failure-only policy | +| `converged_alert_recurrence_notifier` | 可造成 recurrence escalation 或噪音 | noise budget owner、silence boundary、receipt proof | +| `fire_live_alert_script` | 可向 live alert chain 打告警 | allowed receiver、test window、cleanup owner | +| `fire_test_alert_script` | 可觸發測試告警與通知 | dedup proof、receiver owner、noise guard | + +## 4. 固定 0 / false 邊界 + +```text +runtime_execution_authorized=false +host_write_authorized=false +prometheus_reload_authorized=false +alertmanager_reload_authorized=false +grafana_dashboard_apply_authorized=false +signoz_rule_apply_authorized=false +sentry_deploy_authorized=false +langfuse_config_change_authorized=false +otel_collector_reload_authorized=false +receiver_route_change_authorized=false +silence_policy_change_authorized=false +telegram_send_authorized=false +notification_route_change_authorized=false +webhook_receiver_change_authorized=false +remote_write_change_authorized=false +exporter_deploy_authorized=false +live_alert_fire_authorized=false +alert_chain_smoke_authorized=false +ssh_read_authorized=false +ssh_write_authorized=false +kubectl_action_authorized=false +secret_value_collection_allowed=false +active_scan_authorized=false +action_buttons_allowed=false +``` + +## 5. 下一步 owner response + +1. Prometheus owner：提供 live config hash、rule diff、reload owner、rollback owner 與 false-green guard。 +2. Alertmanager owner：提供 receiver diff、route owner、silence policy owner、reload owner 與 failure-only notification proof。 +3. Grafana owner：提供 dashboard UID / folder owner、import owner、rollback ref 與 smoke plan。 +4. SigNoz / OTEL owner：提供 pipeline diff、rule apply owner、data export boundary 與 rollback owner。 +5. Sentry / Langfuse owner：提供 compose live hash、secret injection owner、upgrade / restart window、backup owner 與 rollback owner。 +6. Telegram / notification owner：提供 receiver owner、receipt owner、redaction proof、retry boundary 與 no-secret-value evidence。 +7. Alert chain smoke owner：提供 allowed receiver、execution window、expected receipt、noise budget 與 cleanup owner。 + +## 6. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| P1-4 repo-only surface 註冊 | `100%` | `60` 個 surface 已納入 snapshot | +| source existence / SHA256 | `100%` | `60 / 60` source path 存在 | +| monitoring / alerting 高價值配置成熟度 | `56% -> 62%` | 只代表清冊與 guard 準備度 | +| owner response 收件 / 接受 | `0%` | 尚未收到或接受任何 owner response | +| live evidence collection | `0%` | 未讀 live monitoring stack | +| reload / receiver / route smoke gate | `0%` | 未授權、未執行 | +| runtime gate | `0%` | 無前端執行按鈕 | + +## 7. 邊界 + +本清冊完成不代表 live Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 已一致，也不代表 alert route 已送達或告警必到。不得把 repo source 可見、snapshot、IwoooS UI、AwoooP approval 或 LOGBOOK 當成 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH、kubectl、active scan 或 secret collection 授權。 diff --git a/docs/security/high-value-config-control-coverage.snapshot.json b/docs/security/high-value-config-control-coverage.snapshot.json index cdd25f84a..2840cabb7 100644 --- a/docs/security/high-value-config-control-coverage.snapshot.json +++ b/docs/security/high-value-config-control-coverage.snapshot.json @@ -293,15 +293,17 @@ "action_buttons_allowed": false, "category_id": "monitoring_alerting_observability", "control_tier": "C1", - "coverage_percent": 56, - "coverage_status": "policy_ready_needs_drift_evidence", - "current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。", + "coverage_percent": 62, + "coverage_status": "repo_only_inventory_ready_needs_live_route_evidence", + "current_gap": "repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live config hash、rule diff、receiver diff、reload owner、route smoke、receipt proof 與 owner response。", "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", - "docs/security/SERVICE-HEALTH-FAILURE-NOTIFICATION-POLICY.md" + "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", + "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json" ], "label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse", - "next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。", + "next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、rollback owner 與 no-secret-value evidence。", "owner_response_accepted": false, "owner_response_received": false, "owner_response_required": true, @@ -510,20 +512,31 @@ "action_buttons_allowed": false, "active_scan_authorized": false, "agent_bounty_runtime_authorized": false, + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, "argocd_sync_authorized": false, "backup_run_authorized": false, "certbot_renew_authorized": false, "credential_escrow_marker_write_authorized": false, "dns_tls_change_authorized": false, + "exporter_deploy_authorized": false, "force_push_authorized": false, + "grafana_dashboard_apply_authorized": false, "host_write_authorized": false, "kubectl_action_authorized": false, + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, "nginx_reload_authorized": false, + "notification_route_change_authorized": false, "offsite_remote_delete_authorized": false, "offsite_sync_authorized": false, + "otel_collector_reload_authorized": false, "payout_or_withdrawal_authorized": false, + "prometheus_reload_authorized": false, "rclone_config_authorized": false, + "receiver_route_change_authorized": false, "refs_sync_authorized": false, + "remote_write_change_authorized": false, "restic_prune_authorized": false, "restore_drill_authorized": false, "restore_run_authorized": false, @@ -531,11 +544,16 @@ "runner_change_authorized": false, "runtime_execution_authorized": false, "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "telegram_send_authorized": false, "velero_restore_authorized": false, + "webhook_receiver_change_authorized": false, "workflow_modification_authorized": false }, - "generated_at": "2026-06-11T22:25:00+08:00", - "git_commit": "dba91f3c", + "generated_at": "2026-06-12T09:05:00+08:00", + "git_commit": "7a7daa33", "lowest_coverage_categories": [ { "category_id": "docker_compose_systemd_host_config", @@ -551,19 +569,19 @@ "label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort", "next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。" }, - { - "category_id": "monitoring_alerting_observability", - "coverage_percent": 56, - "current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。", - "label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse", - "next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。" - }, { "category_id": "k8s_production_gitops", "coverage_percent": 58, "current_gap": "尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet。", "label": "K8s / ArgoCD / production manifests", "next_owner_action": "補 GitOps owner、rollback revision、health readback 與 post-deploy validation plan。" + }, + { + "category_id": "backup_restore_credential", + "coverage_percent": 58, + "current_gap": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。", + "label": "Backup / restore / escrow / retention", + "next_owner_action": "補 restore drill approval package、offsite owner、escrow owner、retention owner、rollback owner 與 no-secret-value evidence。" } ], "next_collection_order": [ @@ -588,7 +606,7 @@ "status": "coverage_matrix_ready", "summary": { "action_button_count": 0, - "average_coverage_percent": 65, + "average_coverage_percent": 66, "c0_category_count": 8, "c1_category_count": 4, "c2_category_count": 1, diff --git a/docs/security/iwooos-posture-projection.snapshot.json b/docs/security/iwooos-posture-projection.snapshot.json index 4a00c22e1..06c5f6d8f 100644 --- a/docs/security/iwooos-posture-projection.snapshot.json +++ b/docs/security/iwooos-posture-projection.snapshot.json @@ -1,7 +1,7 @@ { "schema_version": "iwooos_posture_projection_v1", "status": "draft", - "date": "2026-06-11", + "date": "2026-06-12", "product_id": "iwooos", "display_name": "IwoooS", "mode": "mirror_only", @@ -34,6 +34,9 @@ "docs/security/backup-restore-escrow-inventory.snapshot.json", "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", + "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", + "docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json", "docs/LOGBOOK.md", "docs/workplans/2026-06-04-iwooos-security-governance-p0.md", "apps/web/src/app/[locale]/iwooos/page.tsx", @@ -242,7 +245,7 @@ "high_value_config_control_coverage_category_count": 14, "high_value_config_control_coverage_c0_category_count": 8, "high_value_config_control_coverage_c1_category_count": 4, - "high_value_config_control_coverage_average_percent": 65, + "high_value_config_control_coverage_average_percent": 66, "high_value_config_control_coverage_needs_live_evidence_count": 6, "high_value_config_control_coverage_owner_response_required_count": 14, "high_value_config_control_coverage_owner_response_received_count": 0, @@ -432,7 +435,39 @@ "decision_runway_interactive_step_allowed": true, "decision_runway_runtime_gate_count": 0, "decision_runway_owner_response_received_count": 0, - "decision_runway_owner_response_accepted_count": 0 + "decision_runway_owner_response_accepted_count": 0, + "monitoring_alerting_observability_inventory_first_layer": true, + "monitoring_alerting_observability_inventory_surface_count": 60, + "monitoring_alerting_observability_inventory_source_exists_count": 60, + "monitoring_alerting_observability_inventory_expected_scope_count": 60, + "monitoring_alerting_observability_inventory_prometheus_config_surface_count": 8, + "monitoring_alerting_observability_inventory_alert_rule_surface_count": 13, + "monitoring_alerting_observability_inventory_alertmanager_receiver_surface_count": 1, + "monitoring_alerting_observability_inventory_grafana_surface_count": 6, + "monitoring_alerting_observability_inventory_signoz_surface_count": 3, + "monitoring_alerting_observability_inventory_sentry_surface_count": 4, + "monitoring_alerting_observability_inventory_langfuse_surface_count": 3, + "monitoring_alerting_observability_inventory_notification_policy_surface_count": 4, + "monitoring_alerting_observability_inventory_telegram_surface_count": 3, + "monitoring_alerting_observability_inventory_otel_surface_count": 1, + "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count": 6, + "monitoring_alerting_observability_inventory_drift_guard_surface_count": 1, + "monitoring_alerting_observability_inventory_smoke_surface_count": 4, + "monitoring_alerting_observability_inventory_write_capable_surface_count": 11, + "monitoring_alerting_observability_inventory_surfaces_requiring_owner_response_count": 60, + "monitoring_alerting_observability_inventory_surfaces_requiring_live_evidence_count": 60, + "monitoring_alerting_observability_inventory_owner_response_received_count": 0, + "monitoring_alerting_observability_inventory_owner_response_accepted_count": 0, + "monitoring_alerting_observability_inventory_live_evidence_received_count": 0, + "monitoring_alerting_observability_inventory_reload_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_receiver_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_route_smoke_accepted_count": 0, + "monitoring_alerting_observability_inventory_maintenance_window_accepted_count": 0, + "monitoring_alerting_observability_inventory_rollback_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_runtime_gate_count": 0, + "monitoring_alerting_observability_inventory_action_button_count": 0, + "monitoring_alerting_observability_inventory_coverage_percent_before_inventory": 56, + "monitoring_alerting_observability_inventory_coverage_percent_after_inventory": 62 }, "progress": { "overall_percent": 64, diff --git a/docs/security/monitoring-alerting-observability-inventory.snapshot.json b/docs/security/monitoring-alerting-observability-inventory.snapshot.json new file mode 100644 index 000000000..775611f62 --- /dev/null +++ b/docs/security/monitoring-alerting-observability-inventory.snapshot.json @@ -0,0 +1,1990 @@ +{ + "execution_boundaries": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "alert_chain_smoke_authorized": false, + "alertmanager_reload_authorized": false, + "exporter_deploy_authorized": false, + "grafana_dashboard_apply_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "langfuse_config_change_authorized": false, + "live_alert_fire_authorized": false, + "notification_route_change_authorized": false, + "otel_collector_reload_authorized": false, + "prometheus_reload_authorized": false, + "receiver_route_change_authorized": false, + "remote_write_change_authorized": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "sentry_deploy_authorized": false, + "signoz_rule_apply_authorized": false, + "silence_policy_change_authorized": false, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "telegram_send_authorized": false, + "webhook_receiver_change_authorized": false + }, + "expected_scopes": [ + "192.168.0.110_monitoring_stack", + "192.168.0.188_exporters", + "ai_agent_telegram_digest_policy", + "ai_agent_telegram_receipt_policy", + "ai_flywheel_alerts", + "alert_chain_metrics", + "alert_chain_monitor", + "alert_chain_smoke", + "alertmanager_config_deploy", + "alertmanager_routes_receivers", + "api_alert_rule_engine", + "api_prometheus_config_apply", + "backup_notification_policy", + "database_alerts", + "generated_blackbox_targets", + "generated_scrape_targets", + "grafana_agent_step_latency_rules", + "grafana_ai_monitoring_dashboard", + "grafana_ai_slo_dashboard", + "grafana_infra_monitoring_dashboard", + "grafana_nvidia_nemotron_dashboard", + "grafana_ollama_failover_dashboard", + "k3s_cluster_alerts", + "k3s_supplemental_alerts", + "k8s_monitoring_prometheus_additions", + "k8s_monitoring_prometheus_base", + "k8s_prometheus_config_deploy", + "langfuse_api_client", + "langfuse_observability_runbook", + "langfuse_observability_runtime", + "live_alert_fire_script", + "minio_kali_alerts", + "monitoring_exporter_deploy", + "monitoring_service_registry", + "notification_matrix_policy", + "notification_runtime_routing", + "nvidia_gpu_alerts", + "observability_contract_matrix", + "ollama_health_rules", + "ops_alert_chain_smoke", + "ops_prometheus_alerts", + "phase_o_prometheus_config", + "postgres_exporter_queries", + "prometheus_alerts_deploy", + "prometheus_remote_write_signoz", + "prometheus_rule_drift_guard", + "prometheus_slo_rules", + "recurrence_notification_runtime", + "sentry_api_client", + "sentry_self_hosted_deploy", + "sentry_self_hosted_runtime", + "sentry_webhook_receiver", + "service_health_failure_notification_policy", + "signoz_alerting_rules", + "signoz_api_client", + "signoz_log_alert_rules", + "signoz_otel_collector_phase_o", + "telegram_gateway_runtime_sender", + "test_alert_fire_script", + "unified_prometheus_alerts" + ], + "generated_at": "2026-06-12T09:00:00+08:00", + "git_commit": "7a7daa33", + "next_collection_order": [ + "alertmanager_receiver_config", + "prometheus_alerts_ops", + "prometheus_rule_drift_guard_script", + "deploy_alertmanager_config_script", + "deploy_prometheus_alerts_script", + "monitoring_110_compose", + "signoz_otel_collector_config", + "sentry_self_hosted_compose", + "telegram_gateway_service", + "alert_chain_smoke_script" + ], + "observability_surfaces": [ + { + "action_buttons_allowed": false, + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "repo_source_visible_reload_not_authorized", + "expected_scope": "k8s_monitoring_prometheus_base", + "label": "K8s Prometheus base config", + "line_count": 208, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Prometheus owner、live config hash、reload owner、rule diff 與 route smoke 指標。", + "observability_scope": [ + "scrape config", + "service discovery", + "alert rule includes" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "5ea5ec736686dabb05bff0691dd45196eae4d2ab645c14b3f812748186ad6da9", + "source_exists": true, + "source_path": "k8s/monitoring/prometheus.yml", + "surface_id": "prometheus_k8s_base_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "repo_source_visible_needs_drift_disposition", + "expected_scope": "k8s_monitoring_prometheus_additions", + "label": "K8s Prometheus additions", + "line_count": 112, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 additions owner、live parity evidence、rollout window 與 rollback owner。", + "observability_scope": [ + "supplemental scrape", + "additional rule paths" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "67bd6ef7b9da39fd4decb5254dc9bea1980f54fcd162f8468ac98f49258a39b4", + "source_exists": true, + "source_path": "k8s/monitoring/prometheus-config-additions.yaml", + "surface_id": "prometheus_k8s_additions_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "phase_config_visible_reload_not_authorized", + "expected_scope": "phase_o_prometheus_config", + "label": "Prometheus Phase O config", + "line_count": 83, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Phase O owner、stale config disposition、reload owner 與 post-check 指標。", + "observability_scope": [ + "Phase O monitoring", + "baseline scrape" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "7bdb94a23f6f14912c89655e5313fb745a772286671647db32d7ee2f07b50d9d", + "source_exists": true, + "source_path": "k8s/monitoring/prometheus-config-phase-o.yaml", + "surface_id": "prometheus_phase_o_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_remote_write", + "control_tier": "C1", + "current_state": "data_export_config_visible_gate_closed", + "expected_scope": "prometheus_remote_write_signoz", + "label": "Prometheus remote write to SigNoz", + "line_count": 89, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 data export owner、privacy boundary、SigNoz ingest owner、rollback owner 與 volume guard。", + "observability_scope": [ + "remote write", + "SigNoz ingestion", + "data export boundary" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "da6ae1ef0be420b07fc0f56861e548d049ec53fd0f601ee913797304315fbcc7", + "source_exists": true, + "source_path": "k8s/monitoring/prometheus-remote-write-signoz.yaml", + "surface_id": "prometheus_remote_write_signoz" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "current_state": "generated_source_visible_needs_source_registry_parity", + "expected_scope": "generated_scrape_targets", + "label": "Generated Prometheus scrape config", + "line_count": 192, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 generator owner、service registry parity、live target count 與 stale target disposition。", + "observability_scope": [ + "generated targets", + "service registry" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "6c1fb1ef0b672e016584a26b3dd1c1fb62904d9a4d26ec30e35f5493e23b0f9b", + "source_exists": true, + "source_path": "ops/monitoring/generated/prometheus-scrape-generated.yaml", + "surface_id": "prometheus_generated_scrape_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "current_state": "generated_blackbox_targets_visible_probe_not_executed", + "expected_scope": "generated_blackbox_targets", + "label": "Generated blackbox targets", + "line_count": 110, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 blackbox owner、target freshness、public route owner 與 probe execution approval。", + "observability_scope": [ + "blackbox targets", + "public route smoke candidates" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "e375aec2fe6b602157de4d187d66c8a4b0dc237c1ba2ae8c9ad3f598f4730e79", + "source_exists": true, + "source_path": "ops/monitoring/generated/blackbox-targets-generated.yaml", + "surface_id": "prometheus_generated_blackbox_targets" + }, + { + "action_buttons_allowed": false, + "config_kind": "monitoring_service_registry", + "control_tier": "C1", + "current_state": "registry_visible_needs_owner_disposition", + "expected_scope": "monitoring_service_registry", + "label": "Monitoring service registry", + "line_count": 830, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 registry owner、產品 owner mapping、retired target disposition 與 generator smoke。", + "observability_scope": [ + "service registry", + "target generation" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "e01aa01299381506ac901229ab3154329c978358d40882618cfbaa134c007418", + "source_exists": true, + "source_path": "ops/monitoring/service-registry.yaml", + "surface_id": "monitoring_service_registry" + }, + { + "action_buttons_allowed": false, + "config_kind": "exporter_query_config", + "control_tier": "C1", + "current_state": "query_config_visible_needs_db_owner_review", + "expected_scope": "postgres_exporter_queries", + "label": "Postgres exporter query config", + "line_count": 215, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 DB owner、query cost boundary、metric name owner 與 rollback owner。", + "observability_scope": [ + "PostgreSQL metrics", + "custom exporter queries" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "50102b017c91d24c1dcae79779b4da39ce44628a2bd89250f5145411f0ac6f21", + "source_exists": true, + "source_path": "ops/monitoring/postgres-exporter-queries.yaml", + "surface_id": "postgres_exporter_queries" + }, + { + "action_buttons_allowed": false, + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "current_state": "runtime_compose_visible_live_hash_missing", + "expected_scope": "192.168.0.110_monitoring_stack", + "label": "110 monitoring compose", + "line_count": 148, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 110 live compose hash、restart window、rollback owner、admin secret boundary 與 post-check。", + "observability_scope": [ + "Prometheus", + "Grafana", + "Alertmanager", + "blackbox", + "cadvisor" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "00126e9a5cb7a3cf2bf02cfddefea11f05849b46835a4e602eac4777fcb25281", + "source_exists": true, + "source_path": "k8s/monitoring/docker-compose-110.yml", + "surface_id": "monitoring_110_compose" + }, + { + "action_buttons_allowed": false, + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "current_state": "exporter_compose_visible_live_hash_missing", + "expected_scope": "192.168.0.188_exporters", + "label": "188 monitoring exporters compose", + "line_count": 69, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 188 exporter owner、live hash、env source policy、restart window 與 rollback owner。", + "observability_scope": [ + "postgres-exporter", + "redis-exporter" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "3ffb3bd2e98091d18e60b74721904777c27f279c37ab6e873b82e6ef73eb87d4", + "source_exists": true, + "source_path": "ops/monitoring/docker-compose.exporters.yaml", + "surface_id": "monitoring_exporters_compose" + }, + { + "action_buttons_allowed": false, + "config_kind": "alertmanager_receiver_config", + "control_tier": "C1", + "current_state": "receiver_route_visible_reload_not_authorized", + "expected_scope": "alertmanager_routes_receivers", + "label": "Alertmanager receiver config", + "line_count": 146, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 receiver owner、route diff、silence policy owner、reload owner 與 failure-only notification proof。", + "observability_scope": [ + "routes", + "receivers", + "grouping", + "Telegram / webhook receiver boundary" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "7ee436fbe114bd2fffa616d8d87c42dd0cc7f59151dc03ab09258dfa83a1de86", + "source_exists": true, + "source_path": "ops/alertmanager/alertmanager.yml", + "surface_id": "alertmanager_receiver_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "alert_rules_visible_reload_not_authorized", + "expected_scope": "ops_prometheus_alerts", + "label": "Ops Prometheus alerts", + "line_count": 1355, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 alert rule owner、rule diff、receiver mapping、reload owner 與 false-green guard。", + "observability_scope": [ + "infrastructure alerts", + "backup alerts", + "route alerts" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "94d439a2ea599995601a5022dc0a001cc09f405964cd1308b103f86e2af14e90", + "source_exists": true, + "source_path": "ops/monitoring/alerts.yml", + "surface_id": "prometheus_alerts_ops" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "unified_rules_visible_needs_receiver_parity", + "expected_scope": "unified_prometheus_alerts", + "label": "Unified Prometheus alerts", + "line_count": 2031, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 unified rule owner、label taxonomy owner、receiver parity 與 rollout window。", + "observability_scope": [ + "unified alerts", + "routing labels" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "97b5be44a5af982c8013323d353c67748f87a7336d22a7c8270d7d6a1546bf45", + "source_exists": true, + "source_path": "ops/monitoring/alerts-unified.yml", + "surface_id": "prometheus_alerts_unified" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "slo_rules_visible_reload_not_authorized", + "expected_scope": "prometheus_slo_rules", + "label": "Prometheus SLO rules", + "line_count": 257, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 SLO owner、error budget owner、rule test evidence 與 receiver mapping。", + "observability_scope": [ + "SLO burn rate", + "availability indicators" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "31b7cbe0af22c5ad2320cf23fd06cce73a93194acff0e1d4045ed0acb7b3b3bd", + "source_exists": true, + "source_path": "ops/monitoring/slo-rules.yml", + "surface_id": "prometheus_slo_rules" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "ai_runtime_health_rules_visible_reload_not_authorized", + "expected_scope": "ollama_health_rules", + "label": "Ollama health alert rules", + "line_count": 149, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 AI provider owner、fallback owner、receiver owner 與 reload owner。", + "observability_scope": [ + "Ollama health", + "AI provider availability" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "9f994c654d8a8c6c7d570fec0ba0418f8d4cc7fe4e4a83cb1bb80988a3cd0b55", + "source_exists": true, + "source_path": "ops/monitoring/ollama_health_rules.yaml", + "surface_id": "prometheus_ollama_health_rules" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "k3s_rules_visible_apply_not_authorized", + "expected_scope": "k3s_cluster_alerts", + "label": "K3s alert rules", + "line_count": 203, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 K3s owner、rule apply window、ArgoCD / kubectl boundary 與 rollback owner。", + "observability_scope": [ + "K3s workloads", + "cluster health" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "be1a4e796f6f6363566898ffd07ac37a938255b895cde11743fe0770d9946663", + "source_exists": true, + "source_path": "k8s/monitoring/k3s-alerts.yaml", + "surface_id": "k8s_k3s_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "supplemental_rules_visible_apply_not_authorized", + "expected_scope": "k3s_supplemental_alerts", + "label": "K3s supplemental alert rules", + "line_count": 290, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 supplemental rule owner、overlap disposition、receiver owner 與 apply boundary。", + "observability_scope": [ + "K3s supplemental health", + "gap alerts" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "14fd4f8c7deaf22c6828ffbf66400e6d0e274f03db1999197af26311bdb6d203", + "source_exists": true, + "source_path": "k8s/monitoring/k3s-alerts-supplemental.yaml", + "surface_id": "k8s_k3s_supplemental_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "database_rules_visible_apply_not_authorized", + "expected_scope": "database_alerts", + "label": "Database alert rules", + "line_count": 264, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 DB alert owner、threshold owner、receiver mapping 與 live metric evidence。", + "observability_scope": [ + "PostgreSQL", + "Redis", + "DB availability" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "6077aa4e061c6604519eaede01144ffec46c39a6715a296a1ae54ff5484a0111", + "source_exists": true, + "source_path": "k8s/monitoring/database-alerts.yaml", + "surface_id": "k8s_database_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "gpu_rules_visible_apply_not_authorized", + "expected_scope": "nvidia_gpu_alerts", + "label": "NVIDIA alert rules", + "line_count": 122, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 GPU owner、NVIDIA exporter live evidence、receiver owner 與 rollout boundary。", + "observability_scope": [ + "GPU health", + "AI workload capacity" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "c43a6413269dadc8269b9724ee905650f39926249a37c7339179ec88facdf972", + "source_exists": true, + "source_path": "k8s/monitoring/nvidia-alerts.yaml", + "surface_id": "k8s_nvidia_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "minio_kali_rules_visible_apply_not_authorized", + "expected_scope": "minio_kali_alerts", + "label": "MinIO / Kali alert rules", + "line_count": 67, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 MinIO / Kali owner、active scan boundary、receiver owner 與 rule apply owner。", + "observability_scope": [ + "MinIO", + "Kali scanner", + "read-only scanner status" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "3f3ca8c012a40f5a9983b6f587dfd60ffd0a8fb3dcea6b793cb1d5fbad0fe50b", + "source_exists": true, + "source_path": "k8s/monitoring/minio-kali-alerts.yaml", + "surface_id": "k8s_minio_kali_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "flywheel_rules_visible_apply_not_authorized", + "expected_scope": "ai_flywheel_alerts", + "label": "AI flywheel alert rules", + "line_count": 219, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 AI flywheel owner、runtime gate boundary、receiver owner 與 false-green guard。", + "observability_scope": [ + "AI flywheel", + "learning / runtime health" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "74334919400623ff4115472e39ba30a6bbc5383bc7dfd6a3fae7bd06531e7cc6", + "source_exists": true, + "source_path": "k8s/monitoring/flywheel-alerts.yaml", + "surface_id": "k8s_flywheel_alerts" + }, + { + "action_buttons_allowed": false, + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "alert_chain_monitor_visible_apply_not_authorized", + "expected_scope": "alert_chain_monitor", + "label": "Alert chain monitor", + "line_count": 202, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 alert chain owner、E2E smoke owner、receiver owner 與 post-check 指標。", + "observability_scope": [ + "Alertmanager chain", + "E2E alert visibility" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "03ad55d72425f27071ba3afa8d43959a7ee361cc8f76fcf2ca295a33297bbf54", + "source_exists": true, + "source_path": "k8s/monitoring/alert-chain-monitor.yaml", + "surface_id": "k8s_alert_chain_monitor" + }, + { + "action_buttons_allowed": false, + "config_kind": "app_alert_rule_contract", + "control_tier": "C1", + "current_state": "app_rule_contract_visible_runtime_change_not_authorized", + "expected_scope": "api_alert_rule_engine", + "label": "API alert rule engine rules", + "line_count": 889, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 rule owner、AI decision owner、classification drift evidence 與 rollback owner。", + "observability_scope": [ + "alert classification", + "approval recommendations", + "playbook matching" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "5786505aa05073bbb2069203a443a75c8337a289dc015630792d0c201c85cafb", + "source_exists": true, + "source_path": "apps/api/alert_rules.yaml", + "surface_id": "app_alert_rules_yaml" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_alert_rules", + "control_tier": "C1", + "current_state": "grafana_rules_visible_apply_not_authorized", + "expected_scope": "grafana_agent_step_latency_rules", + "label": "Grafana agent step latency rules", + "line_count": 201, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Grafana alert owner、dashboard / rule UID owner、apply owner 與 rollback owner。", + "observability_scope": [ + "agent step latency", + "Grafana alerting" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "24b086bdf0eaca72c90fc323e562de4b47708c25f2427c0fc0b350e883431564", + "source_exists": true, + "source_path": "ops/monitoring/grafana/agent_step_latency_rules.yaml", + "surface_id": "grafana_agent_step_latency_rules" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "expected_scope": "grafana_ai_slo_dashboard", + "label": "Grafana AI SLO dashboard", + "line_count": 496, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 dashboard owner、folder owner、UID conflict check 與 import rollback owner。", + "observability_scope": [ + "AI SLO", + "dashboard panels" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "e7518d6c234330d4b19c056a1810cb8037fbe1572f5a7968ac623dbee3630db3", + "source_exists": true, + "source_path": "ops/monitoring/grafana/dashboards/ai-slo-dashboard.json", + "surface_id": "grafana_ai_slo_dashboard" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "expected_scope": "grafana_ollama_failover_dashboard", + "label": "Grafana Ollama failover dashboard", + "line_count": 295, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 dashboard owner、AI provider owner、Grafana import owner 與 rollback ref。", + "observability_scope": [ + "Ollama failover", + "AI provider health" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "f583bc00a8af0c87f9594fb2452b9835e90a7c1473131bf8fb4b6709887a7a5b", + "source_exists": true, + "source_path": "ops/monitoring/grafana/dashboards/ollama_failover.json", + "surface_id": "grafana_ollama_failover_dashboard" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "expected_scope": "grafana_ai_monitoring_dashboard", + "label": "Grafana AI monitoring dashboard", + "line_count": 347, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 dashboard owner、panel query owner、import window 與 rollback owner。", + "observability_scope": [ + "AI monitoring", + "runtime health" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "acf865af021100244b91358c423e9d73d8bf2d58221cf274ea7ad7ae2fc933fd", + "source_exists": true, + "source_path": "ops/grafana/dashboards/ai-monitoring.json", + "surface_id": "grafana_ai_monitoring_dashboard" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "expected_scope": "grafana_infra_monitoring_dashboard", + "label": "Grafana infra monitoring dashboard", + "line_count": 306, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 infra dashboard owner、host source owner、import owner 與 smoke plan。", + "observability_scope": [ + "infrastructure monitoring", + "host health" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "40c696e140585bd1889c4e07cbd8f9be302c1653b5d0736cd93c8d9c29c2beb0", + "source_exists": true, + "source_path": "ops/grafana/dashboards/infra-monitoring.json", + "surface_id": "grafana_infra_monitoring_dashboard" + }, + { + "action_buttons_allowed": false, + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "expected_scope": "grafana_nvidia_nemotron_dashboard", + "label": "Grafana NVIDIA / NemoTron dashboard", + "line_count": 1426, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 GPU / NemoTron owner、dashboard UID owner、import owner 與 rollback owner。", + "observability_scope": [ + "NVIDIA", + "NemoTron", + "GPU AI route" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "f47280987546c8546058d61b25a41f14bbb573e33a9c08f45b138d8176397d82", + "source_exists": true, + "source_path": "ops/grafana/dashboards/nvidia-nemotron.json", + "surface_id": "grafana_nvidia_nemotron_dashboard" + }, + { + "action_buttons_allowed": false, + "config_kind": "otel_collector_config", + "control_tier": "C1", + "current_state": "otel_collector_config_visible_reload_not_authorized", + "expected_scope": "signoz_otel_collector_phase_o", + "label": "SigNoz OTEL collector config", + "line_count": 188, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 OTEL owner、pipeline diff、secret redaction proof、reload owner 與 data export boundary。", + "observability_scope": [ + "OTEL collector", + "traces / metrics / logs routing" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "85abede3243b0775da600d1a5e092df3ff8c79eea56131b0da52a51aa7f668b9", + "source_exists": true, + "source_path": "ops/signoz/otel-collector-config-phase-o.yaml", + "surface_id": "signoz_otel_collector_config" + }, + { + "action_buttons_allowed": false, + "config_kind": "signoz_alert_rules", + "control_tier": "C1", + "current_state": "signoz_rules_visible_apply_not_authorized", + "expected_scope": "signoz_alerting_rules", + "label": "SigNoz alerting rules", + "line_count": 165, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 SigNoz rule owner、apply owner、receiver mapping、silence owner 與 rollback owner。", + "observability_scope": [ + "SigNoz alert rules", + "logs / traces alerting" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "a70519216e354ff78e323b1d77898e9d55b19eea5704fd8a8e9dd928196881e4", + "source_exists": true, + "source_path": "ops/signoz/alerting/rules.yaml", + "surface_id": "signoz_alerting_rules" + }, + { + "action_buttons_allowed": false, + "config_kind": "signoz_log_rules", + "control_tier": "C1", + "current_state": "log_rule_runbook_visible_apply_not_authorized", + "expected_scope": "signoz_log_alert_rules", + "label": "SigNoz log alert rules", + "line_count": 107, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 log rule owner、manual translation reviewer、apply proof 與 rollback owner。", + "observability_scope": [ + "log alerting", + "manual rule translation" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "f4e77c4e8e6fa149df5a4b5ef4651e514f9e0142f66f3f27dbd951fe3abed533", + "source_exists": true, + "source_path": "ops/signoz/alerting/log-rules.md", + "surface_id": "signoz_log_rules" + }, + { + "action_buttons_allowed": false, + "config_kind": "sentry_runtime_compose", + "control_tier": "C1", + "current_state": "sentry_compose_visible_live_hash_missing", + "expected_scope": "sentry_self_hosted_runtime", + "label": "Sentry self-hosted compose", + "line_count": 49, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Sentry runtime owner、live hash、admin secret boundary、upgrade window 與 rollback owner。", + "observability_scope": [ + "Sentry self-hosted", + "ClickHouse / Postgres / Redis boundary" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "bba852dc0d73934998fa375130168615f9ac7611ce3f3efaa901e3b7e222eae3", + "source_exists": true, + "source_path": "ops/sentry-self-hosted/docker-compose.yml", + "surface_id": "sentry_self_hosted_compose" + }, + { + "action_buttons_allowed": false, + "config_kind": "sentry_deploy_script", + "control_tier": "C1", + "current_state": "deploy_script_visible_not_executed", + "expected_scope": "sentry_self_hosted_deploy", + "label": "Sentry self-hosted deploy script", + "line_count": 65, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 deploy owner、maintenance window、backup owner、migration rollback owner 與 smoke plan。", + "observability_scope": [ + "Sentry deploy", + "compose pull / up", + "migration boundary" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "b3dfb577c398a12d8f0521b159d18413257850eed7220234fcc491ff9aee9c7a", + "source_exists": true, + "source_path": "ops/sentry-self-hosted/deploy.sh", + "surface_id": "sentry_self_hosted_deploy" + }, + { + "action_buttons_allowed": false, + "config_kind": "langfuse_runtime_compose", + "control_tier": "C1", + "current_state": "langfuse_compose_visible_live_hash_missing", + "expected_scope": "langfuse_observability_runtime", + "label": "Langfuse compose", + "line_count": 71, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Langfuse owner、trace privacy owner、live hash、restart window 與 rollback owner。", + "observability_scope": [ + "Langfuse", + "LLM trace storage", + "PostgreSQL dependency" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "6c703a27525e62ef4d4d3c4cba8a89d64f646b01020782e35d22a3bf73f2dc83", + "source_exists": true, + "source_path": "infra/langfuse/docker-compose.yml", + "surface_id": "langfuse_compose" + }, + { + "action_buttons_allowed": false, + "config_kind": "langfuse_runbook", + "control_tier": "C1", + "current_state": "runbook_visible_needs_stale_disposition", + "expected_scope": "langfuse_observability_runbook", + "label": "Langfuse deployment README", + "line_count": 69, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 runbook owner、live deployment parity、trace retention owner 與 secret redaction proof。", + "observability_scope": [ + "Langfuse deployment", + "trace governance" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "7441665bfd3ce69e643364c7e792c837641bd36ff05d1aec44f15a7be62082e1", + "source_exists": true, + "source_path": "infra/langfuse/README.md", + "surface_id": "langfuse_readme" + }, + { + "action_buttons_allowed": false, + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "current_state": "failure_only_policy_visible_live_send_gate_closed", + "expected_scope": "service_health_failure_notification_policy", + "label": "Service health failure notification policy", + "line_count": 303, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 notification owner、receiver owner、live receipt proof、redaction proof 與 retry boundary。", + "observability_scope": [ + "failure-only notification", + "redaction contract" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "210a35e3e122d4311d5d25585c0d88b46206da87baa39a3f712fba291fea6ea3", + "source_exists": true, + "source_path": "docs/evaluations/service_health_failure_notification_policy_2026-06-05.json", + "surface_id": "service_health_failure_policy_snapshot" + }, + { + "action_buttons_allowed": false, + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "current_state": "backup_notification_policy_visible_live_send_gate_closed", + "expected_scope": "backup_notification_policy", + "label": "Backup notification policy", + "line_count": 276, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 backup notification owner、Telegram receipt owner、failure-only proof 與 false-green guard。", + "observability_scope": [ + "backup failure notification", + "restore / offsite alerting" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "0b282dc88bbe140871d9e232de5ebce97168b1a38b16e46b2e90c62fea6d6c8d", + "source_exists": true, + "source_path": "docs/evaluations/backup_notification_policy_2026-06-04.json", + "surface_id": "backup_notification_policy_snapshot" + }, + { + "action_buttons_allowed": false, + "config_kind": "observability_contract_snapshot", + "control_tier": "C1", + "current_state": "contract_matrix_visible_needs_live_parity", + "expected_scope": "observability_contract_matrix", + "label": "Observability contract matrix", + "line_count": 391, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 contract owner、live parity owner、coverage gap disposition 與 evidence freshness owner。", + "observability_scope": [ + "observability contract", + "source coverage", + "runtime evidence" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "b274f086080a4ac8d6e1786fa8d44a585ce92aadb1f6608dfb891cef7b1f05a1", + "source_exists": true, + "source_path": "docs/evaluations/observability_contract_matrix_2026-06-05.json", + "surface_id": "observability_contract_matrix_snapshot" + }, + { + "action_buttons_allowed": false, + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "current_state": "telegram_policy_visible_live_send_gate_closed", + "expected_scope": "ai_agent_telegram_digest_policy", + "label": "Telegram action required digest policy", + "line_count": 405, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Telegram owner、receiver owner、receipt owner、redaction proof 與 retry boundary。", + "observability_scope": [ + "Telegram digest", + "action required routing" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "2f8d00a8d697720e3198678dbaecca9fc618aa7957a348d89fd1bce250be842e", + "source_exists": true, + "source_path": "docs/evaluations/ai_agent_telegram_action_required_digest_policy_2026-06-11.json", + "surface_id": "telegram_action_required_digest_snapshot" + }, + { + "action_buttons_allowed": false, + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "current_state": "receipt_policy_visible_live_receipt_gate_closed", + "expected_scope": "ai_agent_telegram_receipt_policy", + "label": "Telegram receipt approval package", + "line_count": 179, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 receipt owner、gateway queue owner、ack policy owner 與 no-live-send boundary。", + "observability_scope": [ + "delivery receipt", + "ack / retry policy" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "4fcb0f5a9ab809df3ea2ea1e384aa1f9c09544af0a12274029fc52c21c15e857", + "source_exists": true, + "source_path": "docs/evaluations/ai_agent_telegram_receipt_approval_package_2026-06-11.json", + "surface_id": "telegram_receipt_approval_snapshot" + }, + { + "action_buttons_allowed": false, + "config_kind": "telegram_runtime_sender", + "control_tier": "C1", + "current_state": "send_capable_service_visible_gate_closed", + "expected_scope": "telegram_gateway_runtime_sender", + "label": "Telegram gateway service", + "line_count": 9452, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 gateway owner、token injection owner、receipt owner、send approval gate 與 rollback owner。", + "observability_scope": [ + "Telegram Bot API", + "dedup", + "delivery queue" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "bf8727f1fcb8cfbdda0997dbd6e1d5f9298a09d10bebf719a3d3b70a23e3633c", + "source_exists": true, + "source_path": "apps/api/src/services/telegram_gateway.py", + "surface_id": "telegram_gateway_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "current_state": "runtime_router_visible_send_gate_closed", + "expected_scope": "notification_runtime_routing", + "label": "Notification manager", + "line_count": 172, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 channel owner、routing owner、failure-only policy owner、receipt owner 與 rollback owner。", + "observability_scope": [ + "notification channel routing", + "Telegram / Discord manager" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "f3b61e55dba30aca4be16282681445671559467ddc21b946f76762ad829cfeb2", + "source_exists": true, + "source_path": "apps/api/src/services/notifications/manager.py", + "surface_id": "notification_manager_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "notification_policy_code", + "control_tier": "C1", + "current_state": "policy_code_visible_runtime_gate_closed", + "expected_scope": "notification_matrix_policy", + "label": "Notification matrix", + "line_count": 66, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 matrix owner、recipient owner、channel parity evidence 與 redaction policy。", + "observability_scope": [ + "notification policy", + "recipient / channel mapping" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "5881a477e7fe6b7f60af9ad1e880197b01474bc08749977d46fd541764d81442", + "source_exists": true, + "source_path": "apps/api/src/services/notification_matrix.py", + "surface_id": "notification_matrix_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "alert_metrics_service", + "control_tier": "C1", + "current_state": "metrics_service_visible_needs_runtime_evidence", + "expected_scope": "alert_chain_metrics", + "label": "Alert chain metrics service", + "line_count": 160, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 metrics owner、Prometheus scrape owner、delivery evidence 與 false-green guard。", + "observability_scope": [ + "alert chain metrics", + "delivery visibility" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "4eee6ac9e7228183a6fbc05179b85c0d8aca001bf7cc15736d480b3dd1d6f96d", + "source_exists": true, + "source_path": "apps/api/src/services/alert_chain_metrics_service.py", + "surface_id": "alert_chain_metrics_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "current_state": "recurrence_notifier_visible_send_gate_closed", + "expected_scope": "recurrence_notification_runtime", + "label": "Converged alert recurrence notifier", + "line_count": 215, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 recurrence owner、noise budget owner、receipt owner、silence boundary 與 rollback owner。", + "observability_scope": [ + "recurrence notification", + "dedup", + "escalation routing" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "66e7026bd8b6662c6daaaeb004cb5b58a9ffe81b705b227e2ad1f50e84bc6856", + "source_exists": true, + "source_path": "apps/api/src/services/converged_alert_recurrence_notifier.py", + "surface_id": "converged_alert_recurrence_notifier" + }, + { + "action_buttons_allowed": false, + "config_kind": "webhook_receiver", + "control_tier": "C1", + "current_state": "webhook_receiver_visible_secret_value_not_collected", + "expected_scope": "sentry_webhook_receiver", + "label": "Sentry webhook service", + "line_count": 452, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 webhook owner、secret name owner、signature proof、route smoke 與 replay boundary。", + "observability_scope": [ + "Sentry webhook", + "signature validation", + "triage route" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "00c192d55a56f4dafd4e11a4fa7d3950a8938ab158f066bb7d49ab70c4c19d06", + "source_exists": true, + "source_path": "apps/api/src/services/sentry_webhook_service.py", + "surface_id": "sentry_webhook_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "signoz_observability_client", + "control_tier": "C1", + "current_state": "client_visible_live_api_read_not_executed", + "expected_scope": "signoz_api_client", + "label": "SigNoz client service", + "line_count": 577, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 SigNoz client owner、token name owner、rate limit boundary 與 read-only smoke owner。", + "observability_scope": [ + "SigNoz API", + "log query", + "trace query" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "3eceb5f6d2a611390024215e12c8ff634b1eafc7ee9ca697dcde81cf7927de5c", + "source_exists": true, + "source_path": "apps/api/src/services/signoz_client.py", + "surface_id": "signoz_client_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "sentry_observability_client", + "control_tier": "C1", + "current_state": "client_visible_live_api_read_not_executed", + "expected_scope": "sentry_api_client", + "label": "Sentry service client", + "line_count": 464, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Sentry client owner、token name owner、read-only evidence 與 privacy boundary。", + "observability_scope": [ + "Sentry API", + "issue query", + "AI triage" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "8287af9f12a5fbc991f2a8e369559075d863f4d36e4384a0616dc06e0919c05f", + "source_exists": true, + "source_path": "apps/api/src/services/sentry_service.py", + "surface_id": "sentry_service_client" + }, + { + "action_buttons_allowed": false, + "config_kind": "langfuse_observability_client", + "control_tier": "C1", + "current_state": "client_visible_trace_read_write_boundary_needs_owner", + "expected_scope": "langfuse_api_client", + "label": "Langfuse client service", + "line_count": 347, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 Langfuse owner、trace privacy owner、token name owner、write gate 與 retention owner。", + "observability_scope": [ + "Langfuse API", + "AI trace", + "prompt / output privacy" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "fdd232688d58d31d38d1c8545b75a34f3afc53076c5c13bfe318d4d13cffc7cb", + "source_exists": true, + "source_path": "apps/api/src/services/langfuse_client.py", + "surface_id": "langfuse_client_service" + }, + { + "action_buttons_allowed": false, + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "reload_capable_script_visible_gate_closed", + "expected_scope": "alertmanager_config_deploy", + "label": "Alertmanager config deploy script", + "line_count": 145, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 deploy owner、maintenance window、rollback ref、receiver smoke 與 failure-only notification proof。", + "observability_scope": [ + "Alertmanager config copy", + "reload" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "861ce84b7abea40d279e9c346baa4388b6962416914ad39fbd388ef0613c2c30", + "source_exists": true, + "source_path": "scripts/ops/deploy-alertmanager-config.sh", + "surface_id": "deploy_alertmanager_config_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "reload_capable_script_visible_gate_closed", + "expected_scope": "prometheus_alerts_deploy", + "label": "Prometheus alerts deploy script", + "line_count": 164, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 deploy owner、rule test proof、reload owner、receiver smoke 與 rollback owner。", + "observability_scope": [ + "Prometheus alert rule deploy", + "reload" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "302df2ac135a8b360684797cc6210584120f115896859435ddd15a0d3c1cf883", + "source_exists": true, + "source_path": "scripts/ops/deploy-alerts.sh", + "surface_id": "deploy_prometheus_alerts_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "drift_guard_script", + "control_tier": "C1", + "current_state": "drift_guard_visible_not_executed_by_inventory", + "expected_scope": "prometheus_rule_drift_guard", + "label": "Prometheus rule drift guard", + "line_count": 149, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 drift guard owner、live rule export owner、diff disposition 與 blocking policy owner。", + "observability_scope": [ + "rule diff", + "drift evidence", + "reload guard" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "c284f7abe4f511f4670f03f78b945f4506d277fe8a9c382e1bfedae48dfde61a", + "source_exists": true, + "source_path": "scripts/ops/prometheus-rule-drift-guard.sh", + "surface_id": "prometheus_rule_drift_guard_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "deploy_script_visible_not_executed", + "expected_scope": "k8s_prometheus_config_deploy", + "label": "K8s Prometheus config deploy script", + "line_count": 118, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 K8s deploy owner、kubectl / ArgoCD boundary、reload owner 與 rollback owner。", + "observability_scope": [ + "K8s config apply", + "Prometheus reload" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "5511681efdd5563aa980396b2ebb37b7d28e43092feda48f3cba014a4b863adf", + "source_exists": true, + "source_path": "k8s/monitoring/deploy-prometheus-config.sh", + "surface_id": "k8s_deploy_prometheus_config_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "apply_script_visible_not_executed", + "expected_scope": "api_prometheus_config_apply", + "label": "API Prometheus config apply script", + "line_count": 198, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 API deploy owner、config source owner、reload proof 與 rollback owner。", + "observability_scope": [ + "Prometheus config apply", + "API-owned alert deploy" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "dfc154732a7858116fab423655eff8bc0b6e36f135cbd7f5e5f23745c7402aef", + "source_exists": true, + "source_path": "apps/api/scripts/apply_prometheus_config.sh", + "surface_id": "api_apply_prometheus_config_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "host_deploy_script", + "control_tier": "C1", + "current_state": "host_deploy_script_visible_gate_closed", + "expected_scope": "monitoring_exporter_deploy", + "label": "Monitoring exporter deploy script", + "line_count": 76, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 host owner、SSH boundary、restart window、rollback owner 與 exporter scrape proof。", + "observability_scope": [ + "exporter deploy", + "host service restart" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "dbcbca21cf6fd5083177cb8a12c008c1aefed8e6ed05b70d738b3db37699cef3", + "source_exists": true, + "source_path": "ops/monitoring/deploy-exporters.sh", + "surface_id": "monitoring_exporter_deploy_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "live_alert_sender", + "control_tier": "C1", + "current_state": "live_alert_sender_visible_gate_closed", + "expected_scope": "live_alert_fire_script", + "label": "Live alert firing script", + "line_count": 369, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 live alert owner、test window、receiver owner、noise budget 與 rollback / stop condition。", + "observability_scope": [ + "live alert", + "Alertmanager ingestion", + "notification route" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "ec79532dd23559103c8e436b73311d4a2b04be8655c1a804787da6e18c510acf", + "source_exists": true, + "source_path": "apps/api/scripts/fire_live_alert.py", + "surface_id": "fire_live_alert_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "live_alert_sender", + "control_tier": "C1", + "current_state": "test_alert_sender_visible_gate_closed", + "expected_scope": "test_alert_fire_script", + "label": "Test alert firing script", + "line_count": 318, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 test alert owner、allowed receiver、dedup proof、noisy route guard 與 cleanup owner。", + "observability_scope": [ + "test alert", + "notification chain smoke" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "62623a452644aaad1b0997d59f7b120839a1e3605e4cbd0b58bbab2dcb727fe6", + "source_exists": true, + "source_path": "apps/api/scripts/fire_test_alert.py", + "surface_id": "fire_test_alert_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "smoke_script", + "control_tier": "C1", + "current_state": "smoke_script_visible_not_executed_by_inventory", + "expected_scope": "alert_chain_smoke", + "label": "Alert chain smoke script", + "line_count": 1245, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 smoke owner、execution window、receiver owner、expected receipt 與 cleanup owner。", + "observability_scope": [ + "alert chain E2E", + "notification delivery" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "033506075fbdad8cb6b712712fb9af28f2c03fd676889597353f2827cfb5b9d9", + "source_exists": true, + "source_path": "scripts/alert_chain_smoke_test.py", + "surface_id": "alert_chain_smoke_script" + }, + { + "action_buttons_allowed": false, + "config_kind": "smoke_script", + "control_tier": "C1", + "current_state": "ops_smoke_script_visible_not_executed_by_inventory", + "expected_scope": "ops_alert_chain_smoke", + "label": "Ops alert chain smoke script", + "line_count": 267, + "live_evidence_received": false, + "maintenance_window_accepted": false, + "next_owner_action": "補 ops smoke owner、execution window、receiver owner、expected receipt 與 rollback owner。", + "observability_scope": [ + "ops alert chain", + "Alertmanager / Telegram smoke" + ], + "owner_response_accepted": false, + "owner_response_received": false, + "receiver_owner_accepted": false, + "reload_owner_accepted": false, + "requires_live_evidence": true, + "requires_owner_response": true, + "rollback_owner_accepted": false, + "route_smoke_accepted": false, + "runtime_gate_open": false, + "sha256": "473189af791d6df3dfa75c00b3702b7179a5db0bd61692250bcaa79e25f1bc35", + "source_exists": true, + "source_path": "ops/scripts/alert_chain_smoke_test.py", + "surface_id": "ops_alert_chain_smoke_script" + } + ], + "operator_interpretation": [ + "這是 monitoring / alerting / observability 的 repo-only 清冊，不是 live monitoring truth。", + "source_exists 與 sha256 只代表 repo source 可追溯，不代表 live Prometheus / Alertmanager / Grafana / SigNoz / Sentry 已一致。", + "write-capable surface 可改 route、reload、send notification、deploy exporter 或發測試告警；在 owner response、維護窗口、rollback owner 前全部維持 gate closed。", + "不得從本清冊啟動 reload、silence、Telegram send、Sentry deploy、SigNoz apply、Prometheus remote_write 變更、SSH 或 kubectl。" + ], + "schema_version": "monitoring_alerting_observability_inventory_v1", + "source_scope": "committed_repo_files_only", + "status": "repo_only_inventory_ready", + "summary": { + "action_button_count": 0, + "alert_rule_surface_count": 13, + "alertmanager_receiver_surface_count": 1, + "coverage_percent_after_inventory": 62, + "coverage_percent_before_inventory": 56, + "deploy_or_reload_surface_count": 6, + "drift_guard_surface_count": 1, + "expected_scope_count": 60, + "grafana_surface_count": 6, + "langfuse_surface_count": 3, + "live_evidence_received_count": 0, + "maintenance_window_accepted_count": 0, + "notification_policy_surface_count": 4, + "otel_surface_count": 1, + "owner_response_accepted_count": 0, + "owner_response_received_count": 0, + "prometheus_config_surface_count": 8, + "receiver_owner_accepted_count": 0, + "reload_owner_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "runtime_gate_count": 0, + "sentry_surface_count": 4, + "signoz_surface_count": 3, + "smoke_surface_count": 4, + "source_exists_count": 60, + "surface_count": 60, + "surfaces_requiring_live_evidence_count": 60, + "surfaces_requiring_owner_response_count": 60, + "telegram_surface_count": 3, + "write_capable_surface_count": 11 + }, + "write_capable_surfaces": [ + { + "config_kind": "sentry_deploy_script", + "expected_scope": "sentry_self_hosted_deploy", + "label": "Sentry self-hosted deploy script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "sentry_self_hosted_deploy" + }, + { + "config_kind": "telegram_runtime_sender", + "expected_scope": "telegram_gateway_runtime_sender", + "label": "Telegram gateway service", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "telegram_gateway_service" + }, + { + "config_kind": "notification_runtime_router", + "expected_scope": "notification_runtime_routing", + "label": "Notification manager", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "notification_manager_service" + }, + { + "config_kind": "notification_runtime_router", + "expected_scope": "recurrence_notification_runtime", + "label": "Converged alert recurrence notifier", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "converged_alert_recurrence_notifier" + }, + { + "config_kind": "reload_capable_script", + "expected_scope": "alertmanager_config_deploy", + "label": "Alertmanager config deploy script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "deploy_alertmanager_config_script" + }, + { + "config_kind": "reload_capable_script", + "expected_scope": "prometheus_alerts_deploy", + "label": "Prometheus alerts deploy script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "deploy_prometheus_alerts_script" + }, + { + "config_kind": "reload_capable_script", + "expected_scope": "k8s_prometheus_config_deploy", + "label": "K8s Prometheus config deploy script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "k8s_deploy_prometheus_config_script" + }, + { + "config_kind": "reload_capable_script", + "expected_scope": "api_prometheus_config_apply", + "label": "API Prometheus config apply script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "api_apply_prometheus_config_script" + }, + { + "config_kind": "host_deploy_script", + "expected_scope": "monitoring_exporter_deploy", + "label": "Monitoring exporter deploy script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "monitoring_exporter_deploy_script" + }, + { + "config_kind": "live_alert_sender", + "expected_scope": "live_alert_fire_script", + "label": "Live alert firing script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "fire_live_alert_script" + }, + { + "config_kind": "live_alert_sender", + "expected_scope": "test_alert_fire_script", + "label": "Test alert firing script", + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + "surface_id": "fire_test_alert_script" + } + ] +} diff --git a/scripts/security/high-value-config-control-coverage.py b/scripts/security/high-value-config-control-coverage.py index 548d26129..bbfb001d2 100644 --- a/scripts/security/high-value-config-control-coverage.py +++ b/scripts/security/high-value-config-control-coverage.py @@ -111,14 +111,16 @@ CONTROL_STATUS_BY_CATEGORY = { "next_owner_action": "補 repo owner、external agent owner、treasury owner、runtime gate owner 與 validation plan。", }, "monitoring_alerting_observability": { - "coverage_status": "policy_ready_needs_drift_evidence", - "coverage_percent": 56, + "coverage_status": "repo_only_inventory_ready_needs_live_route_evidence", + "coverage_percent": 62, "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", - "docs/security/SERVICE-HEALTH-FAILURE-NOTIFICATION-POLICY.md", + "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", + "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json", ], - "current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。", - "next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。", + "current_gap": "repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live config hash、rule diff、receiver diff、reload owner、route smoke、receipt proof 與 owner response。", + "next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、rollback owner 與 no-secret-value evidence。", }, "docker_compose_systemd_host_config": { "coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence", @@ -201,6 +203,22 @@ FALSE_BOUNDARIES = { "runner_change_authorized": False, "refs_sync_authorized": False, "force_push_authorized": False, + "prometheus_reload_authorized": False, + "alertmanager_reload_authorized": False, + "grafana_dashboard_apply_authorized": False, + "signoz_rule_apply_authorized": False, + "sentry_deploy_authorized": False, + "langfuse_config_change_authorized": False, + "otel_collector_reload_authorized": False, + "receiver_route_change_authorized": False, + "silence_policy_change_authorized": False, + "telegram_send_authorized": False, + "notification_route_change_authorized": False, + "webhook_receiver_change_authorized": False, + "remote_write_change_authorized": False, + "exporter_deploy_authorized": False, + "live_alert_fire_authorized": False, + "alert_chain_smoke_authorized": False, "secret_value_collection_allowed": False, "active_scan_authorized": False, "agent_bounty_runtime_authorized": False, @@ -269,6 +287,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: "gate_defined_needs_runtime_evidence", "policy_defined_needs_restore_drill_owner", "repo_only_inventory_ready_needs_restore_drill_owner", + "repo_only_inventory_ready_needs_live_route_evidence", "policy_ready_needs_drift_evidence", "inventory_needed", "repo_only_inventory_ready_needs_live_owner_evidence", diff --git a/scripts/security/monitoring-alerting-observability-inventory.py b/scripts/security/monitoring-alerting-observability-inventory.py new file mode 100644 index 000000000..553aa22e2 --- /dev/null +++ b/scripts/security/monitoring-alerting-observability-inventory.py @@ -0,0 +1,1039 @@ +#!/usr/bin/env python3 +""" +IwoooS monitoring / alerting / observability repo-only 清冊。 + +本工具只讀取已提交的 repo 檔案，整理 Prometheus、Alertmanager、 +Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification +policy、deploy / reload scripts 與 smoke scripts。它不連 live +Prometheus、不 reload Alertmanager、不改 Grafana、不套用 SigNoz rule、 +不部署 Sentry、不發 Telegram、不建立 silence、不 SSH、不 kubectl、不讀 +secret value。 +""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import subprocess +import sys +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + + +SURFACES: list[dict[str, Any]] = [ + { + "surface_id": "prometheus_k8s_base_config", + "label": "K8s Prometheus base config", + "source_path": "k8s/monitoring/prometheus.yml", + "expected_scope": "k8s_monitoring_prometheus_base", + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "repo_source_visible_reload_not_authorized", + "observability_scope": ["scrape config", "service discovery", "alert rule includes"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Prometheus owner、live config hash、reload owner、rule diff 與 route smoke 指標。", + }, + { + "surface_id": "prometheus_k8s_additions_config", + "label": "K8s Prometheus additions", + "source_path": "k8s/monitoring/prometheus-config-additions.yaml", + "expected_scope": "k8s_monitoring_prometheus_additions", + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "repo_source_visible_needs_drift_disposition", + "observability_scope": ["supplemental scrape", "additional rule paths"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 additions owner、live parity evidence、rollout window 與 rollback owner。", + }, + { + "surface_id": "prometheus_phase_o_config", + "label": "Prometheus Phase O config", + "source_path": "k8s/monitoring/prometheus-config-phase-o.yaml", + "expected_scope": "phase_o_prometheus_config", + "config_kind": "prometheus_config", + "control_tier": "C1", + "current_state": "phase_config_visible_reload_not_authorized", + "observability_scope": ["Phase O monitoring", "baseline scrape"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Phase O owner、stale config disposition、reload owner 與 post-check 指標。", + }, + { + "surface_id": "prometheus_remote_write_signoz", + "label": "Prometheus remote write to SigNoz", + "source_path": "k8s/monitoring/prometheus-remote-write-signoz.yaml", + "expected_scope": "prometheus_remote_write_signoz", + "config_kind": "prometheus_remote_write", + "control_tier": "C1", + "current_state": "data_export_config_visible_gate_closed", + "observability_scope": ["remote write", "SigNoz ingestion", "data export boundary"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 data export owner、privacy boundary、SigNoz ingest owner、rollback owner 與 volume guard。", + }, + { + "surface_id": "prometheus_generated_scrape_config", + "label": "Generated Prometheus scrape config", + "source_path": "ops/monitoring/generated/prometheus-scrape-generated.yaml", + "expected_scope": "generated_scrape_targets", + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "current_state": "generated_source_visible_needs_source_registry_parity", + "observability_scope": ["generated targets", "service registry"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 generator owner、service registry parity、live target count 與 stale target disposition。", + }, + { + "surface_id": "prometheus_generated_blackbox_targets", + "label": "Generated blackbox targets", + "source_path": "ops/monitoring/generated/blackbox-targets-generated.yaml", + "expected_scope": "generated_blackbox_targets", + "config_kind": "prometheus_generated_config", + "control_tier": "C1", + "current_state": "generated_blackbox_targets_visible_probe_not_executed", + "observability_scope": ["blackbox targets", "public route smoke candidates"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 blackbox owner、target freshness、public route owner 與 probe execution approval。", + }, + { + "surface_id": "monitoring_service_registry", + "label": "Monitoring service registry", + "source_path": "ops/monitoring/service-registry.yaml", + "expected_scope": "monitoring_service_registry", + "config_kind": "monitoring_service_registry", + "control_tier": "C1", + "current_state": "registry_visible_needs_owner_disposition", + "observability_scope": ["service registry", "target generation"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 registry owner、產品 owner mapping、retired target disposition 與 generator smoke。", + }, + { + "surface_id": "postgres_exporter_queries", + "label": "Postgres exporter query config", + "source_path": "ops/monitoring/postgres-exporter-queries.yaml", + "expected_scope": "postgres_exporter_queries", + "config_kind": "exporter_query_config", + "control_tier": "C1", + "current_state": "query_config_visible_needs_db_owner_review", + "observability_scope": ["PostgreSQL metrics", "custom exporter queries"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 DB owner、query cost boundary、metric name owner 與 rollback owner。", + }, + { + "surface_id": "monitoring_110_compose", + "label": "110 monitoring compose", + "source_path": "k8s/monitoring/docker-compose-110.yml", + "expected_scope": "192.168.0.110_monitoring_stack", + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "current_state": "runtime_compose_visible_live_hash_missing", + "observability_scope": ["Prometheus", "Grafana", "Alertmanager", "blackbox", "cadvisor"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 110 live compose hash、restart window、rollback owner、admin secret boundary 與 post-check。", + }, + { + "surface_id": "monitoring_exporters_compose", + "label": "188 monitoring exporters compose", + "source_path": "ops/monitoring/docker-compose.exporters.yaml", + "expected_scope": "192.168.0.188_exporters", + "config_kind": "monitoring_runtime_compose", + "control_tier": "C1", + "current_state": "exporter_compose_visible_live_hash_missing", + "observability_scope": ["postgres-exporter", "redis-exporter"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 188 exporter owner、live hash、env source policy、restart window 與 rollback owner。", + }, + { + "surface_id": "alertmanager_receiver_config", + "label": "Alertmanager receiver config", + "source_path": "ops/alertmanager/alertmanager.yml", + "expected_scope": "alertmanager_routes_receivers", + "config_kind": "alertmanager_receiver_config", + "control_tier": "C1", + "current_state": "receiver_route_visible_reload_not_authorized", + "observability_scope": ["routes", "receivers", "grouping", "Telegram / webhook receiver boundary"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 receiver owner、route diff、silence policy owner、reload owner 與 failure-only notification proof。", + }, + { + "surface_id": "prometheus_alerts_ops", + "label": "Ops Prometheus alerts", + "source_path": "ops/monitoring/alerts.yml", + "expected_scope": "ops_prometheus_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "alert_rules_visible_reload_not_authorized", + "observability_scope": ["infrastructure alerts", "backup alerts", "route alerts"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 alert rule owner、rule diff、receiver mapping、reload owner 與 false-green guard。", + }, + { + "surface_id": "prometheus_alerts_unified", + "label": "Unified Prometheus alerts", + "source_path": "ops/monitoring/alerts-unified.yml", + "expected_scope": "unified_prometheus_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "unified_rules_visible_needs_receiver_parity", + "observability_scope": ["unified alerts", "routing labels"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 unified rule owner、label taxonomy owner、receiver parity 與 rollout window。", + }, + { + "surface_id": "prometheus_slo_rules", + "label": "Prometheus SLO rules", + "source_path": "ops/monitoring/slo-rules.yml", + "expected_scope": "prometheus_slo_rules", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "slo_rules_visible_reload_not_authorized", + "observability_scope": ["SLO burn rate", "availability indicators"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 SLO owner、error budget owner、rule test evidence 與 receiver mapping。", + }, + { + "surface_id": "prometheus_ollama_health_rules", + "label": "Ollama health alert rules", + "source_path": "ops/monitoring/ollama_health_rules.yaml", + "expected_scope": "ollama_health_rules", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "ai_runtime_health_rules_visible_reload_not_authorized", + "observability_scope": ["Ollama health", "AI provider availability"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 AI provider owner、fallback owner、receiver owner 與 reload owner。", + }, + { + "surface_id": "k8s_k3s_alerts", + "label": "K3s alert rules", + "source_path": "k8s/monitoring/k3s-alerts.yaml", + "expected_scope": "k3s_cluster_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "k3s_rules_visible_apply_not_authorized", + "observability_scope": ["K3s workloads", "cluster health"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 K3s owner、rule apply window、ArgoCD / kubectl boundary 與 rollback owner。", + }, + { + "surface_id": "k8s_k3s_supplemental_alerts", + "label": "K3s supplemental alert rules", + "source_path": "k8s/monitoring/k3s-alerts-supplemental.yaml", + "expected_scope": "k3s_supplemental_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "supplemental_rules_visible_apply_not_authorized", + "observability_scope": ["K3s supplemental health", "gap alerts"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 supplemental rule owner、overlap disposition、receiver owner 與 apply boundary。", + }, + { + "surface_id": "k8s_database_alerts", + "label": "Database alert rules", + "source_path": "k8s/monitoring/database-alerts.yaml", + "expected_scope": "database_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "database_rules_visible_apply_not_authorized", + "observability_scope": ["PostgreSQL", "Redis", "DB availability"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 DB alert owner、threshold owner、receiver mapping 與 live metric evidence。", + }, + { + "surface_id": "k8s_nvidia_alerts", + "label": "NVIDIA alert rules", + "source_path": "k8s/monitoring/nvidia-alerts.yaml", + "expected_scope": "nvidia_gpu_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "gpu_rules_visible_apply_not_authorized", + "observability_scope": ["GPU health", "AI workload capacity"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 GPU owner、NVIDIA exporter live evidence、receiver owner 與 rollout boundary。", + }, + { + "surface_id": "k8s_minio_kali_alerts", + "label": "MinIO / Kali alert rules", + "source_path": "k8s/monitoring/minio-kali-alerts.yaml", + "expected_scope": "minio_kali_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "minio_kali_rules_visible_apply_not_authorized", + "observability_scope": ["MinIO", "Kali scanner", "read-only scanner status"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 MinIO / Kali owner、active scan boundary、receiver owner 與 rule apply owner。", + }, + { + "surface_id": "k8s_flywheel_alerts", + "label": "AI flywheel alert rules", + "source_path": "k8s/monitoring/flywheel-alerts.yaml", + "expected_scope": "ai_flywheel_alerts", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "flywheel_rules_visible_apply_not_authorized", + "observability_scope": ["AI flywheel", "learning / runtime health"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 AI flywheel owner、runtime gate boundary、receiver owner 與 false-green guard。", + }, + { + "surface_id": "k8s_alert_chain_monitor", + "label": "Alert chain monitor", + "source_path": "k8s/monitoring/alert-chain-monitor.yaml", + "expected_scope": "alert_chain_monitor", + "config_kind": "prometheus_alert_rules", + "control_tier": "C1", + "current_state": "alert_chain_monitor_visible_apply_not_authorized", + "observability_scope": ["Alertmanager chain", "E2E alert visibility"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 alert chain owner、E2E smoke owner、receiver owner 與 post-check 指標。", + }, + { + "surface_id": "app_alert_rules_yaml", + "label": "API alert rule engine rules", + "source_path": "apps/api/alert_rules.yaml", + "expected_scope": "api_alert_rule_engine", + "config_kind": "app_alert_rule_contract", + "control_tier": "C1", + "current_state": "app_rule_contract_visible_runtime_change_not_authorized", + "observability_scope": ["alert classification", "approval recommendations", "playbook matching"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 rule owner、AI decision owner、classification drift evidence 與 rollback owner。", + }, + { + "surface_id": "grafana_agent_step_latency_rules", + "label": "Grafana agent step latency rules", + "source_path": "ops/monitoring/grafana/agent_step_latency_rules.yaml", + "expected_scope": "grafana_agent_step_latency_rules", + "config_kind": "grafana_alert_rules", + "control_tier": "C1", + "current_state": "grafana_rules_visible_apply_not_authorized", + "observability_scope": ["agent step latency", "Grafana alerting"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Grafana alert owner、dashboard / rule UID owner、apply owner 與 rollback owner。", + }, + { + "surface_id": "grafana_ai_slo_dashboard", + "label": "Grafana AI SLO dashboard", + "source_path": "ops/monitoring/grafana/dashboards/ai-slo-dashboard.json", + "expected_scope": "grafana_ai_slo_dashboard", + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "observability_scope": ["AI SLO", "dashboard panels"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 dashboard owner、folder owner、UID conflict check 與 import rollback owner。", + }, + { + "surface_id": "grafana_ollama_failover_dashboard", + "label": "Grafana Ollama failover dashboard", + "source_path": "ops/monitoring/grafana/dashboards/ollama_failover.json", + "expected_scope": "grafana_ollama_failover_dashboard", + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "observability_scope": ["Ollama failover", "AI provider health"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 dashboard owner、AI provider owner、Grafana import owner 與 rollback ref。", + }, + { + "surface_id": "grafana_ai_monitoring_dashboard", + "label": "Grafana AI monitoring dashboard", + "source_path": "ops/grafana/dashboards/ai-monitoring.json", + "expected_scope": "grafana_ai_monitoring_dashboard", + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "observability_scope": ["AI monitoring", "runtime health"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 dashboard owner、panel query owner、import window 與 rollback owner。", + }, + { + "surface_id": "grafana_infra_monitoring_dashboard", + "label": "Grafana infra monitoring dashboard", + "source_path": "ops/grafana/dashboards/infra-monitoring.json", + "expected_scope": "grafana_infra_monitoring_dashboard", + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "observability_scope": ["infrastructure monitoring", "host health"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 infra dashboard owner、host source owner、import owner 與 smoke plan。", + }, + { + "surface_id": "grafana_nvidia_nemotron_dashboard", + "label": "Grafana NVIDIA / NemoTron dashboard", + "source_path": "ops/grafana/dashboards/nvidia-nemotron.json", + "expected_scope": "grafana_nvidia_nemotron_dashboard", + "config_kind": "grafana_dashboard", + "control_tier": "C1", + "current_state": "dashboard_json_visible_apply_not_authorized", + "observability_scope": ["NVIDIA", "NemoTron", "GPU AI route"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 GPU / NemoTron owner、dashboard UID owner、import owner 與 rollback owner。", + }, + { + "surface_id": "signoz_otel_collector_config", + "label": "SigNoz OTEL collector config", + "source_path": "ops/signoz/otel-collector-config-phase-o.yaml", + "expected_scope": "signoz_otel_collector_phase_o", + "config_kind": "otel_collector_config", + "control_tier": "C1", + "current_state": "otel_collector_config_visible_reload_not_authorized", + "observability_scope": ["OTEL collector", "traces / metrics / logs routing"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 OTEL owner、pipeline diff、secret redaction proof、reload owner 與 data export boundary。", + }, + { + "surface_id": "signoz_alerting_rules", + "label": "SigNoz alerting rules", + "source_path": "ops/signoz/alerting/rules.yaml", + "expected_scope": "signoz_alerting_rules", + "config_kind": "signoz_alert_rules", + "control_tier": "C1", + "current_state": "signoz_rules_visible_apply_not_authorized", + "observability_scope": ["SigNoz alert rules", "logs / traces alerting"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 SigNoz rule owner、apply owner、receiver mapping、silence owner 與 rollback owner。", + }, + { + "surface_id": "signoz_log_rules", + "label": "SigNoz log alert rules", + "source_path": "ops/signoz/alerting/log-rules.md", + "expected_scope": "signoz_log_alert_rules", + "config_kind": "signoz_log_rules", + "control_tier": "C1", + "current_state": "log_rule_runbook_visible_apply_not_authorized", + "observability_scope": ["log alerting", "manual rule translation"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 log rule owner、manual translation reviewer、apply proof 與 rollback owner。", + }, + { + "surface_id": "sentry_self_hosted_compose", + "label": "Sentry self-hosted compose", + "source_path": "ops/sentry-self-hosted/docker-compose.yml", + "expected_scope": "sentry_self_hosted_runtime", + "config_kind": "sentry_runtime_compose", + "control_tier": "C1", + "current_state": "sentry_compose_visible_live_hash_missing", + "observability_scope": ["Sentry self-hosted", "ClickHouse / Postgres / Redis boundary"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Sentry runtime owner、live hash、admin secret boundary、upgrade window 與 rollback owner。", + }, + { + "surface_id": "sentry_self_hosted_deploy", + "label": "Sentry self-hosted deploy script", + "source_path": "ops/sentry-self-hosted/deploy.sh", + "expected_scope": "sentry_self_hosted_deploy", + "config_kind": "sentry_deploy_script", + "control_tier": "C1", + "current_state": "deploy_script_visible_not_executed", + "observability_scope": ["Sentry deploy", "compose pull / up", "migration boundary"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 deploy owner、maintenance window、backup owner、migration rollback owner 與 smoke plan。", + }, + { + "surface_id": "langfuse_compose", + "label": "Langfuse compose", + "source_path": "infra/langfuse/docker-compose.yml", + "expected_scope": "langfuse_observability_runtime", + "config_kind": "langfuse_runtime_compose", + "control_tier": "C1", + "current_state": "langfuse_compose_visible_live_hash_missing", + "observability_scope": ["Langfuse", "LLM trace storage", "PostgreSQL dependency"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Langfuse owner、trace privacy owner、live hash、restart window 與 rollback owner。", + }, + { + "surface_id": "langfuse_readme", + "label": "Langfuse deployment README", + "source_path": "infra/langfuse/README.md", + "expected_scope": "langfuse_observability_runbook", + "config_kind": "langfuse_runbook", + "control_tier": "C1", + "current_state": "runbook_visible_needs_stale_disposition", + "observability_scope": ["Langfuse deployment", "trace governance"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 runbook owner、live deployment parity、trace retention owner 與 secret redaction proof。", + }, + { + "surface_id": "service_health_failure_policy_snapshot", + "label": "Service health failure notification policy", + "source_path": "docs/evaluations/service_health_failure_notification_policy_2026-06-05.json", + "expected_scope": "service_health_failure_notification_policy", + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "current_state": "failure_only_policy_visible_live_send_gate_closed", + "observability_scope": ["failure-only notification", "redaction contract"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 notification owner、receiver owner、live receipt proof、redaction proof 與 retry boundary。", + }, + { + "surface_id": "backup_notification_policy_snapshot", + "label": "Backup notification policy", + "source_path": "docs/evaluations/backup_notification_policy_2026-06-04.json", + "expected_scope": "backup_notification_policy", + "config_kind": "notification_policy_snapshot", + "control_tier": "C1", + "current_state": "backup_notification_policy_visible_live_send_gate_closed", + "observability_scope": ["backup failure notification", "restore / offsite alerting"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 backup notification owner、Telegram receipt owner、failure-only proof 與 false-green guard。", + }, + { + "surface_id": "observability_contract_matrix_snapshot", + "label": "Observability contract matrix", + "source_path": "docs/evaluations/observability_contract_matrix_2026-06-05.json", + "expected_scope": "observability_contract_matrix", + "config_kind": "observability_contract_snapshot", + "control_tier": "C1", + "current_state": "contract_matrix_visible_needs_live_parity", + "observability_scope": ["observability contract", "source coverage", "runtime evidence"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 contract owner、live parity owner、coverage gap disposition 與 evidence freshness owner。", + }, + { + "surface_id": "telegram_action_required_digest_snapshot", + "label": "Telegram action required digest policy", + "source_path": "docs/evaluations/ai_agent_telegram_action_required_digest_policy_2026-06-11.json", + "expected_scope": "ai_agent_telegram_digest_policy", + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "current_state": "telegram_policy_visible_live_send_gate_closed", + "observability_scope": ["Telegram digest", "action required routing"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Telegram owner、receiver owner、receipt owner、redaction proof 與 retry boundary。", + }, + { + "surface_id": "telegram_receipt_approval_snapshot", + "label": "Telegram receipt approval package", + "source_path": "docs/evaluations/ai_agent_telegram_receipt_approval_package_2026-06-11.json", + "expected_scope": "ai_agent_telegram_receipt_policy", + "config_kind": "telegram_policy_snapshot", + "control_tier": "C1", + "current_state": "receipt_policy_visible_live_receipt_gate_closed", + "observability_scope": ["delivery receipt", "ack / retry policy"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 receipt owner、gateway queue owner、ack policy owner 與 no-live-send boundary。", + }, + { + "surface_id": "telegram_gateway_service", + "label": "Telegram gateway service", + "source_path": "apps/api/src/services/telegram_gateway.py", + "expected_scope": "telegram_gateway_runtime_sender", + "config_kind": "telegram_runtime_sender", + "control_tier": "C1", + "current_state": "send_capable_service_visible_gate_closed", + "observability_scope": ["Telegram Bot API", "dedup", "delivery queue"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 gateway owner、token injection owner、receipt owner、send approval gate 與 rollback owner。", + }, + { + "surface_id": "notification_manager_service", + "label": "Notification manager", + "source_path": "apps/api/src/services/notifications/manager.py", + "expected_scope": "notification_runtime_routing", + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "current_state": "runtime_router_visible_send_gate_closed", + "observability_scope": ["notification channel routing", "Telegram / Discord manager"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 channel owner、routing owner、failure-only policy owner、receipt owner 與 rollback owner。", + }, + { + "surface_id": "notification_matrix_service", + "label": "Notification matrix", + "source_path": "apps/api/src/services/notification_matrix.py", + "expected_scope": "notification_matrix_policy", + "config_kind": "notification_policy_code", + "control_tier": "C1", + "current_state": "policy_code_visible_runtime_gate_closed", + "observability_scope": ["notification policy", "recipient / channel mapping"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 matrix owner、recipient owner、channel parity evidence 與 redaction policy。", + }, + { + "surface_id": "alert_chain_metrics_service", + "label": "Alert chain metrics service", + "source_path": "apps/api/src/services/alert_chain_metrics_service.py", + "expected_scope": "alert_chain_metrics", + "config_kind": "alert_metrics_service", + "control_tier": "C1", + "current_state": "metrics_service_visible_needs_runtime_evidence", + "observability_scope": ["alert chain metrics", "delivery visibility"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 metrics owner、Prometheus scrape owner、delivery evidence 與 false-green guard。", + }, + { + "surface_id": "converged_alert_recurrence_notifier", + "label": "Converged alert recurrence notifier", + "source_path": "apps/api/src/services/converged_alert_recurrence_notifier.py", + "expected_scope": "recurrence_notification_runtime", + "config_kind": "notification_runtime_router", + "control_tier": "C1", + "current_state": "recurrence_notifier_visible_send_gate_closed", + "observability_scope": ["recurrence notification", "dedup", "escalation routing"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 recurrence owner、noise budget owner、receipt owner、silence boundary 與 rollback owner。", + }, + { + "surface_id": "sentry_webhook_service", + "label": "Sentry webhook service", + "source_path": "apps/api/src/services/sentry_webhook_service.py", + "expected_scope": "sentry_webhook_receiver", + "config_kind": "webhook_receiver", + "control_tier": "C1", + "current_state": "webhook_receiver_visible_secret_value_not_collected", + "observability_scope": ["Sentry webhook", "signature validation", "triage route"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 webhook owner、secret name owner、signature proof、route smoke 與 replay boundary。", + }, + { + "surface_id": "signoz_client_service", + "label": "SigNoz client service", + "source_path": "apps/api/src/services/signoz_client.py", + "expected_scope": "signoz_api_client", + "config_kind": "signoz_observability_client", + "control_tier": "C1", + "current_state": "client_visible_live_api_read_not_executed", + "observability_scope": ["SigNoz API", "log query", "trace query"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 SigNoz client owner、token name owner、rate limit boundary 與 read-only smoke owner。", + }, + { + "surface_id": "sentry_service_client", + "label": "Sentry service client", + "source_path": "apps/api/src/services/sentry_service.py", + "expected_scope": "sentry_api_client", + "config_kind": "sentry_observability_client", + "control_tier": "C1", + "current_state": "client_visible_live_api_read_not_executed", + "observability_scope": ["Sentry API", "issue query", "AI triage"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Sentry client owner、token name owner、read-only evidence 與 privacy boundary。", + }, + { + "surface_id": "langfuse_client_service", + "label": "Langfuse client service", + "source_path": "apps/api/src/services/langfuse_client.py", + "expected_scope": "langfuse_api_client", + "config_kind": "langfuse_observability_client", + "control_tier": "C1", + "current_state": "client_visible_trace_read_write_boundary_needs_owner", + "observability_scope": ["Langfuse API", "AI trace", "prompt / output privacy"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 Langfuse owner、trace privacy owner、token name owner、write gate 與 retention owner。", + }, + { + "surface_id": "deploy_alertmanager_config_script", + "label": "Alertmanager config deploy script", + "source_path": "scripts/ops/deploy-alertmanager-config.sh", + "expected_scope": "alertmanager_config_deploy", + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "reload_capable_script_visible_gate_closed", + "observability_scope": ["Alertmanager config copy", "reload"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 deploy owner、maintenance window、rollback ref、receiver smoke 與 failure-only notification proof。", + }, + { + "surface_id": "deploy_prometheus_alerts_script", + "label": "Prometheus alerts deploy script", + "source_path": "scripts/ops/deploy-alerts.sh", + "expected_scope": "prometheus_alerts_deploy", + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "reload_capable_script_visible_gate_closed", + "observability_scope": ["Prometheus alert rule deploy", "reload"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 deploy owner、rule test proof、reload owner、receiver smoke 與 rollback owner。", + }, + { + "surface_id": "prometheus_rule_drift_guard_script", + "label": "Prometheus rule drift guard", + "source_path": "scripts/ops/prometheus-rule-drift-guard.sh", + "expected_scope": "prometheus_rule_drift_guard", + "config_kind": "drift_guard_script", + "control_tier": "C1", + "current_state": "drift_guard_visible_not_executed_by_inventory", + "observability_scope": ["rule diff", "drift evidence", "reload guard"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 drift guard owner、live rule export owner、diff disposition 與 blocking policy owner。", + }, + { + "surface_id": "k8s_deploy_prometheus_config_script", + "label": "K8s Prometheus config deploy script", + "source_path": "k8s/monitoring/deploy-prometheus-config.sh", + "expected_scope": "k8s_prometheus_config_deploy", + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "deploy_script_visible_not_executed", + "observability_scope": ["K8s config apply", "Prometheus reload"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 K8s deploy owner、kubectl / ArgoCD boundary、reload owner 與 rollback owner。", + }, + { + "surface_id": "api_apply_prometheus_config_script", + "label": "API Prometheus config apply script", + "source_path": "apps/api/scripts/apply_prometheus_config.sh", + "expected_scope": "api_prometheus_config_apply", + "config_kind": "reload_capable_script", + "control_tier": "C1", + "current_state": "apply_script_visible_not_executed", + "observability_scope": ["Prometheus config apply", "API-owned alert deploy"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 API deploy owner、config source owner、reload proof 與 rollback owner。", + }, + { + "surface_id": "monitoring_exporter_deploy_script", + "label": "Monitoring exporter deploy script", + "source_path": "ops/monitoring/deploy-exporters.sh", + "expected_scope": "monitoring_exporter_deploy", + "config_kind": "host_deploy_script", + "control_tier": "C1", + "current_state": "host_deploy_script_visible_gate_closed", + "observability_scope": ["exporter deploy", "host service restart"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 host owner、SSH boundary、restart window、rollback owner 與 exporter scrape proof。", + }, + { + "surface_id": "fire_live_alert_script", + "label": "Live alert firing script", + "source_path": "apps/api/scripts/fire_live_alert.py", + "expected_scope": "live_alert_fire_script", + "config_kind": "live_alert_sender", + "control_tier": "C1", + "current_state": "live_alert_sender_visible_gate_closed", + "observability_scope": ["live alert", "Alertmanager ingestion", "notification route"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 live alert owner、test window、receiver owner、noise budget 與 rollback / stop condition。", + }, + { + "surface_id": "fire_test_alert_script", + "label": "Test alert firing script", + "source_path": "apps/api/scripts/fire_test_alert.py", + "expected_scope": "test_alert_fire_script", + "config_kind": "live_alert_sender", + "control_tier": "C1", + "current_state": "test_alert_sender_visible_gate_closed", + "observability_scope": ["test alert", "notification chain smoke"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 test alert owner、allowed receiver、dedup proof、noisy route guard 與 cleanup owner。", + }, + { + "surface_id": "alert_chain_smoke_script", + "label": "Alert chain smoke script", + "source_path": "scripts/alert_chain_smoke_test.py", + "expected_scope": "alert_chain_smoke", + "config_kind": "smoke_script", + "control_tier": "C1", + "current_state": "smoke_script_visible_not_executed_by_inventory", + "observability_scope": ["alert chain E2E", "notification delivery"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 smoke owner、execution window、receiver owner、expected receipt 與 cleanup owner。", + }, + { + "surface_id": "ops_alert_chain_smoke_script", + "label": "Ops alert chain smoke script", + "source_path": "ops/scripts/alert_chain_smoke_test.py", + "expected_scope": "ops_alert_chain_smoke", + "config_kind": "smoke_script", + "control_tier": "C1", + "current_state": "ops_smoke_script_visible_not_executed_by_inventory", + "observability_scope": ["ops alert chain", "Alertmanager / Telegram smoke"], + "requires_live_evidence": True, + "requires_owner_response": True, + "next_owner_action": "補 ops smoke owner、execution window、receiver owner、expected receipt 與 rollback owner。", + }, +] + + +FALSE_BOUNDARIES = { + "runtime_execution_authorized": False, + "host_write_authorized": False, + "prometheus_reload_authorized": False, + "alertmanager_reload_authorized": False, + "grafana_dashboard_apply_authorized": False, + "signoz_rule_apply_authorized": False, + "sentry_deploy_authorized": False, + "langfuse_config_change_authorized": False, + "otel_collector_reload_authorized": False, + "receiver_route_change_authorized": False, + "silence_policy_change_authorized": False, + "telegram_send_authorized": False, + "notification_route_change_authorized": False, + "webhook_receiver_change_authorized": False, + "remote_write_change_authorized": False, + "exporter_deploy_authorized": False, + "live_alert_fire_authorized": False, + "alert_chain_smoke_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "kubectl_action_authorized": False, + "secret_value_collection_allowed": False, + "active_scan_authorized": False, + "action_buttons_allowed": False, +} + + +WRITE_CAPABLE_KINDS = { + "reload_capable_script", + "host_deploy_script", + "sentry_deploy_script", + "telegram_runtime_sender", + "notification_runtime_router", + "live_alert_sender", +} + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def file_metadata(root: Path, source_path: str) -> dict[str, Any]: + path = root / source_path + exists = path.exists() + if not exists: + return {"source_exists": False, "line_count": 0, "sha256": None} + content = path.read_bytes() + return { + "source_exists": True, + "line_count": len(content.decode("utf-8", errors="replace").splitlines()), + "sha256": hashlib.sha256(content).hexdigest(), + } + + +def build_surface(root: Path, surface: dict[str, Any]) -> dict[str, Any]: + metadata = file_metadata(root, surface["source_path"]) + return { + **surface, + **metadata, + "owner_response_received": False, + "owner_response_accepted": False, + "live_evidence_received": False, + "reload_owner_accepted": False, + "receiver_owner_accepted": False, + "route_smoke_accepted": False, + "maintenance_window_accepted": False, + "rollback_owner_accepted": False, + "runtime_gate_open": False, + "action_buttons_allowed": False, + } + + +def count_kind(surfaces: list[dict[str, Any]], kinds: set[str]) -> int: + return sum(1 for surface in surfaces if surface["config_kind"] in kinds) + + +def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + surfaces = [build_surface(root, surface) for surface in SURFACES] + expected_scopes = sorted({surface["expected_scope"] for surface in surfaces}) + write_capable = [surface for surface in surfaces if surface["config_kind"] in WRITE_CAPABLE_KINDS] + + return { + "schema_version": "monitoring_alerting_observability_inventory_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "status": "repo_only_inventory_ready", + "source_scope": "committed_repo_files_only", + "summary": { + "surface_count": len(surfaces), + "source_exists_count": sum(1 for surface in surfaces if surface["source_exists"]), + "expected_scope_count": len(expected_scopes), + "prometheus_config_surface_count": count_kind( + surfaces, + { + "prometheus_config", + "prometheus_remote_write", + "prometheus_generated_config", + "monitoring_service_registry", + "exporter_query_config", + }, + ), + "alert_rule_surface_count": count_kind( + surfaces, + {"prometheus_alert_rules", "app_alert_rule_contract", "grafana_alert_rules"}, + ), + "alertmanager_receiver_surface_count": count_kind(surfaces, {"alertmanager_receiver_config"}), + "grafana_surface_count": count_kind(surfaces, {"grafana_alert_rules", "grafana_dashboard"}), + "signoz_surface_count": count_kind( + surfaces, + {"signoz_alert_rules", "signoz_log_rules", "signoz_observability_client"}, + ), + "sentry_surface_count": count_kind( + surfaces, + {"sentry_runtime_compose", "sentry_deploy_script", "webhook_receiver", "sentry_observability_client"}, + ), + "langfuse_surface_count": count_kind( + surfaces, + {"langfuse_runtime_compose", "langfuse_runbook", "langfuse_observability_client"}, + ), + "notification_policy_surface_count": count_kind( + surfaces, + {"notification_policy_snapshot", "observability_contract_snapshot", "notification_policy_code"}, + ), + "telegram_surface_count": count_kind( + surfaces, + {"telegram_policy_snapshot", "telegram_runtime_sender"}, + ), + "otel_surface_count": count_kind(surfaces, {"otel_collector_config"}), + "deploy_or_reload_surface_count": count_kind( + surfaces, + {"reload_capable_script", "host_deploy_script", "sentry_deploy_script"}, + ), + "drift_guard_surface_count": count_kind(surfaces, {"drift_guard_script"}), + "smoke_surface_count": count_kind(surfaces, {"smoke_script", "live_alert_sender"}), + "write_capable_surface_count": len(write_capable), + "surfaces_requiring_owner_response_count": sum(1 for surface in surfaces if surface["requires_owner_response"]), + "surfaces_requiring_live_evidence_count": sum(1 for surface in surfaces if surface["requires_live_evidence"]), + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "live_evidence_received_count": 0, + "reload_owner_accepted_count": 0, + "receiver_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "maintenance_window_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_before_inventory": 56, + "coverage_percent_after_inventory": 62, + }, + "execution_boundaries": FALSE_BOUNDARIES, + "expected_scopes": expected_scopes, + "observability_surfaces": surfaces, + "write_capable_surfaces": [ + { + "surface_id": surface["surface_id"], + "label": surface["label"], + "config_kind": surface["config_kind"], + "expected_scope": surface["expected_scope"], + "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", + } + for surface in write_capable + ], + "next_collection_order": [ + "alertmanager_receiver_config", + "prometheus_alerts_ops", + "prometheus_rule_drift_guard_script", + "deploy_alertmanager_config_script", + "deploy_prometheus_alerts_script", + "monitoring_110_compose", + "signoz_otel_collector_config", + "sentry_self_hosted_compose", + "telegram_gateway_service", + "alert_chain_smoke_script", + ], + "operator_interpretation": [ + "這是 monitoring / alerting / observability 的 repo-only 清冊，不是 live monitoring truth。", + "source_exists 與 sha256 只代表 repo source 可追溯，不代表 live Prometheus / Alertmanager / Grafana / SigNoz / Sentry 已一致。", + "write-capable surface 可改 route、reload、send notification、deploy exporter 或發測試告警；在 owner response、維護窗口、rollback owner 前全部維持 gate closed。", + "不得從本清冊啟動 reload、silence、Telegram send、Sentry deploy、SigNoz apply、Prometheus remote_write 變更、SSH 或 kubectl。", + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser(description="IwoooS monitoring / alerting / observability repo-only 清冊") + parser.add_argument("--root", default=".", help="repo root") + parser.add_argument("--output", help="寫出 JSON 報告") + parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") + args = parser.parse_args() + + root = Path(args.root).resolve() + report = build_report(root, args.generated_at) + payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + + if args.output: + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(payload + "\n", encoding="utf-8") + else: + print(payload) + + summary = report["summary"] + print( + "MONITORING_ALERTING_OBSERVABILITY_INVENTORY_OK " + f"surfaces={summary['surface_count']} " + f"alert_rules={summary['alert_rule_surface_count']} " + f"write_capable={summary['write_capable_surface_count']} " + f"runtime_gate={summary['runtime_gate_count']}", + file=sys.stderr, + ) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index 8ab2b26a0..c28949f5b 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -91,6 +91,9 @@ def validate(root: Path) -> None: host_service_config_inventory = load_json(security_dir / "host-service-config-inventory.snapshot.json") ssh_network_access_inventory = load_json(security_dir / "ssh-network-access-inventory.snapshot.json") backup_restore_escrow_inventory = load_json(security_dir / "backup-restore-escrow-inventory.snapshot.json") + monitoring_alerting_observability_inventory = load_json( + security_dir / "monitoring-alerting-observability-inventory.snapshot.json" + ) domain_tls_inventory = load_json(security_dir / "domain-tls-certbot-inventory.snapshot.json") s49_request_draft = load_json(security_dir / "gitea-inventory-owner-attestation-request-draft.snapshot.json") kali_status = load_json(security_dir / "kali-integration-status.snapshot.json") @@ -2420,7 +2423,7 @@ def validate(root: Path) -> None: assert_equal( "high_value_config_coverage.summary.average_coverage_percent", high_value_config_coverage["summary"]["average_coverage_percent"], - 65, + 66, ) assert_equal( "high_value_config_coverage.summary.needs_live_evidence_count", @@ -2528,6 +2531,31 @@ def validate(root: Path) -> None: backup_restore_category["evidence_refs"], evidence_ref, ) + monitoring_category = next( + item + for item in high_value_config_coverage["coverage_categories"] + if item["category_id"] == "monitoring_alerting_observability" + ) + assert_equal( + "high_value_config_coverage.coverage_categories.monitoring.coverage_percent", + monitoring_category["coverage_percent"], + 62, + ) + assert_equal( + "high_value_config_coverage.coverage_categories.monitoring.coverage_status", + monitoring_category["coverage_status"], + "repo_only_inventory_ready_needs_live_route_evidence", + ) + for evidence_ref in [ + "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", + "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json", + ]: + assert_contains( + "high_value_config_coverage.coverage_categories.monitoring.evidence_refs", + monitoring_category["evidence_refs"], + evidence_ref, + ) assert_equal( "host_service_config_inventory.schema", host_service_config_inventory["schema_version"], @@ -2878,6 +2906,145 @@ def validate(root: Path) -> None: [item["surface_id"] for item in backup_restore_escrow_inventory["write_capable_surfaces"]], surface_id, ) + assert_equal( + "monitoring_alerting_observability_inventory.schema", + monitoring_alerting_observability_inventory["schema_version"], + "monitoring_alerting_observability_inventory_v1", + ) + assert_equal( + "monitoring_alerting_observability_inventory.status", + monitoring_alerting_observability_inventory["status"], + "repo_only_inventory_ready", + ) + assert_equal( + "monitoring_alerting_observability_inventory.source_scope", + monitoring_alerting_observability_inventory["source_scope"], + "committed_repo_files_only", + ) + expected_monitoring_alerting_observability_summary = { + "surface_count": 60, + "source_exists_count": 60, + "expected_scope_count": 60, + "prometheus_config_surface_count": 8, + "alert_rule_surface_count": 13, + "alertmanager_receiver_surface_count": 1, + "grafana_surface_count": 6, + "signoz_surface_count": 3, + "sentry_surface_count": 4, + "langfuse_surface_count": 3, + "notification_policy_surface_count": 4, + "telegram_surface_count": 3, + "otel_surface_count": 1, + "deploy_or_reload_surface_count": 6, + "drift_guard_surface_count": 1, + "smoke_surface_count": 4, + "write_capable_surface_count": 11, + "surfaces_requiring_owner_response_count": 60, + "surfaces_requiring_live_evidence_count": 60, + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "live_evidence_received_count": 0, + "reload_owner_accepted_count": 0, + "receiver_owner_accepted_count": 0, + "route_smoke_accepted_count": 0, + "maintenance_window_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_before_inventory": 56, + "coverage_percent_after_inventory": 62, + } + for key, expected in expected_monitoring_alerting_observability_summary.items(): + assert_equal( + f"monitoring_alerting_observability_inventory.summary.{key}", + monitoring_alerting_observability_inventory["summary"][key], + expected, + ) + for key, value in monitoring_alerting_observability_inventory["execution_boundaries"].items(): + assert_false(f"monitoring_alerting_observability_inventory.execution_boundaries.{key}", value) + assert_equal( + "monitoring_alerting_observability_inventory.observability_surfaces.count", + len(monitoring_alerting_observability_inventory["observability_surfaces"]), + 60, + ) + monitoring_surface_ids = [ + item["surface_id"] for item in monitoring_alerting_observability_inventory["observability_surfaces"] + ] + for surface_id in [ + "prometheus_k8s_base_config", + "alertmanager_receiver_config", + "prometheus_alerts_ops", + "grafana_ai_slo_dashboard", + "signoz_otel_collector_config", + "sentry_self_hosted_compose", + "langfuse_compose", + "telegram_gateway_service", + "deploy_alertmanager_config_script", + "prometheus_rule_drift_guard_script", + "alert_chain_smoke_script", + ]: + assert_contains( + "monitoring_alerting_observability_inventory.observability_surfaces", + monitoring_surface_ids, + surface_id, + ) + for surface in monitoring_alerting_observability_inventory["observability_surfaces"]: + assert_true( + f"monitoring_alerting_observability_inventory.observability_surfaces.{surface['surface_id']}.source_exists", + surface["source_exists"], + ) + assert_equal( + f"monitoring_alerting_observability_inventory.observability_surfaces.{surface['surface_id']}.sha256_length", + len(surface["sha256"]), + 64, + ) + assert_true( + f"monitoring_alerting_observability_inventory.observability_surfaces.{surface['surface_id']}.requires_live_evidence", + surface["requires_live_evidence"], + ) + assert_true( + f"monitoring_alerting_observability_inventory.observability_surfaces.{surface['surface_id']}.requires_owner_response", + surface["requires_owner_response"], + ) + for key in [ + "owner_response_received", + "owner_response_accepted", + "live_evidence_received", + "reload_owner_accepted", + "receiver_owner_accepted", + "route_smoke_accepted", + "maintenance_window_accepted", + "rollback_owner_accepted", + "runtime_gate_open", + "action_buttons_allowed", + ]: + assert_false( + f"monitoring_alerting_observability_inventory.observability_surfaces.{surface['surface_id']}.{key}", + surface[key], + ) + assert_equal( + "monitoring_alerting_observability_inventory.write_capable_surfaces.count", + len(monitoring_alerting_observability_inventory["write_capable_surfaces"]), + 11, + ) + for surface_id in [ + "deploy_alertmanager_config_script", + "deploy_prometheus_alerts_script", + "k8s_deploy_prometheus_config_script", + "api_apply_prometheus_config_script", + "monitoring_exporter_deploy_script", + "sentry_self_hosted_deploy", + "telegram_gateway_service", + "notification_manager_service", + "converged_alert_recurrence_notifier", + "fire_live_alert_script", + "fire_test_alert_script", + ]: + assert_contains( + "monitoring_alerting_observability_inventory.write_capable_surfaces", + [item["surface_id"] for item in monitoring_alerting_observability_inventory["write_capable_surfaces"]], + surface_id, + ) for source_path in [ "docs/security/host-service-config-inventory.snapshot.json", "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md", @@ -2888,6 +3055,9 @@ def validate(root: Path) -> None: "docs/security/backup-restore-escrow-inventory.snapshot.json", "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", + "docs/security/monitoring-alerting-observability-inventory.snapshot.json", + "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", + "docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json", ]: assert_contains( "iwooos_projection.source_paths.config_inventory", @@ -2912,7 +3082,7 @@ def validate(root: Path) -> None: "high_value_config_control_coverage_category_count": 14, "high_value_config_control_coverage_c0_category_count": 8, "high_value_config_control_coverage_c1_category_count": 4, - "high_value_config_control_coverage_average_percent": 65, + "high_value_config_control_coverage_average_percent": 66, "high_value_config_control_coverage_needs_live_evidence_count": 6, "high_value_config_control_coverage_owner_response_required_count": 14, "high_value_config_control_coverage_owner_response_received_count": 0, @@ -3019,6 +3189,46 @@ def validate(root: Path) -> None: iwooos_projection["summary"][key], expected, ) + expected_monitoring_alerting_observability_projection_summary = { + "monitoring_alerting_observability_inventory_first_layer": True, + "monitoring_alerting_observability_inventory_surface_count": 60, + "monitoring_alerting_observability_inventory_source_exists_count": 60, + "monitoring_alerting_observability_inventory_expected_scope_count": 60, + "monitoring_alerting_observability_inventory_prometheus_config_surface_count": 8, + "monitoring_alerting_observability_inventory_alert_rule_surface_count": 13, + "monitoring_alerting_observability_inventory_alertmanager_receiver_surface_count": 1, + "monitoring_alerting_observability_inventory_grafana_surface_count": 6, + "monitoring_alerting_observability_inventory_signoz_surface_count": 3, + "monitoring_alerting_observability_inventory_sentry_surface_count": 4, + "monitoring_alerting_observability_inventory_langfuse_surface_count": 3, + "monitoring_alerting_observability_inventory_notification_policy_surface_count": 4, + "monitoring_alerting_observability_inventory_telegram_surface_count": 3, + "monitoring_alerting_observability_inventory_otel_surface_count": 1, + "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count": 6, + "monitoring_alerting_observability_inventory_drift_guard_surface_count": 1, + "monitoring_alerting_observability_inventory_smoke_surface_count": 4, + "monitoring_alerting_observability_inventory_write_capable_surface_count": 11, + "monitoring_alerting_observability_inventory_surfaces_requiring_owner_response_count": 60, + "monitoring_alerting_observability_inventory_surfaces_requiring_live_evidence_count": 60, + "monitoring_alerting_observability_inventory_owner_response_received_count": 0, + "monitoring_alerting_observability_inventory_owner_response_accepted_count": 0, + "monitoring_alerting_observability_inventory_live_evidence_received_count": 0, + "monitoring_alerting_observability_inventory_reload_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_receiver_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_route_smoke_accepted_count": 0, + "monitoring_alerting_observability_inventory_maintenance_window_accepted_count": 0, + "monitoring_alerting_observability_inventory_rollback_owner_accepted_count": 0, + "monitoring_alerting_observability_inventory_runtime_gate_count": 0, + "monitoring_alerting_observability_inventory_action_button_count": 0, + "monitoring_alerting_observability_inventory_coverage_percent_before_inventory": 56, + "monitoring_alerting_observability_inventory_coverage_percent_after_inventory": 62, + } + for key, expected in expected_monitoring_alerting_observability_projection_summary.items(): + assert_equal( + f"iwooos_projection.summary.{key}", + iwooos_projection["summary"][key], + expected, + ) assert_true( "iwooos_projection.summary.high_value_config_owner_packet_first_layer", iwooos_projection["summary"]["high_value_config_owner_packet_first_layer"], @@ -12143,6 +12353,11 @@ def validate(root: Path) -> None: iwooos_projection_page, "{ key: 'backupRestore', rank: 'P1-3', value: '58%'", ) + assert_text_contains( + "iwooos_page.high_value_config_control_coverage_monitoring_percent", + iwooos_projection_page, + "{ key: 'monitoring', rank: 'P1-4', value: '62%'", + ) assert_text_before( "iwooos_page.high_value_config_control_coverage_before_owner_packet", iwooos_projection_page, @@ -12155,7 +12370,7 @@ def validate(root: Path) -> None: "high_value_config_control_coverage_category_count=14", "high_value_config_control_coverage_c0_category_count=8", "high_value_config_control_coverage_c1_category_count=4", - "high_value_config_control_coverage_average_percent=65", + "high_value_config_control_coverage_average_percent=66", "high_value_config_control_coverage_needs_live_evidence_count=6", "high_value_config_control_coverage_owner_response_required_count=14", "high_value_config_control_coverage_owner_response_received_count=0", @@ -12175,6 +12390,14 @@ def validate(root: Path) -> None: "backup_restore_escrow_inventory_offsite_sync_accepted_count=0", "backup_restore_escrow_inventory_credential_escrow_accepted_count=0", "backup_restore_escrow_inventory_retention_change_accepted_count=0", + "monitoring_alerting_observability_inventory_surface_count=60", + "monitoring_alerting_observability_inventory_alert_rule_surface_count=13", + "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6", + "monitoring_alerting_observability_inventory_write_capable_surface_count=11", + "monitoring_alerting_observability_inventory_runtime_gate_count=0", + "monitoring_alerting_observability_inventory_reload_owner_accepted_count=0", + "monitoring_alerting_observability_inventory_receiver_owner_accepted_count=0", + "monitoring_alerting_observability_inventory_route_smoke_accepted_count=0", "docker_compose_action_authorized=false", "systemctl_action_authorized=false", "repair_bot_execution_authorized=false", @@ -12203,6 +12426,22 @@ def validate(root: Path) -> None: "restic_prune_authorized=false", "rclone_config_authorized=false", "velero_restore_authorized=false", + "prometheus_reload_authorized=false", + "alertmanager_reload_authorized=false", + "grafana_dashboard_apply_authorized=false", + "signoz_rule_apply_authorized=false", + "sentry_deploy_authorized=false", + "langfuse_config_change_authorized=false", + "otel_collector_reload_authorized=false", + "receiver_route_change_authorized=false", + "silence_policy_change_authorized=false", + "telegram_send_authorized=false", + "notification_route_change_authorized=false", + "webhook_receiver_change_authorized=false", + "remote_write_change_authorized=false", + "exporter_deploy_authorized=false", + "live_alert_fire_authorized=false", + "alert_chain_smoke_authorized=false", "workflow_modification_authorized=false", "active_scan_authorized=false", "agent_bounty_runtime_authorized=false",