feat(automation): enforce typed SRE execution domains

ops/config/service-registry.yaml

@@ -1,8 +1,8 @@
 # ops/config/service-registry.yaml
 # Service Registry — 服務 Stateful 分級清單
-# 版本: 1.0.0
+# 版本: 2.0.0
 # 建立: Claude Sonnet 4.6 / 2026-04-08 Asia/Taipei
-# 維護: 修改需 PR + 統帥審核，禁止直接 push
+# 維護: Gitea main + controlled CD；runtime ConfigMap 必須由 renderer 精確產生
 # 說明:
 #   BLOCK        = 系統禁止自動修復，僅告警（資料風險最高）
 #   CRITICAL_HITL = 允許 Playbook，但需 MultiSig 2票
@@ -10,12 +10,21 @@
 #   AUTO         = 允許自動執行（無狀態服務）
 # 參考: ADR-062, ADR-063
 
+schema_version: service_registry_v2
+governance_version: global_product_governance_v2
+identity_policy:
+  match_mode: exact_alias_only
+  unknown_asset_terminal: asset_identity_unresolved
+  unknown_asset_auto_fallback_allowed: false
+  cross_domain_fallback_allowed: false
+
 services:
   # ─── BLOCK：系統禁止（連 Playbook 都不提供）────────────────────────────
   - name: postgres
     display_name: "PostgreSQL 主庫 (awoooi_prod)"
     host: "192.168.0.188"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "主要業務資料庫，重啟可能導致 WAL 截斷、事務回滾"
     alert_only: true
     containers: ["postgres"]
@@ -24,6 +33,7 @@ services:
     display_name: "PostgreSQL (momo_db)"
     host: "192.168.0.188"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "momo 產品資料庫，禁止自動操作"
     alert_only: true
     containers: ["momo-db"]
@@ -32,6 +42,7 @@ services:
     display_name: "PostgreSQL (Langfuse)"
     host: "192.168.0.110"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "LLM trace 資料庫，重啟導致追蹤資料遺失"
     alert_only: true
     containers: ["langfuse-db"]
@@ -40,6 +51,7 @@ services:
     display_name: "PostgreSQL (Harbor Registry)"
     host: "192.168.0.110"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "Harbor Registry 資料庫，重啟可能損壞 image layer 索引"
     alert_only: true
     containers: ["harbor-db"]
@@ -48,6 +60,7 @@ services:
     display_name: "PostgreSQL (Sentry)"
     host: "192.168.0.110"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "Sentry 錯誤追蹤資料庫"
     alert_only: true
     containers: ["sentry-postgres"]
@@ -56,6 +69,7 @@ services:
     display_name: "ClickHouse (SignOz)"
     host: "192.168.0.110"
     stateful_level: BLOCK
+    asset_domain: database
     reason: "列欄式 OLAP 資料庫；只允許具備 native backup、bounded apply、rollback 與 post-verifier 的受控重建"
     alert_only: true
     containers: ["signoz-clickhouse"]
@@ -65,6 +79,7 @@ services:
     display_name: "Redis (AWOOOI)"
     host: "192.168.0.188"
     stateful_level: CRITICAL_HITL
+    asset_domain: database
     reason: "AWOOOI 依賴 Redis 做冪等鎖與快取，重啟丟失鎖狀態"
     requires_pre_backup: false
     containers: ["redis"]
@@ -73,6 +88,7 @@ services:
     display_name: "Redis (Harbor)"
     host: "192.168.0.110"
     stateful_level: CRITICAL_HITL
+    asset_domain: database
     reason: "Harbor session 快取"
     containers: ["harbor-redis"]
 
@@ -80,6 +96,7 @@ services:
     display_name: "Redis (Sentry)"
     host: "192.168.0.110"
     stateful_level: CRITICAL_HITL
+    asset_domain: database
     reason: "Sentry 任務佇列"
     containers: ["sentry-redis"]
 
@@ -103,6 +120,7 @@ services:
     display_name: "MinIO (物件存儲)"
     host: "192.168.0.188"
     stateful_level: CRITICAL_HITL
+    asset_domain: storage
     reason: "寫入中重啟可能導致 multipart upload 中斷"
     requires_pre_backup: false
     containers: ["minio"]
@@ -143,12 +161,14 @@ services:
     display_name: "AWOOOI API (K3s)"
     host: "k3s"
     stateful_level: AUTO
+    asset_domain: kubernetes_workload
     containers: []
 
   - name: awoooi-web
     display_name: "AWOOOI Web (K3s)"
     host: "k3s"
     stateful_level: AUTO
+    asset_domain: kubernetes_workload
     containers: []
 
   - name: blackbox-exporter
@@ -161,8 +181,15 @@ services:
     display_name: "Sentry (錯誤追蹤)"
     host: "192.168.0.110"
     stateful_level: AUTO
-    reason: "Web server 無狀態，docker compose up -d 即可恢復"
-    containers: ["sentry-web", "sentry-worker", "sentry-cron"]
+    asset_domain: docker_container
+    reason: "Sentry container 只能走該 host 的 exact-container bounded PlayBook；禁止 compose-wide 或跨 host fallback"
+    containers:
+      - sentry-web
+      - sentry-worker
+      - sentry-cron
+      - sentry-self-hosted-snuba-profiling-functions-consumer-1
+    allowed_catalog_ids:
+      - ansible:110-sentry-profiling-consumer-recovery
 
   - name: langfuse
     display_name: "Langfuse (LLMOps)"