{
  "schema_version": "ai_agent_version_freshness_snapshot_v1",
  "generated_at": "2026-06-11T22:45:00+08:00",
  "program_status": {
    "overall_completion_percent": 42,
    "current_priority": "P2",
    "current_task_id": "P2-402B",
    "next_task_id": "P2-402C",
    "read_only_mode": true,
    "runtime_authority": "repo_only_snapshot_no_external_lookup_or_update",
    "status_note": "P2-402B 建立 repo-only 版本新鮮度快照格式與 API；本波不啟用每日排程、不查外部 registry、不升級套件/模型、不 pull image、不建立 PR、不發 Telegram。"
  },
  "scan_boundaries": {
    "read_only_repo_snapshot_allowed": true,
    "schedule_activation_allowed": false,
    "workflow_write_allowed": false,
    "external_registry_lookup_allowed": false,
    "external_cve_lookup_allowed": false,
    "package_installation_allowed": false,
    "package_upgrade_allowed": false,
    "lockfile_write_allowed": false,
    "docker_build_allowed": false,
    "image_pull_allowed": false,
    "host_probe_allowed": false,
    "auto_pr_allowed": false,
    "auto_merge_allowed": false,
    "telegram_direct_send_allowed": false,
    "paid_external_service_allowed": false,
    "production_route_change_allowed": false
  },
  "agent_roles": [
    {
      "agent_id": "hermes",
      "role": "讀取 repo 內 manifest / lockfile / Dockerfile / K8s / workflow / committed snapshot，產生 version freshness evidence packet。",
      "autonomy_level": "L1_report_only",
      "outputs": [
        "repo-only version freshness snapshot",
        "stale source list",
        "next approval package inputs"
      ],
      "approval_gate": "read_only_repo_snapshot_allowed"
    },
    {
      "agent_id": "openclaw",
      "role": "仲裁 stale / action_required 訊號，判斷是否進入 P2-402C 工具採用批准包或 P2-402D Telegram digest policy。",
      "autonomy_level": "L2_approval_package_only",
      "outputs": [
        "risk note",
        "approval boundary check",
        "human review packet"
      ],
      "approval_gate": "human_review_required_before_any_update"
    },
    {
      "agent_id": "nemotron",
      "role": "離線檢查 Agent / model / replay / prompt governance 快照是否過期，協助建立模型評測 replay 清單。",
      "autonomy_level": "L1_report_only",
      "outputs": [
        "offline model freshness note",
        "replay candidate list"
      ],
      "approval_gate": "offline_replay_only_until_shadow_gate"
    }
  ],
  "repo_scan_summary": {
    "javascript_workspace_count": 6,
    "javascript_direct_dependency_count": 51,
    "python_manifest_count": 6,
    "dockerfile_count": 2,
    "runtime_surface_count": 22,
    "committed_inventory_refs": [
      "docs/evaluations/javascript_package_inventory_2026-06-04.json",
      "docs/evaluations/package_supply_chain_inventory_2026-06-04.json",
      "docs/evaluations/dependency_drift_check_plan_2026-06-04.json",
      "docs/evaluations/docker_build_surface_inventory_2026-06-04.json",
      "docs/evaluations/runtime_surface_inventory_2026-06-05.json",
      "docs/evaluations/ai_agent_proactive_operations_contract_2026-06-11.json"
    ],
    "stale_committed_inventory_refs": [
      "docs/evaluations/javascript_package_inventory_2026-06-04.json",
      "docs/evaluations/package_supply_chain_inventory_2026-06-04.json",
      "docs/evaluations/dependency_drift_check_plan_2026-06-04.json",
      "docs/evaluations/docker_build_surface_inventory_2026-06-04.json",
      "docs/evaluations/runtime_surface_inventory_2026-06-05.json"
    ]
  },
  "daily_snapshot_design": [
    {
      "step_id": "collect_repo_version_sources",
      "sequence": 1,
      "owner_agent": "hermes",
      "allowed_now": true,
      "planned_output": "freshness_sources[] with evidence_refs and repo-only current_signal",
      "blocked_now": [
        "external registry lookup",
        "host probe",
        "package install",
        "lockfile write"
      ]
    },
    {
      "step_id": "compare_committed_inventory_age",
      "sequence": 2,
      "owner_agent": "hermes",
      "allowed_now": true,
      "planned_output": "stale_committed_inventory_refs and action_required source ids",
      "blocked_now": [
        "rewrite historical snapshots",
        "claim latest upstream version",
        "query package registries"
      ]
    },
    {
      "step_id": "openclaw_boundary_review",
      "sequence": 3,
      "owner_agent": "openclaw",
      "allowed_now": true,
      "planned_output": "approval boundary decision for P2-402C / P2-402D / P2-402F",
      "blocked_now": [
        "approve own changes",
        "enable auto merge",
        "change production route"
      ]
    },
    {
      "step_id": "nemotron_offline_agent_model_review",
      "sequence": 4,
      "owner_agent": "nemotron",
      "allowed_now": true,
      "planned_output": "offline model / agent snapshot freshness note",
      "blocked_now": [
        "shadow traffic",
        "canary traffic",
        "production provider routing"
      ]
    },
    {
      "step_id": "emit_action_required_digest_draft",
      "sequence": 5,
      "owner_agent": "hermes",
      "allowed_now": true,
      "planned_output": "AwoooP / Telegram digest draft only; no send",
      "blocked_now": [
        "Telegram direct send",
        "Alertmanager route change",
        "workflow schedule activation"
      ]
    }
  ],
  "freshness_sources": [
    {
      "source_id": "javascript_workspace_manifests",
      "domain": "javascript_packages",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "action_required",
      "freshness_basis": "package.json workspace manifests + previous javascript_package_inventory snapshot",
      "current_signal": "6 workspaces / 51 direct dependencies; prior inventory is 2026-06-04 and should be refreshed by repo-only scanner before any registry comparison.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": true,
      "evidence_refs": [
        "package.json",
        "apps/web/package.json",
        "packages/shared-types/package.json",
        "packages/lewooogo-core/package.json",
        "packages/eslint-config/package.json",
        "packages/tsconfig/package.json",
        "pnpm-lock.yaml",
        "docs/evaluations/javascript_package_inventory_2026-06-04.json"
      ],
      "next_action": "P2-402C 前先建立 registry/tool 採用批准包；未批准前只能比較 repo 內 specifier 與 lockfile。"
    },
    {
      "source_id": "python_package_manifests",
      "domain": "python_packages",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "action_required",
      "freshness_basis": "pyproject.toml / requirements.txt manifests + package_supply_chain_inventory snapshot",
      "current_signal": "6 Python manifest surfaces；apps/api pyproject and requirements are high-impact and still require read-only drift refresh.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": true,
      "evidence_refs": [
        "apps/api/pyproject.toml",
        "apps/api/requirements.txt",
        "apps/sensor/requirements.txt",
        "packages/lewooogo-brain/pyproject.toml",
        "packages/lewooogo-data/pyproject.toml",
        "scripts/aider_watch_client/pyproject.toml",
        "docs/evaluations/package_supply_chain_inventory_2026-06-04.json"
      ],
      "next_action": "只讀比較 dependency specifiers；不得 pip/uv install，不得重寫 requirements。"
    },
    {
      "source_id": "pnpm_lockfile",
      "domain": "javascript_lockfile",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "baseline_ready",
      "freshness_basis": "pnpm-lock.yaml importer consistency",
      "current_signal": "P1-202 snapshot reported 0 manifest/lock mismatch; P2-402B keeps this as repo-only baseline, not upstream latest evidence.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "pnpm-lock.yaml",
        "docs/evaluations/javascript_package_inventory_2026-06-04.json"
      ],
      "next_action": "Future daily run may fail only on repo mismatch; remediation still requires approval package."
    },
    {
      "source_id": "dockerfiles",
      "domain": "container_images",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "action_required",
      "freshness_basis": "Dockerfile FROM / COPY --from / build-time fetch surfaces",
      "current_signal": "2 Dockerfiles; prior inventory shows 0 digest-pinned image refs and 2 action_required surfaces.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": true,
      "evidence_refs": [
        "apps/api/Dockerfile",
        "apps/web/Dockerfile",
        "docs/evaluations/docker_build_surface_inventory_2026-06-04.json"
      ],
      "next_action": "P2-402C 工具批准包需評估 Trivy / Syft / Grype / Docker Scout；本波不 build、不 pull、不查 registry。"
    },
    {
      "source_id": "k8s_prod_manifests",
      "domain": "kubernetes_k3s_components",
      "source_type": "repo_only",
      "owner_agent": "openclaw",
      "status": "baseline_ready",
      "freshness_basis": "committed k8s/awoooi-prod manifests and runtime_surface_inventory",
      "current_signal": "22 runtime surfaces mapped; live K3s / version skew remains outside P2-402B and requires P2-402F gate.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "k8s/awoooi-prod/kustomization.yaml",
        "k8s/awoooi-prod/06-deployment-api.yaml",
        "k8s/awoooi-prod/05-deployment-web.yaml",
        "k8s/awoooi-prod/08-deployment-worker.yaml",
        "docs/evaluations/runtime_surface_inventory_2026-06-05.json"
      ],
      "next_action": "P2-402F 才能建立 host/K3s/stateful 只讀版本盤點；本波不 kubectl、不 host probe。"
    },
    {
      "source_id": "gitea_workflows",
      "domain": "ci_cd_and_runner_tools",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "baseline_ready",
      "freshness_basis": ".gitea/workflows committed YAML",
      "current_signal": "可讀取 workflow schedule / runner / image refs；P2-402B 不新增或修改 schedule。",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        ".gitea/workflows/cd.yaml",
        ".gitea/workflows/agent-market-watch.yaml",
        ".gitea/workflows/e2e-health.yaml"
      ],
      "next_action": "若要啟用 daily freshness schedule，需 P2-402D notification policy 與 workflow approval。"
    },
    {
      "source_id": "observability_manifests",
      "domain": "observability_stack",
      "source_type": "repo_only",
      "owner_agent": "openclaw",
      "status": "baseline_ready",
      "freshness_basis": "Prometheus / Alertmanager / SigNoz committed configs",
      "current_signal": "只讀檢查 alert and scrape config refs；不改 Alertmanager route，不發通知。",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "k8s/monitoring/prometheus.yml",
        "ops/alertmanager/alertmanager.yml",
        "ops/signoz/otel-collector-config-phase-o.yaml"
      ],
      "next_action": "P2-402D 定義 failure-only digest 後，才能接 Telegram/AwoooP 通知。"
    },
    {
      "source_id": "ansible_host_manifests",
      "domain": "host_os_packages",
      "source_type": "repo_only",
      "owner_agent": "openclaw",
      "status": "planned_next",
      "freshness_basis": "infra/ansible inventory and playbooks",
      "current_signal": "Repo contains host roles and playbooks, but live package/kernel/K3s versions require P2-402F host readonly probe approval.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "infra/ansible/inventory/hosts.yml",
        "infra/ansible/playbooks/site.yml",
        "infra/ansible/roles/runner-guardrails/tasks/main.yml"
      ],
      "next_action": "P2-402F 建立 host OS / K3s / stateful version inventory；未批准前不得 SSH probe、apt upgrade、restart 或 reboot。"
    },
    {
      "source_id": "committed_evaluation_snapshots",
      "domain": "governance_snapshots",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "action_required",
      "freshness_basis": "docs/evaluations committed JSON snapshots",
      "current_signal": "Core package / Docker / drift / runtime snapshots are 2026-06-04~2026-06-05 baselines; P2-402B establishes the 2026-06-11 freshness envelope.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": true,
      "evidence_refs": [
        "docs/evaluations/javascript_package_inventory_2026-06-04.json",
        "docs/evaluations/package_supply_chain_inventory_2026-06-04.json",
        "docs/evaluations/dependency_drift_check_plan_2026-06-04.json",
        "docs/evaluations/docker_build_surface_inventory_2026-06-04.json",
        "docs/evaluations/runtime_surface_inventory_2026-06-05.json"
      ],
      "next_action": "每日快照正式啟用前，先由 committed API 顯示 stale refs；不得假裝已查到外部最新版本。"
    },
    {
      "source_id": "agent_model_governance_snapshots",
      "domain": "ai_agents_models",
      "source_type": "repo_only",
      "owner_agent": "nemotron",
      "status": "action_required",
      "freshness_basis": "agent-market / NemoTron / OpenClaw committed governance evidence",
      "current_signal": "Agent market and Nemotron replay sources remain gate-bound; repo-only snapshot may only flag stale committed evidence.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": true,
      "evidence_refs": [
        "docs/evaluations/ai_agent_proactive_operations_contract_2026-06-11.json",
        "docs/ai/AI_AGENT_PROACTIVE_OPERATIONS_2026-06-11.md",
        "docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md"
      ],
      "next_action": "P2-402C/P2-402D 之前不得新增 SDK、shadow/canary、production route 或付費 market source。"
    },
    {
      "source_id": "backup_dr_tooling_refs",
      "domain": "backup_dr_tooling",
      "source_type": "repo_only",
      "owner_agent": "openclaw",
      "status": "planned_next",
      "freshness_basis": "backup scripts / DR runbooks / readiness snapshots",
      "current_signal": "Repo-only source can track script refs, but live backup outcome remains separate and must use current production evidence.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "scripts/backup/backup-gitea.sh",
        "docs/runbooks/BACKUP-STATUS.md",
        "docs/runbooks/FULL-STACK-COLD-START-SOP.md"
      ],
      "next_action": "Keep backup/DR live truth separate; no automatic restore, prune, or backup mutation from version freshness snapshot."
    },
    {
      "source_id": "public_web_admin_surfaces",
      "domain": "public_web_admin_surfaces",
      "source_type": "repo_only",
      "owner_agent": "hermes",
      "status": "baseline_ready",
      "freshness_basis": "apps/web routes, i18n messages, and API client refs",
      "current_signal": "Can detect whether governance UI knows the latest committed API; no browser automation or UI deploy change is implied.",
      "external_lookup_allowed": false,
      "mutation_allowed": false,
      "action_required": false,
      "evidence_refs": [
        "apps/web/src/lib/api-client.ts",
        "apps/web/src/app/[locale]/governance/tabs/automation-inventory-tab.tsx",
        "apps/web/messages/zh-TW.json",
        "apps/web/messages/en.json"
      ],
      "next_action": "P2-402G 才接 UI 顯示；本波只提供 API，不改前端頁面。"
    }
  ],
  "approval_boundaries": {
    "daily_schedule_enabled": false,
    "external_source_lookup_allowed": false,
    "package_or_model_upgrade_allowed": false,
    "host_or_k3s_probe_allowed": false,
    "telegram_digest_send_allowed": false,
    "gitea_pr_creation_allowed": false,
    "production_route_change_allowed": false
  },
  "rollups": {
    "source_count": 12,
    "repo_only_source_count": 12,
    "agent_count": 3,
    "daily_step_count": 5,
    "action_required_source_ids": [
      "javascript_workspace_manifests",
      "python_package_manifests",
      "dockerfiles",
      "committed_evaluation_snapshots",
      "agent_model_governance_snapshots"
    ],
    "blocked_external_lookup_source_ids": [
      "javascript_workspace_manifests",
      "python_package_manifests",
      "pnpm_lockfile",
      "dockerfiles",
      "k8s_prod_manifests",
      "gitea_workflows",
      "observability_manifests",
      "ansible_host_manifests",
      "committed_evaluation_snapshots",
      "agent_model_governance_snapshots",
      "backup_dr_tooling_refs",
      "public_web_admin_surfaces"
    ],
    "mutation_allowed_source_count": 0,
    "schedule_enabled_count": 0,
    "telegram_direct_send_count": 0,
    "next_approval_task_ids": [
      "P2-402C",
      "P2-402D",
      "P2-402E",
      "P2-402F",
      "P2-402G"
    ]
  }
}