{
  "schema_version": "gitea_workflow_runner_health_v1",
  "generated_at": "2026-07-09T23:20:00+08:00",
  "program_status": {
    "overall_completion_percent": 100,
    "current_priority": "P1",
    "current_task_id": "P1-002",
    "next_task_id": "P1-003",
    "read_only_mode": true
  },
  "source_refs": [
    "docs/schemas/gitea_workflow_runner_health_v1.schema.json",
    ".gitea/workflows/agent-market-watch.yaml",
    ".gitea/workflows/agent-version-lifecycle-watch.yaml",
    ".gitea/workflows/ai-technology-watch.yaml",
    ".gitea/workflows/ansible-lint.yml",
    ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
    ".gitea/workflows/cd-dev.yaml",
    ".gitea/workflows/cd.yaml",
    ".gitea/workflows/code-review.yaml",
    ".gitea/workflows/deploy-alerts.yaml",
    ".gitea/workflows/e2e-health.yaml",
    ".gitea/workflows/harbor-110-local-repair.yaml",
    ".gitea/workflows/run-migration.yml",
    ".gitea/workflows/type-sync-check.yaml",
    "docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json",
    "scripts/ci/check-gitea-step-env-secrets.js",
    "scripts/ci/cleanup-host-runner-workspace.sh",
    "scripts/ci/wait-host-web-build-pressure.sh",
    "scripts/ci/notify-awoooi-cicd.sh",
    "scripts/setup-runner-watchdog.sh",
    "scripts/ops/stop-stale-gitea-actions-jobs.sh"
  ],
  "rollups": {
    "total_workflows": 13,
    "by_workflow_status": {
      "manifest_mapped": 13
    },
    "by_runner_evidence_status": {
      "non110_runner_mapped": 10,
      "non110_host_runner_mapped": 3
    },
    "workflows_with_schedule": 5,
    "workflows_with_workflow_dispatch": 13,
    "workflows_with_notify_bridge": 6,
    "workflows_with_actionable_or_failure_quiet_policy": 3,
    "workflow_ids_requiring_runner_attestation": [],
    "total_runner_contracts": 5,
    "runner_contracts_requiring_action": [],
    "notification_contracts_total": 7,
    "notification_contracts_quiet_success_count": 3,
    "notification_contracts_quiet_success_ids": [
      "agent_market_watch_actionable_only",
      "ai_technology_watch_actionable_only",
      "e2e_health_failure_only"
    ]
  },
  "workflow_records": [
    {
      "workflow_id": "agent_market_watch",
      "file_ref": ".gitea/workflows/agent-market-watch.yaml",
      "display_name": "Agent Market Watch",
      "scope": "每週市場觀察與手動觀察；只產生報告、分類與推廣候選，不做 SDK/API/replay/shadow/canary 或 OpenClaw 替換批准。",
      "status": "manifest_mapped",
      "risk_level": "medium",
      "triggers": [
        "workflow_dispatch",
        "schedule"
      ],
      "schedule_cadence": "每週一 09:00 Asia/Taipei；cron=0 1 * * 1 UTC",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "actionable_only_no_success_noise",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "未讀取 Secret；只由 workflow 條件與 committed script 形成只讀證據。",
      "evidence_refs": [
        ".gitea/workflows/agent-market-watch.yaml",
        "docs/evaluations/agent_market_watch_report_2026-06-04_watch_expanded.json"
      ],
      "next_action": "保留 actionable-only；維持 non110 runner label，不啟用額外通知或 paid API。"
    },
    {
      "workflow_id": "agent_version_lifecycle_watch",
      "file_ref": ".gitea/workflows/agent-version-lifecycle-watch.yaml",
      "display_name": "Agent Version Lifecycle Watch",
      "scope": "每週 AI Agent / SDK / framework 版本生命週期治理；只驗證 committed proposal queue，不安裝 SDK、不呼叫 paid/model API、不改 workflow、不切 production provider route。",
      "status": "manifest_mapped",
      "risk_level": "medium",
      "triggers": [
        "workflow_dispatch",
        "schedule"
      ],
      "schedule_cadence": "每週二 09:00 Asia/Taipei；cron=0 1 * * 2 UTC",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "read_only_no_notify",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "未讀取 Secret；runtime_boundaries 明確禁止 package upgrade、workflow write、paid API、provider route switch 與 production write。",
      "evidence_refs": [
        ".gitea/workflows/agent-version-lifecycle-watch.yaml",
        "docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json"
      ],
      "next_action": "維持 no-write proposal validation；若要升級成自動套版，必須先補 replay/shadow/canary 與成本/路由批准。"
    },
    {
      "workflow_id": "ai_technology_watch",
      "file_ref": ".gitea/workflows/ai-technology-watch.yaml",
      "display_name": "AI Technology Watch",
      "scope": "AI 技術雷達監控；只產生 watch/readback，不切換 provider、不進 paid API 或 production route。",
      "status": "manifest_mapped",
      "risk_level": "medium",
      "triggers": [
        "workflow_dispatch",
        "schedule"
      ],
      "schedule_cadence": "定期技術雷達觀察；由 workflow source 定義 cron。",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "actionable_only_no_success_noise",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "不讀 Secret payload；只保留 committed workflow metadata 與治理 flags。",
      "evidence_refs": [
        ".gitea/workflows/ai-technology-watch.yaml"
      ],
      "next_action": "保留 actionable-only；後續只補技術雷達 readback 與報告 freshness。"
    },
    {
      "workflow_id": "ansible_lint",
      "file_ref": ".gitea/workflows/ansible-lint.yml",
      "display_name": "Ansible / Reboot Recovery Contract",
      "scope": "Ansible / reboot recovery contract 驗證；無通知橋接。",
      "status": "manifest_mapped",
      "risk_level": "low",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "read_only_no_notify",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "未見通知或 Secret payload 使用；仍需只讀 secret-name hygiene 持續檢查。",
      "evidence_refs": [
        ".gitea/workflows/ansible-lint.yml"
      ],
      "next_action": "維持 non110 runner label 與 no-notify 合約。"
    },
    {
      "workflow_id": "awoooi_onboarding_warning_step",
      "file_ref": ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
      "display_name": "AWOOOI Onboarding Warning Step",
      "scope": "受控 onboarding warning-step；只允許 workflow_dispatch，不支援 push/pull_request 自動觸發。",
      "status": "manifest_mapped",
      "risk_level": "medium",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-host"
      ],
      "runner_evidence_status": "non110_host_runner_mapped",
      "job_count": 2,
      "notification_policy": "manual_status_exception",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "不讀 Secret payload；此 workflow 用於 shape/guard validation。",
      "evidence_refs": [
        ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
        "docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json"
      ],
      "next_action": "維持 controlled workflow_dispatch；不得改成 push/pull_request 觸發。"
    },
    {
      "workflow_id": "cd_dev",
      "file_ref": ".gitea/workflows/cd-dev.yaml",
      "display_name": "CD Pipeline (Dev)",
      "scope": "dev branch build / deploy；屬部署狀態通知例外，不套用 success-noise 全靜音。",
      "status": "manifest_mapped",
      "risk_level": "high",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "deployment_status_exception",
      "notify_bridge_calls": 3,
      "secrets_policy_status": "需維持 scripts/ci/check-gitea-step-env-secrets.js 類型的 step env / action input hygiene。",
      "evidence_refs": [
        ".gitea/workflows/cd-dev.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留部署狀態例外；後續補 dev deploy marker / smoke receipt 統一讀回。"
    },
    {
      "workflow_id": "cd_pipeline",
      "file_ref": ".gitea/workflows/cd.yaml",
      "display_name": "CD Pipeline",
      "scope": "main branch 正式測試、build、deploy、post-deploy；使用 non110 host runner label，並保留 stale-run guard。",
      "status": "manifest_mapped",
      "risk_level": "critical",
      "triggers": [
        "push:main",
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-host"
      ],
      "runner_evidence_status": "non110_host_runner_mapped",
      "job_count": 5,
      "notification_policy": "deployment_status_exception",
      "notify_bridge_calls": 9,
      "secrets_policy_status": "正式 CD 使用 check-gitea-step-env-secrets guard；不在本 snapshot 讀取任何 Secret payload。",
      "evidence_refs": [
        ".gitea/workflows/cd.yaml",
        "scripts/ci/check-gitea-step-env-secrets.js",
        "scripts/ci/cleanup-host-runner-workspace.sh",
        "scripts/ci/wait-host-web-build-pressure.sh"
      ],
      "next_action": "保留 non110 host 合約與 post-deploy smoke；任何 CD 修改仍需獨立 review / deploy gate。"
    },
    {
      "workflow_id": "code_review",
      "file_ref": ".gitea/workflows/code-review.yaml",
      "display_name": "Code Review",
      "scope": "AI code review 與 stale-main guard；不等於自動 merge 或部署批准。",
      "status": "manifest_mapped",
      "risk_level": "high",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "manual_status_exception",
      "notify_bridge_calls": 2,
      "secrets_policy_status": "不讀 Secret payload；仍需維持通知 secret name parity 與 guard。",
      "evidence_refs": [
        ".gitea/workflows/code-review.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留 review 狀態通知；後續與 PR required check policy 綁定。"
    },
    {
      "workflow_id": "deploy_alerts",
      "file_ref": ".gitea/workflows/deploy-alerts.yaml",
      "display_name": "Deploy Alert Rules",
      "scope": "告警規則部署流程；屬人工/部署狀態例外，不在本 snapshot 變更 alert rule。",
      "status": "manifest_mapped",
      "risk_level": "high",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "manual_status_exception",
      "notify_bridge_calls": 1,
      "secrets_policy_status": "不讀 Secret payload；告警鏈路 E2E 需另走 ADR-025/相關 guard。",
      "evidence_refs": [
        ".gitea/workflows/deploy-alerts.yaml",
        "scripts/ci/notify-awoooi-cicd.sh",
        "docs/HARD_RULES.md"
      ],
      "next_action": "後續再盤點 Alertmanager / Prometheus 合約；本 snapshot 不改 alert rules。"
    },
    {
      "workflow_id": "e2e_health",
      "file_ref": ".gitea/workflows/e2e-health.yaml",
      "display_name": "E2E Health Check",
      "scope": "每日正式 API health 檢查；失敗才升級通知。",
      "status": "manifest_mapped",
      "risk_level": "medium",
      "triggers": [
        "workflow_dispatch",
        "schedule"
      ],
      "schedule_cadence": "每日 00:00 Asia/Taipei；cron=0 16 * * * UTC",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "failure_only",
      "notify_bridge_calls": 1,
      "secrets_policy_status": "失敗通知透過 notify bridge；本 snapshot 不讀 Telegram / webhook Secret payload。",
      "evidence_refs": [
        ".gitea/workflows/e2e-health.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留 failure-only；補最近 run 與 alert receipt stage 證據。"
    },
    {
      "workflow_id": "harbor_110_local_repair",
      "file_ref": ".gitea/workflows/harbor-110-local-repair.yaml",
      "display_name": "AWOOOI Harbor 110 Local Repair",
      "scope": "Harbor 110 local repair guarded workflow；低頻 schedule + workflow_dispatch，內部仍有 no-auto-apply guard。",
      "status": "manifest_mapped",
      "risk_level": "critical",
      "triggers": [
        "workflow_dispatch",
        "schedule"
      ],
      "schedule_cadence": "低頻 hourly guard，由 workflow source 定義 cron。",
      "runner_labels": [
        "awoooi-non110-host"
      ],
      "runner_evidence_status": "non110_host_runner_mapped",
      "job_count": 2,
      "notification_policy": "manual_status_exception",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "不讀 Secret payload；repair workflow 只保留 guarded execution source。",
      "evidence_refs": [
        ".gitea/workflows/harbor-110-local-repair.yaml"
      ],
      "next_action": "維持 no-auto-apply repair guard；不得由 API 直接觸發 repair。"
    },
    {
      "workflow_id": "run_migration",
      "file_ref": ".gitea/workflows/run-migration.yml",
      "display_name": "run-migration",
      "scope": "手動 migration workflow；不得由本 readback 觸發。",
      "status": "manifest_mapped",
      "risk_level": "critical",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "manual_status_exception",
      "notify_bridge_calls": 1,
      "secrets_policy_status": "Migration 相關 secret / DB 權限不得由 readback 讀取或擴權。",
      "evidence_refs": [
        ".gitea/workflows/run-migration.yml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "只讀維持 migration approval boundary；不觸發 workflow。"
    },
    {
      "workflow_id": "type_sync_check",
      "file_ref": ".gitea/workflows/type-sync-check.yaml",
      "display_name": "Type Sync Check",
      "scope": "型別同步檢查；無通知橋接。",
      "status": "manifest_mapped",
      "risk_level": "low",
      "triggers": [
        "workflow_dispatch"
      ],
      "schedule_cadence": "無定期排程",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "runner_evidence_status": "non110_runner_mapped",
      "job_count": 1,
      "notification_policy": "read_only_no_notify",
      "notify_bridge_calls": 0,
      "secrets_policy_status": "無通知橋接；維持 non110 runner label。",
      "evidence_refs": [
        ".gitea/workflows/type-sync-check.yaml"
      ],
      "next_action": "維持 no-notify；後續只補 artifact retention。"
    }
  ],
  "runner_contracts": [
    {
      "contract_id": "awoooi_non110_host_runner",
      "display_name": "awoooi-non110-host controlled runner label",
      "status": "manifest_mapped",
      "risk_level": "critical",
      "runner_labels": [
        "awoooi-non110-host"
      ],
      "used_by_workflows": [
        "awoooi_onboarding_warning_step",
        "cd_pipeline",
        "harbor_110_local_repair"
      ],
      "health_contract": "host-level controlled workflows use the explicit awoooi-non110-host label; this snapshot does not restart or mutate the runner.",
      "guardrail_refs": [
        "scripts/ci/cleanup-host-runner-workspace.sh",
        "scripts/ci/wait-host-web-build-pressure.sh"
      ],
      "evidence_refs": [
        ".gitea/workflows/cd.yaml",
        ".gitea/workflows/harbor-110-local-repair.yaml",
        ".gitea/workflows/awoooi-onboarding-warning-step.yaml"
      ],
      "next_action": "維持 explicit non110 host label；任何 runner/service 變更另走維護窗口。"
    },
    {
      "contract_id": "awoooi_non110_ubuntu_runner",
      "display_name": "awoooi-non110-ubuntu controlled runner label",
      "status": "manifest_mapped",
      "risk_level": "high",
      "runner_labels": [
        "awoooi-non110-ubuntu"
      ],
      "used_by_workflows": [
        "agent_market_watch",
        "ai_technology_watch",
        "ansible_lint",
        "cd_dev",
        "code_review",
        "deploy_alerts",
        "e2e_health",
        "run_migration",
        "type_sync_check"
      ],
      "health_contract": "general CI/CD and governance workflows use explicit awoooi-non110-ubuntu label instead of a generic runner label.",
      "guardrail_refs": [
        "docs/HARD_RULES.md",
        "docs/security/S4-9-CANONICAL-OWNER-RESPONSE-ENVELOPE.md"
      ],
      "evidence_refs": [
        ".gitea/workflows/agent-market-watch.yaml",
        ".gitea/workflows/cd-dev.yaml",
        ".gitea/workflows/e2e-health.yaml",
        ".gitea/workflows/run-migration.yml"
      ],
      "next_action": "維持 explicit non110 ubuntu label；後續補容量/freshness 指標，不直接註冊或重啟 runner。"
    },
    {
      "contract_id": "runner_watchdog_systemd",
      "display_name": "actions.runner systemd watchdog 草案",
      "status": "prepared_not_applied_by_snapshot",
      "risk_level": "medium",
      "runner_labels": [
        "actions.runner.owenhytsai-awoooi.awoooi-110.service"
      ],
      "used_by_workflows": [
        "Gitea Actions host runner service"
      ],
      "health_contract": "setup script 只描述 WatchdogSec=300、Restart=always、StartLimitBurst=5；本 snapshot 不套用、不 restart、不 systemctl daemon-reload。",
      "guardrail_refs": [
        "scripts/setup-runner-watchdog.sh"
      ],
      "evidence_refs": [
        "scripts/setup-runner-watchdog.sh",
        "docs/MONITORING_COMPLETE_STRATEGY.md"
      ],
      "next_action": "若需套用 watchdog，另開批准包與維護窗口；本 snapshot 僅展示草案存在。"
    },
    {
      "contract_id": "stale_job_container_guard",
      "display_name": "Gitea Actions stale job container guard",
      "status": "dry_run_only",
      "risk_level": "high",
      "runner_labels": [
        "GITEA-ACTIONS-* docker containers"
      ],
      "used_by_workflows": [
        "all_gitea_actions"
      ],
      "health_contract": "stop-stale-gitea-actions-jobs.sh 預設 dry-run；只有 --apply 才停止 container，且仍要檢查 recent logs 與 workflow threshold。",
      "guardrail_refs": [
        "scripts/ops/stop-stale-gitea-actions-jobs.sh"
      ],
      "evidence_refs": [
        "scripts/ops/stop-stale-gitea-actions-jobs.sh"
      ],
      "next_action": "維持 dry-run-only；不得由治理頁或 API 直接停止 container。"
    },
    {
      "contract_id": "secret_env_hygiene_guard",
      "display_name": "Gitea step env secret hygiene guard",
      "status": "manifest_mapped",
      "risk_level": "high",
      "runner_labels": [
        "all_gitea_actions"
      ],
      "used_by_workflows": [
        "cd_pipeline",
        "code_review",
        "cd_dev"
      ],
      "health_contract": "check-gitea-step-env-secrets.js is the committed source guard for step env / action input hygiene; this snapshot reads no secret values.",
      "guardrail_refs": [
        "scripts/ci/check-gitea-step-env-secrets.js"
      ],
      "evidence_refs": [
        "scripts/ci/check-gitea-step-env-secrets.js",
        ".gitea/workflows/cd.yaml",
        ".gitea/workflows/code-review.yaml"
      ],
      "next_action": "保留 secret-name hygiene guard；後續只做 redacted name inventory，不讀 secret value。"
    }
  ],
  "notification_contracts": [
    {
      "contract_id": "agent_market_watch_actionable_only",
      "display_name": "Agent Market Watch actionable-only",
      "status": "preserved",
      "policy_kind": "actionable_only",
      "success_noise_policy": "無 actionable market change 時保持 Telegram 安靜，不發成功洗版訊息。",
      "failure_policy": "發現新候選、queue、失敗或需人工 review 時才產生 summary / action-required。",
      "workflow_refs": [
        "agent_market_watch"
      ],
      "evidence_refs": [
        ".gitea/workflows/agent-market-watch.yaml"
      ],
      "next_action": "保留每週觀察 cadence；不增加外部 API 或通知頻率。"
    },
    {
      "contract_id": "ai_technology_watch_actionable_only",
      "display_name": "AI Technology Watch actionable-only",
      "status": "preserved",
      "policy_kind": "actionable_only",
      "success_noise_policy": "無 actionable 技術採用變更時保持安靜，不發成功洗版訊息。",
      "failure_policy": "watch 失敗或需 review 時才產生 action-required evidence。",
      "workflow_refs": [
        "ai_technology_watch"
      ],
      "evidence_refs": [
        ".gitea/workflows/ai-technology-watch.yaml"
      ],
      "next_action": "保留技術雷達 cadence；後續補報告 freshness readback。"
    },
    {
      "contract_id": "e2e_health_failure_only",
      "display_name": "E2E Health failure-only",
      "status": "preserved",
      "policy_kind": "failure_only",
      "success_noise_policy": "健康檢查成功不即時通知。",
      "failure_policy": "workflow failure 才呼叫 notify bridge / Alertmanager payload。",
      "workflow_refs": [
        "e2e_health"
      ],
      "evidence_refs": [
        ".gitea/workflows/e2e-health.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留 failure-only；後續補最近 run readback。"
    },
    {
      "contract_id": "cd_pipeline_status_exception",
      "display_name": "正式 CD 狀態通知例外",
      "status": "exception_documented",
      "policy_kind": "deployment_status_exception",
      "success_noise_policy": "正式部署成功通知屬 release evidence，不套入一般備份成功靜音規則；仍不得在非部署情境洗版。",
      "failure_policy": "tests/build/deploy/post-deploy 任一失敗必須升級。",
      "workflow_refs": [
        "cd_pipeline"
      ],
      "evidence_refs": [
        ".gitea/workflows/cd.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留 release evidence；任何降噪調整另提批准包。"
    },
    {
      "contract_id": "dev_cd_status_exception",
      "display_name": "Dev CD 狀態通知例外",
      "status": "exception_documented",
      "policy_kind": "deployment_status_exception",
      "success_noise_policy": "dev deploy status 屬部署流程訊號；不得擴大為其他成功洗版。",
      "failure_policy": "dev build/deploy failure 升級到 AwoooP / Telegram contract。",
      "workflow_refs": [
        "cd_dev"
      ],
      "evidence_refs": [
        ".gitea/workflows/cd-dev.yaml",
        "scripts/ci/notify-awoooi-cicd.sh"
      ],
      "next_action": "保留現況；後續評估 dev 通知是否需要降噪。"
    },
    {
      "contract_id": "review_repair_and_manual_workflow_status_exception",
      "display_name": "Review / repair / manual workflow 狀態例外",
      "status": "exception_documented",
      "policy_kind": "manual_status_exception",
      "success_noise_policy": "code-review、alert deploy、migration、repair 的狀態訊號不自動擴張到成功洗版；手動 workflow 成功仍應看情境與 release evidence。",
      "failure_policy": "review、alert deploy、migration 或 repair failure 必須留可追蹤證據。",
      "workflow_refs": [
        "awoooi_onboarding_warning_step",
        "code_review",
        "deploy_alerts",
        "harbor_110_local_repair",
        "run_migration"
      ],
      "evidence_refs": [
        ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
        ".gitea/workflows/code-review.yaml",
        ".gitea/workflows/deploy-alerts.yaml",
        ".gitea/workflows/harbor-110-local-repair.yaml",
        ".gitea/workflows/run-migration.yml"
      ],
      "next_action": "後續補 alert/repair receipt；本 snapshot 不發通知、不觸發 migration 或 repair。"
    },
    {
      "contract_id": "lint_and_typecheck_no_notify",
      "display_name": "Lint / typecheck no-notify",
      "status": "preserved",
      "policy_kind": "read_only_no_notify",
      "success_noise_policy": "lint / type sync 成功不通知。",
      "failure_policy": "失敗只留 workflow 結果，是否升級需由 code-review / CD gate 判斷。",
      "workflow_refs": [
        "ansible_lint",
        "type_sync_check"
      ],
      "evidence_refs": [
        ".gitea/workflows/ansible-lint.yml",
        ".gitea/workflows/type-sync-check.yaml"
      ],
      "next_action": "維持 no-notify；補 artifact retention。"
    }
  ],
  "latest_observations": [
    {
      "observation_id": "latest_gitea_runs_success_readback",
      "status": "verified",
      "summary": "P1-001 後續正式部署已由 Gitea code-review run 2597 與 CD run 2596 成功收斂；P1-002 只引用既有 deploy evidence，不觸發新 run。",
      "evidence_refs": [
        "docs/LOGBOOK.md",
        "docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md"
      ]
    },
    {
      "observation_id": "gitea_api_unauthenticated_boundary",
      "status": "action_required",
      "summary": "Gitea Actions API 若無 token 會遇到 401；P1-002 以 committed workflow、HTML/DB readback 或 owner attestation 為證據，不猜測 API 狀態。",
      "evidence_refs": [
        "docs/HARD_RULES.md",
        "docs/security/S4-9-CANONICAL-OWNER-RESPONSE-ENVELOPE.md"
      ]
    },
    {
      "observation_id": "workflow_secret_guard_present",
      "status": "verified",
      "summary": "正式 CD / code-review / dev CD 已具備 check-gitea-step-env-secrets guard，可阻擋 secrets 掛在 step env / action input；本 snapshot 不讀任何 Secret payload。",
      "evidence_refs": [
        "scripts/ci/check-gitea-step-env-secrets.js",
        ".gitea/workflows/cd.yaml"
      ]
    }
  ],
  "operator_contract": {
    "display_mode": "read_only_gitea_workflow_runner_health",
    "must_not_interpret_as": [
      "workflow 修改批准",
      "runner restart / stop 批准",
      "Secret 已讀取或可輸出",
      "Telegram 測試通知批准",
      "排程啟用或變更批准",
      "Gitea write token 授權",
      "deploy / migration workflow 觸發批准"
    ],
    "secret_display_policy": "只允許顯示 workflow / secret-name hygiene 與 redacted metadata；不得讀 token、runner token、webhook secret、authorization header 或任何 Secret payload。",
    "runner_mutation_policy": "本 snapshot 只描述 explicit non110 runner label、watchdog 草案與 dry-run guard；不得 systemctl restart、docker stop、修改 label、註冊 runner 或套用 watchdog。",
    "notification_policy": "成功不洗版是預設治理方向；failure-only / actionable-only 合約需保留，CD/review/manual workflow 的狀態通知例外需另外標示。"
  },
  "operation_boundaries": {
    "read_only_api_allowed": true,
    "workflow_modification_allowed": false,
    "runner_restart_allowed": false,
    "runner_container_stop_allowed": false,
    "runner_label_change_allowed": false,
    "runner_registration_allowed": false,
    "secret_read_allowed": false,
    "secret_plaintext_allowed": false,
    "notification_send_allowed": false,
    "schedule_enable_allowed": false,
    "gitea_api_write_allowed": false,
    "deploy_trigger_allowed": false,
    "migration_trigger_allowed": false
  },
  "approval_boundaries": {
    "workflow_modification_authorized": false,
    "runner_mutation_authorized": false,
    "notification_send_authorized": false,
    "secret_plaintext_allowed": false,
    "runtime_execution_authorized": false,
    "schedule_change_authorized": false,
    "gitea_write_authorized": false,
    "deploy_trigger_authorized": false,
    "migration_trigger_authorized": false
  }
}