# IwoooS K8s / ArgoCD Owner Request Draft

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-14 |
| 狀態 | `owner_request_draft_ready_not_dispatched` |
| 工具 | `scripts/security/k8s-argocd-owner-request-draft.py` |
| 輸入 | `docs/security/k8s-argocd-manifest-inventory.snapshot.json` |
| Snapshot | `docs/security/k8s-argocd-owner-request-draft.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

P0-20 已建立 K8s / ArgoCD manifest repo-only 清冊，但清冊本身不能當成 owner response，也不能授權 live cluster read、ArgoCD sync 或 `kubectl` action。本文件將四個 scan group 轉成人工送件前 request draft，讓後續可以按 production、ArgoCD、Velero、monitoring 分別收 owner 回覆與 rollback / validation 欄位。

本文件不是 request sent、不是 owner response received、不是 accepted response、不是 ArgoCD API read、不是 ArgoCD sync、不是 `kubectl apply`、不是 secret collection，也不是 production write 或 runtime gate。

## 2. 摘要

| 指標 | 值 | 說明 |
|------|----|------|
| request draft count | `4` | production、ArgoCD、Velero、monitoring 四組 |
| C0 / C1 request draft | `3 / 1` | production、ArgoCD、Velero 為 C0；monitoring 為 C1 |
| request field count | `20` | 每份 request draft 的 envelope 欄位 |
| required owner field count | `11` | owner、決策、ArgoCD readback、rollback、validation 等欄位 |
| evidence gap count | `8` | owner response、rendered diff、ArgoCD readback、rollback、post-check 等 |
| blocked action count | `13` | sync、kubectl、Helm、secret、restart、scale、restore 等全部阻擋 |
| request sent / recipient confirmed | `0 / 0` | 尚未送件 |
| owner response received / accepted | `0 / 0` | 尚未收到，尚未驗收 |
| rendered manifest diff / ArgoCD health readback | `0 / 0` | 尚未產生，尚未接收 |
| ArgoCD sync / kubectl action | `0 / 0` | 尚未批准且未執行 |
| runtime gate / action button | `0 / 0` | 未開啟 |

## 3. 四份 Request Draft

| Request | Tier | Root | Scope |
|---------|------|------|-------|
| `k8s_argocd_owner_request:awoooi_prod` | `C0` | `k8s/awoooi-prod` | production namespace manifests、Deployment、CronJob、Secret metadata、RBAC、NetworkPolicy、autoscaling |
| `k8s_argocd_owner_request:argocd` | `C0` | `k8s/argocd` | ArgoCD Application、metrics NetworkPolicy / NodePort |
| `k8s_argocd_owner_request:velero` | `C0` | `k8s/velero` | backup / restore manifests、Velero credentials metadata、metrics service |
| `k8s_argocd_owner_request:monitoring` | `C1` | `k8s/monitoring` | Prometheus rules、monitoring config、alert source 與支援腳本 |

## 4. Owner 必填欄位

1. `owner_role_or_team`
2. `decision`
3. `decision_reason`
4. `affected_scope`
5. `redacted_evidence_refs`
6. `argocd_health_readback_ref`
7. `argocd_sync_revision_ref`
8. `rollback_revision`
9. `followup_owner`
10. `maintenance_window`
11. `validation_plan`

## 5. Evidence 缺口

| 缺口 | 目前狀態 |
|------|----------|
| owner response | `0` |
| rendered manifest diff | `0` |
| ArgoCD health readback | `0` |
| ArgoCD sync revision | `0` |
| kubectl dry-run / server validation plan | `0` |
| rollout blast radius | `0` |
| rollback revision | `0` |
| postcheck metrics | `0` |

## 6. 阻擋動作

以下動作不得由 request draft 直接授權：

1. `argocd_sync`
2. `kubectl_apply`
3. `kubectl_patch`
4. `kubectl_delete`
5. `helm_upgrade`
6. `secret_value_collection`
7. `live_cluster_write`
8. `manual_pod_restart`
9. `scale_workload`
10. `change_network_policy`
11. `change_rbac`
12. `restore_backup`
13. `open_runtime_gate`

## 7. 指令

產生 committed snapshot：

```bash
python3 scripts/security/k8s-argocd-owner-request-draft.py \
  --root . \
  --inventory-report docs/security/k8s-argocd-manifest-inventory.snapshot.json \
  --output docs/security/k8s-argocd-owner-request-draft.snapshot.json \
  --generated-at 2026-06-14T21:35:00+08:00
```

驗證 guard：

```bash
python3 scripts/security/security-mirror-progress-guard.py --root .
```

## 8. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| owner request draft artifact | `100%` | 4 份 request draft、snapshot、文件與 guard 已固定 |
| request dispatch | `0%` | 尚未送件 |
| owner response received / accepted | `0%` | 尚未收到，尚未驗收 |
| rendered manifest diff / ArgoCD readback | `0%` | 尚未產生或接收 |
| ArgoCD sync / kubectl action | `0%` | 未授權且未執行 |
| runtime gate / production write | `0%` | 未授權且未執行 |