{ "blocked_actions": [ "argocd_api_read_without_approval", "live_cluster_read_without_approval", "argocd_sync", "argocd_rollback", "kubectl_apply", "kubectl_patch", "kubectl_delete", "kubectl_rollout_restart", "helm_upgrade", "kustomize_image_set", "secret_value_collection", "kubeconfig_collection", "live_cluster_write", "manual_pod_restart", "scale_workload", "change_network_policy", "change_rbac", "change_service_type", "change_nodeport", "change_ingress_route", "change_configmap_runtime", "change_secret_metadata_without_owner", "restore_backup", "velero_restore", "prometheus_rule_apply", "mark_change_evidence_accepted_without_reviewer_record", "open_runtime_gate", "add_action_button" ], "change_evidence_candidates": [ { "acceptance_candidate_id": "k8s_argocd_owner_response_acceptance:awoooi_prod", "action_buttons_allowed": false, "argocd_api_read_authorized": false, "argocd_api_read_executed": false, "argocd_application_readback_accepted": false, "argocd_application_readback_ref": null, "argocd_sync_authorized": false, "argocd_sync_executed": false, "argocd_sync_revision_accepted": false, "argocd_sync_revision_ref": null, "blast_radius": "pending_change_evidence", "blast_radius_accepted": false, "blocked_actions": [ "argocd_api_read_without_approval", "live_cluster_read_without_approval", "argocd_sync", "argocd_rollback", "kubectl_apply", "kubectl_patch", "kubectl_delete", "kubectl_rollout_restart", "helm_upgrade", "kustomize_image_set", "secret_value_collection", "kubeconfig_collection", "live_cluster_write", "manual_pod_restart", "scale_workload", "change_network_policy", "change_rbac", "change_service_type", "change_nodeport", "change_ingress_route", "change_configmap_runtime", "change_secret_metadata_without_owner", "restore_backup", "velero_restore", "prometheus_rule_apply", "mark_change_evidence_accepted_without_reviewer_record", "open_runtime_gate", "add_action_button" ], "change_evidence_accepted": false, "change_evidence_candidate_id": "k8s_argocd_change_evidence:awoooi_prod", "change_evidence_fields": [ "change_evidence_candidate_id", "acceptance_candidate_id", "group_id", "root", "control_tier", "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "reviewer_outcome", "not_approval" ], "change_evidence_quarantined": false, "change_evidence_received": false, "change_evidence_rejected": false, "control_tier": "C0", "cross_project_sync_accepted": false, "file_count": 25, "gate_tags": [ "availability_and_scaling", "backup_restore", "network_policy", "rbac", "secret_metadata", "supporting_source", "workload_or_schedule" ], "group_id": "awoooi_prod", "health_after_accepted": false, "health_after_ref": null, "health_before_accepted": false, "health_before_ref": null, "helm_upgrade_authorized": false, "helm_upgrade_executed": false, "kubectl_action_authorized": false, "kubectl_action_executed": false, "live_cluster_read_authorized": false, "live_cluster_read_executed": false, "maintenance_window": "pending_change_evidence", "maintenance_window_accepted": false, "metrics_alert_accepted": false, "metrics_alert_ref": null, "network_policy_apply_authorized": false, "nodeport_change_authorized": false, "not_approval": true, "outcome_lanes": [ "waiting_change_evidence", "quarantine_sensitive_payload", "reject_unredacted_or_runtime_claim", "request_supplement", "ready_for_reviewer_acceptance", "ready_for_runtime_approval_package", "waiting_maintenance_window", "waiting_runtime_gate" ], "postcheck_owner": "pending_change_evidence", "postcheck_owner_accepted": false, "production_write_authorized": false, "proposed_commit_ref": null, "proposed_commit_ref_accepted": false, "rbac_change_authorized": false, "rendered_manifest_diff_accepted": false, "rendered_manifest_diff_ref": null, "required_evidence_fields": [ "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "affected_scope", "redacted_evidence_refs", "reviewer_outcome", "not_approval" ], "requires_runtime_approval_package": true, "reviewer_checks": [ "change_ref_present", "group_scope_matches_inventory", "rendered_manifest_diff_ref_only", "argocd_readback_ref_shape", "secret_value_absent", "network_policy_impact_called_out", "rbac_impact_called_out", "workload_rollout_plan_present", "health_before_after_present", "route_smoke_or_not_applicable", "metric_alert_postcheck_present", "blast_radius_present", "maintenance_window_present", "rollback_revision_present", "postcheck_owner_present", "no_runtime_action_claim", "counts_transition_safe", "cross_project_sync_noted" ], "reviewer_outcome": "waiting_change_evidence", "rollback_revision": "pending_change_evidence", "rollback_revision_accepted": false, "rollout_status_accepted": false, "rollout_status_ref": null, "root": "k8s/awoooi-prod", "runtime_approval_package_ready": false, "runtime_gate": false, "secret_metadata_parity_accepted": false, "secret_metadata_parity_ref": null, "secret_value_collection_allowed": false, "service_route_smoke_accepted": false, "service_route_smoke_ref": null, "status": "waiting_change_evidence", "supplement_requested": false, "supporting_source_file_count": 1, "top_level_kind_marker_count": 0, "write_capable": true, "yaml_manifest_file_count": 24 }, { "acceptance_candidate_id": "k8s_argocd_owner_response_acceptance:argocd", "action_buttons_allowed": false, "argocd_api_read_authorized": false, "argocd_api_read_executed": false, "argocd_application_readback_accepted": false, "argocd_application_readback_ref": null, "argocd_sync_authorized": false, "argocd_sync_executed": false, "argocd_sync_revision_accepted": false, "argocd_sync_revision_ref": null, "blast_radius": "pending_change_evidence", "blast_radius_accepted": false, "blocked_actions": [ "argocd_api_read_without_approval", "live_cluster_read_without_approval", "argocd_sync", "argocd_rollback", "kubectl_apply", "kubectl_patch", "kubectl_delete", "kubectl_rollout_restart", "helm_upgrade", "kustomize_image_set", "secret_value_collection", "kubeconfig_collection", "live_cluster_write", "manual_pod_restart", "scale_workload", "change_network_policy", "change_rbac", "change_service_type", "change_nodeport", "change_ingress_route", "change_configmap_runtime", "change_secret_metadata_without_owner", "restore_backup", "velero_restore", "prometheus_rule_apply", "mark_change_evidence_accepted_without_reviewer_record", "open_runtime_gate", "add_action_button" ], "change_evidence_accepted": false, "change_evidence_candidate_id": "k8s_argocd_change_evidence:argocd", "change_evidence_fields": [ "change_evidence_candidate_id", "acceptance_candidate_id", "group_id", "root", "control_tier", "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "reviewer_outcome", "not_approval" ], "change_evidence_quarantined": false, "change_evidence_received": false, "change_evidence_rejected": false, "control_tier": "C0", "cross_project_sync_accepted": false, "file_count": 4, "gate_tags": [ "argocd_application", "network_policy", "supporting_source" ], "group_id": "argocd", "health_after_accepted": false, "health_after_ref": null, "health_before_accepted": false, "health_before_ref": null, "helm_upgrade_authorized": false, "helm_upgrade_executed": false, "kubectl_action_authorized": false, "kubectl_action_executed": false, "live_cluster_read_authorized": false, "live_cluster_read_executed": false, "maintenance_window": "pending_change_evidence", "maintenance_window_accepted": false, "metrics_alert_accepted": false, "metrics_alert_ref": null, "network_policy_apply_authorized": false, "nodeport_change_authorized": false, "not_approval": true, "outcome_lanes": [ "waiting_change_evidence", "quarantine_sensitive_payload", "reject_unredacted_or_runtime_claim", "request_supplement", "ready_for_reviewer_acceptance", "ready_for_runtime_approval_package", "waiting_maintenance_window", "waiting_runtime_gate" ], "postcheck_owner": "pending_change_evidence", "postcheck_owner_accepted": false, "production_write_authorized": false, "proposed_commit_ref": null, "proposed_commit_ref_accepted": false, "rbac_change_authorized": false, "rendered_manifest_diff_accepted": false, "rendered_manifest_diff_ref": null, "required_evidence_fields": [ "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "affected_scope", "redacted_evidence_refs", "reviewer_outcome", "not_approval" ], "requires_runtime_approval_package": true, "reviewer_checks": [ "change_ref_present", "group_scope_matches_inventory", "rendered_manifest_diff_ref_only", "argocd_readback_ref_shape", "secret_value_absent", "network_policy_impact_called_out", "rbac_impact_called_out", "workload_rollout_plan_present", "health_before_after_present", "route_smoke_or_not_applicable", "metric_alert_postcheck_present", "blast_radius_present", "maintenance_window_present", "rollback_revision_present", "postcheck_owner_present", "no_runtime_action_claim", "counts_transition_safe", "cross_project_sync_noted" ], "reviewer_outcome": "waiting_change_evidence", "rollback_revision": "pending_change_evidence", "rollback_revision_accepted": false, "rollout_status_accepted": false, "rollout_status_ref": null, "root": "k8s/argocd", "runtime_approval_package_ready": false, "runtime_gate": false, "secret_metadata_parity_accepted": false, "secret_metadata_parity_ref": null, "secret_value_collection_allowed": false, "service_route_smoke_accepted": false, "service_route_smoke_ref": null, "status": "waiting_change_evidence", "supplement_requested": false, "supporting_source_file_count": 1, "top_level_kind_marker_count": 0, "write_capable": true, "yaml_manifest_file_count": 3 }, { "acceptance_candidate_id": "k8s_argocd_owner_response_acceptance:velero", "action_buttons_allowed": false, "argocd_api_read_authorized": false, "argocd_api_read_executed": false, "argocd_application_readback_accepted": false, "argocd_application_readback_ref": null, "argocd_sync_authorized": false, "argocd_sync_executed": false, "argocd_sync_revision_accepted": false, "argocd_sync_revision_ref": null, "blast_radius": "pending_change_evidence", "blast_radius_accepted": false, "blocked_actions": [ "argocd_api_read_without_approval", "live_cluster_read_without_approval", "argocd_sync", "argocd_rollback", "kubectl_apply", "kubectl_patch", "kubectl_delete", "kubectl_rollout_restart", "helm_upgrade", "kustomize_image_set", "secret_value_collection", "kubeconfig_collection", "live_cluster_write", "manual_pod_restart", "scale_workload", "change_network_policy", "change_rbac", "change_service_type", "change_nodeport", "change_ingress_route", "change_configmap_runtime", "change_secret_metadata_without_owner", "restore_backup", "velero_restore", "prometheus_rule_apply", "mark_change_evidence_accepted_without_reviewer_record", "open_runtime_gate", "add_action_button" ], "change_evidence_accepted": false, "change_evidence_candidate_id": "k8s_argocd_change_evidence:velero", "change_evidence_fields": [ "change_evidence_candidate_id", "acceptance_candidate_id", "group_id", "root", "control_tier", "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "reviewer_outcome", "not_approval" ], "change_evidence_quarantined": false, "change_evidence_received": false, "change_evidence_rejected": false, "control_tier": "C0", "cross_project_sync_accepted": false, "file_count": 7, "gate_tags": [ "backup_restore", "rbac", "secret_metadata", "workload_or_schedule" ], "group_id": "velero", "health_after_accepted": false, "health_after_ref": null, "health_before_accepted": false, "health_before_ref": null, "helm_upgrade_authorized": false, "helm_upgrade_executed": false, "kubectl_action_authorized": false, "kubectl_action_executed": false, "live_cluster_read_authorized": false, "live_cluster_read_executed": false, "maintenance_window": "pending_change_evidence", "maintenance_window_accepted": false, "metrics_alert_accepted": false, "metrics_alert_ref": null, "network_policy_apply_authorized": false, "nodeport_change_authorized": false, "not_approval": true, "outcome_lanes": [ "waiting_change_evidence", "quarantine_sensitive_payload", "reject_unredacted_or_runtime_claim", "request_supplement", "ready_for_reviewer_acceptance", "ready_for_runtime_approval_package", "waiting_maintenance_window", "waiting_runtime_gate" ], "postcheck_owner": "pending_change_evidence", "postcheck_owner_accepted": false, "production_write_authorized": false, "proposed_commit_ref": null, "proposed_commit_ref_accepted": false, "rbac_change_authorized": false, "rendered_manifest_diff_accepted": false, "rendered_manifest_diff_ref": null, "required_evidence_fields": [ "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "affected_scope", "redacted_evidence_refs", "reviewer_outcome", "not_approval" ], "requires_runtime_approval_package": true, "reviewer_checks": [ "change_ref_present", "group_scope_matches_inventory", "rendered_manifest_diff_ref_only", "argocd_readback_ref_shape", "secret_value_absent", "network_policy_impact_called_out", "rbac_impact_called_out", "workload_rollout_plan_present", "health_before_after_present", "route_smoke_or_not_applicable", "metric_alert_postcheck_present", "blast_radius_present", "maintenance_window_present", "rollback_revision_present", "postcheck_owner_present", "no_runtime_action_claim", "counts_transition_safe", "cross_project_sync_noted" ], "reviewer_outcome": "waiting_change_evidence", "rollback_revision": "pending_change_evidence", "rollback_revision_accepted": false, "rollout_status_accepted": false, "rollout_status_ref": null, "root": "k8s/velero", "runtime_approval_package_ready": false, "runtime_gate": false, "secret_metadata_parity_accepted": false, "secret_metadata_parity_ref": null, "secret_value_collection_allowed": false, "service_route_smoke_accepted": false, "service_route_smoke_ref": null, "status": "waiting_change_evidence", "supplement_requested": false, "supporting_source_file_count": 1, "top_level_kind_marker_count": 0, "write_capable": true, "yaml_manifest_file_count": 6 }, { "acceptance_candidate_id": "k8s_argocd_owner_response_acceptance:monitoring", "action_buttons_allowed": false, "argocd_api_read_authorized": false, "argocd_api_read_executed": false, "argocd_application_readback_accepted": false, "argocd_application_readback_ref": null, "argocd_sync_authorized": false, "argocd_sync_executed": false, "argocd_sync_revision_accepted": false, "argocd_sync_revision_ref": null, "blast_radius": "pending_change_evidence", "blast_radius_accepted": false, "blocked_actions": [ "argocd_api_read_without_approval", "live_cluster_read_without_approval", "argocd_sync", "argocd_rollback", "kubectl_apply", "kubectl_patch", "kubectl_delete", "kubectl_rollout_restart", "helm_upgrade", "kustomize_image_set", "secret_value_collection", "kubeconfig_collection", "live_cluster_write", "manual_pod_restart", "scale_workload", "change_network_policy", "change_rbac", "change_service_type", "change_nodeport", "change_ingress_route", "change_configmap_runtime", "change_secret_metadata_without_owner", "restore_backup", "velero_restore", "prometheus_rule_apply", "mark_change_evidence_accepted_without_reviewer_record", "open_runtime_gate", "add_action_button" ], "change_evidence_accepted": false, "change_evidence_candidate_id": "k8s_argocd_change_evidence:monitoring", "change_evidence_fields": [ "change_evidence_candidate_id", "acceptance_candidate_id", "group_id", "root", "control_tier", "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "reviewer_outcome", "not_approval" ], "change_evidence_quarantined": false, "change_evidence_received": false, "change_evidence_rejected": false, "control_tier": "C1", "cross_project_sync_accepted": false, "file_count": 13, "gate_tags": [ "apply_capable_script", "monitoring_alerting", "supporting_source" ], "group_id": "monitoring", "health_after_accepted": false, "health_after_ref": null, "health_before_accepted": false, "health_before_ref": null, "helm_upgrade_authorized": false, "helm_upgrade_executed": false, "kubectl_action_authorized": false, "kubectl_action_executed": false, "live_cluster_read_authorized": false, "live_cluster_read_executed": false, "maintenance_window": "pending_change_evidence", "maintenance_window_accepted": false, "metrics_alert_accepted": false, "metrics_alert_ref": null, "network_policy_apply_authorized": false, "nodeport_change_authorized": false, "not_approval": true, "outcome_lanes": [ "waiting_change_evidence", "quarantine_sensitive_payload", "reject_unredacted_or_runtime_claim", "request_supplement", "ready_for_reviewer_acceptance", "ready_for_runtime_approval_package", "waiting_maintenance_window", "waiting_runtime_gate" ], "postcheck_owner": "pending_change_evidence", "postcheck_owner_accepted": false, "production_write_authorized": false, "proposed_commit_ref": null, "proposed_commit_ref_accepted": false, "rbac_change_authorized": false, "rendered_manifest_diff_accepted": false, "rendered_manifest_diff_ref": null, "required_evidence_fields": [ "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "affected_scope", "redacted_evidence_refs", "reviewer_outcome", "not_approval" ], "requires_runtime_approval_package": true, "reviewer_checks": [ "change_ref_present", "group_scope_matches_inventory", "rendered_manifest_diff_ref_only", "argocd_readback_ref_shape", "secret_value_absent", "network_policy_impact_called_out", "rbac_impact_called_out", "workload_rollout_plan_present", "health_before_after_present", "route_smoke_or_not_applicable", "metric_alert_postcheck_present", "blast_radius_present", "maintenance_window_present", "rollback_revision_present", "postcheck_owner_present", "no_runtime_action_claim", "counts_transition_safe", "cross_project_sync_noted" ], "reviewer_outcome": "waiting_change_evidence", "rollback_revision": "pending_change_evidence", "rollback_revision_accepted": false, "rollout_status_accepted": false, "rollout_status_ref": null, "root": "k8s/monitoring", "runtime_approval_package_ready": false, "runtime_gate": false, "secret_metadata_parity_accepted": false, "secret_metadata_parity_ref": null, "secret_value_collection_allowed": false, "service_route_smoke_accepted": false, "service_route_smoke_ref": null, "status": "waiting_change_evidence", "supplement_requested": false, "supporting_source_file_count": 1, "top_level_kind_marker_count": 0, "write_capable": true, "yaml_manifest_file_count": 12 } ], "change_evidence_fields": [ "change_evidence_candidate_id", "acceptance_candidate_id", "group_id", "root", "control_tier", "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "reviewer_outcome", "not_approval" ], "execution_boundaries": { "action_buttons_allowed": false, "argocd_api_read_authorized": false, "argocd_api_read_executed": false, "argocd_application_readback_accepted": false, "argocd_sync_authorized": false, "argocd_sync_executed": false, "argocd_sync_revision_accepted": false, "blast_radius_accepted": false, "change_evidence_accepted": false, "change_evidence_received": false, "cross_project_sync_accepted": false, "health_before_after_accepted": false, "helm_upgrade_authorized": false, "helm_upgrade_executed": false, "kubectl_action_authorized": false, "kubectl_action_executed": false, "live_cluster_read_authorized": false, "live_cluster_read_executed": false, "maintenance_window_accepted": false, "metrics_alert_accepted": false, "network_policy_apply_authorized": false, "nodeport_change_authorized": false, "not_authorization": true, "postcheck_owner_accepted": false, "production_write_authorized": false, "rbac_change_authorized": false, "rendered_manifest_diff_accepted": false, "rollback_revision_accepted": false, "rollout_status_accepted": false, "runtime_approval_package_ready": false, "runtime_execution_authorized": false, "secret_metadata_parity_accepted": false, "secret_value_collection_allowed": false, "service_route_smoke_accepted": false }, "gate_tag_counts": { "apply_capable_script": 1, "argocd_application": 1, "availability_and_scaling": 1, "backup_restore": 2, "monitoring_alerting": 1, "network_policy": 2, "rbac": 2, "secret_metadata": 2, "supporting_source": 3, "workload_or_schedule": 2 }, "generated_at": "2026-06-15T02:05:00+08:00", "git_commit": "26e5f1d0", "next_steps": [ "要求 owner 提供 proposed commit、rendered manifest diff、ArgoCD app / sync revision、health before / after、rollout、route smoke、metrics / alert、rollback 與 post-check evidence ref。", "收到資料後先做敏感 payload 隔離與 reviewer acceptance，不得自動 sync、apply、restart、scale 或改 NetworkPolicy / RBAC / NodePort。", "若未來要進 runtime approval package，必須另有維護窗口、rollback revision、跨專案同步與 production post-check gate。" ], "outcome_lanes": [ { "lane_id": "waiting_change_evidence", "meaning": "尚未收到 GitOps 變更證據；所有 accepted / runtime count 維持 0。" }, { "lane_id": "quarantine_sensitive_payload", "meaning": "收到 manifest payload、kubeconfig、Secret value 或可還原 credential 時只能隔離。" }, { "lane_id": "reject_unredacted_or_runtime_claim", "meaning": "出現未脫敏 payload、secret value 或把 evidence 誤當執行批准時直接拒收。" }, { "lane_id": "request_supplement", "meaning": "缺 before / after、rollback、blast radius、post-check 或 route smoke 時要求補件。" }, { "lane_id": "ready_for_reviewer_acceptance", "meaning": "metadata 合格後，只能進 reviewer acceptance，不得自動 sync 或 apply。" }, { "lane_id": "ready_for_runtime_approval_package", "meaning": "reviewer 接受後也只能形成 runtime approval package，不自動打開 gate。" }, { "lane_id": "waiting_maintenance_window", "meaning": "若未來要 sync / rollout / rollback，仍需獨立維護窗口。" }, { "lane_id": "waiting_runtime_gate", "meaning": "即使 change evidence accepted，runtime gate 仍等待獨立人工批准。" } ], "required_evidence_fields": [ "proposed_commit_ref", "rendered_manifest_diff_ref", "argocd_application_readback_ref", "argocd_sync_revision_ref", "health_before_ref", "health_after_ref", "rollout_status_ref", "service_route_smoke_ref", "metrics_alert_ref", "secret_metadata_parity_ref", "blast_radius", "maintenance_window", "rollback_revision", "postcheck_owner", "affected_scope", "redacted_evidence_refs", "reviewer_outcome", "not_approval" ], "reviewer_checks": [ { "check_id": "change_ref_present", "instruction": "必須有 proposed commit / PR / patch ref，不能只寫聊天同意。" }, { "check_id": "group_scope_matches_inventory", "instruction": "affected scope 必須能對回 manifest inventory group 與 root path。" }, { "check_id": "rendered_manifest_diff_ref_only", "instruction": "只能收 rendered manifest diff ref，不保存完整 manifest payload。" }, { "check_id": "argocd_readback_ref_shape", "instruction": "ArgoCD app / sync revision / health readback 只能是 owner-provided redacted ref。" }, { "check_id": "secret_value_absent", "instruction": "不得出現 Secret value、token、kubeconfig、private key、cookie、DSN 或 credential derivative。" }, { "check_id": "network_policy_impact_called_out", "instruction": "涉及 NetworkPolicy、Service、Ingress 或 NodePort 時必須標出 route / port 影響。" }, { "check_id": "rbac_impact_called_out", "instruction": "涉及 RBAC / ServiceAccount 時必須標出權限影響與 rollback revision。" }, { "check_id": "workload_rollout_plan_present", "instruction": "涉及 Deployment、CronJob、HPA 或 image 時必須有 rollout / rollback / smoke plan。" }, { "check_id": "health_before_after_present", "instruction": "需有 health before / after evidence ref；沒有 before evidence 只能要求補件。" }, { "check_id": "route_smoke_or_not_applicable", "instruction": "公開 / admin / API route 受影響時需有 smoke ref；不適用時要說明原因。" }, { "check_id": "metric_alert_postcheck_present", "instruction": "需有 metric、alert、事件或 log post-check evidence ref。" }, { "check_id": "blast_radius_present", "instruction": "必須列 namespace、workload、route、port、secret metadata、backup / restore 影響範圍。" }, { "check_id": "maintenance_window_present", "instruction": "任何 future sync / apply / rollout 都必須另有維護窗口。" }, { "check_id": "rollback_revision_present", "instruction": "必須有 rollback revision 或明確禁止窗口與 follow-up owner。" }, { "check_id": "postcheck_owner_present", "instruction": "post-check owner 必須可追溯，不能只寫 team generic approval。" }, { "check_id": "no_runtime_action_claim", "instruction": "不能把本帳本、owner response、CD success 或 deploy marker 當 runtime approval。" }, { "check_id": "counts_transition_safe", "instruction": "只有 reviewer record 可更新 received / accepted / rejected；不得同時開 runtime gate。" }, { "check_id": "cross_project_sync_noted", "instruction": "若影響 AwoooP、agent-bounty、監控、公開 gateway 或外部產品，需有跨專案同步 ref。" } ], "schema_version": "k8s_argocd_change_evidence_acceptance_v1", "source_acceptance_schema_version": "k8s_argocd_owner_response_acceptance_v1", "source_acceptance_status": "owner_response_acceptance_ledger_ready_no_runtime_action", "source_inventory_schema_version": "k8s_argocd_manifest_inventory_v1", "source_inventory_status": "repo_only_inventory_ready_no_live_cluster_read", "status": "change_evidence_acceptance_ledger_ready_no_runtime_action", "summary": { "action_button_count": 0, "argocd_api_read_authorized_count": 0, "argocd_api_read_executed_count": 0, "argocd_application_count": 1, "argocd_application_readback_accepted_count": 0, "argocd_sync_authorized_count": 0, "argocd_sync_executed_count": 0, "argocd_sync_revision_accepted_count": 0, "blast_radius_accepted_count": 0, "blocked_action_count": 28, "c0_change_evidence_candidate_count": 3, "c1_change_evidence_candidate_count": 1, "change_evidence_accepted_count": 0, "change_evidence_candidate_count": 4, "change_evidence_field_count": 21, "change_evidence_quarantined_count": 0, "change_evidence_received_count": 0, "change_evidence_rejected_count": 0, "coverage_percent_after_acceptance": 64, "coverage_percent_before_acceptance": 62, "cronjob_object_count": 5, "cross_project_sync_accepted_count": 0, "deployment_object_count": 5, "gate_tag_count": 10, "health_after_accepted_count": 0, "health_before_accepted_count": 0, "helm_upgrade_authorized_count": 0, "helm_upgrade_executed_count": 0, "kubectl_action_authorized_count": 0, "kubectl_action_executed_count": 0, "live_cluster_read_authorized_count": 0, "live_cluster_read_executed_count": 0, "maintenance_window_accepted_count": 0, "metrics_alert_accepted_count": 0, "network_policy_apply_authorized_count": 0, "network_policy_object_count": 6, "nodeport_change_authorized_count": 0, "outcome_lane_count": 8, "postcheck_owner_accepted_count": 0, "production_write_authorized_count": 0, "prometheus_rule_count": 4, "rbac_change_authorized_count": 0, "rbac_object_count": 5, "rendered_manifest_diff_accepted_count": 0, "required_evidence_field_count": 18, "reviewer_check_count": 18, "rollback_revision_accepted_count": 0, "rollout_status_accepted_count": 0, "runtime_approval_package_ready_count": 0, "runtime_gate_count": 0, "secret_metadata_parity_accepted_count": 0, "secret_object_count": 6, "secret_value_collection_allowed_count": 0, "service_route_smoke_accepted_count": 0, "source_acceptance_candidate_count": 4, "source_c0_file_count": 36, "source_manifest_file_count": 49, "source_scan_group_count": 4, "source_yaml_manifest_file_count": 45, "supplement_requested_count": 0, "write_capable_candidate_count": 4 } }