{ "schema_version": "dependency_supply_chain_drift_monitor_v1", "generated_at": "2026-06-18T23:05:00+08:00", "program_status": { "overall_completion_percent": 100, "current_priority": "P2", "current_task_id": "P2-004", "next_task_id": "P2-406B", "read_only_mode": true, "runtime_authority": "repo_only_dependency_supply_chain_drift_monitor_no_external_lookup_or_write", "status_note": "P2-004 將既有 Python / JavaScript / Docker / policy / version freshness 快照收斂為依賴與供應鏈漂移監控讀回；本輪只產生 committed snapshot 與 API，不啟用外部查詢、排程、升級、Telegram 實發或 production write。" }, "source_refs": [ "docs/evaluations/package_supply_chain_inventory_2026-06-04.json", "docs/evaluations/javascript_package_inventory_2026-06-04.json", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json", "docs/evaluations/dependency_risk_policy_2026-06-04.json", "docs/evaluations/dependency_drift_check_plan_2026-06-04.json", "docs/evaluations/dependency_upgrade_approval_package_template_2026-06-04.json", "docs/evaluations/ai_agent_version_freshness_snapshot_2026-06-11.json" ], "rollups": { "source_snapshot_count": 6, "stale_source_snapshot_count": 5, "monitor_check_count": 7, "drift_candidate_count": 9, "action_required_candidate_count": 9, "owner_action_count": 9, "blocked_operation_count": 20, "by_domain": { "python": 2, "javascript": 2, "docker": 3, "external_source": 1, "agent_market": 1 }, "action_required_drift_candidate_ids": [ "api_python_manifest_drift", "python_lockfile_absence", "apps_web_caret_range_exposure", "shared_types_publish_boundary", "docker_base_images_not_digest_pinned", "api_kubectl_binary_without_checksum_policy", "docker_build_time_network_fetches_present", "external_cve_license_registry_lookup_not_approved", "agent_market_source_lookup_not_approved" ] }, "source_snapshot_readbacks": [ { "snapshot_id": "package_supply_chain_inventory", "source_ref": "docs/evaluations/package_supply_chain_inventory_2026-06-04.json", "source_schema_version": "package_supply_chain_inventory_v1", "generated_at": "2026-06-04T21:06:22+08:00", "freshness_status": "stale_action_required", "evidence_status": "action_required_surfaces_present", "next_action": "以 repo-only 方式刷新 Python / JS / Docker source rollup；未批准前不得查 registry 或升級。" }, { "snapshot_id": "javascript_package_inventory", "source_ref": "docs/evaluations/javascript_package_inventory_2026-06-04.json", "source_schema_version": "javascript_package_inventory_v1", "generated_at": "2026-06-04T20:22:00+08:00", "freshness_status": "stale_action_required", "evidence_status": "caret_range_and_workspace_boundary_present", "next_action": "建立高影響前端套件與 workspace publish boundary 批准包；不得寫 pnpm-lock.yaml。" }, { "snapshot_id": "docker_build_surface_inventory", "source_ref": "docs/evaluations/docker_build_surface_inventory_2026-06-04.json", "source_schema_version": "docker_build_surface_inventory_v1", "generated_at": "2026-06-04T19:23:03+08:00", "freshness_status": "stale_action_required", "evidence_status": "digest_and_network_fetch_risk_present", "next_action": "產生 digest pin、checksum、network source policy 批准包；未批准前不得 build 或 pull image。" }, { "snapshot_id": "dependency_risk_policy", "source_ref": "docs/evaluations/dependency_risk_policy_2026-06-04.json", "source_schema_version": "dependency_risk_policy_v1", "generated_at": "2026-06-04T21:40:00+08:00", "freshness_status": "stale_action_required", "evidence_status": "policy_defined_no_external_lookup", "next_action": "將 policy hit 轉成 owner packet 與 Telegram failure-only digest draft；不得自動套用。" }, { "snapshot_id": "dependency_drift_check_plan", "source_ref": "docs/evaluations/dependency_drift_check_plan_2026-06-04.json", "source_schema_version": "dependency_drift_check_plan_v1", "generated_at": "2026-06-04T22:15:00+08:00", "freshness_status": "stale_action_required", "evidence_status": "cadence_design_only", "next_action": "下一輪若要定期化，必須先送 schedule / workflow / external source approval packet。" }, { "snapshot_id": "ai_agent_version_freshness_snapshot", "source_ref": "docs/evaluations/ai_agent_version_freshness_snapshot_2026-06-11.json", "source_schema_version": "ai_agent_version_freshness_snapshot_v1", "generated_at": "2026-06-11T22:45:00+08:00", "freshness_status": "recent_action_required", "evidence_status": "repo_only_version_sources_present", "next_action": "把 stale source refs 與 P2-004 drift candidates 串接到 P2-406B / P2-407 報表讀回，不啟用外部 lookup。" } ], "monitor_checks": [ { "check_id": "python_manifest_authority_drift_readback", "domain": "python", "owner_agent": "hermes", "status": "action_required", "current_signal": "apps/api/pyproject.toml 與 apps/api/requirements.txt 權威性仍未決；Dockerfile 目前以 pyproject + uv 為建置來源。", "evidence_refs": [ "apps/api/pyproject.toml", "apps/api/requirements.txt", "apps/api/Dockerfile", "docs/evaluations/package_supply_chain_inventory_2026-06-04.json" ], "blocked_now": ["delete requirements", "install packages", "write lockfile"], "next_action": "prepare_python_manifest_authority_packet" }, { "check_id": "python_lockfile_absence_readback", "domain": "python", "owner_agent": "openclaw", "status": "action_required", "current_signal": "Python manifests 仍無 uv.lock / poetry.lock / constraints authority；重現性策略需要人工批准。", "evidence_refs": [ "apps/api/pyproject.toml", "packages/lewooogo-data/pyproject.toml", "docs/evaluations/package_supply_chain_inventory_2026-06-04.json" ], "blocked_now": ["generate lockfile", "pin all versions", "upgrade dependencies"], "next_action": "prepare_python_lockfile_strategy_packet" }, { "check_id": "javascript_importer_lockfile_readback", "domain": "javascript", "owner_agent": "hermes", "status": "read_only_passed", "current_signal": "P1-202 已確認 pnpm importers 與 lockfile specifier 沒有 mismatch；仍需處理 high-impact caret range。", "evidence_refs": [ "package.json", "apps/web/package.json", "pnpm-lock.yaml", "docs/evaluations/javascript_package_inventory_2026-06-04.json" ], "blocked_now": ["pnpm install", "npm audit", "lockfile write"], "next_action": "prepare_js_high_impact_upgrade_packet" }, { "check_id": "javascript_caret_range_exposure_readback", "domain": "javascript", "owner_agent": "openclaw", "status": "action_required", "current_signal": "apps/web 仍有大量 caret range；Next / React / Sentry / Playwright 等高影響套件需要升級批准包與 rollback plan。", "evidence_refs": [ "apps/web/package.json", "pnpm-lock.yaml", "docs/evaluations/javascript_package_inventory_2026-06-04.json" ], "blocked_now": ["package upgrade", "lockfile write", "external registry lookup"], "next_action": "prepare_js_high_impact_upgrade_packet" }, { "check_id": "docker_digest_pin_readback", "domain": "docker", "owner_agent": "openclaw", "status": "action_required", "current_signal": "API / Web Dockerfile 的 base image 與 uv image tag-pinned 但未 digest-pinned。", "evidence_refs": [ "apps/api/Dockerfile", "apps/web/Dockerfile", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json" ], "blocked_now": ["docker build", "image pull", "registry push"], "next_action": "prepare_docker_digest_pin_packet" }, { "check_id": "docker_binary_checksum_readback", "domain": "docker", "owner_agent": "hermes", "status": "action_required", "current_signal": "API image build 下載 kubectl v1.29.0，但 checksum / signature policy 尚未固定。", "evidence_refs": [ "apps/api/Dockerfile", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json" ], "blocked_now": ["curl new binary", "edit Dockerfile", "image rebuild"], "next_action": "prepare_kubectl_checksum_packet" }, { "check_id": "external_source_activation_readback", "domain": "external_source", "owner_agent": "nemotron", "status": "blocked_until_approval", "current_signal": "OSV / Trivy / Syft / Grype / PyPI / npm / Docker Hub / Agent market primary sources 都仍是候選來源，尚未批准外部查詢。", "evidence_refs": [ "docs/evaluations/dependency_drift_check_plan_2026-06-04.json", "docs/evaluations/ai_agent_version_freshness_snapshot_2026-06-11.json" ], "blocked_now": ["external CVE lookup", "license lookup", "registry lookup", "agent market lookup"], "next_action": "prepare_external_source_activation_packet" } ], "drift_candidates": [ { "candidate_id": "api_python_manifest_drift", "domain": "python", "severity": "high", "status": "action_required", "owner_agent": "openclaw", "summary": "API pyproject 與 legacy requirements 仍未決定權威來源；若直接刪除或改寫會影響 build / local tool / rollback 判斷。", "evidence_refs": [ "apps/api/pyproject.toml", "apps/api/requirements.txt", "docs/evaluations/package_supply_chain_inventory_2026-06-04.json" ], "next_owner_action": "prepare_python_manifest_authority_packet" }, { "candidate_id": "python_lockfile_absence", "domain": "python", "severity": "medium", "status": "action_required", "owner_agent": "openclaw", "summary": "Python 依賴仍缺 committed lockfile 或 constraints authority；可先產策略批准包，不得直接生成。", "evidence_refs": [ "apps/api/pyproject.toml", "packages/lewooogo-data/pyproject.toml", "docs/evaluations/dependency_risk_policy_2026-06-04.json" ], "next_owner_action": "prepare_python_lockfile_strategy_packet" }, { "candidate_id": "apps_web_caret_range_exposure", "domain": "javascript", "severity": "medium", "status": "action_required", "owner_agent": "openclaw", "summary": "apps/web 仍有 high-impact caret ranges；下一步是升級批准包與 smoke matrix，不是直接 pnpm install。", "evidence_refs": [ "apps/web/package.json", "pnpm-lock.yaml", "docs/evaluations/javascript_package_inventory_2026-06-04.json" ], "next_owner_action": "prepare_js_high_impact_upgrade_packet" }, { "candidate_id": "shared_types_publish_boundary", "domain": "javascript", "severity": "medium", "status": "action_required", "owner_agent": "hermes", "summary": "shared-types 類 workspace 需要 publish / version / compatibility boundary；應以批准包定義，不由 Agent 自行 publish。", "evidence_refs": [ "packages/shared-types/package.json", "pnpm-lock.yaml", "docs/evaluations/javascript_package_inventory_2026-06-04.json" ], "next_owner_action": "prepare_shared_types_publish_boundary_packet" }, { "candidate_id": "docker_base_images_not_digest_pinned", "domain": "docker", "severity": "high", "status": "action_required", "owner_agent": "openclaw", "summary": "python:3.11-slim、node:20-alpine、ghcr.io/astral-sh/uv:0.6.9 尚未 digest-pinned；需要 digest、rollback 與 rebuild approval。", "evidence_refs": [ "apps/api/Dockerfile", "apps/web/Dockerfile", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json" ], "next_owner_action": "prepare_docker_digest_pin_packet" }, { "candidate_id": "api_kubectl_binary_without_checksum_policy", "domain": "docker", "severity": "high", "status": "action_required", "owner_agent": "hermes", "summary": "API image build 以 curl 下載 kubectl v1.29.0，但 checksum / signature policy 尚未固定。", "evidence_refs": [ "apps/api/Dockerfile", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json" ], "next_owner_action": "prepare_kubectl_checksum_packet" }, { "candidate_id": "docker_build_time_network_fetches_present", "domain": "docker", "severity": "medium", "status": "action_required", "owner_agent": "hermes", "summary": "API build 的 apt-get / curl 與 Web build 的 corepack / pnpm install 都是 build-time network fetch，需要 source policy 與 failure-only digest。", "evidence_refs": [ "apps/api/Dockerfile", "apps/web/Dockerfile", "pnpm-lock.yaml", "docs/evaluations/docker_build_surface_inventory_2026-06-04.json" ], "next_owner_action": "prepare_build_time_network_source_packet" }, { "candidate_id": "external_cve_license_registry_lookup_not_approved", "domain": "external_source", "severity": "medium", "status": "blocked_until_approval", "owner_agent": "openclaw", "summary": "CVE、license、PyPI、npm、Docker manifest freshness 尚未批准外部查詢；只能保留 repo-only drift 與批准包。", "evidence_refs": [ "docs/evaluations/dependency_drift_check_plan_2026-06-04.json", "docs/evaluations/dependency_risk_policy_2026-06-04.json" ], "next_owner_action": "prepare_external_source_activation_packet" }, { "candidate_id": "agent_market_source_lookup_not_approved", "domain": "agent_market", "severity": "medium", "status": "blocked_until_approval", "owner_agent": "nemotron", "summary": "主流 AI Agent / SDK / model watch 已納入工作清單，但定期外部 primary-source lookup 尚未批准；NemoTron 只能先做 committed snapshot freshness 與離線 scorecard 草案。", "evidence_refs": [ "docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md", "docs/evaluations/ai_agent_version_freshness_snapshot_2026-06-11.json" ], "next_owner_action": "prepare_agent_market_source_activation_packet" } ], "owner_actions": [ { "action_id": "prepare_python_manifest_authority_packet", "priority": "P2", "owner_agent": "openclaw", "approval_gate": "human_review_required_before_manifest_delete_or_generation", "summary": "判定 pyproject / requirements 權威來源、生成或退場策略、rollback 與測試矩陣。", "blocked_until": "Owner Gate + build/test/smoke plan + rollback owner" }, { "action_id": "prepare_python_lockfile_strategy_packet", "priority": "P2", "owner_agent": "openclaw", "approval_gate": "dependency_lock_strategy_approval_required", "summary": "提出 uv.lock / constraints / no-lock exception 三路策略與風險評分。", "blocked_until": "Owner Gate + package install approval + rollback plan" }, { "action_id": "prepare_js_high_impact_upgrade_packet", "priority": "P2", "owner_agent": "openclaw", "approval_gate": "frontend_high_impact_upgrade_approval_required", "summary": "針對 Next / React / Sentry / Playwright 等 high-impact 套件產生升級、測試、rollback 與 cache busting 批准包。", "blocked_until": "Owner Gate + pnpm lockfile write approval + browser smoke matrix" }, { "action_id": "prepare_shared_types_publish_boundary_packet", "priority": "P2", "owner_agent": "hermes", "approval_gate": "workspace_publish_boundary_approval_required", "summary": "定義 shared-types version / publish / consumer compatibility 邊界與不自動 publish 規則。", "blocked_until": "Owner Gate + package publish policy" }, { "action_id": "prepare_docker_digest_pin_packet", "priority": "P2", "owner_agent": "openclaw", "approval_gate": "image_digest_pin_and_rebuild_approval_required", "summary": "產生 base image digest pin、重建、rollout、rollback 與 registry promotion 批准包。", "blocked_until": "Owner Gate + docker build/pull/push approval + rollout window" }, { "action_id": "prepare_kubectl_checksum_packet", "priority": "P2", "owner_agent": "hermes", "approval_gate": "binary_checksum_policy_approval_required", "summary": "定義 kubectl binary checksum / signature policy 與替換方案。", "blocked_until": "Owner Gate + Dockerfile write approval" }, { "action_id": "prepare_build_time_network_source_packet", "priority": "P2", "owner_agent": "hermes", "approval_gate": "build_network_source_policy_approval_required", "summary": "把 apt / curl / corepack / pnpm install 來源與失敗限定 digest policy 固定成批准包。", "blocked_until": "Owner Gate + workflow and registry policy approval" }, { "action_id": "prepare_external_source_activation_packet", "priority": "P2", "owner_agent": "openclaw", "approval_gate": "external_cve_license_registry_lookup_approval_required", "summary": "列出 OSV / Trivy / Syft / Grype / PyPI / npm / Docker registry lookup 的費用、頻率、rate limit、資料保存與 redaction 條件。", "blocked_until": "Owner Gate + cost/rate-limit/privacy approval" }, { "action_id": "prepare_agent_market_source_activation_packet", "priority": "P2", "owner_agent": "nemotron", "approval_gate": "agent_market_primary_source_lookup_approval_required", "summary": "把主流 AI Agent / SDK / model watch 來源、scorecard、回放基準與 OpenClaw 替代決策門檻固定成批准包。", "blocked_until": "Owner Gate + primary-source refresh approval + replay policy" } ], "telegram_policy": { "status": "draft_only_no_send", "direct_send_allowed": false, "gateway_queue_write_allowed": false, "success_quiet": true, "failure_digest_after_approval": true, "draft_only_outputs": [ "P2-004 dependency drift action-required digest draft", "Owner packet summary", "failure-only schema mismatch digest draft" ] }, "agent_roles": [ { "agent_id": "openclaw", "role": "仲裁 high / critical supply-chain drift、升級風險、費用與 HITL gate；不得自行批准套件或 provider 變更。", "autonomy_level": "L2_approval_package_only", "approval_gate": "human_review_required_before_any_update_or_external_lookup", "outputs": [ "risk arbitration", "owner action packet", "blocked operation verification" ] }, { "agent_id": "hermes", "role": "彙整 repo-only manifest / lockfile / Dockerfile / committed snapshot 證據，產出報表與 KM 草稿。", "autonomy_level": "L1_report_only", "approval_gate": "read_only_repo_monitor_allowed", "outputs": [ "drift evidence packet", "report section", "Telegram digest draft" ] }, { "agent_id": "nemotron", "role": "進行離線長任務比對、版本 / Agent market freshness 草案與 replay scorecard 草案；不得替換 OpenClaw 或接 production route。", "autonomy_level": "L1_offline_comparison_only", "approval_gate": "offline_scorecard_only_until_market_lookup_and_replay_gate", "outputs": [ "agent market source activation packet", "offline comparison note", "replay candidate list" ] } ], "next_actions": [ { "task_id": "P2-406B", "priority": "P2", "summary": "把 P2-004 drift monitor 與日週月報 / Telegram receipt readback owner review 串接成同一個只讀審核視圖。", "gate": "Telegram send、Gateway queue write、Bot API、receipt production write 仍必須全部為 0。" }, { "task_id": "P2-407", "priority": "P2", "summary": "讓 OpenClaw / Hermes / NemoTron 讀取日週月報與 P2-004 drift monitor 後產生 無寫入 分析與建議。", "gate": "只寫 committed snapshot / 草稿；不得 production optimization write。" }, { "task_id": "P2-412", "priority": "P2", "summary": "準備外部主流 Agent / SDK / model watch 的 primary-source refresh 批准包。", "gate": "未批准前不得外部查詢、不得宣稱 latest、不得替換 OpenClaw。" } ], "monitor_boundaries": { "read_only_repo_monitor_allowed": true, "schedule_activation_allowed": false, "workflow_write_allowed": false, "external_cve_lookup_allowed": false, "external_license_lookup_allowed": false, "registry_lookup_allowed": false, "agent_market_external_lookup_allowed": false, "package_installation_allowed": false, "package_upgrade_allowed": false, "lockfile_write_allowed": false, "docker_build_allowed": false, "image_pull_allowed": false, "image_rebuild_allowed": false, "registry_push_allowed": false, "pr_creation_allowed": false, "telegram_send_allowed": false, "production_write_allowed": false, "paid_external_service_allowed": false, "secret_read_allowed": false, "host_probe_allowed": false, "npm_audit_allowed": false } }