awoooi/docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md

IwoooS Monitoring / Alerting / Observability repo-only 清冊

項目	內容
日期	2026-06-12
狀態	repo_only_inventory_ready
工具	scripts/security/monitoring-alerting-observability-inventory.py
Snapshot	docs/security/monitoring-alerting-observability-inventory.snapshot.json
Schema	docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json
runtime gate	0

1. 目的

這份清冊把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 集中納入 IwoooS 高價值配置控管。

本階段仍是 repo-only source inventory：只讀已提交檔案、計算 SHA256、整理 owner gate 與 live evidence 缺口。不連 live Prometheus、不 reload Alertmanager、不改 Grafana、不套用 SigNoz rule、不部署 Sentry、不發 Telegram、不建立 silence、不 SSH、不 kubectl、不讀 secret value。

2026-06-14 已新增 docs/security/MONITORING-OWNER-REQUEST-DRAFT.md 與 docs/security/monitoring-owner-request-draft.snapshot.json，將 60 個 surface 轉成 owner request draft。此更新只代表人工送件前欄位包已完成；request sent、owner response received / accepted、live evidence、reload、receiver route change、Telegram send、alert chain smoke、runtime gate 與 action button 仍全部為 0 / false。

2. 覆蓋摘要

指標	目前值	說明
surface	60	全部為 committed repo source
source exists	60	每個 source path 都存在並有 SHA256
Prometheus config surface	8	基礎設定、remote write、generated target、service registry、exporter query
alert rule surface	13	Prometheus、K8s、SLO、Ollama、app alert rule 與 Grafana alert rule
Alertmanager receiver surface	1	route / receiver / grouping source
Grafana surface	6	alert rule 與 dashboard JSON
SigNoz surface	3	alert rule、log rule、API client
Sentry surface	4	compose、deploy、webhook receiver、API client
Langfuse surface	3	compose、runbook、API client
notification policy surface	4	failure-only policy、backup policy、observability contract、notification matrix
Telegram surface	3	digest policy、receipt package、gateway service
OTEL surface	1	SigNoz OTEL collector
deploy / reload surface	6	Alertmanager / Prometheus / Sentry / exporter deploy 或 reload-capable script
drift guard surface	1	Prometheus rule drift guard
smoke surface	4	live / test alert 與 alert chain smoke script
write-capable surface	11	可能 reload、deploy、send notification、fire alert 或 restart exporter
owner response received / accepted	0 / 0	不得假性拉高
live evidence received	0	尚未驗證 live monitoring truth
reload owner / receiver owner / route smoke accepted	0 / 0 / 0	尚未授權 reload、route change 或 live smoke
runtime gate / action button	0 / 0	不得建立前端執行入口
P1-4 成熟度	56% -> 62%	只代表 repo-only 清冊完成，不代表 live alert chain 通過

3. Write-capable surface

surface	風險	必要 gate
deploy_alertmanager_config_script	可影響 receiver / route / reload	owner response、維護窗口、rollback owner、receiver smoke
deploy_prometheus_alerts_script	可影響 alert rules / reload	rule test、receiver mapping、reload owner、rollback owner
k8s_deploy_prometheus_config_script	可觸發 K8s apply / reload	K8s owner、ArgoCD / kubectl 邊界、rollback owner
api_apply_prometheus_config_script	可由 API side 套用 Prometheus config	API deploy owner、config source owner、reload proof
monitoring_exporter_deploy_script	可透過 host deploy 影響 exporter / restart	host owner、SSH boundary、restart window
sentry_self_hosted_deploy	可部署 Sentry self-hosted stack	deploy owner、backup owner、migration rollback
telegram_gateway_service	可送 Telegram / 寫 delivery path	token injection owner、receipt owner、send approval gate
notification_manager_service	可改通知通道與路由	channel owner、receipt owner、failure-only policy
converged_alert_recurrence_notifier	可造成 recurrence escalation 或噪音	noise budget owner、silence boundary、receipt proof
fire_live_alert_script	可向 live alert chain 打告警	allowed receiver、test window、cleanup owner
fire_test_alert_script	可觸發測試告警與通知	dedup proof、receiver owner、noise guard

4. 固定 0 / false 邊界

runtime_execution_authorized=false
host_write_authorized=false
prometheus_reload_authorized=false
alertmanager_reload_authorized=false
grafana_dashboard_apply_authorized=false
signoz_rule_apply_authorized=false
sentry_deploy_authorized=false
langfuse_config_change_authorized=false
otel_collector_reload_authorized=false
receiver_route_change_authorized=false
silence_policy_change_authorized=false
telegram_send_authorized=false
notification_route_change_authorized=false
webhook_receiver_change_authorized=false
remote_write_change_authorized=false
exporter_deploy_authorized=false
live_alert_fire_authorized=false
alert_chain_smoke_authorized=false
ssh_read_authorized=false
ssh_write_authorized=false
kubectl_action_authorized=false
secret_value_collection_allowed=false
active_scan_authorized=false
action_buttons_allowed=false

5. 下一步 owner response

1. Prometheus owner：提供 live config hash、rule diff、reload owner、rollback owner 與 false-green guard。
2. Alertmanager owner：提供 receiver diff、route owner、silence policy owner、reload owner 與 failure-only notification proof。
3. Grafana owner：提供 dashboard UID / folder owner、import owner、rollback ref 與 smoke plan。
4. SigNoz / OTEL owner：提供 pipeline diff、rule apply owner、data export boundary 與 rollback owner。
5. Sentry / Langfuse owner：提供 compose live hash、secret injection owner、upgrade / restart window、backup owner 與 rollback owner。
6. Telegram / notification owner：提供 receiver owner、receipt owner、redaction proof、retry boundary 與 no-secret-value evidence。
7. Alert chain smoke owner：提供 allowed receiver、execution window、expected receipt、noise budget 與 cleanup owner。

6. 完成度

工作	完成度	說明
P1-4 repo-only surface 註冊	100%	60 個 surface 已納入 snapshot
source existence / SHA256	100%	60 / 60 source path 存在
monitoring / alerting 高價值配置成熟度	56% -> 62%	只代表清冊與 guard 準備度
owner request draft artifact	100%	60 份 request draft 已完成；不代表已送件或已授權
owner response 收件 / 接受	0%	尚未收到或接受任何 owner response
live evidence collection	0%	未讀 live monitoring stack
reload / receiver / route smoke gate	0%	未授權、未執行
runtime gate	0%	無前端執行按鈕

7. 邊界

本清冊完成不代表 live Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 已一致，也不代表 alert route 已送達或告警必到。不得把 repo source 可見、snapshot、IwoooS UI、AwoooP approval 或 LOGBOOK 當成 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH、kubectl、active scan 或 secret collection 授權。