2262 lines
77 KiB
JSON
2262 lines
77 KiB
JSON
{
|
||
"schema_version": "ai_provider_owner_response_acceptance_v1",
|
||
"status": "owner_response_acceptance_ledger_ready_no_runtime_action",
|
||
"generated_at": "2026-06-15T19:35:00+08:00",
|
||
"git_sha": "403b29df",
|
||
"source_paths": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/ai/AI-MODEL-CARDS.md",
|
||
"docs/runbooks/OPENCLAW-REPLACEMENT-EVALUATION.md",
|
||
"scripts/security/ai-provider-owner-response-acceptance.py",
|
||
"scripts/security/high-value-config-control-coverage.py"
|
||
],
|
||
"summary": {
|
||
"acceptance_candidate_count": 8,
|
||
"write_capable_acceptance_candidate_count": 5,
|
||
"paid_provider_related_candidate_count": 5,
|
||
"data_egress_candidate_count": 6,
|
||
"live_evidence_required_candidate_count": 6,
|
||
"acceptance_field_count": 37,
|
||
"required_owner_field_count": 24,
|
||
"reviewer_check_count": 24,
|
||
"outcome_lane_count": 10,
|
||
"blocked_action_count": 38,
|
||
"owner_response_received_count": 0,
|
||
"owner_response_accepted_count": 0,
|
||
"owner_response_rejected_count": 0,
|
||
"owner_response_quarantined_count": 0,
|
||
"supplement_requested_count": 0,
|
||
"fallback_order_accepted_count": 0,
|
||
"dry_run_result_accepted_count": 0,
|
||
"benchmark_result_accepted_count": 0,
|
||
"cost_review_accepted_count": 0,
|
||
"privacy_review_accepted_count": 0,
|
||
"data_classification_accepted_count": 0,
|
||
"prompt_redaction_accepted_count": 0,
|
||
"secret_handling_accepted_count": 0,
|
||
"quota_budget_accepted_count": 0,
|
||
"latency_slo_accepted_count": 0,
|
||
"quality_gate_accepted_count": 0,
|
||
"rollback_owner_accepted_count": 0,
|
||
"maintenance_window_accepted_count": 0,
|
||
"postcheck_evidence_accepted_count": 0,
|
||
"provider_switch_authorized_count": 0,
|
||
"external_provider_call_authorized_count": 0,
|
||
"paid_provider_call_authorized_count": 0,
|
||
"prompt_send_authorized_count": 0,
|
||
"live_endpoint_probe_authorized_count": 0,
|
||
"secret_value_collection_allowed_count": 0,
|
||
"runtime_gate_count": 0,
|
||
"action_button_count": 0,
|
||
"coverage_percent_before_acceptance": 60,
|
||
"coverage_percent_after_acceptance": 64
|
||
},
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
{
|
||
"check_id": "owner_identity_present",
|
||
"instruction": "owner role / team 與 provider owner 必須可追溯。"
|
||
},
|
||
{
|
||
"check_id": "decision_reason_present",
|
||
"instruction": "decision 與 decision reason 必須同時存在。"
|
||
},
|
||
{
|
||
"check_id": "affected_scope_matches_surface",
|
||
"instruction": "affected scope 必須能對回既有 AI provider surface。"
|
||
},
|
||
{
|
||
"check_id": "redacted_refs_only",
|
||
"instruction": "evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer。"
|
||
},
|
||
{
|
||
"check_id": "secret_value_absent",
|
||
"instruction": "不得出現 API key、token、cookie、private key、env dump、完整 DSN 或 partial secret。"
|
||
},
|
||
{
|
||
"check_id": "live_endpoint_absent",
|
||
"instruction": "不得保存 raw live endpoint、內網位址或可直接連線 URL。"
|
||
},
|
||
{
|
||
"check_id": "fallback_order_present",
|
||
"instruction": "必須提供 fallback order 與 degraded mode ref，不接受憑印象切 provider。"
|
||
},
|
||
{
|
||
"check_id": "dry_run_result_present",
|
||
"instruction": "必須有 dry-run 結果或明確不適用理由；dry-run 不得呼叫 production LLM。"
|
||
},
|
||
{
|
||
"check_id": "benchmark_result_present",
|
||
"instruction": "必須有 benchmark / replay / fixture 結果與評分方法 ref。"
|
||
},
|
||
{
|
||
"check_id": "cost_review_present",
|
||
"instruction": "涉及雲端或付費 provider 時必須有成本上限、quota、告警與停損 ref。"
|
||
},
|
||
{
|
||
"check_id": "privacy_review_present",
|
||
"instruction": "涉及外部 provider、prompt、log 或 embedding 時必須有資料外送與脫敏審查 ref。"
|
||
},
|
||
{
|
||
"check_id": "data_classification_present",
|
||
"instruction": "必須標示可送出、不可送出、需遮罩與只能本地處理的資料分類。"
|
||
},
|
||
{
|
||
"check_id": "prompt_redaction_present",
|
||
"instruction": "prompt / log / incident context 需有 redaction proof，不接受 raw prompt 或 raw log。"
|
||
},
|
||
{
|
||
"check_id": "secret_handling_metadata_only",
|
||
"instruction": "secret handling 只能描述注入路徑與 owner，不得貼 secret value / hash / partial token。"
|
||
},
|
||
{
|
||
"check_id": "quota_budget_present",
|
||
"instruction": "付費 provider、雲端 provider 或外部 API 必須有 quota budget 與 stop condition。"
|
||
},
|
||
{
|
||
"check_id": "latency_slo_present",
|
||
"instruction": "需要 latency / timeout / circuit breaker / degradation SLO ref。"
|
||
},
|
||
{
|
||
"check_id": "quality_gate_present",
|
||
"instruction": "模型切換或 agent replacement 必須有品質門檻與 incumbent baseline。"
|
||
},
|
||
{
|
||
"check_id": "rollback_owner_present",
|
||
"instruction": "rollback owner 與 rollback plan 必須存在。"
|
||
},
|
||
{
|
||
"check_id": "maintenance_window_present",
|
||
"instruction": "provider route、proxy、env 或 model change 必須另有維護窗口。"
|
||
},
|
||
{
|
||
"check_id": "postcheck_evidence_present",
|
||
"instruction": "post-check 必須覆蓋 provider route、fallback、cost、privacy、observability 與 rollback stop condition。"
|
||
},
|
||
{
|
||
"check_id": "no_runtime_request",
|
||
"instruction": "夾帶 provider switch、Nginx reload、env change、external call、prompt send、benchmark live call 或 deploy 時拒收。"
|
||
},
|
||
{
|
||
"check_id": "no_false_green_provider_health",
|
||
"instruction": "不得把 provider route 200、dashboard up、模型回覆一次成功當成 routing / privacy / cost 已驗收。"
|
||
},
|
||
{
|
||
"check_id": "cross_project_sync_present",
|
||
"instruction": "影響 AwoooP、IwoooS、agent-bounty、code review、StockPlatform 或公開網站時需有跨專案同步 ref。"
|
||
},
|
||
{
|
||
"check_id": "counts_transition_safe",
|
||
"instruction": "只有 reviewer record 可更新 received / accepted；不得同時開 runtime gate。"
|
||
}
|
||
],
|
||
"outcome_lanes": [
|
||
{
|
||
"lane_id": "waiting_owner_response",
|
||
"meaning": "尚未收到 AI provider owner response；所有 accepted / runtime count 維持 0。"
|
||
},
|
||
{
|
||
"lane_id": "quarantine_secret_or_raw_payload",
|
||
"meaning": "收到 secret、raw prompt、raw log、raw endpoint、未脫敏截圖或 env dump 時隔離。"
|
||
},
|
||
{
|
||
"lane_id": "reject_execution_request",
|
||
"meaning": "夾帶 provider switch、外部呼叫、prompt send、Nginx reload、env change 或 deploy 要求時拒收。"
|
||
},
|
||
{
|
||
"lane_id": "request_fallback_supplement",
|
||
"meaning": "缺 fallback order、degraded mode、circuit breaker 或 rollback 時要求補件。"
|
||
},
|
||
{
|
||
"lane_id": "request_cost_privacy_supplement",
|
||
"meaning": "缺 cost / quota / privacy / data classification / prompt redaction 時要求補件。"
|
||
},
|
||
{
|
||
"lane_id": "request_benchmark_supplement",
|
||
"meaning": "缺 dry-run、benchmark、fixture replay、quality gate 或 incumbent baseline 時要求補件。"
|
||
},
|
||
{
|
||
"lane_id": "legacy_model_card_redaction_required",
|
||
"meaning": "舊模型卡、runbook 或報表含 raw endpoint / 主機識別時，先改成脫敏 alias。"
|
||
},
|
||
{
|
||
"lane_id": "ready_for_ai_provider_review",
|
||
"meaning": "metadata 合格後，只能進 AI provider reviewer review。"
|
||
},
|
||
{
|
||
"lane_id": "owner_review_only_update",
|
||
"meaning": "只允許更新只讀 owner review ledger，不切 provider、不呼叫模型、不改 proxy。"
|
||
},
|
||
{
|
||
"lane_id": "waiting_runtime_gate",
|
||
"meaning": "即使 owner response accepted，runtime gate 仍需獨立人工批准。"
|
||
}
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"acceptance_candidates": [
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:ai_router_provider_policy",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "ai_router_provider_policy",
|
||
"label": "AI router provider policy / purpose mapping",
|
||
"expected_scope": "purpose routing、provider priority、degraded mode",
|
||
"config_kind": "provider_policy",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"apps/api/src/services/ai_router.py",
|
||
"apps/api/src/services/ai_provider_route_matrix.py",
|
||
"apps/api/models.json",
|
||
"docs/ai/AI-MODEL-CARDS.md"
|
||
],
|
||
"source_ref_sha256": "fdfb8489a1b92feeb7a540c6a4c4810c3d72df2831691831e7347ad9bb86e351",
|
||
"write_capable_surface": true,
|
||
"paid_provider_related": true,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:ollama_proxy_gateway",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "ollama_proxy_gateway",
|
||
"label": "Ollama proxy gateway / local fallback boundary",
|
||
"expected_scope": "proxy route、local fallback、gateway health",
|
||
"config_kind": "proxy_gateway",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
|
||
"apps/api/src/services/ollama_endpoint_resolver.py",
|
||
"apps/api/src/services/ollama_failover_manager.py",
|
||
"apps/api/src/services/provider_proxy.py"
|
||
],
|
||
"source_ref_sha256": "7eb65ad1c985886cad9add02894440995d4ca936f46831dce53995ba668632e5",
|
||
"write_capable_surface": true,
|
||
"paid_provider_related": false,
|
||
"data_egress_related": false,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:fallback_order_and_circuit_breaker",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "fallback_order_and_circuit_breaker",
|
||
"label": "Fallback order / circuit breaker",
|
||
"expected_scope": "GCP / local / cloud fallback order、timeout、circuit breaker",
|
||
"config_kind": "routing_guard",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"apps/api/src/services/ollama_endpoint_circuit_breaker.py",
|
||
"apps/api/src/services/ollama_health_monitor.py",
|
||
"apps/api/src/services/failover_alerter.py",
|
||
"apps/web/messages/zh-TW.json"
|
||
],
|
||
"source_ref_sha256": "909d508008b3660c9fcd3617e0571f18e38fc6a71894a12c48f94b8cc22d02dd",
|
||
"write_capable_surface": true,
|
||
"paid_provider_related": true,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:cost_budget_and_quota",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "cost_budget_and_quota",
|
||
"label": "Cost budget / quota / paid provider stop condition",
|
||
"expected_scope": "quota、token budget、cost alert、paid provider stop condition",
|
||
"config_kind": "cost_policy",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"docs/ai/AI-MODEL-CARDS.md",
|
||
"apps/api/src/services/ai_rate_limiter.py",
|
||
"apps/api/src/services/ai_slo_calculator.py",
|
||
"apps/web/messages/zh-TW.json"
|
||
],
|
||
"source_ref_sha256": "9cab1f216749d36b76cfb8da06e324b0bf4bcd12424657bc8e40c2bf64c03af7",
|
||
"write_capable_surface": false,
|
||
"paid_provider_related": true,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:privacy_data_egress_boundary",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "privacy_data_egress_boundary",
|
||
"label": "Privacy / data egress / prompt redaction boundary",
|
||
"expected_scope": "prompt redaction、資料分級、外部 provider 資料外送",
|
||
"config_kind": "privacy_policy",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/ai/AI-MODEL-CARDS.md",
|
||
"apps/api/src/services/ai_providers/permissions.py",
|
||
"apps/api/src/services/alertmanager_llm_guard.py"
|
||
],
|
||
"source_ref_sha256": "c15c8a91861b12a72117e70a8a44cd18c96bc1494f90245c57b517d0509fe3ae",
|
||
"write_capable_surface": false,
|
||
"paid_provider_related": true,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:benchmark_dry_run_pack",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "benchmark_dry_run_pack",
|
||
"label": "Dry-run / benchmark / replay pack",
|
||
"expected_scope": "dry-run、benchmark、fixture replay、quality gate",
|
||
"config_kind": "evaluation_pack",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"docs/runbooks/OPENCLAW-REPLACEMENT-EVALUATION.md",
|
||
"docs/ai/agent-replacement-candidates.v1.json",
|
||
"scripts/agents/run-agent-replacement-replay.py",
|
||
"scripts/agents/evaluate-agent-promotion-gate.py"
|
||
],
|
||
"source_ref_sha256": "692a2417842c677b5282118efe43b74deb47c017f6a2a7a5f4bfd013e822992e",
|
||
"write_capable_surface": false,
|
||
"paid_provider_related": false,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": false,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:model_card_and_version_inventory",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "model_card_and_version_inventory",
|
||
"label": "Model card / model version inventory",
|
||
"expected_scope": "model card、version freshness、source-of-truth、redacted endpoint",
|
||
"config_kind": "model_metadata",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"docs/ai/AI-MODEL-CARDS.md",
|
||
"apps/api/src/services/model_registry.py",
|
||
"apps/api/src/services/model_version_tracker.py",
|
||
"apps/api/src/services/model_version_probe.py"
|
||
],
|
||
"source_ref_sha256": "d5f5fce37c4c1cdb61b2fe60357b7f43bcb771372a9984fbff4647067c3c11f9",
|
||
"write_capable_surface": true,
|
||
"paid_provider_related": false,
|
||
"data_egress_related": false,
|
||
"requires_live_evidence": false,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
{
|
||
"acceptance_candidate_id": "ai_provider_owner_response_acceptance:agent_replacement_candidate_runtime_boundary",
|
||
"status": "waiting_owner_response",
|
||
"surface_id": "agent_replacement_candidate_runtime_boundary",
|
||
"label": "Agent replacement / NemoTron / Hermes / OpenClaw candidate boundary",
|
||
"expected_scope": "agent candidate、promotion gate、shadow/canary boundary",
|
||
"config_kind": "agent_runtime_boundary",
|
||
"control_tier": "C1",
|
||
"source_refs": [
|
||
"docs/runbooks/OPENCLAW-REPLACEMENT-EVALUATION.md",
|
||
"docs/ai/agent-market-watch-sources.v1.json",
|
||
"docs/ai/agent-replacement-candidates.v1.json",
|
||
"apps/api/src/services/ai_agent_tool_adoption_approval_package.py"
|
||
],
|
||
"source_ref_sha256": "de3de57ea5fb5cbe9d47fab30167110521165e3680bb4dba449035f9a7a29845",
|
||
"write_capable_surface": true,
|
||
"paid_provider_related": true,
|
||
"data_egress_related": true,
|
||
"requires_live_evidence": true,
|
||
"owner_response_ref": null,
|
||
"owner_role_or_team": "pending_owner_response",
|
||
"decision": "pending_owner_response",
|
||
"decision_reason": "pending_owner_response",
|
||
"affected_scope": "pending_owner_response",
|
||
"provider_owner": "pending_owner_response",
|
||
"fallback_order_ref": null,
|
||
"dry_run_result_ref": null,
|
||
"benchmark_result_ref": null,
|
||
"cost_review_ref": null,
|
||
"privacy_review_ref": null,
|
||
"data_classification_ref": null,
|
||
"prompt_redaction_ref": null,
|
||
"secret_handling_ref": null,
|
||
"quota_budget_ref": null,
|
||
"latency_slo_ref": null,
|
||
"quality_gate_ref": null,
|
||
"rollback_owner": "pending_owner_response",
|
||
"rollback_plan_ref": null,
|
||
"maintenance_window": "pending_owner_response",
|
||
"postcheck_evidence_refs": [],
|
||
"redacted_evidence_refs": [],
|
||
"reviewer_outcome": "waiting_owner_response",
|
||
"followup_owner": "pending_owner_response",
|
||
"acceptance_fields": [
|
||
"acceptance_candidate_id",
|
||
"surface_id",
|
||
"label",
|
||
"expected_scope",
|
||
"config_kind",
|
||
"control_tier",
|
||
"source_refs",
|
||
"source_ref_sha256",
|
||
"write_capable_surface",
|
||
"paid_provider_related",
|
||
"data_egress_related",
|
||
"requires_live_evidence",
|
||
"owner_response_ref",
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"reviewer_outcome",
|
||
"followup_owner",
|
||
"not_approval"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"provider_owner",
|
||
"fallback_order_ref",
|
||
"dry_run_result_ref",
|
||
"benchmark_result_ref",
|
||
"cost_review_ref",
|
||
"privacy_review_ref",
|
||
"data_classification_ref",
|
||
"prompt_redaction_ref",
|
||
"secret_handling_ref",
|
||
"quota_budget_ref",
|
||
"latency_slo_ref",
|
||
"quality_gate_ref",
|
||
"rollback_owner",
|
||
"rollback_plan_ref",
|
||
"maintenance_window",
|
||
"postcheck_evidence_refs",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"not_approval",
|
||
"no_secret_value_attestation"
|
||
],
|
||
"reviewer_checks": [
|
||
"owner_identity_present",
|
||
"decision_reason_present",
|
||
"affected_scope_matches_surface",
|
||
"redacted_refs_only",
|
||
"secret_value_absent",
|
||
"live_endpoint_absent",
|
||
"fallback_order_present",
|
||
"dry_run_result_present",
|
||
"benchmark_result_present",
|
||
"cost_review_present",
|
||
"privacy_review_present",
|
||
"data_classification_present",
|
||
"prompt_redaction_present",
|
||
"secret_handling_metadata_only",
|
||
"quota_budget_present",
|
||
"latency_slo_present",
|
||
"quality_gate_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"postcheck_evidence_present",
|
||
"no_runtime_request",
|
||
"no_false_green_provider_health",
|
||
"cross_project_sync_present",
|
||
"counts_transition_safe"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_response",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_execution_request",
|
||
"request_fallback_supplement",
|
||
"request_cost_privacy_supplement",
|
||
"request_benchmark_supplement",
|
||
"legacy_model_card_redaction_required",
|
||
"ready_for_ai_provider_review",
|
||
"owner_review_only_update",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"blocked_actions": [
|
||
"provider_switch",
|
||
"model_route_change",
|
||
"fallback_order_change",
|
||
"ollama_proxy_change",
|
||
"nginx_reload",
|
||
"env_change",
|
||
"runtime_config_change",
|
||
"external_provider_call",
|
||
"paid_provider_call",
|
||
"prompt_send",
|
||
"raw_prompt_storage",
|
||
"raw_log_storage",
|
||
"raw_endpoint_storage",
|
||
"live_endpoint_probe",
|
||
"benchmark_live_call",
|
||
"dry_run_external_call",
|
||
"quota_increase",
|
||
"cost_limit_change",
|
||
"privacy_boundary_change",
|
||
"data_egress_change",
|
||
"secret_value_collection",
|
||
"secret_hash_collection",
|
||
"partial_token_collection",
|
||
"api_key_rotation",
|
||
"secret_store_read",
|
||
"model_download",
|
||
"sdk_install",
|
||
"agent_runtime_enable",
|
||
"shadow_or_canary_enable",
|
||
"production_deploy",
|
||
"workflow_dispatch",
|
||
"host_write",
|
||
"ssh_read",
|
||
"ssh_write",
|
||
"active_scan",
|
||
"mark_owner_response_accepted_without_reviewer_record",
|
||
"open_runtime_gate",
|
||
"add_action_button"
|
||
],
|
||
"not_approval": true,
|
||
"request_sent": false,
|
||
"recipient_confirmed": false,
|
||
"owner_response_received": false,
|
||
"owner_response_accepted": false,
|
||
"owner_response_rejected": false,
|
||
"owner_response_quarantined": false,
|
||
"supplement_requested": false,
|
||
"fallback_order_accepted": false,
|
||
"dry_run_result_accepted": false,
|
||
"benchmark_result_accepted": false,
|
||
"cost_review_accepted": false,
|
||
"privacy_review_accepted": false,
|
||
"data_classification_accepted": false,
|
||
"prompt_redaction_accepted": false,
|
||
"secret_handling_accepted": false,
|
||
"quota_budget_accepted": false,
|
||
"latency_slo_accepted": false,
|
||
"quality_gate_accepted": false,
|
||
"rollback_owner_accepted": false,
|
||
"maintenance_window_accepted": false,
|
||
"postcheck_evidence_accepted": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"env_change_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"benchmark_live_call_authorized": false,
|
||
"dry_run_external_call_authorized": false,
|
||
"quota_increase_authorized": false,
|
||
"cost_limit_change_authorized": false,
|
||
"privacy_boundary_change_authorized": false,
|
||
"data_egress_change_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"secret_hash_collection_allowed": false,
|
||
"partial_token_collection_allowed": false,
|
||
"api_key_rotation_authorized": false,
|
||
"secret_store_read_authorized": false,
|
||
"model_download_authorized": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"workflow_dispatch_authorized": false,
|
||
"host_write_authorized": false,
|
||
"ssh_read_authorized": false,
|
||
"ssh_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
}
|
||
],
|
||
"boundaries": {
|
||
"not_authorization": true,
|
||
"runtime_execution_authorized": false,
|
||
"provider_switch_authorized": false,
|
||
"model_route_change_authorized": false,
|
||
"fallback_order_change_authorized": false,
|
||
"ollama_proxy_change_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"external_provider_call_authorized": false,
|
||
"paid_provider_call_authorized": false,
|
||
"prompt_send_authorized": false,
|
||
"live_endpoint_probe_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"raw_prompt_storage_allowed": false,
|
||
"raw_endpoint_storage_allowed": false,
|
||
"sdk_install_authorized": false,
|
||
"agent_runtime_enable_authorized": false,
|
||
"shadow_or_canary_enable_authorized": false,
|
||
"production_deploy_authorized": false,
|
||
"host_write_authorized": false,
|
||
"active_scan_authorized": false,
|
||
"runtime_gate": false,
|
||
"action_buttons_allowed": false
|
||
}
|
||
}
|