awoooi/docs/security/TELEGRAM-NOTIFICATION-EGRESS-OWNER-RESPONSE-ACCEPTANCE.md

Telegram 通知出口 Owner Response 驗收帳本

項目	內容
日期	2026-06-19
狀態	owner_response_acceptance_ledger_clear_no_direct_candidates
工具	scripts/security/telegram-notification-egress-owner-response-acceptance.py
Snapshot	docs/security/telegram-notification-egress-owner-response-acceptance.snapshot.json
Source snapshots	docs/security/telegram-notification-egress-owner-request-draft.snapshot.json、docs/security/telegram-notification-egress-migration-plan-draft.snapshot.json
模式	metadata-only；不讀 secret、不送 Telegram、不呼叫 Bot API、不改 workflow / script / API sender
runtime gate	0

1. 目的

telegram_notification_egress_owner_response_acceptance_v1 把 Telegram 通知出口 owner request 草稿與 migration plan 草稿轉成 reviewer 可驗收的帳本。目前 repo source 已讀回 0 個 direct Bot API sendMessage call site，因此 acceptance ledger 沒有待收件 candidate；若未來 direct call 回歸，仍用本帳本避免把「CD success、route 200、UI 可見或 Telegram sent」誤判為 delivery receipt 或自動化閉環完成。

這份帳本不是 owner response received，也不是 migration authorized。workflow、ops script 或 API sender 要真的改走 wrapper / gateway 時，仍需要獨立 change evidence、維護窗口、rollback owner 與 runtime approval。

2. 固定數字

指標	數值	解讀
source_request_draft_count	0	來源 owner request 草稿
source_migration_candidate_count	0	來源 migration candidate
source_direct_bot_api_call_count	0	既有 direct Bot API call site
acceptance_candidate_count	0	每個 direct egress 檔案一個驗收候選
workflow_acceptance_candidate_count	0	Gitea workflow 類
ops_script_acceptance_candidate_count	0	Ops script 類
api_direct_acceptance_candidate_count	0	API direct sender 類
acceptance_field_count	33	每個 candidate 的驗收欄位
required_owner_field_count	0	目前沒有待收件 candidate
reviewer_check_count	23	reviewer 必檢規則
outcome_lane_count	10	收件結果分流
forbidden_payload_count	14	禁止出現在回覆中的 payload 類型
blocked_action_count	35	帳本階段禁止動作

所有 request sent、recipient confirmed、audit event emitted、owner response received / accepted / rejected / quarantined、formatter convergence accepted、redaction contract accepted、delivery receipt accepted、break-glass fallback accepted、maintenance window accepted、rollback owner accepted、postcheck evidence accepted、dedup / fingerprint accepted、no-false-green accepted、migration authorized、workflow / script / API sender modification、Telegram send、Bot API call、workflow dispatch、production deploy、secret collection、raw payload storage、production write、runtime gate、action button 全部維持 0 / false。

3. Reviewer checks

Reviewer 必須確認：

• source owner request draft 與 migration plan 都是目前版本。
• owner identity、decision、decision reason、affected scope 與 followup owner 完整。
• 所有 evidence refs 都是脫敏 metadata，不包含 secret value、hash、partial token、raw message payload 或 raw workflow log。
• message shape contract、message_readability_guard_ref、redaction contract、formatter convergence、gateway / Alertmanager target、break-glass fallback、delivery receipt、dedup / fingerprint、maintenance window、rollback owner 與 postcheck evidence 都明確存在。
• message_readability_guard_ref 必須固定指向 docs/security/telegram-alert-readability-guard.snapshot.json，確保 direct egress 遷移審查不能繞過告警卡片化、脫敏、runtime_write_gate=0 與 no-false-green。
• no_secret_value_attestation、no_raw_payload_attestation、no_false_green_attestation 都存在。
• migration authorization 與 runtime approval 必須分離；此帳本不能直接批准 workflow / script / API sender 修改。
• runtime gate 維持 0。

4. Outcome lanes

Lane	說明
waiting_owner_response	等待合格 owner response
quarantine_secret_or_raw_payload	收到 secret、raw payload 或 raw log 時隔離
reject_execution_request	回覆夾帶立即執行要求時拒收
request_owner_route_supplement	owner、route 或 scope 不完整
request_formatter_convergence_supplement	formatter convergence 或 target 不完整
request_redaction_or_receipt_supplement	redaction contract、delivery receipt 或 dedup 不完整
request_maintenance_or_rollback_supplement	maintenance window 或 rollback owner 不完整
ready_for_migration_review	metadata 完整，可另開 migration review
owner_review_only_update	只更新 owner review metadata
waiting_runtime_gate	owner review 完成後仍等待 runtime gate

5. 禁止動作

此帳本階段禁止：

• 標記 owner response received / accepted。
• 送 Telegram、呼叫 Bot API、dispatch workflow、觸發 CD 或 production deploy。
• 修改 workflow、ops script、API sender、chat route、Bot token 或 secret。
• 讀 secret store、收 secret value / hash / partial token / chat id secret。
• 保存 raw message payload、raw workflow log、raw action log、內部協作逐字稿或未脫敏截圖。
• 把 CD success、route 200、UI 可見或 Telegram sent 當作 delivery receipt。
• 跳過 formatter convergence、redaction contract、dedup / fingerprint、break-glass fallback 或 no-false-green review。
• 開 runtime gate 或新增 action button。

6. 驗證指令

python3 scripts/security/telegram-notification-egress-owner-response-acceptance.py --root .
python3 -m json.tool docs/security/telegram-notification-egress-owner-response-acceptance.snapshot.json >/dev/null
python3 -m py_compile scripts/security/telegram-notification-egress-owner-response-acceptance.py
python3 scripts/security/security-mirror-progress-guard.py --root .

7. 完成度

項目	完成度	邊界
Owner response acceptance artifact	100%	11 個 candidate 已可 reviewer 驗收
Owner response dispatch / received / accepted	0%	尚未送件、尚未收件、尚未接受
Direct Bot API convergence	0%	尚未修改 workflow / script / API sender
Runtime execution	0%	不送 Telegram、不呼叫 Bot API、不開 runtime gate