awoooi/docs/operations/portfolio-infrastructure-asset-reconciliation.snapshot.json

{
  "schema_version": "portfolio_infrastructure_asset_reconciliation_v1",
  "governance_version": "global_product_governance_v2",
  "program_id": "AIA-SRE-P0-20260715",
  "generated_at": "2026-07-16T15:18:00+08:00",
  "status": "all_imported_rows_mapped_source_conflicts_and_omissions_recorded_runtime_unverified",
  "scope_complete": false,
  "source_inventory": {
    "active_version_id": "inventory-c214160-20260716",
    "label": "WOOO 基礎設施服務工具盤點表（完整版）",
    "source_path": "/Users/ogt/.gemini/antigravity-ide/brain/4e1bfd7f-cc1d-4f4f-94b0-df62ecb40386/infrastructure_inventory.md",
    "sha256": "c21416023775cc7fa96952ea3f06be389246269d11130902ae039aa0bd463df4",
    "declared_updated_date": "2026-07-16",
    "source_line_count": 284,
    "inventory_item_row_count": 131,
    "source_category_counts": {
      "hosts": 5,
      "databases": 15,
      "cache_queue": 8,
      "monitoring_observability": 18,
      "error_tracking": 3,
      "ai_llm": 5,
      "workflow_automation": 1,
      "container_registry_cicd": 9,
      "storage_backup": 2,
      "gateway_proxy": 7,
      "host112_security": 23,
      "applications": 24,
      "k3s_components": 11
    },
    "live_truth_accepted": false,
    "runtime_probe_performed": false,
    "interpretation": "The imported docker-ps and health labels are historical evidence only. Every asset remains runtime-unverified until an exact production receipt is correlated to this source revision.",
    "version_history": [
      {
        "version_id": "inventory-2e8580c-20260716",
        "sha256": "2e8580c6465fe072990bc3736625c1a81614201d6cb7acadcc27338f96acaf22",
        "source_line_count": 241,
        "inventory_item_row_count": 112,
        "disposition": "superseded_by_inventory-c214160-20260716_preserved_as_reconciliation_history"
      }
    ]
  },
  "governance": {
    "pipeline": [
      "Alert",
      "Canonical Asset Normalize",
      "Typed Domain Router",
      "HolmesGPT Investigator",
      "Ollama RCA / Gemini Critic",
      "Deterministic Policy",
      "Single Controlled Executor",
      "Independent Verifier",
      "Incident Closure + KM/RAG/MCP/PlayBook"
    ],
    "provider_order": ["ollama_gcp_a", "ollama_gcp_b", "ollama_local_host111", "claude", "gemini"],
    "github_frozen": true,
    "cross_domain_fallback_allowed": false,
    "unknown_asset_terminal": "asset_identity_unresolved",
    "snapshot_health_is_live_truth": false,
    "critical_backup_restore_default": "read_only_investigation_break_glass_for_write",
    "alert_attribution_required": [
      "decision_engine",
      "ai_models_used",
      "agent_actions",
      "executor",
      "independent_verifier",
      "same_run_receipt"
    ]
  },
  "asset_groups": [
    {
      "group_id": "imported-hosts",
      "category": "host",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "wooo-platform",
        "site_id": "on-prem-lan",
        "owner_lane": "infrastructure_ops",
        "source_truth_state": "source_registry_partial",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "host_systemd",
        "executor": "host_ansible_executor",
        "verifier": "host_runtime_independent_verifier",
        "monitoring": {"signals": ["node_reachability", "cpu", "memory", "disk", "service_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "canonical_incident_only", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "readback_first", "target": "host_config_and_service_specific_contracts", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001"],
        "next_action": "Run exact-host read-only identity and service probes, then bind each result to a durable asset receipt."
      },
      "members": [
        {"canonical_id": "host:110", "inventory_labels": ["DevOps", "192.168.0.110"], "source_rows": ["L012"], "runtime_identity": "192.168.0.110", "reconciliation_state": "matched_with_source_drift", "findings": ["Inventory claims healthy containers but no same-run receipt exists", "Host110 Ollama has been removed; every former endpoint/proxy identity must resolve only to a retired tombstone", "Source tombstone and monitoring cleanup are not production proof of endpoint absence", "Legacy GitHub exporter runtime remains visible while the exact gitea-native target is missing"], "source_refs": ["infra/ansible/inventory/hosts.yml", "infra/ansible/inventory/group_vars/host_110.yml", "ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml"], "next_action": "Verify the Host110 Ollama tombstone against runtime and monitoring, verify gitea-native target freshness, and retire only the exact legacy GitHub exporter under bounded apply."},
        {"canonical_id": "host:188", "inventory_labels": ["AI/Data", "192.168.0.188"], "source_rows": ["L013"], "runtime_identity": "192.168.0.188", "reconciliation_state": "matched_with_role_conflict", "findings": ["Inventory says AI/Data without GPU", "Imported local Ollama identity conflicts with the approved host111 provider route", "Disk 64 percent is an unverified point-in-time claim"], "source_refs": ["infra/ansible/inventory/hosts.yml", "infra/ansible/inventory/group_vars/host_188.yml", "ops/config/service-registry.yaml"]},
        {"canonical_id": "host:120", "inventory_labels": ["K3s Master", "K3s Master (192.168.0.120)"], "source_rows": ["L014", "L249"], "runtime_identity": "192.168.0.120", "reconciliation_state": "matched_runtime_unverified", "findings": ["Control-plane role is source-visible; health is not live-verified"], "source_refs": ["infra/ansible/inventory/hosts.yml", "ops/monitoring/service-registry.yaml"], "domain_router": "control_plane_recovery", "executor": "Agent99", "verifier": "cold_start_independent_scorecard_verifier"},
        {"canonical_id": "host:121", "inventory_labels": ["K3s Backup", "K3s Backup (192.168.0.121)"], "source_rows": ["L015", "L250"], "runtime_identity": "192.168.0.121", "reconciliation_state": "role_conflict", "findings": ["Imported inventory calls this a backup/control-plane node while monitoring registry calls it k3s-worker"], "source_refs": ["infra/ansible/inventory/hosts.yml", "ops/monitoring/service-registry.yaml"], "domain_router": "control_plane_recovery", "executor": "Agent99", "verifier": "cold_start_independent_scorecard_verifier", "next_action": "Resolve exact K3s node roles from live kubectl node identity before any recovery action."},
        {"canonical_id": "host:112", "inventory_labels": ["Security", "192.168.0.112"], "source_rows": ["L016"], "runtime_identity": "192.168.0.112", "reconciliation_state": "matched_runtime_unverified", "findings": ["Wazuh/Kali source identity exists; imported healthy state is not a current receipt"], "source_refs": ["infra/ansible/inventory/hosts.yml", "ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml"], "owner_lane": "security_ops"}
      ]
    },
    {
      "group_id": "imported-databases",
      "category": "database",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "database-estate",
        "site_id": "on-prem-lan",
        "owner_lane": "database_ops",
        "source_truth_state": "inventory_claim_and_partial_registry",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "database",
        "executor": "db_bounded_executor",
        "verifier": "db_independent_verifier",
        "monitoring": {"signals": ["readiness", "connections", "replication", "capacity", "backup_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "database_typed_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "gap:no_exact_product_restore_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-007"],
        "next_action": "Resolve exact database/container/port identity, collect read-only health and backup freshness, then create bounded DB verifier work."
      },
      "members": [
        {"canonical_id": "database:awoooi:prod", "inventory_labels": ["awoooi_prod"], "source_rows": ["L025"], "runtime_identity": "host188/postgresql/awoooi_prod", "reconciliation_state": "identity_scope_conflict", "findings": ["Inventory combines AWOOOI business database and K3s datastore into one purpose", "Canonical service registry names the container postgres, not awoooi_prod"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-awoooi.sh"], "product_id": "awoooi", "project_id": "awoooi", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-awoooi.sh", "freshness": "unverified"}},
        {"canonical_id": "database:momo-pro:postgres", "inventory_labels": ["momo-db"], "source_rows": ["L026"], "runtime_identity": "host188/docker/momo-db", "reconciliation_state": "matched_source_runtime_unverified", "findings": ["Exact exposed port and database name are not proven by the inventory row"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-momo.sh"], "product_id": "momo-pro", "project_id": "momo-pro-system", "owner_lane": "momo_product_ops", "telegram_destination": "blocked:momo_configured_chat_unresolved", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-momo.sh", "freshness": "unverified"}},
        {"canonical_id": "database:vibework:postgres", "inventory_labels": ["vibework-production-postgres-1"], "source_rows": ["L027"], "runtime_identity": "host188/docker/vibework-production-postgres-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["No exact AWOOOI service registry entry or committed restore contract found"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "vibework", "project_id": "vibework", "owner_lane": "vibework_product_ops", "telegram_destination": "blocked:vibework_route_not_implemented"},
        {"canonical_id": "database:2026fifa:timescaledb", "inventory_labels": ["current-fifa2026-postgres-1", "TimescaleDB current-fifa2026-postgres-1"], "source_rows": ["L028", "L043"], "runtime_identity": "host188/docker/current-fifa2026-postgres-1", "reconciliation_state": "duplicate_inventory_row_and_registry_gap", "findings": ["Same instance is counted once as PostgreSQL and again as TimescaleDB", "No exact restore drill is registered"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "database:k3s:postgres-recovery", "inventory_labels": ["k3s-postgres-recovery"], "source_rows": ["L029"], "runtime_identity": "host188/docker/k3s-postgres-recovery", "reconciliation_state": "recovery_asset_without_restore_receipt", "findings": ["Running recovery container is not proof of current K3s datastore recovery readiness"], "source_refs": ["docs/security/backup-restore-escrow-inventory.snapshot.json"], "product_id": "shared-infrastructure", "project_id": "k3s-control-plane"},
        {"canonical_id": "database:test:pgvector-b5-8801", "inventory_labels": ["pg-test-b5-8801-1"], "source_rows": ["L030"], "runtime_identity": "host188/docker/pg-test-b5-8801-1", "reconciliation_state": "stale_exited_candidate", "findings": ["Imported state says Exited", "No deletion is authorized; ownership and retention must be resolved first"], "source_refs": ["ops/config/service-registry.yaml"], "product_id": "unknown", "project_id": "unknown", "owner_lane": "asset_identity", "domain_router": "unknown", "executor": null, "verifier": "asset_identity_drift_verifier", "next_action": "Create deterministic drift work item; do not prune or restart until owner and data classification are proven."},
        {"canonical_id": "database:harbor:postgres", "inventory_labels": ["harbor-db"], "source_rows": ["L031"], "runtime_identity": "host110/docker/harbor-db", "reconciliation_state": "matched_runtime_unverified", "findings": ["Stateful BLOCK policy exists; health and backup freshness remain unverified"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-harbor.sh"], "project_id": "harbor", "owner_lane": "devops_team", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-harbor.sh", "freshness": "unverified"}},
        {"canonical_id": "database:langfuse:postgres", "inventory_labels": ["langfuse-db"], "source_rows": ["L032"], "runtime_identity": "host110/docker/langfuse-db", "reconciliation_state": "matched_runtime_unverified", "findings": ["Stateful BLOCK policy exists; LLM trace privacy and restore evidence remain unverified"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-langfuse.sh"], "project_id": "langfuse", "owner_lane": "ai_team", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-langfuse.sh", "freshness": "unverified"}},
        {"canonical_id": "database:agent-bounty:postgres", "inventory_labels": ["agent_bounty_db"], "source_rows": ["L033"], "runtime_identity": "host110/docker/agent_bounty_db", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["No exact backup/restore verifier is registered"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "agent-bounty-protocol", "project_id": "agent-bounty-protocol", "owner_lane": "agent_bounty_product_ops", "telegram_destination": "blocked:vibe_ai_agent_receipt_gap"},
        {"canonical_id": "database:stockplatform-v2:postgres", "inventory_labels": ["stockplatform-v2-postgres-1"], "source_rows": ["L034"], "runtime_identity": "host110/docker/stockplatform-v2-postgres-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product destination ownership and restore contract are unresolved"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "database:awooogo:postgres", "inventory_labels": ["awooo-go-db-1"], "source_rows": ["L035"], "runtime_identity": "host110/docker/awooo-go-db-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product Telegram egress is disabled and restore evidence is absent"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "awooogo", "project_id": "AwoooGo", "owner_lane": "awooogo_product_ops", "telegram_destination": "disabled:awooogo"},
        {"canonical_id": "database:bitan-pharmacy:restore", "inventory_labels": ["bitan-pg-restore"], "source_rows": ["L036"], "runtime_identity": "host110/docker/bitan-pg-restore", "reconciliation_state": "restore_marker_without_drill_receipt", "findings": ["Container name implies restore but no isolated drill receipt is linked"], "source_refs": ["docs/security/backup-restore-escrow-inventory.snapshot.json"], "product_id": "bitan-pharmacy", "project_id": "bitan-pharmacy", "owner_lane": "bitan_product_ops", "telegram_destination": "blocked:bitan_destination_unassigned"},
        {"canonical_id": "database:sentry:postgres", "inventory_labels": ["Sentry PG (內建)"], "source_rows": ["L037"], "runtime_identity": "host110/sentry-self-hosted/postgres", "reconciliation_state": "matched_runtime_unverified", "findings": ["Exact container identity is not present in the imported row"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-sentry.sh"], "project_id": "sentry", "owner_lane": "devops_team", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-sentry.sh", "freshness": "unverified"}},
        {"canonical_id": "database:signoz:clickhouse", "inventory_labels": ["signoz-clickhouse"], "source_rows": ["L042"], "runtime_identity": "unresolved:host110_or_host188/signoz-clickhouse", "reconciliation_state": "host_identity_conflict", "findings": ["Imported inventory places ClickHouse on host110 while monitoring registry places clickhouse on host188"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "scripts/backup/clickhouse-native-backup.sh"], "project_id": "signoz", "owner_lane": "observability_ops", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/clickhouse-native-restore-drill.sh", "freshness": "unverified"}, "next_action": "Resolve exact host/container identity before any DB executor or restore drill."}
      ]
    },
    {
      "group_id": "imported-cache-queue",
      "category": "cache_queue",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "cache-queue-estate",
        "site_id": "on-prem-lan",
        "owner_lane": "database_ops",
        "source_truth_state": "inventory_claim_and_partial_registry",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "database",
        "executor": "db_bounded_executor",
        "verifier": "db_independent_verifier",
        "monitoring": {"signals": ["readiness", "memory", "connections", "queue_depth", "persistence_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "stateful_cache_queue_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "gap:no_exact_persistence_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-007"],
        "next_action": "Verify exact instance identity and persistence mode before generating any bounded action."
      },
      "members": [
        {"canonical_id": "cache:awoooi:redis", "inventory_labels": ["redis-server (systemd)"], "source_rows": ["L052"], "runtime_identity": "host188/systemd/redis-server", "reconciliation_state": "service_type_conflict", "findings": ["Imported row says systemd while monitoring registry models redis as Docker on port 6380"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml"], "product_id": "awoooi", "project_id": "awoooi", "priority": "P0"},
        {"canonical_id": "cache:clawbot:redis", "inventory_labels": ["clawbot-redis"], "source_rows": ["L053"], "runtime_identity": "host188/docker/clawbot-redis", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Persistence and backup contract are not registered"], "source_refs": ["scripts/backup/backup-clawbot.sh"], "product_id": "clawbot-openclaw", "project_id": "clawbot", "owner_lane": "ai_agent_runtime", "telegram_destination": "blocked:clawbot_cross_product_route"},
        {"canonical_id": "cache:2026fifa:redis", "inventory_labels": ["current-fifa2026-redis-1"], "source_rows": ["L054"], "runtime_identity": "host188/docker/current-fifa2026-redis-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product cache has no canonical persistence/restore contract"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "cache:harbor:redis", "inventory_labels": ["harbor-redis"], "source_rows": ["L055"], "runtime_identity": "host110/docker/harbor-redis", "reconciliation_state": "matched_runtime_unverified", "findings": ["Critical HITL stateful policy exists; runtime health remains unverified"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-harbor.sh"], "project_id": "harbor", "owner_lane": "devops_team"},
        {"canonical_id": "cache:agent-bounty:redis", "inventory_labels": ["agent_bounty_redis"], "source_rows": ["L056"], "runtime_identity": "host110/docker/agent_bounty_redis", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product route receipt and persistence contract are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "agent-bounty-protocol", "project_id": "agent-bounty-protocol", "owner_lane": "agent_bounty_product_ops", "telegram_destination": "blocked:vibe_ai_agent_receipt_gap"},
        {"canonical_id": "cache:stockplatform-v2:redis", "inventory_labels": ["stockplatform-v2-redis-1"], "source_rows": ["L057"], "runtime_identity": "host110/docker/stockplatform-v2-redis-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product ownership and persistence contract are unresolved"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "cache:sentry:redis", "inventory_labels": ["Sentry Redis (內建)"], "source_rows": ["L058"], "runtime_identity": "host110/sentry-self-hosted/redis", "reconciliation_state": "matched_runtime_unverified", "findings": ["Exact container and queue health receipt are absent"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-sentry.sh"], "project_id": "sentry", "owner_lane": "devops_team"},
        {"canonical_id": "queue:signoz:zookeeper", "inventory_labels": ["signoz-zookeeper-1"], "source_rows": ["L063"], "runtime_identity": "host110/docker/signoz-zookeeper-1", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Host placement and dependent ClickHouse/Kafka topology are not reconciled"], "source_refs": ["ops/monitoring/service-registry.yaml", "scripts/backup/backup-signoz.sh"], "project_id": "signoz", "owner_lane": "observability_ops"}
      ]
    },
    {
      "group_id": "imported-observability",
      "category": "monitoring_observability",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "observability-platform",
        "site_id": "on-prem-and-k3s",
        "owner_lane": "observability_ops",
        "source_truth_state": "monitoring_registry_and_inventory_conflict",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["self_health", "pipeline_freshness", "target_coverage", "delivery_receipts"], "coverage": "partial"},
        "alerting": {"lifecycle": "observability_platform_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-monitoring.sh", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-002", "PORT-010"],
        "next_action": "Resolve exact deployment identity, verify generated target parity, and attach lifecycle receipts before claiming observability coverage."
      },
      "members": [
        {"canonical_id": "service:prometheus", "inventory_labels": ["Prometheus"], "source_rows": ["L071"], "runtime_identity": "host110/docker/prometheus", "source_truth_state": "source_reconciled_runtime_pending", "reconciliation_state": "source_identity_reconciled_runtime_pending", "findings": ["Monitoring registry now declares the exact host110 Docker identity", "Production container, generated target parity and scrape freshness remain unverified"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "k8s/monitoring/prometheus.yml", "scripts/ops/deploy-alertmanager-runtime-scrape.sh"], "priority": "P0", "verifier": "prometheus_runtime_target_and_rule_verifier"},
        {"canonical_id": "service:grafana", "inventory_labels": ["Grafana"], "source_rows": ["L072"], "runtime_identity": "host110/docker/grafana", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["Source policy exists but live dashboard/runtime parity is not proven"], "source_refs": ["ops/config/service-registry.yaml", "docs/security/monitoring-alerting-observability-inventory.snapshot.json"]},
        {"canonical_id": "service:alertmanager", "inventory_labels": ["Alertmanager"], "source_rows": ["L073"], "runtime_identity": "host110/docker/alertmanager", "source_truth_state": "source_reconciled_runtime_pending", "reconciliation_state": "source_control_path_reconciled_runtime_pending", "findings": ["Monitoring registry and typed router now declare the exact host110 Docker identity", "Production readback proves this Alertmanager exports notification counters with integration labels but no native receiver label", "The source contract has exactly one webhook receiver and Prometheus stamps receiver_contract=awoooi-webhook only on the two webhook counter families", "The corrected bounded dry-run passed promtool with no persistent write; apply and production same-run receipt remain pending"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "k8s/monitoring/alert-chain-monitor.yaml", "ops/alertmanager/alertmanager.yml", "infra/ansible/playbooks/110-alertmanager-delivery-recovery.yml", "scripts/ops/deploy-alertmanager-runtime-scrape.sh"], "priority": "P0", "verifier": "alertmanager_delivery_chain_independent_verifier", "next_action": "Deploy the production-schema-compatible scrape/rule and exact playbook, then correlate receiver contract, API ingest, Telegram receipt, retry/rollback and KM writeback under one run."},
        {"canonical_id": "service:signoz", "inventory_labels": ["SignOz"], "source_rows": ["L074"], "runtime_identity": "unresolved:host110-ui-host188-collector", "reconciliation_state": "split_plane_identity_conflict", "findings": ["Inventory collapses UI, collector, and storage into one host110 service while source registries split them across hosts"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "scripts/backup/backup-signoz.sh"]},
        {"canonical_id": "service:otel-collector:signoz", "inventory_labels": ["OTel Collector"], "source_rows": ["L075"], "runtime_identity": "unresolved:host110-or-host188/otel-collector", "reconciliation_state": "host_identity_conflict", "findings": ["Inventory says host110 while monitoring registry says host188 port 24317"], "source_refs": ["ops/monitoring/service-registry.yaml", "docs/security/monitoring-alerting-observability-inventory.snapshot.json"], "domain_router": "unknown", "executor": null, "verifier": "asset_identity_drift_verifier"},
        {"canonical_id": "service:blackbox-exporter", "inventory_labels": ["Blackbox Exporter"], "source_rows": ["L076"], "runtime_identity": "host110/docker/blackbox-exporter", "reconciliation_state": "matched_runtime_unverified", "findings": ["Generated target freshness and live probe results are not current truth"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/generated/blackbox-targets-generated.yaml"]},
        {"canonical_id": "service:node-exporter:host110", "inventory_labels": ["Node Exporter host110"], "source_rows": ["L077"], "runtime_identity": "host110/docker/node-exporter", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["No exact canonical service entry links this exporter to host110"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "service:node-exporter:host188", "inventory_labels": ["Node Exporter host188"], "source_rows": ["L078"], "runtime_identity": "host188/docker/node-exporter:9100", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["No exact canonical service entry links this exporter to host188"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "service:cadvisor:host110", "inventory_labels": ["cAdvisor"], "source_rows": ["L079"], "runtime_identity": "host110/docker/cadvisor", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["Image/version claim and scrape freshness need source and runtime receipts"], "source_refs": ["docs/security/monitoring-alerting-observability-inventory.snapshot.json"]},
        {"canonical_id": "service:redis-exporter:host188", "inventory_labels": ["Redis Exporter"], "source_rows": ["L080"], "runtime_identity": "host188/docker/redis-exporter:9121", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["Exporter target must be reconciled with the conflicting Redis systemd/Docker identity"], "source_refs": ["ops/monitoring/generated/prometheus-scrape-generated.yaml"]},
        {"canonical_id": "service:postgres-exporter:host188", "inventory_labels": ["Postgres Exporter"], "source_rows": ["L081"], "runtime_identity": "host188/docker/postgres-exporter:9187", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["One exporter does not prove coverage for every product database"], "source_refs": ["docs/security/monitoring-alerting-observability-inventory.snapshot.json"]},
        {"canonical_id": "service:nginx-exporter:host188", "inventory_labels": ["Nginx Exporter"], "source_rows": ["L082"], "runtime_identity": "host188/docker/nginx-exporter:9113", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["Target freshness and exact Nginx instance coverage are unverified"], "source_refs": ["ops/monitoring/generated/prometheus-scrape-generated.yaml"]},
        {"canonical_id": "service:gitea-exporter:host110", "inventory_labels": ["GitHub/Gitea Exporter"], "source_rows": ["L083"], "runtime_identity": "host110/docker/promhippie-github-exporter", "source_truth_state": "source_reconciled_runtime_pending", "reconciliation_state": "source_retirement_ready_runtime_pending", "findings": ["GitHub exporter and token references are removed from the source compose contract", "Prometheus contains a Gitea-native source candidate, but the exact production target is missing", "The legacy GitHub exporter remains visible in production and requires bounded removal plus independent readback", "Source retirement cannot be promoted to runtime closure until gitea-native freshness and legacy absence are both verified"], "source_refs": ["k8s/monitoring/docker-compose-110.yml", "k8s/monitoring/prometheus.yml", "scripts/generate_monitoring.py"], "priority": "P0", "monitoring": {"signals": ["gitea_native_target_up", "gitea_native_scrape_freshness", "legacy_github_exporter_absence"], "coverage": "source_candidate_runtime_target_missing"}, "next_action": "First make the exact gitea-native target observable; then use a bounded host110 compose apply to retire only the legacy exporter and independently verify target freshness plus absence of GitHub runtime traffic."},
        {"canonical_id": "k8s:kube-state-metrics", "inventory_labels": ["kube-state-metrics"], "source_rows": ["L084"], "runtime_identity": "k3s/kube-state-metrics/deployment", "reconciliation_state": "source_visible_runtime_unverified", "findings": ["K3s deployment is registered; live rollout and scrape freshness are unverified"], "source_refs": ["ops/monitoring/service-registry.yaml"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:node-problem-detector", "inventory_labels": ["Node Problem Detector"], "source_rows": ["L085"], "runtime_identity": "k3s/node-problem-detector", "reconciliation_state": "missing_from_monitoring_service_registry", "findings": ["Inventory claims running but no exact registry member is present"], "source_refs": ["k8s/monitoring"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:otel-daemonset", "inventory_labels": ["OTel DaemonSet"], "source_rows": ["L086"], "runtime_identity": "k3s/observability/otel-daemonset", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["Node coverage and telemetry delivery freshness need independent verification"], "source_refs": ["k8s/monitoring"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:event-exporter", "inventory_labels": ["Event Exporter"], "source_rows": ["L087"], "runtime_identity": "k3s/observability/event-exporter", "reconciliation_state": "source_visible_runtime_unverified", "findings": ["Registry entry exists; event-to-metric freshness is unverified"], "source_refs": ["ops/monitoring/service-registry.yaml"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "service:langfuse", "inventory_labels": ["Langfuse"], "source_rows": ["L088"], "runtime_identity": "host110/docker/langfuse", "reconciliation_state": "matched_runtime_unverified", "findings": ["Trace ingest, privacy boundary, and backup freshness are unverified"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "scripts/backup/backup-langfuse.sh"], "owner_lane": "ai_team", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-langfuse.sh", "freshness": "unverified"}}
      ]
    },
    {
      "group_id": "imported-error-tracking",
      "category": "error_tracking",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "sentry-self-hosted",
        "site_id": "host110",
        "owner_lane": "observability_ops",
        "source_truth_state": "partial_exact_container_registry",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["container_health", "ingestion", "queue_lag", "error_event_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "sentry_exact_container_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-sentry.sh", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-004"],
        "next_action": "Bind exact host110 container aliases to bounded PlayBooks and require independent queue/ingest verification."
      },
      "members": [
        {"canonical_id": "service:sentry:web", "inventory_labels": ["Sentry Self-Hosted"], "source_rows": ["L096"], "runtime_identity": "host110/sentry-self-hosted/web", "reconciliation_state": "matched_runtime_unverified", "findings": ["Exact-container recovery catalog exists but production runtime receipt is pending"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "service:sentry:relay", "inventory_labels": ["Sentry Relay"], "source_rows": ["L097"], "runtime_identity": "host110/sentry-self-hosted/relay", "reconciliation_state": "image_supply_chain_conflict", "findings": ["Imported image points to ghcr.io, which is forbidden by the GitHub freeze unless replaced by an internal immutable mirror"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json", "ops/config/service-registry.yaml"], "priority": "P0"},
        {"canonical_id": "service:sentry:snuba", "inventory_labels": ["Snuba"], "source_rows": ["L098"], "runtime_identity": "host110/sentry-self-hosted/snuba", "reconciliation_state": "image_supply_chain_and_exact_worker_gap", "findings": ["Imported image points to ghcr.io", "Only the profiling consumer has an exact recovery catalog; other workers need identity-only monitoring until registered"], "source_refs": ["ops/config/service-registry.yaml"], "priority": "P0"}
      ]
    },
    {
      "group_id": "imported-ai-runtime",
      "category": "ai_llm",
      "common": {
        "product_id": "awoooi",
        "project_id": "ai-control-plane",
        "site_id": "on-prem-lan",
        "owner_lane": "ai_team",
        "source_truth_state": "conflicts_with_approved_provider_route",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["health", "latency", "tokens", "cost", "route_state", "receipt_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "ai_provider_or_agent_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "readback_first", "target": "scripts/backup/backup-ai-artifacts.sh", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-003", "PORT-011"],
        "next_action": "Reconcile provider and agent identity before route evaluation; never treat a proxy host as the AI provider."
      },
      "members": [
        {"canonical_id": "service:ollama:host188", "inventory_labels": ["Ollama systemd host188"], "source_rows": ["L106"], "runtime_identity": "host188/systemd/ollama:11434", "reconciliation_state": "stale_provider_identity_conflict", "findings": ["Imported inventory identifies host188 Ollama, while the approved route uses host111 as the local hop", "No fallback is allowed to select another host/domain by generic target"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json"], "domain_router": "host_systemd", "executor": "host_ansible_executor", "verifier": "host111_ollama_route_identity_verifier", "next_action": "Create identity drift work; determine whether host188 Ollama is retired, non-routing, or a separately owned asset without changing the five-hop order."},
        {"canonical_id": "model:host188:nemotron-mini", "inventory_labels": ["nemotron-mini:latest"], "source_rows": ["L107"], "runtime_identity": "host188/ollama/model/nemotron-mini:latest", "reconciliation_state": "model_catalog_conflict", "findings": ["Imported model conflicts with monitoring registry local model list and approved provider identity", "Latest tag is mutable and not an immutable deployment identity"], "source_refs": ["ops/monitoring/service-registry.yaml"], "domain_router": "control_plane_service", "executor": "single_control_plane_executor", "verifier": "model_catalog_and_digest_verifier"},
        {"canonical_id": "service:open-webui", "inventory_labels": ["Open WebUI"], "source_rows": ["L108"], "runtime_identity": "host188/docker/open-webui:3010", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["UI availability does not prove Ollama route correctness"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml", "scripts/backup/backup-open-webui.sh"]},
        {"canonical_id": "service:openclaw", "inventory_labels": ["OpenClaw"], "source_rows": ["L109"], "runtime_identity": "host188/docker/openclaw:8089", "reconciliation_state": "port_and_service_identity_conflict", "findings": ["Ansible source maps openclaw to port 8088 while imported inventory says 8089", "No current durable agent decision receipt is implied by container health"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml", "ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "service:clawbot:v5", "inventory_labels": ["ClawBot v5", "clawbot"], "source_rows": ["L110", "L232"], "runtime_identity": "host188/docker/clawbot:8088", "reconciliation_state": "duplicate_inventory_row_and_route_drift", "findings": ["Same service appears in AI and application tables", "Telegram route is blocked by cross-product bot ownership drift"], "source_refs": ["scripts/backup/backup-clawbot.sh", "docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "clawbot-openclaw", "project_id": "clawbot", "owner_lane": "ai_agent_runtime", "telegram_destination": "blocked:clawbot_cross_product_route"}
      ]
    },
    {
      "group_id": "imported-workflow-automation",
      "category": "workflow_automation",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "workflow-automation",
        "site_id": "host188",
        "owner_lane": "automation_ops",
        "source_truth_state": "ansible_source_partial",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["health", "workflow_failures", "queue_depth", "delivery_receipts"], "coverage": "gap"},
        "alerting": {"lifecycle": "workflow_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "gap:no_n8n_restore_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-011"],
        "next_action": "Register n8n workflow inventory, owners, failure receipts, and exact-host restore verifier."
      },
      "members": [
        {"canonical_id": "service:n8n:host188", "inventory_labels": ["n8n"], "source_rows": ["L118"], "runtime_identity": "host188/docker/n8n:5678", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Ansible directory exists but workflow inventory, backup, and failure routing are absent"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml"]}
      ]
    },
    {
      "group_id": "imported-cicd-registry",
      "category": "container_registry_cicd",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "gitea-harbor-cd",
        "site_id": "on-prem-and-k3s",
        "owner_lane": "devops_team",
        "source_truth_state": "source_partial_runtime_unverified",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["health", "queue", "build", "deploy_marker", "artifact_digest", "runner_freshness"], "coverage": "partial"},
        "alerting": {"lifecycle": "gitea_cd_or_registry_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "service_specific_backup_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-004", "PORT-007"],
        "next_action": "Verify Gitea-only source control, internal artifact provenance, exact runner ownership, and backup/restore freshness."
      },
      "members": [
        {"canonical_id": "service:harbor", "inventory_labels": ["Harbor"], "source_rows": ["L126"], "runtime_identity": "host110/docker/harbor-core:5000", "reconciliation_state": "matched_runtime_unverified", "findings": ["Critical HITL policy exists; current health, immutable image, and backup receipts are unverified"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "scripts/backup/backup-harbor.sh"], "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-harbor.sh", "freshness": "unverified"}},
        {"canonical_id": "service:harbor:trivy", "inventory_labels": ["Trivy via Harbor"], "source_rows": ["L127"], "runtime_identity": "host110/docker/trivy-adapter", "reconciliation_state": "inventory_only_runtime_unverified", "findings": ["Scanner freshness and vulnerability database provenance are not linked"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"]},
        {"canonical_id": "service:docker-registry:backup", "inventory_labels": ["Docker Registry 備用"], "source_rows": ["L128"], "runtime_identity": "unresolved:host110-or-host188/docker-registry", "reconciliation_state": "host_identity_conflict", "findings": ["Imported row says host110 while host188 Ansible variables define docker_registry", "Backup registry promotion policy is not registered"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml"], "domain_router": "unknown", "executor": null, "verifier": "asset_identity_drift_verifier"},
        {"canonical_id": "service:gitea", "inventory_labels": ["Gitea"], "source_rows": ["L129"], "runtime_identity": "host110/docker/gitea:3001", "reconciliation_state": "matched_runtime_unverified", "findings": ["Gitea is the sole source-control authority; runtime and backup freshness need exact receipts", "The exact gitea-native Prometheus target is missing in production, so source configuration cannot prove metrics coverage", "The legacy GitHub exporter must remain a separate drift until bounded removal and absence verification"], "source_refs": ["ops/config/service-registry.yaml", "product.awoooi.yaml", "scripts/backup/backup-gitea.sh", "k8s/monitoring/prometheus.yml"], "monitoring": {"signals": ["gitea_native_target_up", "gitea_native_scrape_freshness", "legacy_exporter_absence"], "coverage": "runtime_target_missing"}, "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/gitea-full-backup-restore-drill.sh", "freshness": "unverified"}, "next_action": "Restore and verify the exact gitea-native metrics target before retiring the legacy exporter; keep both checks separate from Gitea application health."},
        {"canonical_id": "runner:gitea:vibework-host110", "inventory_labels": ["Act Runner VibeWork 110"], "source_rows": ["L130"], "runtime_identity": "host110/gitea-act-runner/vibework", "reconciliation_state": "paused_capacity_and_legacy_registry_gap", "findings": ["Imported state says paused", "Monitoring registry still describes a GitHub Actions runner instead of this Gitea runner"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "runner:gitea:vibework-deployer-host188", "inventory_labels": ["Act Runner VibeWork deployer"], "source_rows": ["L131"], "runtime_identity": "host188/gitea-act-runner/vibework-deployer", "reconciliation_state": "missing_from_monitoring_registry", "findings": ["Current health and single-writer/CD ownership are unverified"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "runner:gitea:vibework-dedicated-host188", "inventory_labels": ["Act Runner VibeWork dedicated"], "source_rows": ["L132"], "runtime_identity": "host188/gitea-act-runner/vibework-dedicated", "reconciliation_state": "missing_from_monitoring_registry", "findings": ["Exact labels, capacity, and production deploy scope are unverified"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "runner:gitea:stockplatform-host188", "inventory_labels": ["Act Runner StockPlatform"], "source_rows": ["L133"], "runtime_identity": "host188/gitea-act-runner/stockplatform", "reconciliation_state": "missing_from_monitoring_registry", "findings": ["Exact labels, capacity, and product ownership are unverified"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "k8s:argocd", "inventory_labels": ["ArgoCD", "K3s ArgoCD"], "source_rows": ["L134", "L251"], "runtime_identity": "k3s/argocd", "reconciliation_state": "source_visible_runtime_unverified", "findings": ["Multiple ArgoCD components are registered; live sync and rollout truth remain unverified"], "source_refs": ["ops/monitoring/service-registry.yaml", "docs/security/k8s-argocd-manifest-inventory.snapshot.json"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"}
      ]
    },
    {
      "group_id": "imported-storage-backup",
      "category": "storage_backup",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "backup-dr",
        "site_id": "on-prem-and-k3s",
        "owner_lane": "dr_ops",
        "source_truth_state": "source_policy_visible_runtime_unverified",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "backup_restore",
        "executor": "backup_restore_break_glass",
        "verifier": "backup_restore_readback_verifier",
        "monitoring": {"signals": ["freshness", "integrity", "offsite", "escrow", "restore_drill"], "coverage": "partial"},
        "alerting": {"lifecycle": "dr_readback_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "critical_read_only_default", "target": "backup_status_and_isolated_restore_drill", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-007"],
        "next_action": "Read backup status, offsite, escrow, and isolated restore receipts; do not run restore or write markers without break-glass."
      },
      "members": [
        {"canonical_id": "storage:minio:host188", "inventory_labels": ["MinIO"], "source_rows": ["L142"], "runtime_identity": "host188/docker/minio:9000", "reconciliation_state": "matched_runtime_unverified", "findings": ["MinIO service identity exists; backup object freshness, offsite, and escrow remain unverified"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "docs/security/backup-restore-escrow-inventory.snapshot.json"]},
        {"canonical_id": "k8s:velero", "inventory_labels": ["Velero", "K3s Velero"], "source_rows": ["L143", "L252"], "runtime_identity": "k3s/velero", "reconciliation_state": "source_visible_runtime_unverified", "findings": ["Deployment presence is not proof of backup freshness or restore success"], "source_refs": ["ops/monitoring/service-registry.yaml", "docs/security/backup-restore-escrow-inventory.snapshot.json"], "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "velero_readback_and_rollout_verifier"}
      ]
    },
    {
      "group_id": "imported-gateways",
      "category": "gateway_proxy",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "network-gateway",
        "site_id": "on-prem-lan",
        "owner_lane": "network_ops",
        "source_truth_state": "inventory_and_ansible_partial",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["health", "tls", "route", "upstream", "latency"], "coverage": "partial"},
        "alerting": {"lifecycle": "gateway_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "readback_first", "target": "scripts/backup/backup-configs.sh", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-009"],
        "next_action": "Resolve exact gateway identity and run route/TLS/upstream readback before bounded reload or restart."
      },
      "members": [
        {"canonical_id": "service:nginx:host188", "inventory_labels": ["Nginx systemd"], "source_rows": ["L151"], "runtime_identity": "host188/systemd/nginx:80,443", "reconciliation_state": "source_visible_runtime_unverified", "findings": ["Imported purpose mentions multiple products but exact route ownership is not reconciled"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml", "scripts/backup/backup-public-routes.sh"], "domain_router": "host_systemd", "executor": "host_ansible_executor", "verifier": "host_route_tls_independent_verifier"},
        {"canonical_id": "service:harbor:nginx", "inventory_labels": ["Nginx Harbor"], "source_rows": ["L152"], "runtime_identity": "host110/docker/harbor-nginx:5000", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["Exact container health and upstream route receipt are absent"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-harbor.sh"], "project_id": "harbor"},
        {"canonical_id": "service:sentry:nginx", "inventory_labels": ["Nginx Sentry"], "source_rows": ["L153"], "runtime_identity": "host110/sentry-self-hosted/nginx:9000", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["Exact container health and Sentry upstream receipt are absent"], "source_refs": ["ops/config/service-registry.yaml", "scripts/backup/backup-sentry.sh"], "project_id": "sentry"},
        {"canonical_id": "service:stockplatform-v2:nginx", "inventory_labels": ["Nginx stockplatform-v2"], "source_rows": ["L154"], "runtime_identity": "host110/docker/stockplatform-v2-nginx:31235", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product route ownership and alert destination are unresolved"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "service:bitan:nginx", "inventory_labels": ["Nginx Bitan"], "source_rows": ["L155"], "runtime_identity": "host110/docker/bitan-nginx", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Product gateway has no canonical Telegram route or backup verifier"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "bitan-pharmacy", "project_id": "bitan-pharmacy", "owner_lane": "bitan_product_ops", "telegram_destination": "blocked:bitan_destination_unassigned"},
        {"canonical_id": "service:bitan:postgrest", "inventory_labels": ["PostgREST"], "source_rows": ["L156"], "runtime_identity": "host110/docker/bitan-postgrest:3000", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Database API must use Bitan-specific policy and DB verifier; generic container restart is insufficient"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "bitan-pharmacy", "project_id": "bitan-pharmacy", "owner_lane": "bitan_product_ops", "telegram_destination": "blocked:bitan_destination_unassigned"},
        {"canonical_id": "network:keepalived:vip-unresolved", "inventory_labels": ["Keepalived"], "source_rows": ["L157"], "runtime_identity": "unresolved:vip-192.168.0.125-or-192.168.0.200", "reconciliation_state": "critical_vip_identity_conflict", "findings": ["Imported inventory claims VIP 192.168.0.125 on host188 plus K3s", "Ansible host110/host188 vars claim VIP 192.168.0.200", "No network cutover is authorized"], "source_refs": ["infra/ansible/inventory/group_vars/host_110.yml", "infra/ansible/inventory/group_vars/host_188.yml"], "priority": "P0", "domain_router": "unknown", "executor": null, "verifier": "vip_identity_drift_verifier", "next_action": "Create fail-closed drift item and reconcile live VIP ownership read-only before any keepalived action."}
      ]
    },
    {
      "group_id": "imported-security",
      "category": "security",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "security-platform",
        "site_id": "on-prem-lan",
        "owner_lane": "security_ops",
        "source_truth_state": "source_registry_partial",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "host_systemd",
        "executor": "host_ansible_executor",
        "verifier": "host_runtime_independent_verifier",
        "monitoring": {"signals": ["service_health", "agent_freshness", "security_events", "scan_receipts"], "coverage": "partial"},
        "alerting": {"lifecycle": "security_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_security_incident_lifecycle",
        "backup_restore": {"mode": "critical_read_only_default", "target": "security_config_and_evidence_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-005"],
        "next_action": "Run bounded no-secret posture readback and attach exact-host verifier receipts; active scans remain break-glass."
      },
      "members": [
        {"canonical_id": "service:wazuh-manager", "inventory_labels": ["Wazuh Manager"], "source_rows": ["L168"], "runtime_identity": "host112/systemd/wazuh-manager", "reconciliation_state": "bounded_source_ready_runtime_unverified", "findings": ["Imported Active 22h and memory labels remain unverified point-in-time claims", "Exact no-write posture catalog exists; active response and arbitrary mutation remain unavailable"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml"], "verifier": "iwooos_wazuh_controlled_executor_runtime"},
        {"canonical_id": "service:wazuh-indexer:host112", "inventory_labels": ["Wazuh Indexer"], "source_rows": ["L169"], "runtime_identity": "host112/systemd/wazuh-indexer:9200,9300", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Indexer state, disk, shard health, and backup/restore verifier are not registered", "OpenSearch-compatible data mutation remains database-bounded"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "domain_router": "database", "executor": "db_bounded_executor", "verifier": "wazuh_indexer_independent_verifier"},
        {"canonical_id": "service:wazuh-dashboard:host112", "inventory_labels": ["Wazuh Dashboard"], "source_rows": ["L170"], "runtime_identity": "host112/systemd/wazuh-dashboard:443", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["TLS, auth-safe UI health, and upstream Indexer/Manager receipts are not registered"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "wazuh_dashboard_independent_verifier"},
        {"canonical_id": "service:wazuh-agent:host188", "inventory_labels": ["Wazuh Agent host188"], "source_rows": ["L171"], "runtime_identity": "host188/systemd/wazuh-agent", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Agent-manager connectivity and event freshness are not registered"], "source_refs": ["infra/ansible/inventory/hosts.yml"]},
        {"canonical_id": "service:kali-scanner:host112", "inventory_labels": ["kali-scanner.service"], "source_rows": ["L176"], "runtime_identity": "host112/systemd/kali-scanner:8080", "reconciliation_state": "source_partial_runtime_unverified", "findings": ["Only TCP blackbox is registered", "Active or credentialed scans remain critical break-glass"], "source_refs": ["ops/monitoring/service-registry.yaml"]},
        {"canonical_id": "service:awoooi-guardian:host112", "inventory_labels": ["awoooi-guardian.service"], "source_rows": ["L177"], "runtime_identity": "host112/systemd/awoooi-guardian", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Multi-host monitoring scope, action boundary, and independent verifier are not registered"], "source_refs": ["ops/monitoring/alerts-unified.yml"]},
        {"canonical_id": "service:filebeat:host112", "inventory_labels": ["filebeat.service"], "source_rows": ["L178"], "runtime_identity": "host112/systemd/filebeat", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Log delivery freshness and Wazuh Indexer backpressure receipts are missing"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "filebeat_delivery_independent_verifier"},
        {"canonical_id": "service:wg-easy:host112", "inventory_labels": ["wg-easy"], "source_rows": ["L183"], "runtime_identity": "host112/docker/wg-easy:51820,51821", "reconciliation_state": "github_freeze_and_network_boundary_conflict", "findings": ["Imported image points to ghcr.io and conflicts with the GitHub freeze", "VPN/firewall cutover is critical break-glass", "Web UI exposure and route ownership are unverified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "domain_router": "docker_container", "executor": "host_ansible_executor_with_exact_container_playbook", "verifier": "wireguard_route_and_container_independent_verifier"},
        {"canonical_id": "service:node-exporter:host112", "inventory_labels": ["node-exporter host112"], "source_rows": ["L184"], "runtime_identity": "host112/docker/node-exporter:9100", "reconciliation_state": "missing_from_monitoring_service_registry", "findings": ["Current scrape freshness and exact image provenance are not registered"], "source_refs": ["ops/monitoring/generated/prometheus-scrape-generated.yaml"], "domain_router": "docker_container", "executor": "host_ansible_executor_with_exact_container_playbook", "verifier": "node_exporter_scrape_independent_verifier"},
        {"canonical_id": "package:wazuh-suite:host112:4.9.2", "inventory_labels": ["Wazuh Manager/Indexer/Dashboard 4.9.2"], "source_rows": ["L189"], "runtime_identity": "host112/packages/wazuh-suite:4.9.2", "reconciliation_state": "package_version_claim_runtime_unverified", "findings": ["Composite package row duplicates three runtime services", "Upgrade and rollback require component-specific replay and canary"], "source_refs": ["ops/config/service-registry.yaml"], "verifier": "host_package_version_independent_verifier"},
        {"canonical_id": "package:nmap-zenmap:host112", "inventory_labels": ["nmap / zenmap"], "source_rows": ["L190"], "runtime_identity": "host112/packages/nmap-zenmap", "reconciliation_state": "security_tool_inventory_only", "findings": ["Installed tool is not authorization for active scanning", "Version pair requires immutable package provenance"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_inventory_verifier"},
        {"canonical_id": "package:metasploit:host112", "inventory_labels": ["Metasploit Framework"], "source_rows": ["L191"], "runtime_identity": "host112/packages/metasploit", "reconciliation_state": "critical_security_tool_inventory_only", "findings": ["Credentialed exploit activity is critical break-glass", "Installed version and package provenance are unverified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_inventory_verifier"},
        {"canonical_id": "package:burp-suite:host112", "inventory_labels": ["Burp Suite"], "source_rows": ["L192"], "runtime_identity": "host112/packages/burp-suite", "reconciliation_state": "critical_security_tool_inventory_only", "findings": ["Active web scanning is critical break-glass", "Edition, license, and package provenance are unverified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_inventory_verifier"},
        {"canonical_id": "package:sqlmap:host112", "inventory_labels": ["sqlmap"], "source_rows": ["L193"], "runtime_identity": "host112/packages/sqlmap", "reconciliation_state": "critical_security_tool_inventory_only", "findings": ["SQL injection scanning is critical break-glass", "Installed version and package provenance are unverified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_inventory_verifier"},
        {"canonical_id": "package:nikto:host112", "inventory_labels": ["nikto"], "source_rows": ["L194"], "runtime_identity": "host112/packages/nikto", "reconciliation_state": "critical_security_tool_inventory_only", "findings": ["Active web scanning is critical break-glass", "Installed version and package provenance are unverified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_inventory_verifier"},
        {"canonical_id": "package:openvas:host112", "inventory_labels": ["OpenVAS / ospd-openvas"], "source_rows": ["L195"], "runtime_identity": "host112/packages/openvas-ospd", "reconciliation_state": "critical_security_tool_inventory_only", "findings": ["Active vulnerability scanning is critical break-glass", "Feed freshness and daemon state are not registered"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "security_tool_and_feed_independent_verifier"},
        {"canonical_id": "package:python-elasticsearch:host112", "inventory_labels": ["python3-elasticsearch"], "source_rows": ["L196"], "runtime_identity": "host112/packages/python3-elasticsearch", "reconciliation_state": "package_inventory_only", "findings": ["Client compatibility with Wazuh Indexer 4.9.2 is not verified"], "source_refs": ["docs/evaluations/package_supply_chain_inventory_2026-06-04.json"], "verifier": "host_package_version_independent_verifier"},
        {"canonical_id": "service:haveged:host112", "inventory_labels": ["haveged"], "source_rows": ["L197"], "runtime_identity": "host112/systemd/haveged", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["Entropy service health and dependency need are unverified"], "source_refs": ["infra/ansible/inventory/hosts.yml"]},
        {"canonical_id": "service:lightdm:host112", "inventory_labels": ["LightDM"], "source_rows": ["L198"], "runtime_identity": "host112/systemd/lightdm", "reconciliation_state": "missing_from_canonical_service_registry", "findings": ["GUI display-manager health is not a Wazuh completion receipt", "Recovery must remain exact-host and independently verified"], "source_refs": ["docs/operations/host112-guest-recovery-20260711.snapshot.json"]},
        {"canonical_id": "schedule:host112:wazuh-guardian-hourly", "inventory_labels": ["每小時整點 host112 security schedule"], "source_rows": ["L203"], "runtime_identity": "host112/crontab/hourly-security-monitor", "reconciliation_state": "schedule_command_and_receipt_unregistered", "findings": ["Schedule label alone does not identify exact command, owner, idempotency, or output receipt"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "host_schedule_freshness_independent_verifier"},
        {"canonical_id": "schedule:host112:daily-0800", "inventory_labels": ["每日 08:00 host112 security schedule"], "source_rows": ["L204"], "runtime_identity": "host112/crontab/daily-0800", "reconciliation_state": "schedule_command_and_receipt_unregistered", "findings": ["Exact command, owner, risk, and delivery receipt are absent"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "host_schedule_freshness_independent_verifier"},
        {"canonical_id": "schedule:host112:weekly-sunday-0900", "inventory_labels": ["每週日 09:00 host112 security schedule"], "source_rows": ["L205"], "runtime_identity": "host112/crontab/weekly-sunday-0900", "reconciliation_state": "schedule_command_and_receipt_unregistered", "findings": ["Exact command, active-scan boundary, and result receipt are absent"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "host_schedule_freshness_independent_verifier"},
        {"canonical_id": "schedule:host112:daily-0200", "inventory_labels": ["每日 02:00 host112 security schedule"], "source_rows": ["L206"], "runtime_identity": "host112/crontab/daily-0200", "reconciliation_state": "schedule_command_and_receipt_unregistered", "findings": ["Exact command, backup/log retention boundary, and result receipt are absent"], "source_refs": ["ops/monitoring/alerts-unified.yml"], "verifier": "host_schedule_freshness_independent_verifier"},
        {"canonical_id": "service:fail2ban:host188", "inventory_labels": ["Fail2Ban historical inventory row"], "source_rows": [], "historical_source_rows": ["inventory-2e8580c-20260716:L167"], "runtime_identity": "host188/systemd/fail2ban", "reconciliation_state": "missing_from_imported_inventory", "findings": ["Asset was present in the 241-line inventory but disappeared from active c214160 without a retirement receipt", "Ban policy, rollback, and independent verifier remain unregistered"], "source_refs": ["infra/ansible/inventory/hosts.yml"], "next_action": "Create removal drift work; verify whether Fail2Ban is retired or omitted without restarting or changing bans."}
      ]
    },
    {
      "group_id": "imported-product-applications",
      "category": "application_service",
      "common": {
        "product_id": "unknown",
        "project_id": "unknown",
        "site_id": "on-prem-lan",
        "owner_lane": "asset_identity",
        "source_truth_state": "imported_runtime_claim_without_product_manifest",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "docker_container",
        "executor": "host_ansible_executor_with_exact_container_playbook",
        "verifier": "container_runtime_independent_verifier",
        "monitoring": {"signals": ["health", "latency", "errors", "data_freshness", "worker_lag"], "coverage": "gap"},
        "alerting": {"lifecycle": "product_specific_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "blocked:canonical_product_route_required",
        "backup_restore": {"mode": "critical_read_only_default", "target": "gap:product_backup_restore_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-006", "PORT-007", "PORT-008"],
        "next_action": "Adopt a product manifest, exact container registry, product-only Telegram route, backup contract, and same-run verifier before controlled apply."
      },
      "members": [
        {"canonical_id": "service:momo-pro:web", "inventory_labels": ["momo-pro-system"], "source_rows": ["L218"], "runtime_identity": "host188/docker/momo-pro-system:5003", "reconciliation_state": "product_manifest_and_registry_gap", "findings": ["Imported health is unverified; product destination returns chat_not_found"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json", "scripts/backup/backup-momo.sh"], "product_id": "momo-pro", "project_id": "momo-pro-system", "owner_lane": "momo_product_ops", "telegram_destination": "blocked:momo_configured_chat_unresolved", "backup_restore": {"mode": "critical_read_only_default", "target": "scripts/backup/backup-momo.sh", "freshness": "unverified"}},
        {"canonical_id": "service:momo-pro:scheduler", "inventory_labels": ["momo-scheduler"], "source_rows": ["L219"], "runtime_identity": "host188/docker/momo-scheduler", "reconciliation_state": "product_manifest_and_registry_gap", "findings": ["Scheduler freshness and idempotent replay contract are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "momo-pro", "project_id": "momo-pro-system", "owner_lane": "momo_product_ops", "telegram_destination": "blocked:momo_configured_chat_unresolved"},
        {"canonical_id": "service:momo-pro:telegram-bot", "inventory_labels": ["momo-telegram-bot"], "source_rows": ["L220"], "runtime_identity": "host188/docker/momo-telegram-bot", "reconciliation_state": "destination_unreachable", "findings": ["Configured destination returns chat_not_found; sending remains blocked"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "momo-pro", "project_id": "momo-pro-system", "owner_lane": "momo_product_ops", "telegram_destination": "blocked:momo_configured_chat_unresolved"},
        {"canonical_id": "service:vibework:web", "inventory_labels": ["vibework-production-web-1"], "source_rows": ["L221"], "runtime_identity": "host188/docker/vibework-production-web-1:32336", "reconciliation_state": "product_manifest_and_route_gap", "findings": ["Standalone VibeWork Telegram route is not implemented"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "vibework", "project_id": "vibework", "owner_lane": "vibework_product_ops", "telegram_destination": "blocked:vibework_route_not_implemented"},
        {"canonical_id": "service:vibework:notification-worker", "inventory_labels": ["vibework-production-notification-worker-1"], "source_rows": ["L222"], "runtime_identity": "host188/docker/vibework-production-notification-worker-1", "reconciliation_state": "product_manifest_and_receipt_gap", "findings": ["Notification durability and delivery receipts are unverified"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "vibework", "project_id": "vibework", "owner_lane": "vibework_product_ops", "telegram_destination": "blocked:vibework_route_not_implemented"},
        {"canonical_id": "site:tsenyang-website", "inventory_labels": ["tsenyang-website"], "source_rows": ["L223"], "runtime_identity": "host188/docker/tsenyang-website:3000", "reconciliation_state": "route_ownership_conflict", "findings": ["Telegram private route is shared with StockPlatform and ownership is unresolved"], "source_refs": ["infra/ansible/inventory/group_vars/host_188.yml", "docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "tsenyang-website", "project_id": "tsenyang-website", "owner_lane": "tsenyang_site_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "service:2026fifa:web", "inventory_labels": ["current-fifa2026-web-1"], "source_rows": ["L224"], "runtime_identity": "host188/docker/current-fifa2026-web-1:3108", "reconciliation_state": "product_manifest_and_route_gap", "findings": ["Canonical product destination and durable receipt backend are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:backend", "inventory_labels": ["current-fifa2026-backend-1"], "source_rows": ["L225"], "runtime_identity": "host188/docker/current-fifa2026-backend-1:8000", "reconciliation_state": "product_manifest_and_route_gap", "findings": ["API SLO and backup contract are not registered in this repo"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:odds-worker", "inventory_labels": ["current-fifa2026-odds-worker-1"], "source_rows": ["L226"], "runtime_identity": "host188/docker/current-fifa2026-odds-worker-1", "reconciliation_state": "freshness_and_route_gap", "findings": ["Odds source freshness, provider ownership, and replay verifier are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:fixtures-worker", "inventory_labels": ["current-fifa2026-fixtures-worker-1"], "source_rows": ["L227"], "runtime_identity": "host188/docker/current-fifa2026-fixtures-worker-1", "reconciliation_state": "freshness_and_route_gap", "findings": ["Fixture source freshness and replay verifier are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:calendar-cache-worker", "inventory_labels": ["current-fifa2026-calendar-cache-worker-1"], "source_rows": ["L228"], "runtime_identity": "host188/docker/current-fifa2026-calendar-cache-worker-1", "reconciliation_state": "freshness_and_route_gap", "findings": ["Cache freshness and rebuild verifier are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:agent-review-worker", "inventory_labels": ["current-fifa2026-agent-review-worker-1"], "source_rows": ["L229"], "runtime_identity": "host188/docker/current-fifa2026-agent-review-worker-1", "reconciliation_state": "ai_review_receipt_gap", "findings": ["AI reviewer model, decision receipt, and cost attribution are not registered"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:news-worker", "inventory_labels": ["current-fifa2026-news-worker-1"], "source_rows": ["L230"], "runtime_identity": "host188/docker/current-fifa2026-news-worker-1", "reconciliation_state": "source_freshness_and_route_gap", "findings": ["News source provenance/freshness and replay verifier are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:2026fifa:alerts", "inventory_labels": ["current-fifa2026-alerts-1"], "source_rows": ["L231"], "runtime_identity": "host188/docker/current-fifa2026-alerts-1", "reconciliation_state": "alert_destination_and_receipt_gap", "findings": ["Product alert service has no canonical destination or durable delivery receipt"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "2026fifa", "project_id": "2026FIFAWorldCup", "owner_lane": "2026fifa_product_ops", "telegram_destination": "blocked:2026fifa_destination_unassigned"},
        {"canonical_id": "service:agent-bounty:web", "inventory_labels": ["agent_bounty_web"], "source_rows": ["L233"], "runtime_identity": "host110/docker/agent_bounty_web:3005", "reconciliation_state": "durable_route_receipt_gap", "findings": ["Bot-to-group route is source-proven but durable delivery receipt is missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "agent-bounty-protocol", "project_id": "agent-bounty-protocol", "owner_lane": "agent_bounty_product_ops", "telegram_destination": "blocked:vibe_ai_agent_receipt_gap"},
        {"canonical_id": "service:awooogo:web", "inventory_labels": ["awooo-go-web-1"], "source_rows": ["L234"], "runtime_identity": "host110/docker/awooo-go-web-1:32190", "reconciliation_state": "telegram_disabled_and_manifest_gap", "findings": ["Product Telegram egress is intentionally disabled"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "awooogo", "project_id": "AwoooGo", "owner_lane": "awooogo_product_ops", "telegram_destination": "disabled:awooogo"},
        {"canonical_id": "service:awooogo:api", "inventory_labels": ["awooo-go-api-1"], "source_rows": ["L235"], "runtime_identity": "host110/docker/awooo-go-api-1", "reconciliation_state": "telegram_disabled_and_manifest_gap", "findings": ["Product API monitoring and backup contract are not registered here"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "awooogo", "project_id": "AwoooGo", "owner_lane": "awooogo_product_ops", "telegram_destination": "disabled:awooogo"},
        {"canonical_id": "service:awooogo:security-agent", "inventory_labels": ["awooo-go-security-agent-1"], "source_rows": ["L236"], "runtime_identity": "host110/docker/awooo-go-security-agent-1", "reconciliation_state": "security_agent_contract_gap", "findings": ["Exact authority, active-response boundary, and verifier are not registered"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "awooogo", "project_id": "AwoooGo", "owner_lane": "awooogo_product_ops", "telegram_destination": "disabled:awooogo", "priority": "P0"},
        {"canonical_id": "service:bitan-pharmacy:postgrest", "inventory_labels": ["bitan-pharmacy-postgrest"], "source_rows": ["L237"], "runtime_identity": "host110/docker/bitan-pharmacy-postgrest", "reconciliation_state": "product_route_and_db_verifier_gap", "findings": ["Canonical product destination and bounded DB/API verifier are missing"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "bitan-pharmacy", "project_id": "bitan-pharmacy", "owner_lane": "bitan_product_ops", "telegram_destination": "blocked:bitan_destination_unassigned"},
        {"canonical_id": "service:open-design", "inventory_labels": ["open-design"], "source_rows": ["L238"], "runtime_identity": "host110/docker/open-design", "reconciliation_state": "asset_identity_unresolved", "findings": ["Product owner, source repository, monitoring, alert route, and backup contract are absent"], "source_refs": ["ops/config/service-registry.yaml"], "domain_router": "unknown", "executor": null, "verifier": "asset_identity_drift_verifier", "next_action": "Create deterministic drift work item; prohibit fallback AUTO until product ownership and source truth are registered."},
        {"canonical_id": "service:stockplatform-v2:web", "inventory_labels": ["stockplatform-v2-web-1"], "source_rows": ["L239"], "runtime_identity": "host110/docker/stockplatform-v2-web-1:3000", "reconciliation_state": "route_ownership_and_manifest_gap", "findings": ["Telegram private route ownership conflicts with TSENYANG Website"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "service:stockplatform-v2:admin", "inventory_labels": ["stockplatform-v2-admin-1"], "source_rows": ["L240"], "runtime_identity": "host110/docker/stockplatform-v2-admin-1:3001", "reconciliation_state": "admin_surface_and_route_gap", "findings": ["Admin auth, smoke, and alert ownership are not linked to a product manifest"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"},
        {"canonical_id": "service:stockplatform-v2:api", "inventory_labels": ["stockplatform-v2-api-1"], "source_rows": ["L241"], "runtime_identity": "host110/docker/stockplatform-v2-api-1:8000", "reconciliation_state": "api_data_and_route_gap", "findings": ["Market-data freshness, API SLO, and product alert ownership are not registered here"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "product_id": "stockplatform-v2", "project_id": "stockPlatform", "owner_lane": "stockplatform_product_ops", "telegram_destination": "blocked:stockplatform_tsenyang_ownership_drift"}
      ]
    },
    {
      "group_id": "imported-k3s-controls",
      "category": "k3s_component",
      "common": {
        "product_id": "shared-infrastructure",
        "project_id": "k3s-control-plane",
        "site_id": "k3s",
        "owner_lane": "k3s_ops",
        "source_truth_state": "inventory_claim_manifest_lookup_required",
        "live_truth_state": "not_probed_this_reconciliation",
        "domain_router": "kubernetes_workload",
        "executor": "kubernetes_controlled_executor",
        "verifier": "kubernetes_rollout_verifier",
        "monitoring": {"signals": ["rollout", "readiness", "events", "policy_drift"], "coverage": "partial"},
        "alerting": {"lifecycle": "k3s_component_incident", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "readback_first", "target": "k3s_manifest_and_velero_contract", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P1",
        "dependencies": ["PORT-001", "PORT-005", "PORT-010"],
        "next_action": "Resolve exact namespace/kind/name and verify rollout/policy state before Kubernetes controlled apply."
      },
      "members": [
        {"canonical_id": "k8s:kured", "inventory_labels": ["Kured"], "source_rows": ["L253"], "runtime_identity": "k3s/kured", "reconciliation_state": "critical_reboot_boundary_gap", "findings": ["Host reboot is critical break-glass; inventory presence cannot authorize Kured actions"], "source_refs": ["k8s"], "priority": "P0"},
        {"canonical_id": "k8s:descheduler", "inventory_labels": ["Descheduler"], "source_rows": ["L254"], "runtime_identity": "k3s/descheduler", "reconciliation_state": "manifest_and_runtime_verifier_gap", "findings": ["Rescheduling blast radius and post-verifier are not linked"], "source_refs": ["k8s"]},
        {"canonical_id": "k8s:vpa", "inventory_labels": ["VPA"], "source_rows": ["L255"], "runtime_identity": "k3s/vpa", "reconciliation_state": "recommendation_mode_unverified", "findings": ["Imported row says recommendation mode but live mode and recommendation freshness are unverified"], "source_refs": ["k8s"]},
        {"canonical_id": "k8s:hpa", "inventory_labels": ["HPA"], "source_rows": ["L256"], "runtime_identity": "k3s/hpa", "reconciliation_state": "policy_coverage_unverified", "findings": ["Target workload coverage and scaling verifier are not enumerated"], "source_refs": ["k8s"]},
        {"canonical_id": "k8s:pdb", "inventory_labels": ["PDB"], "source_rows": ["L257"], "runtime_identity": "k3s/pdb", "reconciliation_state": "policy_coverage_unverified", "findings": ["Protected workload coverage and disruption allowance are not enumerated"], "source_refs": ["k8s"]},
        {"canonical_id": "k8s:network-policy", "inventory_labels": ["NetworkPolicy"], "source_rows": ["L258"], "runtime_identity": "k3s/networkpolicy", "reconciliation_state": "policy_coverage_unverified", "findings": ["Presence does not prove every workload/provider path is allowed or isolated"], "source_refs": ["k8s/awoooi-prod/02-network-policy.yaml"]},
        {"canonical_id": "k8s:rbac", "inventory_labels": ["RBAC"], "source_rows": ["L259"], "runtime_identity": "k3s/rbac", "reconciliation_state": "policy_coverage_unverified", "findings": ["Presence does not prove least privilege or executor identity"], "source_refs": ["k8s"]}
      ]
    },
    {
      "group_id": "missing-control-plane-and-runtime-assets",
      "category": "inventory_omission",
      "common": {
        "product_id": "awoooi",
        "project_id": "ai-control-plane",
        "site_id": "production",
        "owner_lane": "AIControlPlane",
        "source_truth_state": "source_visible_missing_from_imported_inventory",
        "live_truth_state": "not_probed_this_reconciliation",
        "reconciliation_state": "missing_from_imported_inventory",
        "domain_router": "control_plane_service",
        "executor": "single_control_plane_executor",
        "verifier": "control_plane_independent_verifier",
        "monitoring": {"signals": ["health", "freshness", "same_run_receipt", "coverage"], "coverage": "inventory_gap"},
        "alerting": {"lifecycle": "canonical_incident_only", "cross_domain_fallback_allowed": false, "required_ai_attribution": true},
        "telegram_destination": "awoooi_sre_war_room_for_shared_P0_P1_lifecycle_only",
        "backup_restore": {"mode": "readback_first", "target": "component_specific_contract_required", "freshness": "unverified"},
        "learning_targets": ["KM", "RAG", "MCP", "PlayBook"],
        "priority": "P0",
        "dependencies": ["PORT-001", "PORT-005", "PORT-011"],
        "next_action": "Add the canonical asset to the reconciled source registry and require same-run production readback."
      },
      "members": [
        {"canonical_id": "windows-vmware:host_99", "inventory_labels": ["Agent99 Windows/VMware control plane"], "source_rows": [], "runtime_identity": "192.168.0.99/Agent99", "findings": ["Agent99 is required for Windows/VMware and control-plane recovery but absent from the imported inventory", "Agent99 also owns the read-only host110 Alertmanager poll/reduced relay coordination role; Linux remediation still routes only to the host Ansible executor", "The atomic 15-file runtime bundle includes the poller but production deployment/readback is pending"], "source_refs": ["docs/operations/agent99-enterprise-ai-automation-work-items.snapshot.json", "k8s/awoooi-prod/04-configmap.yaml", "agent99-alertmanager-alertchain-poll.ps1", "scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh"], "owner_lane": "Agent99", "domain_router": "windows_vmware", "executor": "Agent99", "verifier": "agent99_independent_runtime_verifier"},
        {"canonical_id": "service:ollama:host110", "inventory_labels": ["retired Host110 Ollama tombstone"], "source_rows": [], "runtime_identity": "retired-tombstone:host110/ollama/no-endpoint", "source_truth_state": "retired_tombstone_runtime_absence_verified", "reconciliation_state": "retired_tombstone_runtime_absence_verified", "findings": ["Host110 Ollama is forbidden as a provider, proxy, primary, secondary or failover target", "A tombstone is retained so stale sensors and routes create drift instead of resurrecting the endpoint", "AIA-SRE-002 run-aia-sre-002-20260716-1752 removed the exact stale Nginx 11435 proxy with a root-only rollback backup", "Independent post-verifier proved listeners 11435/11434=0, Ollama containers and systemd units=0, stale config paths=0, Nginx active/config valid and Prometheus host110 Ollama targets=0"], "source_refs": ["ops/config/service-registry.yaml", "ops/monitoring/service-registry.yaml", "docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json", "scripts/ops/retire-host110-ollama-proxy.sh"], "owner_lane": "ai_team", "domain_router": "host_systemd", "executor": "host_ansible_executor", "bounded_executor_receipt": "run-aia-sre-002-20260716-1752", "runtime_closure": {"status": "verified_absent", "trace_id": "trace-aia-sre-002-20260716-1752", "run_id": "run-aia-sre-002-20260716-1752", "work_item_id": "AIA-SRE-002", "post_verifier": "host110_ollama_runtime_and_monitoring_absence_verifier"}, "verifier": "host110_ollama_runtime_and_monitoring_absence_verifier", "monitoring": {"signals": ["runtime_endpoint_absence", "prometheus_target_absence", "route_reference_absence"], "coverage": "runtime_absence_verified_20260716"}, "next_action": "Preserve the tombstone and create a drift work item on any Host110 Ollama process, proxy, listener, target, rule or provider-route recurrence."},
        {"canonical_id": "host:111", "inventory_labels": ["host111 local Ollama"], "source_rows": [], "runtime_identity": "192.168.0.111/macos-launchd/ollama", "findings": ["Approved third provider hop and Ansible host are absent from the imported inventory", "The runtime manager is a macOS LaunchAgent, not systemd", "The exact LaunchAgent playbook requires local verification plus independent origin probes from host120 and host121", "The canonical host111 Ollama sensor/rule has no fresh production series"], "source_refs": ["infra/ansible/inventory/hosts.yml", "infra/ansible/playbooks/111-ollama-fallback.yml", "ops/monitoring/service-registry.yaml", "ops/monitoring/alerts-unified.yml", "apps/api/src/services/awooop_ansible_post_verifier.py"], "owner_lane": "ai_team", "domain_router": "host_systemd", "executor": "host_ansible_executor", "verifier": "host111_launchagent_local_and_120_121_origin_verifier", "monitoring": {"signals": ["launchagent_state", "local_generation", "host120_origin_generation", "host121_origin_generation", "canonical_alert_series"], "coverage": "source_candidate_runtime_sensor_missing"}, "next_action": "Check/apply the exact LaunchAgent catalog, verify local plus host120/host121 origins, and require a fresh canonical sensor series before provider readiness."},
        {"canonical_id": "ai-provider:ollama_gcp_a", "inventory_labels": ["GCP-A Ollama"], "source_rows": [], "runtime_identity": "34.143.170.20:11434", "source_truth_state": "source_reconciled_runtime_pending", "findings": ["Approved first provider hop is absent from the imported inventory", "Observed transport is public HTTP and is candidate-only until secure mesh/TLS promotion", "Only sanitized prompts may cross this boundary; unsanitized input and every tool loop fail closed before network access", "The exact Prometheus provider target is missing in production"], "source_refs": ["ops/monitoring/service-registry.yaml", "k8s/monitoring/prometheus.yml", "docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json", "apps/api/src/services/ai_provider_policy.py"], "owner_lane": "ai_team", "domain_router": "ai_provider", "executor": "deterministic_provider_router", "verifier": "provider_health_generation_and_transport_receipt_verifier", "monitoring": {"signals": ["exact_target_up", "scrape_freshness", "sanitization_receipt", "tool_loop_denial", "transport_boundary"], "coverage": "source_candidate_runtime_target_missing"}, "transport_policy": {"observed": "public_http", "execution_scope": "sanitized_candidate_only", "tool_loop": "fail_closed", "promotion_requires": "secure_mesh_or_tls_plus_runtime_readback"}, "next_action": "Deploy the exact blackbox target, verify fresh series and sanitization/tool-loop denials, then retain candidate-only status until secure transport promotion."},
        {"canonical_id": "ai-provider:ollama_gcp_b", "inventory_labels": ["GCP-B Ollama"], "source_rows": [], "runtime_identity": "34.21.145.224:11434", "source_truth_state": "source_reconciled_runtime_pending", "findings": ["Approved second provider hop is absent from the imported inventory", "Observed transport is public HTTP and is candidate-only until secure mesh/TLS promotion", "Only sanitized prompts may cross this boundary; unsanitized input and every tool loop fail closed before network access", "The exact Prometheus provider target is missing in production"], "source_refs": ["ops/monitoring/service-registry.yaml", "k8s/monitoring/prometheus.yml", "docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json", "apps/api/src/services/ai_provider_policy.py"], "owner_lane": "ai_team", "domain_router": "ai_provider", "executor": "deterministic_provider_router", "verifier": "provider_health_generation_and_transport_receipt_verifier", "monitoring": {"signals": ["exact_target_up", "scrape_freshness", "sanitization_receipt", "tool_loop_denial", "transport_boundary"], "coverage": "source_candidate_runtime_target_missing"}, "transport_policy": {"observed": "public_http", "execution_scope": "sanitized_candidate_only", "tool_loop": "fail_closed", "promotion_requires": "secure_mesh_or_tls_plus_runtime_readback"}, "next_action": "Deploy the exact blackbox target, verify fresh series and sanitization/tool-loop denials, then retain candidate-only status until secure transport promotion."},
        {"canonical_id": "ai-provider:claude", "inventory_labels": ["Anthropic Claude API"], "source_rows": [], "runtime_identity": "protected-secret-reference/anthropic", "findings": ["Approved fourth provider hop and paid canary are absent from the imported inventory", "User-supplied credential material was noted but no raw value is recorded or readable from this snapshot", "A protected-secret metadata verifier and durable Gate5 authorization bound to the run are pending", "Paid enablement requires paired Claude/Gemini rollback, daily/monthly/per-incident cost caps and production cost readback", "The sanitized five-lane paid canary has not run"], "source_refs": ["docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json", "apps/api/src/services/paid_provider_canary_validation.py"], "owner_lane": "ai_team", "domain_router": "ai_provider", "executor": "deterministic_provider_router", "verifier": "paid_provider_generation_and_cost_receipt_verifier", "credential_metadata": {"user_supplied_credential_noted": true, "raw_value_recorded": false, "raw_value_readback_allowed": false, "protected_secret_reference_status": "pending"}, "authorization": {"gate": "Gate5", "durable_run_binding_required": true, "status": "pending"}, "canary": {"percent": 5, "status": "pending", "paired_rollback_required": true, "cost_caps_verified": false}},
        {"canonical_id": "ai-provider:gemini", "inventory_labels": ["Gemini API"], "source_rows": [], "runtime_identity": "protected-secret-reference/gemini", "findings": ["Approved final provider hop and paid canary are absent from the imported inventory", "User-supplied credential material was noted but no raw value is recorded or readable from this snapshot", "A protected-secret metadata verifier and durable Gate5 authorization bound to the run are pending", "Paid enablement requires paired Claude/Gemini rollback, daily/monthly/per-incident cost caps and production cost readback", "The sanitized five-lane paid canary has not run"], "source_refs": ["docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json", "apps/api/src/services/paid_provider_canary_validation.py"], "owner_lane": "ai_team", "domain_router": "ai_provider", "executor": "deterministic_provider_router", "verifier": "paid_provider_generation_and_cost_receipt_verifier", "credential_metadata": {"user_supplied_credential_noted": true, "raw_value_recorded": false, "raw_value_readback_allowed": false, "protected_secret_reference_status": "pending"}, "authorization": {"gate": "Gate5", "durable_run_binding_required": true, "status": "pending"}, "canary": {"percent": 5, "status": "pending", "paired_rollback_required": true, "cost_caps_verified": false}},
        {"canonical_id": "control-plane:holmesgpt-investigator", "inventory_labels": ["HolmesGPT Investigator"], "source_rows": [], "runtime_identity": "source_candidate/runtime_not_promoted", "findings": ["Required pipeline investigator is absent from the infrastructure inventory and runtime promotion remains pending"], "source_refs": ["docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json"], "owner_lane": "InvestigationPlane"},
        {"canonical_id": "k8s:awoooi-prod:api", "inventory_labels": ["AWOOOI production API"], "source_rows": [], "runtime_identity": "k3s/awoooi-prod/deployment/awoooi-api", "findings": ["Production API is in the monitoring registry but absent from the imported infrastructure inventory"], "source_refs": ["ops/monitoring/service-registry.yaml", "k8s/awoooi-prod/06-deployment-api.yaml"], "owner_lane": "backend_team", "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:awoooi-prod:web", "inventory_labels": ["AWOOOI production Web"], "source_rows": [], "runtime_identity": "k3s/awoooi-prod/deployment/awoooi-web", "findings": ["Production Web is in the monitoring registry but absent from the imported infrastructure inventory"], "source_refs": ["ops/monitoring/service-registry.yaml", "k8s/awoooi-prod"], "owner_lane": "frontend_team", "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:awoooi-prod:worker", "inventory_labels": ["AWOOOI production Worker"], "source_rows": [], "runtime_identity": "k3s/awoooi-prod/deployment/awoooi-worker", "findings": ["Worker is in the monitoring registry but absent from the imported infrastructure inventory"], "source_refs": ["ops/monitoring/service-registry.yaml", "k8s/awoooi-prod"], "owner_lane": "backend_team", "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "k8s:awoooi-prod:broker", "inventory_labels": ["AWOOOI production Broker"], "source_rows": [], "runtime_identity": "k3s/awoooi-prod/deployment/awoooi-broker", "findings": ["Broker is part of production deployment/readback but absent from the imported inventory and monitoring service registry"], "source_refs": ["k8s/awoooi-prod", "docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json"], "owner_lane": "backend_team", "domain_router": "kubernetes_workload", "executor": "kubernetes_controlled_executor", "verifier": "kubernetes_rollout_verifier"},
        {"canonical_id": "signal:alertmanager-webhook-chain", "inventory_labels": ["AlertChainBroken_Alertmanager"], "source_rows": [], "runtime_identity": "alertmanager->awoooi-api-webhook->incident->telegram plus host99 Agent99 exact-host pull fallback", "source_truth_state": "source_reconciled_runtime_pending", "findings": ["Canonical signal is locked to container:host_110:alertmanager", "Rule, concise attribution card, exact bounded recovery and independent verifier are source-ready", "Host99 Agent99 independently polls only the exact active/critical AlertChain signal from host110 without a first-hop credential or raw-payload persistence", "The reduced event is relayed over HTTPS with stable dedupe while Linux execution remains in the host Ansible lane", "Production deployment, poll freshness/dedupe, current alert resolution and same-run learning acknowledgements remain pending"], "source_refs": ["k8s/monitoring/alert-chain-monitor.yaml", "ops/alertmanager/alertmanager.yml", "agent99-alertmanager-alertchain-poll.ps1", "agent99-sre-alert-relay.ps1", "apps/api/src/api/v1/webhooks.py", "apps/api/src/services/controlled_alert_target_router.py", "infra/ansible/playbooks/110-alertmanager-delivery-recovery.yml", "scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh"], "owner_lane": "observability_ops", "verifier": "alert_delivery_chain_plus_agent99_pull_independent_verifier", "monitoring": {"signals": ["alertmanager_delivery_counters", "primary_webhook_health", "agent99_pull_freshness", "dedupe_receipt", "telegram_delivery_receipt"], "coverage": "source_primary_and_independent_pull_ready_runtime_pending"}, "next_action": "Deploy the receiver-scoped scrape/rule/playbook and the atomic Agent99 15-file bundle; run check/apply/verify under one trace/run/work item; then require Alertmanager resolution, Telegram and KM/RAG/MCP/PlayBook acknowledgements before closure."},
        {"canonical_id": "control-plane:telegram-routing-registry", "inventory_labels": ["Canonical Telegram routing registry"], "source_rows": [], "runtime_identity": "docs/security/telegram-canonical-routing-registry.snapshot.json", "findings": ["Nine product routes are blocked/disabled/not implemented; scattering alerts is forbidden"], "source_refs": ["docs/security/telegram-canonical-routing-registry.snapshot.json"], "owner_lane": "NotificationGovernance", "verifier": "telegram_route_and_delivery_receipt_verifier"},
        {"canonical_id": "control-plane:km-rag", "inventory_labels": ["Knowledge Base and RAG"], "source_rows": [], "runtime_identity": "awoooi-api/knowledge-rag", "findings": ["Required learning target is implemented in source but absent from the imported inventory and runtime closure is unverified"], "source_refs": ["apps/api/src/api/v1/knowledge.py", "apps/api/src/api/v1/rag.py"], "owner_lane": "LearningPlane", "verifier": "km_rag_durable_write_ack_verifier"},
        {"canonical_id": "control-plane:mcp-gateway", "inventory_labels": ["Internal MCP Gateway"], "source_rows": [], "runtime_identity": "awoooi-api/mcp-control-plane", "findings": ["MCP catalog has broad product coverage but is absent from the imported inventory; write adapters must remain policy controlled"], "source_refs": ["docs/operations/mcp-control-plane-catalog.snapshot.json"], "owner_lane": "MCPControlPlane", "verifier": "mcp_gateway_audit_and_runtime_verifier"},
        {"canonical_id": "control-plane:playbook-registry", "inventory_labels": ["PlayBook registry"], "source_rows": [], "runtime_identity": "awoooi-api/playbook-service", "findings": ["Required candidate/rollback/trust asset is absent from the imported inventory"], "source_refs": ["apps/api/src/services/playbook_service.py"], "owner_lane": "AutomationControlPlane", "verifier": "playbook_trust_and_execution_receipt_verifier"},
        {"canonical_id": "control-plane:independent-verifier-registry", "inventory_labels": ["Independent verifier registry"], "source_rows": [], "runtime_identity": "awoooi-api/verifier-registry", "findings": ["All assets require an independent verifier, but the inventory does not enumerate verifier ownership or coverage"], "source_refs": ["docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json"], "owner_lane": "VerifierPlane", "verifier": "verifier_registry_self_check"}
      ]
    }
  ],
  "conflict_register": [
    {"id": "PORT-CONFLICT-001", "priority": "P0", "assets": ["service:alertmanager", "signal:alertmanager-webhook-chain"], "conflict": "Alertmanager source identity, production-compatible integration counters plus sole-webhook receiver contract, exact repair path and host99 Agent99 independent pull/reduced relay are reconciled in source; production apply, poll freshness/dedupe, alert resolution and same-run closure receipts remain pending.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-003", "AIA-SRE-004", "AIA-SRE-014", "AIA-SRE-015", "AIA-SRE-017"]},
    {"id": "PORT-CONFLICT-002", "priority": "P0", "assets": ["service:ollama:host110", "service:ollama:host188", "host:111", "ai-provider:ollama_gcp_a", "ai-provider:ollama_gcp_b", "ai-provider:claude", "ai-provider:gemini"], "conflict": "Host110 tombstone runtime absence is verified under AIA-SRE-002 and must remain absent; host111 is a LaunchAgent without local plus host120/121 same-run verification or a fresh sensor; GCP-A/GCP-B remain public-HTTP sanitized candidates with exact Prometheus targets missing; Claude/Gemini still lack a completed five-lane canary and durable cost receipt.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-004", "AIA-SRE-008", "AIA-SRE-013", "AIA-SRE-014"]},
    {"id": "PORT-CONFLICT-003", "priority": "P0", "assets": ["service:gitea-exporter:host110", "service:sentry:relay", "service:sentry:snuba", "runner:gitea:vibework-host110"], "conflict": "GitHub exporter source retirement is ready, but the exact gitea-native production target is missing and the legacy exporter remains visible; remaining ghcr/runner claims also conflict with the global GitHub freeze.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-004", "AIA-SRE-014", "AIA-SRE-018"]},
    {"id": "PORT-CONFLICT-004", "priority": "P0", "assets": ["network:keepalived:vip-unresolved"], "conflict": "Inventory VIP 192.168.0.125 conflicts with Ansible VIP 192.168.0.200 and host membership differs.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-003"]},
    {"id": "PORT-CONFLICT-005", "priority": "P0", "assets": ["service:signoz", "service:otel-collector:signoz", "database:signoz:clickhouse"], "conflict": "SignOz UI, collector, and ClickHouse host placement is inconsistent across imported inventory and registries.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-014"]},
    {"id": "PORT-CONFLICT-006", "priority": "P0", "assets": ["database:awoooi:prod", "database:k3s:postgres-recovery"], "conflict": "AWOOOI business database and K3s datastore/recovery identities are conflated; multiple same-host port 5432 claims are not externally disambiguated.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-010", "AIA-SRE-011"]},
    {"id": "PORT-CONFLICT-007", "priority": "P0", "assets": ["control-plane:telegram-routing-registry"], "conflict": "Most product Telegram routes are blocked, disabled, or not implemented; shared-war-room fallback is forbidden for raw product monitoring.", "linked_work_items": ["AIA-SRE-017"]},
    {"id": "PORT-CONFLICT-008", "priority": "P0", "assets": ["control-plane:km-rag", "control-plane:mcp-gateway", "control-plane:playbook-registry", "control-plane:independent-verifier-registry"], "conflict": "Imported inventory omits the learning and verifier control planes required to make AI automation complete.", "linked_work_items": ["AIA-SRE-014", "AIA-SRE-015"]},
    {"id": "PORT-CONFLICT-009", "priority": "P0", "assets": ["windows-vmware:host_99", "host:111", "k8s:awoooi-prod:api", "k8s:awoooi-prod:web", "k8s:awoooi-prod:worker", "k8s:awoooi-prod:broker"], "conflict": "Core execution and production workload assets are absent from the imported inventory.", "linked_work_items": ["AIA-SRE-006", "AIA-SRE-007", "AIA-SRE-009", "AIA-SRE-013"]},
    {"id": "PORT-CONFLICT-010", "priority": "P1", "assets": ["all-imported-assets"], "conflict": "All imported healthy/up labels are uncorrelated point-in-time claims and cannot close runtime work items.", "linked_work_items": ["AIA-SRE-014", "AIA-SRE-016", "AIA-SRE-018"]},
    {"id": "PORT-CONFLICT-011", "priority": "P0", "assets": ["service:wg-easy:host112", "package:metasploit:host112", "package:burp-suite:host112", "package:sqlmap:host112", "package:nikto:host112", "package:openvas:host112", "service:fail2ban:host188"], "conflict": "The expanded host112 inventory adds a forbidden ghcr image claim and multiple active-scan tools without authorization/receipt contracts, while Fail2Ban disappeared without a retirement receipt.", "linked_work_items": ["AIA-SRE-002", "AIA-SRE-003", "AIA-SRE-008", "AIA-SRE-014", "AIA-SRE-016"]}
  ],
  "priority_policy": {
    "current_p0_unchanged": "AIA-SRE-013",
    "P0": "identity, execution safety, active critical alert chain, provider route, backup integrity, monitoring and learning closure",
    "P1": "portfolio manifest adoption and 24-hour effectiveness scorecard after P0 control paths are safe",
    "ordering_rule": "all P0 reconciliation work precedes P1; declared dependencies are mandatory and an external blocker may not stop unrelated ready P0 work"
  },
  "reconciliation_work_items": [
    {"id": "PORT-001", "order": 1, "priority": "P0", "title": "Canonical portfolio asset normalization and exact identity graph", "dependencies": [], "linked_program_items": ["AIA-SRE-001", "AIA-SRE-002", "AIA-SRE-003"], "terminal_condition": "Every imported and omitted asset has exact owner, runtime identity, source truth, and fail-closed drift receipt."},
    {"id": "PORT-002", "order": 2, "priority": "P0", "title": "Alertmanager webhook chain same-run diagnosis, bounded repair, verifier, and closure", "dependencies": ["PORT-001"], "linked_program_items": ["AIA-SRE-004", "AIA-SRE-014", "AIA-SRE-015", "AIA-SRE-017"], "terminal_condition": "Alertmanager receiver through API ingest and Telegram durable receipt closes under one run; host99 Agent99 exact-host read-only polling creates the reduced repair event when the primary webhook is fully broken, without a first-hop credential or raw-payload persistence; repeated unchanged alerts are suppressed without hiding recurrence."},
    {"id": "PORT-003", "order": 3, "priority": "P0", "title": "Ollama provider identity and retired transport cleanup", "dependencies": ["PORT-001"], "linked_program_items": ["AIA-SRE-002", "AIA-SRE-004", "AIA-SRE-008", "AIA-SRE-013", "AIA-SRE-014"], "terminal_condition": "Provider readback shows GCP-A, GCP-B, host111, Claude, Gemini in order; Host110 is only a verified retired tombstone; host111 LaunchAgent closes local and host120/121 verification with a fresh sensor; GCP public-HTTP hops remain sanitized candidate-only and tool loops fail closed."},
    {"id": "PORT-004", "order": 4, "priority": "P0", "title": "Sunset generic auto-repair and GitHub legacy supply/runtime paths", "dependencies": ["PORT-001"], "linked_program_items": ["AIA-SRE-002", "AIA-SRE-004", "AIA-SRE-014", "AIA-SRE-018"], "terminal_condition": "No generic SSH/docker/delete/cross-provider fallback or GitHub source/image/API path can execute; gitea-native exact metrics are fresh; the legacy GitHub exporter is absent; exact typed executors and internal immutable artifacts are verified."},
    {"id": "PORT-005", "order": 5, "priority": "P0", "title": "Register host99, host111, K3s nodes, host112 security tools/schedules and control-plane assets", "dependencies": ["PORT-001", "PORT-004"], "linked_program_items": ["AIA-SRE-006", "AIA-SRE-007", "AIA-SRE-008", "AIA-SRE-009", "AIA-SRE-014", "AIA-SRE-016"], "terminal_condition": "Host and control-plane inventories reconcile with Agent99/Ansible/Kubernetes single-executor routes; host112 services, containers, packages and schedules have no-secret inventory, active-scan break-glass boundaries and independent readbacks."},
    {"id": "PORT-006", "order": 6, "priority": "P0", "title": "Canonical per-product Telegram destinations and concise AI-work attribution", "dependencies": ["PORT-001", "PORT-002"], "linked_program_items": ["AIA-SRE-017"], "terminal_condition": "Every emitted alert has exact product route, decision engine/models/actions/executor/verifier/receipt and no raw product alert leaks into the shared war room."},
    {"id": "PORT-007", "order": 7, "priority": "P0", "title": "Portfolio backup/restore, escrow, freshness and isolated drill coverage", "dependencies": ["PORT-001", "PORT-004"], "linked_program_items": ["AIA-SRE-010", "AIA-SRE-011"], "terminal_condition": "Every stateful asset has readback freshness, escrow/offsite state and an isolated restore verifier; writes remain critical break-glass."},
    {"id": "PORT-009", "order": 8, "priority": "P0", "title": "Resolve VIP, SignOz, database, port and service placement conflicts", "dependencies": ["PORT-001", "PORT-005"], "linked_program_items": ["AIA-SRE-002", "AIA-SRE-003", "AIA-SRE-010", "AIA-SRE-014"], "terminal_condition": "All identity conflicts have read-only live evidence, canonical resolution, source update, and drift verifier without blind mutation."},
    {"id": "PORT-010", "order": 9, "priority": "P0", "title": "Generated monitoring/alert coverage and source-to-runtime parity", "dependencies": ["PORT-001", "PORT-004", "PORT-009"], "linked_program_items": ["AIA-SRE-002", "AIA-SRE-013", "AIA-SRE-014", "AIA-SRE-016", "AIA-SRE-017", "AIA-SRE-018"], "terminal_condition": "Every canonical asset has fresh metrics/logs/traces/alerts, exact owner, generated target parity, and a tested lifecycle route; source targets alone never count as runtime coverage; GCP-A/GCP-B, host111 and gitea-native exact series are production-visible."},
    {"id": "PORT-011", "order": 10, "priority": "P0", "title": "KM/RAG/MCP/PlayBook and verifier target attachment for every asset", "dependencies": ["PORT-001", "PORT-004", "PORT-007", "PORT-010"], "linked_program_items": ["AIA-SRE-012", "AIA-SRE-014", "AIA-SRE-015"], "terminal_condition": "Every verified run writes durable acknowledgements to all learning targets and never marks learning complete from metadata-only refs."},
    {"id": "PORT-008", "order": 11, "priority": "P1", "title": "Adopt product manifests for every imported project/site", "dependencies": ["PORT-001", "PORT-004"], "linked_program_items": ["AIA-SRE-002", "AIA-SRE-015"], "terminal_condition": "Every product/site has Gitea authority, runtime, contracts, operation boundaries and owner without creating repos or using GitHub."},
    {"id": "PORT-012", "order": 12, "priority": "P1", "title": "24-hour replay, cost, recurrence and production closure scorecard", "dependencies": ["PORT-002", "PORT-003", "PORT-005", "PORT-006", "PORT-007", "PORT-008", "PORT-009", "PORT-010", "PORT-011"], "linked_program_items": ["AIA-SRE-013", "AIA-SRE-016", "AIA-SRE-018"], "terminal_condition": "Production same-run closure publishes MTTA, MTTR, false positive, recurrence, human intervention, verifier, rollback, freshness, coverage and paid-provider cost without false green; paid evidence includes durable Gate5 authorization, protected-secret metadata only, daily/monthly/per-incident caps and paired Claude/Gemini rollback on any partial result."}
  ],
  "rollups": {
    "imported_item_rows": 131,
    "canonical_assets": 144,
    "inventory_omissions": 18,
    "conflicts": 11,
    "conflict_assets": 36,
    "reconciliation_work_items": 12,
    "source_reconciled_assets": 6,
    "runtime_closed_assets": 1,
    "program_completion_percent": 1,
    "asset_coverage_status": "all_imported_rows_mapped_but_identity_and_runtime_coverage_partial",
    "runtime_closure_status": "started_partial_1_of_144"
  }
}