4defe99bd8
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Failing after 2m47s
CD Pipeline / build-and-deploy (push) Has been skipped
CD Pipeline / post-deploy-checks (push) Has been skipped
252 lines
12 KiB
JSON
252 lines
12 KiB
JSON
{
|
|
"schema_version": "awoooi_priority_work_order_readback_v1",
|
|
"generated_at": "2026-06-29T14:00:19+08:00",
|
|
"status": "p0_005_dr_escrow_checklist_ready_waiting_redacted_refs",
|
|
"source_refs": {
|
|
"global_scorecard": "~/.codex/product-runtime-governance-completion-scorecard.snapshot.json",
|
|
"workstation_dashboard": "~/.codex/codex-workstation-sync-dashboard.snapshot.json",
|
|
"post_reboot_summary": "/tmp/awoooi-post-reboot-readiness-20260629-115730/summary.txt",
|
|
"full_stack_cold_start_check": "scripts/reboot-recovery/full-stack-cold-start-check.sh --monitor-read-only --no-color",
|
|
"delivery_closure_workbench": "https://awoooi.wooo.work/api/v1/agents/delivery-closure-workbench",
|
|
"public_gitea_queue_readback": "ops/runner/read-public-gitea-actions-queue.py --json",
|
|
"credential_escrow_scorecard": "/tmp/awoooi-credential-escrow-intake-scorecard-20260629-1200-priority.json",
|
|
"dr_escrow_evidence_checklist_generator": "scripts/reboot-recovery/dr-escrow-evidence-checklist.py"
|
|
},
|
|
"current_head": {
|
|
"gitea_main_sha": "bd55386e6edc46ce0b188011b171191b7773c5ba",
|
|
"latest_successful_deploy_marker": "9362588ce chore(cd): deploy a423301 [skip ci]",
|
|
"latest_successful_deployed_source_sha": "a4233017ad5fd03977233f3db6a4bb45d71507ed",
|
|
"latest_source_readiness_commit_sha": "0c8d4e88c39157b92322fa41a92e6b15c317ac49",
|
|
"latest_source_readiness_cd_run_id": "3882",
|
|
"latest_source_readiness_cd_run_status": "Success",
|
|
"source_readiness_ci_fix_required": false,
|
|
"no_matching_runner_visible": false
|
|
},
|
|
"completed_in_priority_order": [
|
|
{
|
|
"workplan_id": "P0-001",
|
|
"title": "建立主機 runtime inventory 權威資料",
|
|
"status": "core_green_with_warnings",
|
|
"evidence": {
|
|
"hosts_checked": [
|
|
"192.168.0.110",
|
|
"192.168.0.120",
|
|
"192.168.0.121",
|
|
"192.168.0.188"
|
|
],
|
|
"full_stack_pass": 91,
|
|
"full_stack_warn": 2,
|
|
"full_stack_blocked": 0,
|
|
"post_start_pass": 43,
|
|
"post_start_warn": 5,
|
|
"post_start_blocked": 0,
|
|
"service_green": true,
|
|
"host_188_hygiene_blocked": false,
|
|
"wazuh_manager_registry_accepted": 6,
|
|
"runtime_action_authorized": false
|
|
},
|
|
"warnings_kept_visible": [
|
|
"110 systemd failed units remain",
|
|
"188 momo daily sales stale but source preflight has no hard blocker"
|
|
]
|
|
},
|
|
{
|
|
"workplan_id": "P0-004",
|
|
"title": "補 dev / prod CI/CD baseline",
|
|
"status": "production_deploy_closure_verified",
|
|
"evidence": {
|
|
"non110_runner_ready": true,
|
|
"latest_cd_run_id": "3868",
|
|
"latest_cd_run_status": "Success",
|
|
"production_deploy_status": "closure_verified",
|
|
"production_image_tag_matches_main": true,
|
|
"production_governance_fields_present": true,
|
|
"runner_pressure_guard_ok": true
|
|
}
|
|
},
|
|
{
|
|
"workplan_id": "P0-004-source-readiness",
|
|
"title": "P0-004 CI/CD baseline source readiness",
|
|
"status": "ready_for_template_copy_apply_gate",
|
|
"evidence": {
|
|
"required_source_count": 11,
|
|
"present_required_source_count": 11,
|
|
"missing_required_source_count": 0,
|
|
"source_readiness_percent": 100,
|
|
"blocked_source_ids": []
|
|
},
|
|
"safe_next_step": "open_template_copy_apply_gate_after_source_readiness_green"
|
|
},
|
|
{
|
|
"workplan_id": "P0-002",
|
|
"title": "建立 product.awoooi.yaml 產品 manifest 標準",
|
|
"status": "ready_for_product_manifest_adoption",
|
|
"evidence": {
|
|
"manifest_present": true,
|
|
"manifest_schema_present": true,
|
|
"manifest_schema_version": "product_awoooi_manifest_v1",
|
|
"product_id": "awoooi",
|
|
"source_control_authority": "gitea",
|
|
"github_status": "stopped_retired_do_not_use",
|
|
"required_section_count": 5,
|
|
"present_required_section_count": 5,
|
|
"missing_required_section_count": 0,
|
|
"required_contract_ref_count": 3,
|
|
"present_contract_ref_count": 3,
|
|
"missing_contract_ref_count": 0,
|
|
"source_readiness_percent": 100
|
|
},
|
|
"safe_next_step": "adopt_product_manifest_schema_for_remaining_products_without_repo_creation_or_secret_read"
|
|
}
|
|
],
|
|
"in_progress_or_blocked_in_priority_order": [
|
|
{
|
|
"workplan_id": "P0-005",
|
|
"title": "產品資料與備份 contract",
|
|
"status": "checklist_ready_waiting_non_secret_credential_escrow_evidence",
|
|
"reason": "Backup core and product freshness are green, and the P0-005 lane now has one no-secret checklist packet for the five remaining credential escrow evidence markers.",
|
|
"evidence": {
|
|
"product_data_green": true,
|
|
"stock_freshness_status": "ok",
|
|
"stock_latest_trading_date": "2026-06-26",
|
|
"backup_core_green": true,
|
|
"dr_escrow_blocked": true,
|
|
"summary_escrow_missing_count": 5,
|
|
"offsite_configured": true,
|
|
"rclone_configured": true,
|
|
"script_missing_count": 0,
|
|
"credential_marker_write_authorized_count": 0,
|
|
"secret_value_collection_allowed": false,
|
|
"checklist_generator_present": true,
|
|
"checklist_schema_version": "awoooi_dr_escrow_evidence_checklist_v1"
|
|
},
|
|
"missing_items": [
|
|
"restic_repository_password",
|
|
"offsite_provider_credentials",
|
|
"break_glass_admin_credentials",
|
|
"dns_registrar_recovery",
|
|
"oauth_ai_provider_recovery"
|
|
],
|
|
"professional_fix": {
|
|
"owner": "DR evidence lane",
|
|
"action": "Use the single DR escrow checklist packet with the five required item ids, accept only redacted evidence refs, then run the existing preflight once.",
|
|
"exit_criteria": [
|
|
"effective_escrow_missing_count=0",
|
|
"owner_response_accepted_count=1",
|
|
"forbidden_true_field_count=0",
|
|
"secret_value_collection_allowed=false",
|
|
"post_reboot_readiness OVERALL_DECLARATION no longer includes DR_ESCROW_BLOCKED"
|
|
],
|
|
"do_not_repeat": [
|
|
"Do not reopen cold-start or CI/CD work because escrow refs are missing.",
|
|
"Do not create additional owner-package variants for the same five refs."
|
|
]
|
|
},
|
|
"safe_next_step": "fill_single_dr_escrow_evidence_checklist_with_five_non_secret_refs_then_run_one_preflight"
|
|
},
|
|
{
|
|
"workplan_id": "P0-003",
|
|
"title": "取得 Gitea private inventory 權限",
|
|
"status": "blocked_external_or_authenticated_inventory_required",
|
|
"reason": "Global scorecard still reports private/internal inventory incomplete; GitHub remains stopped and must not be used as a fallback.",
|
|
"professional_fix": {
|
|
"owner": "Gitea inventory lane",
|
|
"action": "Use Gitea-only inventory readback and retire GitHub from P0 completion math; keep GitHub as do_not_use historical context only.",
|
|
"exit_criteria": [
|
|
"private_inventory_source=gitea",
|
|
"github_lane_excluded_from_p0_blocker_count=true",
|
|
"all active product repos have Gitea owner/readiness row"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"workplan_id": "P0-006",
|
|
"title": "清理 source-to-runtime drift 與 stale routes",
|
|
"status": "pending_after_p0_005_and_p0_003",
|
|
"reason": "P0-004 source readiness and P0-002 product manifest are green; keep drift cleanup after credential escrow and authenticated Gitea inventory readback.",
|
|
"professional_fix": {
|
|
"owner": "source-runtime drift lane",
|
|
"action": "Compare product.awoooi.yaml, committed K8s/docker/workflow sources, production readback, and public routes; generate one drift list with owner and fix command per row.",
|
|
"exit_criteria": [
|
|
"runtime_without_source_count=0",
|
|
"source_without_runtime_count=0",
|
|
"stale_route_count=0 or explicitly retired"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"noise_integrated_risk_register": [
|
|
{
|
|
"signal": "canceled_or_superseded_cd_runs",
|
|
"why_it_matters": "Canceled runs hide whether the latest main actually deployed and can make a completed source fix look failed.",
|
|
"professional_handling": "Only the latest non-canceled run for the current main head is a deploy signal; older canceled runs become context, not blockers.",
|
|
"exit_criteria": "latest_main_deploy_readback_success=true"
|
|
},
|
|
{
|
|
"signal": "ui_redaction_commits_during_p0_recovery",
|
|
"why_it_matters": "Concurrent UI-only commits can cancel P0 CI runs and consume attention while not changing cold-start or DR truth.",
|
|
"professional_handling": "Keep UI-only changes on controlled-runtime profile and verify production readback after the newest head; do not reopen host recovery.",
|
|
"exit_criteria": "production_deploy_status=closure_verified and P0 endpoints unchanged"
|
|
},
|
|
{
|
|
"signal": "dirty_local_awooop_worktree",
|
|
"why_it_matters": "Local uncommitted frontend copy can create false test failures and pollute P0 diagnosis.",
|
|
"professional_handling": "Run P0 verification in clean Gitea main worktrees; never stage or revert user dirty files during P0 recovery.",
|
|
"exit_criteria": "all P0 test receipts come from clean main worktree"
|
|
},
|
|
{
|
|
"signal": "legacy_github_lane",
|
|
"why_it_matters": "Retired GitHub blockers inflate P0 blocker count and distract from active Gitea/runtime work.",
|
|
"professional_handling": "Keep GitHub stopped/do_not_use; remove it from active P0 next actions and route inventory work to Gitea.",
|
|
"exit_criteria": "active_p0_next_actions contain no GitHub recovery work"
|
|
},
|
|
{
|
|
"signal": "warning_only_cold_start_findings",
|
|
"why_it_matters": "Warnings can reveal hygiene debt, but treating them as reboot blockers delays recovery closure.",
|
|
"professional_handling": "Keep warnings visible with owner and due lane; close reboot recovery when BLOCKED=0 and service/data health are green.",
|
|
"exit_criteria": "cold_start_blocked=0 and warning items assigned outside reboot recovery"
|
|
},
|
|
{
|
|
"signal": "stale_or_incomplete_priority_snapshots",
|
|
"why_it_matters": "Old snapshots can contradict live production readback and send work back to already-fixed items.",
|
|
"professional_handling": "Live production readback wins; snapshots must be refreshed only when they change the next executable P0 action.",
|
|
"exit_criteria": "priority snapshot current_head matches latest successful deploy marker"
|
|
}
|
|
],
|
|
"professional_execution_rules": [
|
|
"Treat noise as a risk input when it masks, delays, or misroutes a P0; otherwise keep it as context.",
|
|
"Do not split noise into a separate project; attach it to the P0 row it can affect.",
|
|
"Every P0 row must have one owner lane, one action, and measurable exit criteria.",
|
|
"Do not re-run cold-start, CD, or UI checks unless their result can change the next P0 action.",
|
|
"One blocker gets one checklist and one preflight; do not produce duplicate owner packets for the same missing evidence."
|
|
],
|
|
"stopped_or_do_not_use": [
|
|
{
|
|
"workplan_id": "P0-003A",
|
|
"title": "GitHub 全產品備援鏡像",
|
|
"status": "removed_deleted_do_not_use",
|
|
"allowed_actions": 0
|
|
}
|
|
],
|
|
"operation_boundaries": {
|
|
"github_api_used": false,
|
|
"github_cli_used": false,
|
|
"workflow_dispatch_performed": false,
|
|
"runner_registration_performed": false,
|
|
"secret_or_runner_token_read": false,
|
|
"credential_secret_value_read": false,
|
|
"credential_marker_written": false,
|
|
"host_write_performed": false,
|
|
"docker_restart_performed": false,
|
|
"nginx_restart_performed": false,
|
|
"firewall_change_performed": false,
|
|
"k3s_restart_or_node_drain_performed": false,
|
|
"database_write_or_restore_performed": false
|
|
},
|
|
"next_execution_order": [
|
|
"P0-005: fill the single DR escrow evidence checklist with five non-secret refs and rerun one preflight.",
|
|
"P0-003: convert private/internal inventory to Gitea-only readback and remove retired GitHub from active P0 blocker math.",
|
|
"P0-006: run source-to-runtime drift cleanup using product manifest, committed runtime sources, production readback, and public route evidence."
|
|
]
|
|
}
|