705 lines
28 KiB
JSON
705 lines
28 KiB
JSON
{
|
||
"schema_version": "gitea_workflow_runner_health_v1",
|
||
"generated_at": "2026-07-09T23:20:00+08:00",
|
||
"program_status": {
|
||
"overall_completion_percent": 100,
|
||
"current_priority": "P1",
|
||
"current_task_id": "P1-002",
|
||
"next_task_id": "P1-003",
|
||
"read_only_mode": true
|
||
},
|
||
"source_refs": [
|
||
"docs/schemas/gitea_workflow_runner_health_v1.schema.json",
|
||
".gitea/workflows/agent-market-watch.yaml",
|
||
".gitea/workflows/agent-version-lifecycle-watch.yaml",
|
||
".gitea/workflows/ai-technology-watch.yaml",
|
||
".gitea/workflows/ansible-lint.yml",
|
||
".gitea/workflows/awoooi-onboarding-warning-step.yaml",
|
||
".gitea/workflows/cd-dev.yaml",
|
||
".gitea/workflows/cd.yaml",
|
||
".gitea/workflows/code-review.yaml",
|
||
".gitea/workflows/deploy-alerts.yaml",
|
||
".gitea/workflows/e2e-health.yaml",
|
||
".gitea/workflows/harbor-110-local-repair.yaml",
|
||
".gitea/workflows/run-migration.yml",
|
||
".gitea/workflows/type-sync-check.yaml",
|
||
"docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json",
|
||
"scripts/ci/check-gitea-step-env-secrets.js",
|
||
"scripts/ci/cleanup-host-runner-workspace.sh",
|
||
"scripts/ci/wait-host-web-build-pressure.sh",
|
||
"scripts/ci/notify-awoooi-cicd.sh",
|
||
"scripts/setup-runner-watchdog.sh",
|
||
"scripts/ops/stop-stale-gitea-actions-jobs.sh"
|
||
],
|
||
"rollups": {
|
||
"total_workflows": 13,
|
||
"by_workflow_status": {
|
||
"manifest_mapped": 13
|
||
},
|
||
"by_runner_evidence_status": {
|
||
"non110_runner_mapped": 10,
|
||
"non110_host_runner_mapped": 3
|
||
},
|
||
"workflows_with_schedule": 5,
|
||
"workflows_with_workflow_dispatch": 13,
|
||
"workflows_with_notify_bridge": 6,
|
||
"workflows_with_actionable_or_failure_quiet_policy": 3,
|
||
"workflow_ids_requiring_runner_attestation": [],
|
||
"total_runner_contracts": 5,
|
||
"runner_contracts_requiring_action": [],
|
||
"notification_contracts_total": 7,
|
||
"notification_contracts_quiet_success_count": 3,
|
||
"notification_contracts_quiet_success_ids": [
|
||
"agent_market_watch_actionable_only",
|
||
"ai_technology_watch_actionable_only",
|
||
"e2e_health_failure_only"
|
||
]
|
||
},
|
||
"workflow_records": [
|
||
{
|
||
"workflow_id": "agent_market_watch",
|
||
"file_ref": ".gitea/workflows/agent-market-watch.yaml",
|
||
"display_name": "Agent Market Watch",
|
||
"scope": "每週市場觀察與手動觀察；只產生報告、分類與推廣候選，不做 SDK/API/replay/shadow/canary 或 OpenClaw 替換批准。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "medium",
|
||
"triggers": [
|
||
"workflow_dispatch",
|
||
"schedule"
|
||
],
|
||
"schedule_cadence": "每週一 09:00 Asia/Taipei；cron=0 1 * * 1 UTC",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "actionable_only_no_success_noise",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "未讀取 Secret；只由 workflow 條件與 committed script 形成只讀證據。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/agent-market-watch.yaml",
|
||
"docs/evaluations/agent_market_watch_report_2026-06-04_watch_expanded.json"
|
||
],
|
||
"next_action": "保留 actionable-only；維持 non110 runner label，不啟用額外通知或 paid API。"
|
||
},
|
||
{
|
||
"workflow_id": "agent_version_lifecycle_watch",
|
||
"file_ref": ".gitea/workflows/agent-version-lifecycle-watch.yaml",
|
||
"display_name": "Agent Version Lifecycle Watch",
|
||
"scope": "每週 AI Agent / SDK / framework 版本生命週期治理；只驗證 committed proposal queue，不安裝 SDK、不呼叫 paid/model API、不改 workflow、不切 production provider route。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "medium",
|
||
"triggers": [
|
||
"workflow_dispatch",
|
||
"schedule"
|
||
],
|
||
"schedule_cadence": "每週二 09:00 Asia/Taipei；cron=0 1 * * 2 UTC",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "read_only_no_notify",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "未讀取 Secret；runtime_boundaries 明確禁止 package upgrade、workflow write、paid API、provider route switch 與 production write。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/agent-version-lifecycle-watch.yaml",
|
||
"docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json"
|
||
],
|
||
"next_action": "維持 no-write proposal validation；若要升級成自動套版，必須先補 replay/shadow/canary 與成本/路由批准。"
|
||
},
|
||
{
|
||
"workflow_id": "ai_technology_watch",
|
||
"file_ref": ".gitea/workflows/ai-technology-watch.yaml",
|
||
"display_name": "AI Technology Watch",
|
||
"scope": "AI 技術雷達監控；只產生 watch/readback，不切換 provider、不進 paid API 或 production route。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "medium",
|
||
"triggers": [
|
||
"workflow_dispatch",
|
||
"schedule"
|
||
],
|
||
"schedule_cadence": "定期技術雷達觀察；由 workflow source 定義 cron。",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "actionable_only_no_success_noise",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "不讀 Secret payload；只保留 committed workflow metadata 與治理 flags。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/ai-technology-watch.yaml"
|
||
],
|
||
"next_action": "保留 actionable-only；後續只補技術雷達 readback 與報告 freshness。"
|
||
},
|
||
{
|
||
"workflow_id": "ansible_lint",
|
||
"file_ref": ".gitea/workflows/ansible-lint.yml",
|
||
"display_name": "Ansible / Reboot Recovery Contract",
|
||
"scope": "Ansible / reboot recovery contract 驗證；無通知橋接。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "low",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "read_only_no_notify",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "未見通知或 Secret payload 使用；仍需只讀 secret-name hygiene 持續檢查。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/ansible-lint.yml"
|
||
],
|
||
"next_action": "維持 non110 runner label 與 no-notify 合約。"
|
||
},
|
||
{
|
||
"workflow_id": "awoooi_onboarding_warning_step",
|
||
"file_ref": ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
|
||
"display_name": "AWOOOI Onboarding Warning Step",
|
||
"scope": "受控 onboarding warning-step；只允許 workflow_dispatch，不支援 push/pull_request 自動觸發。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "medium",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-host"
|
||
],
|
||
"runner_evidence_status": "non110_host_runner_mapped",
|
||
"job_count": 2,
|
||
"notification_policy": "manual_status_exception",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "不讀 Secret payload；此 workflow 用於 shape/guard validation。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/awoooi-onboarding-warning-step.yaml",
|
||
"docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json"
|
||
],
|
||
"next_action": "維持 controlled workflow_dispatch；不得改成 push/pull_request 觸發。"
|
||
},
|
||
{
|
||
"workflow_id": "cd_dev",
|
||
"file_ref": ".gitea/workflows/cd-dev.yaml",
|
||
"display_name": "CD Pipeline (Dev)",
|
||
"scope": "dev branch build / deploy；屬部署狀態通知例外，不套用 success-noise 全靜音。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "high",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "deployment_status_exception",
|
||
"notify_bridge_calls": 3,
|
||
"secrets_policy_status": "需維持 scripts/ci/check-gitea-step-env-secrets.js 類型的 step env / action input hygiene。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/cd-dev.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留部署狀態例外；後續補 dev deploy marker / smoke receipt 統一讀回。"
|
||
},
|
||
{
|
||
"workflow_id": "cd_pipeline",
|
||
"file_ref": ".gitea/workflows/cd.yaml",
|
||
"display_name": "CD Pipeline",
|
||
"scope": "main branch 正式測試、build、deploy、post-deploy；使用 non110 host runner label，並保留 stale-run guard。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "critical",
|
||
"triggers": [
|
||
"push:main",
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-host"
|
||
],
|
||
"runner_evidence_status": "non110_host_runner_mapped",
|
||
"job_count": 5,
|
||
"notification_policy": "deployment_status_exception",
|
||
"notify_bridge_calls": 9,
|
||
"secrets_policy_status": "正式 CD 使用 check-gitea-step-env-secrets guard；不在本 snapshot 讀取任何 Secret payload。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/cd.yaml",
|
||
"scripts/ci/check-gitea-step-env-secrets.js",
|
||
"scripts/ci/cleanup-host-runner-workspace.sh",
|
||
"scripts/ci/wait-host-web-build-pressure.sh"
|
||
],
|
||
"next_action": "保留 non110 host 合約與 post-deploy smoke；任何 CD 修改仍需獨立 review / deploy gate。"
|
||
},
|
||
{
|
||
"workflow_id": "code_review",
|
||
"file_ref": ".gitea/workflows/code-review.yaml",
|
||
"display_name": "Code Review",
|
||
"scope": "AI code review 與 stale-main guard；不等於自動 merge 或部署批准。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "high",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "manual_status_exception",
|
||
"notify_bridge_calls": 2,
|
||
"secrets_policy_status": "不讀 Secret payload；仍需維持通知 secret name parity 與 guard。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/code-review.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留 review 狀態通知；後續與 PR required check policy 綁定。"
|
||
},
|
||
{
|
||
"workflow_id": "deploy_alerts",
|
||
"file_ref": ".gitea/workflows/deploy-alerts.yaml",
|
||
"display_name": "Deploy Alert Rules",
|
||
"scope": "告警規則部署流程；屬人工/部署狀態例外，不在本 snapshot 變更 alert rule。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "high",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "manual_status_exception",
|
||
"notify_bridge_calls": 1,
|
||
"secrets_policy_status": "不讀 Secret payload；告警鏈路 E2E 需另走 ADR-025/相關 guard。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/deploy-alerts.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh",
|
||
"docs/HARD_RULES.md"
|
||
],
|
||
"next_action": "後續再盤點 Alertmanager / Prometheus 合約；本 snapshot 不改 alert rules。"
|
||
},
|
||
{
|
||
"workflow_id": "e2e_health",
|
||
"file_ref": ".gitea/workflows/e2e-health.yaml",
|
||
"display_name": "E2E Health Check",
|
||
"scope": "每日正式 API health 檢查；失敗才升級通知。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "medium",
|
||
"triggers": [
|
||
"workflow_dispatch",
|
||
"schedule"
|
||
],
|
||
"schedule_cadence": "每日 00:00 Asia/Taipei；cron=0 16 * * * UTC",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "failure_only",
|
||
"notify_bridge_calls": 1,
|
||
"secrets_policy_status": "失敗通知透過 notify bridge；本 snapshot 不讀 Telegram / webhook Secret payload。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/e2e-health.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留 failure-only；補最近 run 與 alert receipt stage 證據。"
|
||
},
|
||
{
|
||
"workflow_id": "harbor_110_local_repair",
|
||
"file_ref": ".gitea/workflows/harbor-110-local-repair.yaml",
|
||
"display_name": "AWOOOI Harbor 110 Local Repair",
|
||
"scope": "Harbor 110 local repair guarded workflow；低頻 schedule + workflow_dispatch，內部仍有 no-auto-apply guard。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "critical",
|
||
"triggers": [
|
||
"workflow_dispatch",
|
||
"schedule"
|
||
],
|
||
"schedule_cadence": "低頻 hourly guard，由 workflow source 定義 cron。",
|
||
"runner_labels": [
|
||
"awoooi-non110-host"
|
||
],
|
||
"runner_evidence_status": "non110_host_runner_mapped",
|
||
"job_count": 2,
|
||
"notification_policy": "manual_status_exception",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "不讀 Secret payload；repair workflow 只保留 guarded execution source。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/harbor-110-local-repair.yaml"
|
||
],
|
||
"next_action": "維持 no-auto-apply repair guard；不得由 API 直接觸發 repair。"
|
||
},
|
||
{
|
||
"workflow_id": "run_migration",
|
||
"file_ref": ".gitea/workflows/run-migration.yml",
|
||
"display_name": "run-migration",
|
||
"scope": "手動 migration workflow；不得由本 readback 觸發。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "critical",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "manual_status_exception",
|
||
"notify_bridge_calls": 1,
|
||
"secrets_policy_status": "Migration 相關 secret / DB 權限不得由 readback 讀取或擴權。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/run-migration.yml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "只讀維持 migration approval boundary；不觸發 workflow。"
|
||
},
|
||
{
|
||
"workflow_id": "type_sync_check",
|
||
"file_ref": ".gitea/workflows/type-sync-check.yaml",
|
||
"display_name": "Type Sync Check",
|
||
"scope": "型別同步檢查；無通知橋接。",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "low",
|
||
"triggers": [
|
||
"workflow_dispatch"
|
||
],
|
||
"schedule_cadence": "無定期排程",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"runner_evidence_status": "non110_runner_mapped",
|
||
"job_count": 1,
|
||
"notification_policy": "read_only_no_notify",
|
||
"notify_bridge_calls": 0,
|
||
"secrets_policy_status": "無通知橋接；維持 non110 runner label。",
|
||
"evidence_refs": [
|
||
".gitea/workflows/type-sync-check.yaml"
|
||
],
|
||
"next_action": "維持 no-notify；後續只補 artifact retention。"
|
||
}
|
||
],
|
||
"runner_contracts": [
|
||
{
|
||
"contract_id": "awoooi_non110_host_runner",
|
||
"display_name": "awoooi-non110-host controlled runner label",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "critical",
|
||
"runner_labels": [
|
||
"awoooi-non110-host"
|
||
],
|
||
"used_by_workflows": [
|
||
"awoooi_onboarding_warning_step",
|
||
"cd_pipeline",
|
||
"harbor_110_local_repair"
|
||
],
|
||
"health_contract": "host-level controlled workflows use the explicit awoooi-non110-host label; this snapshot does not restart or mutate the runner.",
|
||
"guardrail_refs": [
|
||
"scripts/ci/cleanup-host-runner-workspace.sh",
|
||
"scripts/ci/wait-host-web-build-pressure.sh"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/cd.yaml",
|
||
".gitea/workflows/harbor-110-local-repair.yaml",
|
||
".gitea/workflows/awoooi-onboarding-warning-step.yaml"
|
||
],
|
||
"next_action": "維持 explicit non110 host label；任何 runner/service 變更另走維護窗口。"
|
||
},
|
||
{
|
||
"contract_id": "awoooi_non110_ubuntu_runner",
|
||
"display_name": "awoooi-non110-ubuntu controlled runner label",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "high",
|
||
"runner_labels": [
|
||
"awoooi-non110-ubuntu"
|
||
],
|
||
"used_by_workflows": [
|
||
"agent_market_watch",
|
||
"ai_technology_watch",
|
||
"ansible_lint",
|
||
"cd_dev",
|
||
"code_review",
|
||
"deploy_alerts",
|
||
"e2e_health",
|
||
"run_migration",
|
||
"type_sync_check"
|
||
],
|
||
"health_contract": "general CI/CD and governance workflows use explicit awoooi-non110-ubuntu label instead of a generic runner label.",
|
||
"guardrail_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/security/S4-9-CANONICAL-OWNER-RESPONSE-ENVELOPE.md"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/agent-market-watch.yaml",
|
||
".gitea/workflows/cd-dev.yaml",
|
||
".gitea/workflows/e2e-health.yaml",
|
||
".gitea/workflows/run-migration.yml"
|
||
],
|
||
"next_action": "維持 explicit non110 ubuntu label；後續補容量/freshness 指標，不直接註冊或重啟 runner。"
|
||
},
|
||
{
|
||
"contract_id": "runner_watchdog_systemd",
|
||
"display_name": "actions.runner systemd watchdog 草案",
|
||
"status": "prepared_not_applied_by_snapshot",
|
||
"risk_level": "medium",
|
||
"runner_labels": [
|
||
"actions.runner.owenhytsai-awoooi.awoooi-110.service"
|
||
],
|
||
"used_by_workflows": [
|
||
"Gitea Actions host runner service"
|
||
],
|
||
"health_contract": "setup script 只描述 WatchdogSec=300、Restart=always、StartLimitBurst=5；本 snapshot 不套用、不 restart、不 systemctl daemon-reload。",
|
||
"guardrail_refs": [
|
||
"scripts/setup-runner-watchdog.sh"
|
||
],
|
||
"evidence_refs": [
|
||
"scripts/setup-runner-watchdog.sh",
|
||
"docs/MONITORING_COMPLETE_STRATEGY.md"
|
||
],
|
||
"next_action": "若需套用 watchdog，另開批准包與維護窗口；本 snapshot 僅展示草案存在。"
|
||
},
|
||
{
|
||
"contract_id": "stale_job_container_guard",
|
||
"display_name": "Gitea Actions stale job container guard",
|
||
"status": "dry_run_only",
|
||
"risk_level": "high",
|
||
"runner_labels": [
|
||
"GITEA-ACTIONS-* docker containers"
|
||
],
|
||
"used_by_workflows": [
|
||
"all_gitea_actions"
|
||
],
|
||
"health_contract": "stop-stale-gitea-actions-jobs.sh 預設 dry-run；只有 --apply 才停止 container，且仍要檢查 recent logs 與 workflow threshold。",
|
||
"guardrail_refs": [
|
||
"scripts/ops/stop-stale-gitea-actions-jobs.sh"
|
||
],
|
||
"evidence_refs": [
|
||
"scripts/ops/stop-stale-gitea-actions-jobs.sh"
|
||
],
|
||
"next_action": "維持 dry-run-only；不得由治理頁或 API 直接停止 container。"
|
||
},
|
||
{
|
||
"contract_id": "secret_env_hygiene_guard",
|
||
"display_name": "Gitea step env secret hygiene guard",
|
||
"status": "manifest_mapped",
|
||
"risk_level": "high",
|
||
"runner_labels": [
|
||
"all_gitea_actions"
|
||
],
|
||
"used_by_workflows": [
|
||
"cd_pipeline",
|
||
"code_review",
|
||
"cd_dev"
|
||
],
|
||
"health_contract": "check-gitea-step-env-secrets.js is the committed source guard for step env / action input hygiene; this snapshot reads no secret values.",
|
||
"guardrail_refs": [
|
||
"scripts/ci/check-gitea-step-env-secrets.js"
|
||
],
|
||
"evidence_refs": [
|
||
"scripts/ci/check-gitea-step-env-secrets.js",
|
||
".gitea/workflows/cd.yaml",
|
||
".gitea/workflows/code-review.yaml"
|
||
],
|
||
"next_action": "保留 secret-name hygiene guard；後續只做 redacted name inventory，不讀 secret value。"
|
||
}
|
||
],
|
||
"notification_contracts": [
|
||
{
|
||
"contract_id": "agent_market_watch_actionable_only",
|
||
"display_name": "Agent Market Watch actionable-only",
|
||
"status": "preserved",
|
||
"policy_kind": "actionable_only",
|
||
"success_noise_policy": "無 actionable market change 時保持 Telegram 安靜，不發成功洗版訊息。",
|
||
"failure_policy": "發現新候選、queue、失敗或需人工 review 時才產生 summary / action-required。",
|
||
"workflow_refs": [
|
||
"agent_market_watch"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/agent-market-watch.yaml"
|
||
],
|
||
"next_action": "保留每週觀察 cadence；不增加外部 API 或通知頻率。"
|
||
},
|
||
{
|
||
"contract_id": "ai_technology_watch_actionable_only",
|
||
"display_name": "AI Technology Watch actionable-only",
|
||
"status": "preserved",
|
||
"policy_kind": "actionable_only",
|
||
"success_noise_policy": "無 actionable 技術採用變更時保持安靜，不發成功洗版訊息。",
|
||
"failure_policy": "watch 失敗或需 review 時才產生 action-required evidence。",
|
||
"workflow_refs": [
|
||
"ai_technology_watch"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/ai-technology-watch.yaml"
|
||
],
|
||
"next_action": "保留技術雷達 cadence；後續補報告 freshness readback。"
|
||
},
|
||
{
|
||
"contract_id": "e2e_health_failure_only",
|
||
"display_name": "E2E Health failure-only",
|
||
"status": "preserved",
|
||
"policy_kind": "failure_only",
|
||
"success_noise_policy": "健康檢查成功不即時通知。",
|
||
"failure_policy": "workflow failure 才呼叫 notify bridge / Alertmanager payload。",
|
||
"workflow_refs": [
|
||
"e2e_health"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/e2e-health.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留 failure-only；後續補最近 run readback。"
|
||
},
|
||
{
|
||
"contract_id": "cd_pipeline_status_exception",
|
||
"display_name": "正式 CD 狀態通知例外",
|
||
"status": "exception_documented",
|
||
"policy_kind": "deployment_status_exception",
|
||
"success_noise_policy": "正式部署成功通知屬 release evidence，不套入一般備份成功靜音規則；仍不得在非部署情境洗版。",
|
||
"failure_policy": "tests/build/deploy/post-deploy 任一失敗必須升級。",
|
||
"workflow_refs": [
|
||
"cd_pipeline"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/cd.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留 release evidence；任何降噪調整另提批准包。"
|
||
},
|
||
{
|
||
"contract_id": "dev_cd_status_exception",
|
||
"display_name": "Dev CD 狀態通知例外",
|
||
"status": "exception_documented",
|
||
"policy_kind": "deployment_status_exception",
|
||
"success_noise_policy": "dev deploy status 屬部署流程訊號；不得擴大為其他成功洗版。",
|
||
"failure_policy": "dev build/deploy failure 升級到 AwoooP / Telegram contract。",
|
||
"workflow_refs": [
|
||
"cd_dev"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/cd-dev.yaml",
|
||
"scripts/ci/notify-awoooi-cicd.sh"
|
||
],
|
||
"next_action": "保留現況；後續評估 dev 通知是否需要降噪。"
|
||
},
|
||
{
|
||
"contract_id": "review_repair_and_manual_workflow_status_exception",
|
||
"display_name": "Review / repair / manual workflow 狀態例外",
|
||
"status": "exception_documented",
|
||
"policy_kind": "manual_status_exception",
|
||
"success_noise_policy": "code-review、alert deploy、migration、repair 的狀態訊號不自動擴張到成功洗版；手動 workflow 成功仍應看情境與 release evidence。",
|
||
"failure_policy": "review、alert deploy、migration 或 repair failure 必須留可追蹤證據。",
|
||
"workflow_refs": [
|
||
"awoooi_onboarding_warning_step",
|
||
"code_review",
|
||
"deploy_alerts",
|
||
"harbor_110_local_repair",
|
||
"run_migration"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/awoooi-onboarding-warning-step.yaml",
|
||
".gitea/workflows/code-review.yaml",
|
||
".gitea/workflows/deploy-alerts.yaml",
|
||
".gitea/workflows/harbor-110-local-repair.yaml",
|
||
".gitea/workflows/run-migration.yml"
|
||
],
|
||
"next_action": "後續補 alert/repair receipt；本 snapshot 不發通知、不觸發 migration 或 repair。"
|
||
},
|
||
{
|
||
"contract_id": "lint_and_typecheck_no_notify",
|
||
"display_name": "Lint / typecheck no-notify",
|
||
"status": "preserved",
|
||
"policy_kind": "read_only_no_notify",
|
||
"success_noise_policy": "lint / type sync 成功不通知。",
|
||
"failure_policy": "失敗只留 workflow 結果，是否升級需由 code-review / CD gate 判斷。",
|
||
"workflow_refs": [
|
||
"ansible_lint",
|
||
"type_sync_check"
|
||
],
|
||
"evidence_refs": [
|
||
".gitea/workflows/ansible-lint.yml",
|
||
".gitea/workflows/type-sync-check.yaml"
|
||
],
|
||
"next_action": "維持 no-notify；補 artifact retention。"
|
||
}
|
||
],
|
||
"latest_observations": [
|
||
{
|
||
"observation_id": "latest_gitea_runs_success_readback",
|
||
"status": "verified",
|
||
"summary": "P1-001 後續正式部署已由 Gitea code-review run 2597 與 CD run 2596 成功收斂；P1-002 只引用既有 deploy evidence，不觸發新 run。",
|
||
"evidence_refs": [
|
||
"docs/LOGBOOK.md",
|
||
"docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md"
|
||
]
|
||
},
|
||
{
|
||
"observation_id": "gitea_api_unauthenticated_boundary",
|
||
"status": "action_required",
|
||
"summary": "Gitea Actions API 若無 token 會遇到 401；P1-002 以 committed workflow、HTML/DB readback 或 owner attestation 為證據，不猜測 API 狀態。",
|
||
"evidence_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/security/S4-9-CANONICAL-OWNER-RESPONSE-ENVELOPE.md"
|
||
]
|
||
},
|
||
{
|
||
"observation_id": "workflow_secret_guard_present",
|
||
"status": "verified",
|
||
"summary": "正式 CD / code-review / dev CD 已具備 check-gitea-step-env-secrets guard，可阻擋 secrets 掛在 step env / action input；本 snapshot 不讀任何 Secret payload。",
|
||
"evidence_refs": [
|
||
"scripts/ci/check-gitea-step-env-secrets.js",
|
||
".gitea/workflows/cd.yaml"
|
||
]
|
||
}
|
||
],
|
||
"operator_contract": {
|
||
"display_mode": "read_only_gitea_workflow_runner_health",
|
||
"must_not_interpret_as": [
|
||
"workflow 修改批准",
|
||
"runner restart / stop 批准",
|
||
"Secret 已讀取或可輸出",
|
||
"Telegram 測試通知批准",
|
||
"排程啟用或變更批准",
|
||
"Gitea write token 授權",
|
||
"deploy / migration workflow 觸發批准"
|
||
],
|
||
"secret_display_policy": "只允許顯示 workflow / secret-name hygiene 與 redacted metadata；不得讀 token、runner token、webhook secret、authorization header 或任何 Secret payload。",
|
||
"runner_mutation_policy": "本 snapshot 只描述 explicit non110 runner label、watchdog 草案與 dry-run guard；不得 systemctl restart、docker stop、修改 label、註冊 runner 或套用 watchdog。",
|
||
"notification_policy": "成功不洗版是預設治理方向；failure-only / actionable-only 合約需保留，CD/review/manual workflow 的狀態通知例外需另外標示。"
|
||
},
|
||
"operation_boundaries": {
|
||
"read_only_api_allowed": true,
|
||
"workflow_modification_allowed": false,
|
||
"runner_restart_allowed": false,
|
||
"runner_container_stop_allowed": false,
|
||
"runner_label_change_allowed": false,
|
||
"runner_registration_allowed": false,
|
||
"secret_read_allowed": false,
|
||
"secret_plaintext_allowed": false,
|
||
"notification_send_allowed": false,
|
||
"schedule_enable_allowed": false,
|
||
"gitea_api_write_allowed": false,
|
||
"deploy_trigger_allowed": false,
|
||
"migration_trigger_allowed": false
|
||
},
|
||
"approval_boundaries": {
|
||
"workflow_modification_authorized": false,
|
||
"runner_mutation_authorized": false,
|
||
"notification_send_authorized": false,
|
||
"secret_plaintext_allowed": false,
|
||
"runtime_execution_authorized": false,
|
||
"schedule_change_authorized": false,
|
||
"gitea_write_authorized": false,
|
||
"deploy_trigger_authorized": false,
|
||
"migration_trigger_authorized": false
|
||
}
|
||
}
|