awoooi/docs/security/AI-PROVIDER-OWNER-RESPONSE-ACCEPTANCE.md

# AI Provider / Model Routing Owner Response Acceptance

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-15 |
| 狀態 | `owner_response_acceptance_ledger_ready_no_runtime_action` |
| 工具 | `scripts/security/ai-provider-owner-response-acceptance.py` |
| Snapshot | `docs/security/ai-provider-owner-response-acceptance.snapshot.json` |
| Schema | `ai_provider_owner_response_acceptance_v1` |
| runtime gate | `0` |

## 1. 目的

AI provider、模型路由、Ollama proxy、fallback order、成本與隱私邊界已是 C1 高價值配置。這份文件把它們從「只知道要管」推進成可重跑 owner response acceptance 帳本，讓任何 provider 切換、fallback 調整、付費 provider 使用、外部 API 呼叫、prompt 外送、模型版本更新或 agent replacement 都先走只讀證據驗收。

本階段仍只做 source-control 文件、snapshot 與 guard，不呼叫任何模型、不讀 live endpoint、不切 provider、不改 Nginx、不送 prompt、不增加付費 provider 呼叫、不讀 secret、不安裝 SDK、不啟動 shadow / canary、不部署 production。

## 2. 驗收候選

| Surface | 範圍 | 風險 | 狀態 |
|---------|------|------|------|
| AI router provider policy / purpose mapping | purpose routing、provider priority、degraded mode | route drift 會造成外部 provider 誤用、成本上升、資料外送或品質下降 | `waiting_owner_response` |
| Ollama proxy gateway / local fallback boundary | proxy route、local fallback、gateway health | proxy drift 會造成 fallback 失效或錯誤 upstream | `waiting_owner_response` |
| Fallback order / circuit breaker | fallback order、timeout、circuit breaker | 只剩雲端或跳過本地 fallback 會造成成本與隱私風險 | `waiting_owner_response` |
| Cost budget / quota / paid provider stop condition | quota、token budget、cost alert、stop condition | 付費 provider 失控、告警不足或未設停損 | `waiting_owner_response` |
| Privacy / data egress / prompt redaction boundary | prompt redaction、資料分級、外部 provider 資料外送 | raw prompt、raw log、incident context 或 secrets 被外送 | `waiting_owner_response` |
| Dry-run / benchmark / replay pack | dry-run、benchmark、fixture replay、quality gate | 未經 replay / benchmark 就替換模型或 agent | `waiting_owner_response` |
| Model card / model version inventory | model card、version freshness、source-of-truth、redacted endpoint | 模型卡片含 raw endpoint 或版本來源漂移 | `waiting_owner_response` |
| Agent replacement / NemoTron / Hermes / OpenClaw candidate boundary | agent candidate、promotion gate、shadow/canary boundary | 未授權 SDK、外部呼叫、shadow/canary 或 production replacement | `waiting_owner_response` |

## 3. 固定數字

| 指標 | 目前值 |
|------|--------|
| acceptance candidates | `8` |
| write-capable candidates | `5` |
| paid-provider related candidates | `5` |
| data-egress candidates | `6` |
| live-evidence required candidates | `6` |
| acceptance fields | `37` |
| required owner fields | `24` |
| reviewer checks | `24` |
| outcome lanes | `10` |
| blocked actions | `38` |
| owner response received / accepted | `0 / 0` |
| dry-run / benchmark / cost / privacy accepted | `0 / 0 / 0 / 0` |
| fallback order / rollback owner accepted | `0 / 0` |
| runtime gate | `0` |

## 4. 必填 owner response

每筆 AI provider owner response 必須至少包含：

1. owner role / team、provider owner、decision、decision reason、affected scope。
2. fallback order ref、dry-run result ref、benchmark result ref、quality gate ref。
3. cost review ref、quota budget ref、privacy review ref、data classification ref。
4. prompt redaction ref、secret handling ref、latency / timeout / circuit breaker SLO ref。
5. rollback owner、rollback plan ref、maintenance window、postcheck evidence refs。
6. redacted evidence refs、followup owner、no-secret-value attestation。

缺欄位只能要求補件，不得標記 accepted。

## 5. 拒收與隔離

以下內容一律拒收或隔離：

- raw prompt、raw log、raw incident payload、未脫敏截圖。
- raw live endpoint、內網位址、可直接連線 URL、API key、token、cookie、private key、env dump、secret value、secret hash 或 partial token。
- 夾帶 provider switch、fallback order change、Ollama proxy change、Nginx reload、env change、production deploy、workflow dispatch、external provider call、paid provider call、prompt send、SDK install、model download、agent runtime enable、shadow / canary enable。
- 只用 provider route `200`、dashboard up、模型成功回覆一次或 UI 可見來宣稱 routing / cost / privacy / quality 已驗收。

## 6. Outcome lanes

| Lane | 意義 |
|------|------|
| `waiting_owner_response` | 尚未收到 AI provider owner response，全部 accepted / runtime count 維持 0 |
| `quarantine_secret_or_raw_payload` | 收到 secret、raw prompt、raw log、raw endpoint 或未脫敏內容時隔離 |
| `reject_execution_request` | 夾帶 provider switch、外部呼叫、prompt send、Nginx reload、env change 或 deploy 要求時拒收 |
| `request_fallback_supplement` | 缺 fallback order、degraded mode、circuit breaker 或 rollback 時要求補件 |
| `request_cost_privacy_supplement` | 缺 cost、quota、privacy、data classification 或 prompt redaction 時要求補件 |
| `request_benchmark_supplement` | 缺 dry-run、benchmark、fixture replay、quality gate 或 incumbent baseline 時要求補件 |
| `legacy_model_card_redaction_required` | 舊模型卡、runbook 或報表含 raw endpoint / 主機識別時，先改成脫敏 alias |
| `ready_for_ai_provider_review` | metadata 合格後，只能進 AI provider reviewer review |
| `owner_review_only_update` | 只允許更新只讀 owner review ledger，不切 provider、不呼叫模型、不改 proxy |
| `waiting_runtime_gate` | 即使 owner response accepted，runtime gate 仍需獨立人工批准 |

## 7. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| AI provider owner response acceptance ledger | `100%` | 已新增可重跑 script、snapshot、reviewer checks、outcome lanes 與 blocked actions |
| AI provider / model routing 只讀成熟度 | `60% -> 64%` | 從分類政策推進到 owner response acceptance；仍未收到 owner response |
| owner response received / accepted | `0%` | 不得假性提高 |
| runtime / provider 切換 | `0%` | 不呼叫模型、不切 provider、不改 proxy、不外送資料、不增加付費呼叫 |

## 8. 指令

```bash
python3 scripts/security/ai-provider-owner-response-acceptance.py \
  --root . \
  --output docs/security/ai-provider-owner-response-acceptance.snapshot.json
```

固定 committed snapshot 時間：

```bash
python3 scripts/security/ai-provider-owner-response-acceptance.py \
  --root . \
  --generated-at 2026-06-15T19:35:00+08:00 \
  --output docs/security/ai-provider-owner-response-acceptance.snapshot.json
```