727 lines
30 KiB
JSON
727 lines
30 KiB
JSON
{
|
||
"schema_version": "ai_agent_proactive_operations_contract_v1",
|
||
"generated_at": "2026-06-11T21:30:00+08:00",
|
||
"program_status": {
|
||
"overall_completion_percent": 30,
|
||
"current_priority": "P2",
|
||
"current_task_id": "P2-402A",
|
||
"next_task_id": "P2-402B",
|
||
"read_only_mode": true,
|
||
"runtime_authority": "contract_only_no_version_or_runtime_update",
|
||
"status_note": "本快照定義 AI Agent 可主動處理的營運工作與版本生命週期；本波不啟用排程、不升級套件、不更新主機、不 pull image、不 auto merge、不發 Telegram。"
|
||
},
|
||
"external_source_evidence": [
|
||
{
|
||
"id": "renovate_gitea_docs",
|
||
"name": "Renovate Gitea platform docs",
|
||
"url": "https://docs.renovatebot.com/modules/platform/gitea/",
|
||
"decision_use": "列為 Gitea 版本更新 PR 自動化候選；本波不啟用 bot、不建立 workflow。"
|
||
},
|
||
{
|
||
"id": "osv_scanner_docs",
|
||
"name": "OSV-Scanner usage docs",
|
||
"url": "https://google.github.io/osv-scanner/usage/",
|
||
"decision_use": "列為依賴漏洞掃描候選；本波只做契約，不執行外部 vulnerability query。"
|
||
},
|
||
{
|
||
"id": "trivy_docs",
|
||
"name": "Trivy docs",
|
||
"url": "https://trivy.dev/",
|
||
"decision_use": "列為 repository / filesystem / container / Kubernetes 掃描候選；本波不安裝、不掃描 live cluster。"
|
||
},
|
||
{
|
||
"id": "syft_docs",
|
||
"name": "Anchore Syft",
|
||
"url": "https://github.com/anchore/syft",
|
||
"decision_use": "列為 SBOM 產生候選；本波不安裝、不產生 live SBOM。"
|
||
},
|
||
{
|
||
"id": "grype_docs",
|
||
"name": "Anchore Grype",
|
||
"url": "https://github.com/anchore/grype",
|
||
"decision_use": "列為 SBOM / filesystem / container vulnerability scanner 候選；本波不安裝。"
|
||
},
|
||
{
|
||
"id": "kubernetes_version_skew_policy",
|
||
"name": "Kubernetes Version Skew Policy",
|
||
"url": "https://kubernetes.io/releases/version-skew-policy/",
|
||
"decision_use": "K3s / Kubernetes / kubectl / kubelet 版本更新必須先檢查 skew policy。"
|
||
},
|
||
{
|
||
"id": "docker_scout_docs",
|
||
"name": "Docker Scout docs",
|
||
"url": "https://docs.docker.com/scout/",
|
||
"decision_use": "列為 container image SBOM / vulnerability platform 候選；若使用 managed service 需費用與 secret gate。"
|
||
}
|
||
],
|
||
"delegation_model": {
|
||
"autonomy_levels": [
|
||
{
|
||
"level": "L0_observe_only",
|
||
"meaning": "Agent 可主動盤點、比對版本、產生風險摘要，不修改 repo、主機或服務。"
|
||
},
|
||
{
|
||
"level": "L1_report_only",
|
||
"meaning": "Agent 可產生定期報告、KM 記錄、LOGBOOK 草稿與 Telegram action-required 摘要草稿。"
|
||
},
|
||
{
|
||
"level": "L2_approval_package_only",
|
||
"meaning": "Agent 可產生升級批准包、rollback plan、smoke plan、owner packet；不得自行套用。"
|
||
},
|
||
{
|
||
"level": "L3_draft_change_after_gate",
|
||
"meaning": "通過明確 gate 後，Agent 可建立 branch / PR 草案或 Renovate 類更新 PR；不得 auto merge。"
|
||
},
|
||
{
|
||
"level": "L4_execute_after_human_approval",
|
||
"meaning": "只有低風險、可回滾、已驗證 dry-run 的操作可在人工批准後執行。"
|
||
},
|
||
{
|
||
"level": "L5_blocked",
|
||
"meaning": "主機升級、K3s 版本升級、production route、secret rotation value、付費服務啟用等仍阻擋。"
|
||
}
|
||
],
|
||
"agent_responsibilities": [
|
||
{
|
||
"agent_id": "hermes",
|
||
"responsibility": "版本發現、changelog 摘要、SBOM / CVE / license / drift 證據、KM / runbook 更新草稿。"
|
||
},
|
||
{
|
||
"agent_id": "openclaw",
|
||
"responsibility": "風險分級、相依性衝突、rollback / dry-run gate、Telegram action-required 與 HITL 仲裁。"
|
||
},
|
||
{
|
||
"agent_id": "nemotron",
|
||
"responsibility": "AI Agent / 模型 / prompt / tool-call 變更的 sanitized replay、schema 合約與離線評分。"
|
||
}
|
||
],
|
||
"telegram_policy": {
|
||
"allowed_now": "只產 action-required 摘要資料；不得直接送 Bot。",
|
||
"failure_only": "版本 watch source 連續失敗、critical CVE、EOL approaching、production incompatibility risk 才可進 Telegram Gateway queue。",
|
||
"success_spam": "禁止成功巡檢洗版。"
|
||
}
|
||
},
|
||
"version_lifecycle_domains": [
|
||
{
|
||
"domain_id": "ai_agents_models",
|
||
"display_name": "AI Agent / 模型 / prompt / SDK",
|
||
"primary_owner": "nemotron",
|
||
"cadence": "weekly + triggered_on_major_release",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "OpenClaw 仲裁 + replay / shadow / canary gate",
|
||
"approval_gate": "market_scorecard_replay_and_cost_data_approval_required",
|
||
"tracked_examples": ["OpenClaw", "Hermes", "NemoTron", "LangGraph", "OpenAI Agents SDK", "Claude Agent SDK"]
|
||
},
|
||
{
|
||
"domain_id": "python_packages",
|
||
"display_name": "API Python 套件",
|
||
"primary_owner": "hermes",
|
||
"cadence": "daily_repo_only + weekly_external",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "dependency upgrade approval package",
|
||
"approval_gate": "dependency_approval_required",
|
||
"tracked_examples": ["pyproject.toml", "requirements.txt"]
|
||
},
|
||
{
|
||
"domain_id": "javascript_packages",
|
||
"display_name": "Web pnpm / npm 套件",
|
||
"primary_owner": "hermes",
|
||
"cadence": "daily_repo_only + weekly_external",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "dependency upgrade approval package",
|
||
"approval_gate": "dependency_approval_required",
|
||
"tracked_examples": ["package.json", "pnpm-lock.yaml"]
|
||
},
|
||
{
|
||
"domain_id": "container_images",
|
||
"display_name": "Docker base image / runtime image / digest",
|
||
"primary_owner": "openclaw",
|
||
"cadence": "weekly + triggered_on_critical_cve",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "image digest pin proposal + smoke plan",
|
||
"approval_gate": "image_pull_build_push_approval_required",
|
||
"tracked_examples": ["Dockerfile", "Harbor image tags", "base image digest"]
|
||
},
|
||
{
|
||
"domain_id": "kubernetes_k3s_components",
|
||
"display_name": "K3s / Kubernetes / kubectl / kubelet",
|
||
"primary_owner": "openclaw",
|
||
"cadence": "monthly + triggered_on_eol_or_security",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "version skew report + maintenance window approval",
|
||
"approval_gate": "k8s_upgrade_maintenance_window_required",
|
||
"tracked_examples": ["kube-apiserver", "kubelet", "kubectl", "CNI", "Ingress"]
|
||
},
|
||
{
|
||
"domain_id": "host_os_packages",
|
||
"display_name": "主機 OS / kernel / systemd / SSH / Nginx",
|
||
"primary_owner": "openclaw",
|
||
"cadence": "monthly + triggered_on_critical_cve",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "Ansible check-mode / maintenance plan only",
|
||
"approval_gate": "host_update_approval_required",
|
||
"tracked_examples": ["Ubuntu packages", "kernel", "Nginx", "OpenSSH"]
|
||
},
|
||
{
|
||
"domain_id": "observability_stack",
|
||
"display_name": "Prometheus / Alertmanager / Grafana / SigNoz / OTEL / Sentry",
|
||
"primary_owner": "hermes",
|
||
"cadence": "weekly_freshness + monthly_upgrade_review",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "observability compatibility report",
|
||
"approval_gate": "monitoring_route_receiver_write_blocked",
|
||
"tracked_examples": ["Prometheus", "Alertmanager", "Grafana", "SigNoz", "OpenTelemetry Collector", "Sentry"]
|
||
},
|
||
{
|
||
"domain_id": "stateful_services",
|
||
"display_name": "PostgreSQL / Redis / MinIO / Harbor / Gitea",
|
||
"primary_owner": "openclaw",
|
||
"cadence": "monthly + triggered_on_security",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "backup freshness + rollback + compatibility gate",
|
||
"approval_gate": "stateful_upgrade_approval_required",
|
||
"tracked_examples": ["PostgreSQL", "Redis", "MinIO", "Harbor", "Gitea"]
|
||
},
|
||
{
|
||
"domain_id": "backup_dr_tooling",
|
||
"display_name": "Backup / DR / restore 工具",
|
||
"primary_owner": "openclaw",
|
||
"cadence": "weekly_freshness + monthly_drill_readiness",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "restore drill approval package",
|
||
"approval_gate": "restore_or_prune_approval_required",
|
||
"tracked_examples": ["restic", "Velero", "backup scripts", "offsite escrow"]
|
||
},
|
||
{
|
||
"domain_id": "ci_cd_and_runner_tools",
|
||
"display_name": "Gitea Actions / runner / deploy tooling",
|
||
"primary_owner": "hermes",
|
||
"cadence": "weekly_freshness + triggered_on_runner_failure",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "workflow / runner owner packet",
|
||
"approval_gate": "workflow_modification_approval_required",
|
||
"tracked_examples": ["Gitea workflow", "runner labels", "deploy scripts"]
|
||
},
|
||
{
|
||
"domain_id": "mcp_tools_integrations",
|
||
"display_name": "MCP tools / A2A / external integrations",
|
||
"primary_owner": "hermes",
|
||
"cadence": "weekly_contract_review",
|
||
"current_allowed_autonomy": "L2_approval_package_only",
|
||
"update_authority": "MCP schema compatibility report",
|
||
"approval_gate": "new_tool_or_secret_approval_required",
|
||
"tracked_examples": ["K8s MCP", "Prometheus MCP", "Sentry MCP", "Telegram Gateway"]
|
||
},
|
||
{
|
||
"domain_id": "public_web_admin_surfaces",
|
||
"display_name": "網站前後台 / route / UI smoke",
|
||
"primary_owner": "hermes",
|
||
"cadence": "daily_smoke + triggered_on_release",
|
||
"current_allowed_autonomy": "L1_report_only",
|
||
"update_authority": "UI smoke report only",
|
||
"approval_gate": "code_change_required_for_fix",
|
||
"tracked_examples": ["awoooi.wooo.work", "AwoooP", "IwoooS", "governance tabs"]
|
||
}
|
||
],
|
||
"delegable_capabilities": [
|
||
{
|
||
"capability_id": "version_discovery_freshness",
|
||
"display_name": "版本發現與新鮮度盤點",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "low",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["version_delta_report", "freshness_score", "stale_source_list"],
|
||
"approval_gate": "read_only_allowed",
|
||
"telegram_policy": "failure_or_action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "upgrade_approval_package",
|
||
"display_name": "升級批准包與 rollback plan",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["risk_matrix", "rollback_plan", "smoke_plan", "owner_packet"],
|
||
"approval_gate": "human_approval_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "renovate_pr_proposal",
|
||
"display_name": "Renovate / Gitea PR 草案候選",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L3_draft_change_after_gate",
|
||
"outputs": ["pr_plan", "grouping_policy", "automerge_false_policy"],
|
||
"approval_gate": "workflow_and_bot_approval_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "sbom_generation_plan",
|
||
"display_name": "SBOM 產生與保存策略",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["sbom_plan", "retention_policy", "tool_choice_matrix"],
|
||
"approval_gate": "tool_install_or_ci_change_approval_required",
|
||
"telegram_policy": "failure_only"
|
||
},
|
||
{
|
||
"capability_id": "vulnerability_triage",
|
||
"display_name": "CVE / OSV / container vulnerability triage",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["vulnerability_report", "blast_radius", "patch_priority"],
|
||
"approval_gate": "external_scan_and_dependency_approval_required",
|
||
"telegram_policy": "critical_or_action_required"
|
||
},
|
||
{
|
||
"capability_id": "license_policy_review",
|
||
"display_name": "License / copyleft 風險檢查",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["license_delta_report", "owner_review_queue"],
|
||
"approval_gate": "legal_owner_review_required",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "kubernetes_version_skew_review",
|
||
"display_name": "Kubernetes / K3s version skew 檢查",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["skew_report", "upgrade_order", "rollback_window"],
|
||
"approval_gate": "maintenance_window_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "host_patch_advisory",
|
||
"display_name": "主機 patch advisory / Ansible check-mode 計畫",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["host_patch_plan", "affected_service_map", "reboot_risk"],
|
||
"approval_gate": "host_update_approval_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "config_drift_owner_packet",
|
||
"display_name": "高價值配置 drift 與 owner packet",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["drift_report", "owner_packet", "rollback_refs"],
|
||
"approval_gate": "owner_response_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "service_health_staleness",
|
||
"display_name": "服務健康缺口與過期端點",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["stale_endpoint_report", "health_gap_list"],
|
||
"approval_gate": "restart_or_endpoint_change_requires_approval",
|
||
"telegram_policy": "failure_only"
|
||
},
|
||
{
|
||
"capability_id": "observability_noise_review",
|
||
"display_name": "告警噪音、路由與 silence 建議",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["noise_report", "rule_change_proposal"],
|
||
"approval_gate": "alert_rule_write_approval_required",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "telegram_delivery_audit",
|
||
"display_name": "Telegram 告警送達與 fallback 稽核",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["delivery_report", "silent_route_alert", "fallback_gap"],
|
||
"approval_gate": "telegram_send_or_route_change_requires_approval",
|
||
"telegram_policy": "failure_or_action_required"
|
||
},
|
||
{
|
||
"capability_id": "backup_dr_readiness",
|
||
"display_name": "備份 / DR / restore readiness",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["readiness_matrix", "restore_drill_package", "offsite_gap"],
|
||
"approval_gate": "restore_or_prune_approval_required",
|
||
"telegram_policy": "failure_or_action_required"
|
||
},
|
||
{
|
||
"capability_id": "cost_and_capacity_review",
|
||
"display_name": "成本、容量與資源優化建議",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["capacity_forecast", "cost_delta", "resource_limit_proposal"],
|
||
"approval_gate": "cost_or_runtime_change_approval_required",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "ai_provider_route_review",
|
||
"display_name": "AI provider / model route / fallback 成本與品質檢查",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["provider_scorecard", "fallback_gap", "cost_boundary_report"],
|
||
"approval_gate": "cost_data_and_route_approval_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "nemotron_replay_and_model_eval",
|
||
"display_name": "NemoTron replay / model eval / prompt eval",
|
||
"primary_owner": "nemotron",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["sanitized_replay_score", "schema_pass_rate", "tool_call_quality"],
|
||
"approval_gate": "cost_data_and_sanitized_fixture_approval_required",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "rag_km_freshness",
|
||
"display_name": "RAG / KM stale cleanup 與知識壓縮草案",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["stale_km_report", "merge_draft", "owner_review_queue"],
|
||
"approval_gate": "owner_review_required",
|
||
"telegram_policy": "digest_only"
|
||
},
|
||
{
|
||
"capability_id": "ui_smoke_and_accessibility",
|
||
"display_name": "前後台 UI smoke / mobile / overflow / a11y",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "low",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["browser_smoke_report", "overflow_report", "route_health"],
|
||
"approval_gate": "code_change_required_for_fix",
|
||
"telegram_policy": "failure_only"
|
||
},
|
||
{
|
||
"capability_id": "data_quality_and_schema_drift",
|
||
"display_name": "資料品質、schema drift、RLS / tenant context 稽核",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["schema_drift_report", "rls_context_gap", "migration_plan"],
|
||
"approval_gate": "db_migration_approval_required",
|
||
"telegram_policy": "action_required"
|
||
},
|
||
{
|
||
"capability_id": "incident_postmortem_and_learning",
|
||
"display_name": "Incident postmortem、學習回寫與週報",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["postmortem_draft", "learning_delta", "weekly_digest"],
|
||
"approval_gate": "km_write_owner_review_required",
|
||
"telegram_policy": "digest_only"
|
||
},
|
||
{
|
||
"capability_id": "secret_rotation_metadata",
|
||
"display_name": "Secret rotation metadata 與到期提醒",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "high",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["secret_name_inventory", "rotation_due_report", "owner_packet"],
|
||
"approval_gate": "secret_value_handling_forbidden",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "compliance_and_evidence_pack",
|
||
"display_name": "合規、稽核證據包、owner response 完整度",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L1_report_only",
|
||
"outputs": ["evidence_pack", "missing_owner_response", "audit_gap"],
|
||
"approval_gate": "read_only_allowed",
|
||
"telegram_policy": "digest_only"
|
||
},
|
||
{
|
||
"capability_id": "market_watch_and_candidate_intake",
|
||
"display_name": "市場主流 AI Agent / 工具候選追蹤",
|
||
"primary_owner": "hermes",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["market_watch_report", "candidate_queue", "integration_review"],
|
||
"approval_gate": "market_scorecard_and_replay_gate_required",
|
||
"telegram_policy": "action_required_only"
|
||
},
|
||
{
|
||
"capability_id": "release_train_digest",
|
||
"display_name": "Release train 風險整理與分批升級建議",
|
||
"primary_owner": "openclaw",
|
||
"risk_tier": "medium",
|
||
"automation_level": "L2_approval_package_only",
|
||
"outputs": ["release_train_plan", "batching_policy", "blast_radius_map"],
|
||
"approval_gate": "operator_release_window_required",
|
||
"telegram_policy": "action_required"
|
||
}
|
||
],
|
||
"cadence_matrix": [
|
||
{
|
||
"cadence_id": "hourly_failure_signals",
|
||
"frequency": "hourly",
|
||
"scope": "只看既有 monitoring / Telegram / workflow failure signal，不查外部 registry。",
|
||
"allowed_now": true,
|
||
"next_gate": "已存在監控資料；不發成功訊息"
|
||
},
|
||
{
|
||
"cadence_id": "daily_repo_only",
|
||
"frequency": "daily",
|
||
"scope": "manifest / lockfile / Dockerfile / K8s YAML / runbook / snapshot freshness repo-only 巡檢。",
|
||
"allowed_now": true,
|
||
"next_gate": "排程 workflow 仍需獨立批准"
|
||
},
|
||
{
|
||
"cadence_id": "weekly_external_primary_sources",
|
||
"frequency": "weekly",
|
||
"scope": "PyPI / npm / GitHub release / Docker registry / Kubernetes / tool official docs primary source version watch。",
|
||
"allowed_now": false,
|
||
"next_gate": "external_source_and_workflow_approval_required"
|
||
},
|
||
{
|
||
"cadence_id": "monthly_upgrade_planning",
|
||
"frequency": "monthly",
|
||
"scope": "host OS、K3s、stateful services、observability stack、backup tooling 升級批次規劃。",
|
||
"allowed_now": false,
|
||
"next_gate": "maintenance_window_and_owner_approval_required"
|
||
},
|
||
{
|
||
"cadence_id": "triggered_critical_security",
|
||
"frequency": "triggered",
|
||
"scope": "critical CVE、EOL notice、重大版本、watch source failure、Telegram silence、production incompatibility。",
|
||
"allowed_now": false,
|
||
"next_gate": "critical_alert_route_and_human_gate_required"
|
||
}
|
||
],
|
||
"mcp_tool_requirements": [
|
||
{
|
||
"tool_id": "gitea_release_pr_mcp",
|
||
"display_name": "Gitea / PR / workflow MCP",
|
||
"purpose": "查 commit、workflow、PR、runner、release train；未批准不得寫 workflow、建 PR 或 merge。",
|
||
"owner_agent": "hermes",
|
||
"status": "planned_read_only_first",
|
||
"approval_gate": "write_requires_human_gate"
|
||
},
|
||
{
|
||
"tool_id": "package_registry_mcp",
|
||
"display_name": "PyPI / npm / GitHub release / Docker registry MCP",
|
||
"purpose": "查官方版本與 changelog；重大版本進 approval package。",
|
||
"owner_agent": "hermes",
|
||
"status": "planned_external_source",
|
||
"approval_gate": "external_source_approval_required"
|
||
},
|
||
{
|
||
"tool_id": "sbom_sca_mcp",
|
||
"display_name": "SBOM / SCA MCP",
|
||
"purpose": "連接 Syft / Grype / OSV / Trivy 類工具；只產報告與批准包。",
|
||
"owner_agent": "openclaw",
|
||
"status": "tool_candidate",
|
||
"approval_gate": "tool_install_or_ci_change_approval_required"
|
||
},
|
||
{
|
||
"tool_id": "k8s_version_mcp",
|
||
"display_name": "K8s / K3s version MCP",
|
||
"purpose": "只讀檢查 kubectl / kubelet / apiserver / CNI version skew 與升級順序。",
|
||
"owner_agent": "openclaw",
|
||
"status": "planned_read_only",
|
||
"approval_gate": "cluster_write_blocked"
|
||
},
|
||
{
|
||
"tool_id": "host_os_readonly_mcp",
|
||
"display_name": "Host OS read-only MCP",
|
||
"purpose": "讀 OS / kernel / package version metadata；不 apt upgrade、不 reboot、不 restart。",
|
||
"owner_agent": "openclaw",
|
||
"status": "planned_read_only",
|
||
"approval_gate": "ssh_or_host_probe_approval_required"
|
||
},
|
||
{
|
||
"tool_id": "observability_context_mcp",
|
||
"display_name": "Prometheus / Alertmanager / SigNoz / Sentry MCP",
|
||
"purpose": "把版本變更與 metrics / trace / issue regression 串起來。",
|
||
"owner_agent": "hermes",
|
||
"status": "partially_existing",
|
||
"approval_gate": "route_receiver_write_blocked"
|
||
},
|
||
{
|
||
"tool_id": "backup_dr_mcp",
|
||
"display_name": "Backup / DR readiness MCP",
|
||
"purpose": "升級前檢查備份新鮮度、restore readiness、rollback evidence。",
|
||
"owner_agent": "openclaw",
|
||
"status": "snapshot_existing",
|
||
"approval_gate": "restore_execution_blocked"
|
||
},
|
||
{
|
||
"tool_id": "telegram_gateway_mcp",
|
||
"display_name": "Telegram Gateway MCP",
|
||
"purpose": "只送 action-required、failure-only、critical security；禁止 direct send 與成功洗版。",
|
||
"owner_agent": "openclaw",
|
||
"status": "policy_existing",
|
||
"approval_gate": "telegram_direct_send_blocked"
|
||
}
|
||
],
|
||
"rag_memory_contract": [
|
||
{
|
||
"memory_id": "version_history",
|
||
"display_name": "Version History Memory",
|
||
"storage": "PostgreSQL + pgvector + committed snapshots",
|
||
"owner_agent": "hermes",
|
||
"purpose": "保存每個 Agent、套件、工具、服務、主機的版本歷史、source ref、freshness 與升級結果。",
|
||
"redaction_policy": "不得保存 secret、token、private key、registry credential、完整工作視窗對話。"
|
||
},
|
||
{
|
||
"memory_id": "compatibility_matrix",
|
||
"display_name": "Compatibility Matrix Memory",
|
||
"storage": "knowledge_entries + runbooks + docs/evaluations",
|
||
"owner_agent": "openclaw",
|
||
"purpose": "保存 K8s skew、service compatibility、DB migration、provider fallback 與 rollback constraints。",
|
||
"redaction_policy": "只保存版本、風險、證據 ref，不保存 secret payload。"
|
||
},
|
||
{
|
||
"memory_id": "upgrade_outcomes",
|
||
"display_name": "Upgrade Outcomes Memory",
|
||
"storage": "timeline_events + audit_logs + LOGBOOK",
|
||
"owner_agent": "openclaw",
|
||
"purpose": "把每次升級成功、失敗、回滾、延遲、Telegram outcome 回寫，讓下次分批更聰明。",
|
||
"redaction_policy": "只保存 decision envelope、evidence refs、redacted summary。"
|
||
},
|
||
{
|
||
"memory_id": "delegation_playbooks",
|
||
"display_name": "Delegation Playbooks Memory",
|
||
"storage": "playbooks + KM + docs/runbooks",
|
||
"owner_agent": "hermes",
|
||
"purpose": "把可委派工作轉成標準化 playbook、owner packet 與 approval package 模板。",
|
||
"redaction_policy": "owner response 只保存 redacted evidence refs。"
|
||
}
|
||
],
|
||
"rollout_tasks": [
|
||
{
|
||
"task_id": "P2-402A",
|
||
"priority": "P2",
|
||
"status": "done",
|
||
"completion_percent": 100,
|
||
"owner_agent": "Hermes + OpenClaw + NemoTron",
|
||
"summary": "定義 AI Agent 主動營運委派與版本生命週期契約、schema、snapshot、只讀 API 與文件同步。",
|
||
"next_gate": "正式部署驗證"
|
||
},
|
||
{
|
||
"task_id": "P2-402B",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "Hermes",
|
||
"summary": "建立 repo-only daily version freshness snapshot，不查外部 registry、不改 workflow。",
|
||
"next_gate": "workflow_schedule_approval_required"
|
||
},
|
||
{
|
||
"task_id": "P2-402C",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "OpenClaw",
|
||
"summary": "建立 Renovate / OSV / Trivy / Syft / Grype 工具採用批准包。",
|
||
"next_gate": "tool_install_ci_change_and_secret_approval_required"
|
||
},
|
||
{
|
||
"task_id": "P2-402D",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "OpenClaw",
|
||
"summary": "建立 Telegram action-required digest policy，只通知 critical / action-required，不發成功洗版。",
|
||
"next_gate": "telegram_gateway_e2e_required"
|
||
},
|
||
{
|
||
"task_id": "P2-402E",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "Hermes",
|
||
"summary": "設計 Gitea PR 草案 lane：grouping、automerge=false、tests、rollback、owner response。",
|
||
"next_gate": "gitea_bot_and_branch_policy_approval_required"
|
||
},
|
||
{
|
||
"task_id": "P2-402F",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "OpenClaw",
|
||
"summary": "建立 host OS / K3s / stateful services 版本只讀盤點與 maintenance window 批准包。",
|
||
"next_gate": "host_readonly_probe_and_maintenance_window_approval_required"
|
||
},
|
||
{
|
||
"task_id": "P2-402G",
|
||
"priority": "P2",
|
||
"status": "planned",
|
||
"completion_percent": 0,
|
||
"owner_agent": "Hermes",
|
||
"summary": "把可委派能力接入 governance UI，顯示自主等級、gate、owner、Telegram policy。",
|
||
"next_gate": "frontend_ui_change_approval_required"
|
||
}
|
||
],
|
||
"approval_boundaries": {
|
||
"runtime_version_update_allowed": false,
|
||
"package_upgrade_allowed": false,
|
||
"host_upgrade_allowed": false,
|
||
"container_pull_allowed": false,
|
||
"workflow_schedule_enabled": false,
|
||
"auto_merge_allowed": false,
|
||
"telegram_direct_send_allowed": false,
|
||
"secret_plaintext_allowed": false,
|
||
"paid_external_service_allowed": false,
|
||
"production_route_change_allowed": false
|
||
},
|
||
"rollups": {
|
||
"version_domain_count": 12,
|
||
"delegable_capability_count": 24,
|
||
"cadence_count": 5,
|
||
"mcp_tool_count": 8,
|
||
"rag_memory_count": 4,
|
||
"rollout_task_count": 7,
|
||
"auto_execute_allowed_count": 0,
|
||
"approval_required_capability_count": 23,
|
||
"blocked_update_domain_ids": [
|
||
"ai_agents_models",
|
||
"python_packages",
|
||
"javascript_packages",
|
||
"container_images",
|
||
"kubernetes_k3s_components",
|
||
"host_os_packages",
|
||
"observability_stack",
|
||
"stateful_services",
|
||
"backup_dr_tooling",
|
||
"ci_cd_and_runner_tools",
|
||
"mcp_tools_integrations",
|
||
"public_web_admin_surfaces"
|
||
],
|
||
"telegram_action_required_capability_ids": [
|
||
"ai_provider_route_review",
|
||
"backup_dr_readiness",
|
||
"config_drift_owner_packet",
|
||
"cost_and_capacity_review",
|
||
"data_quality_and_schema_drift",
|
||
"host_patch_advisory",
|
||
"kubernetes_version_skew_review",
|
||
"license_policy_review",
|
||
"market_watch_and_candidate_intake",
|
||
"nemotron_replay_and_model_eval",
|
||
"observability_noise_review",
|
||
"release_train_digest",
|
||
"renovate_pr_proposal",
|
||
"secret_rotation_metadata",
|
||
"upgrade_approval_package",
|
||
"version_discovery_freshness",
|
||
"vulnerability_triage",
|
||
"telegram_delivery_audit"
|
||
]
|
||
}
|
||
}
|