6.4 KiB
Telegram 通知出口 Owner Response 驗收帳本
| 項目 | 內容 |
|---|---|
| 日期 | 2026-06-19 |
| 狀態 | owner_response_acceptance_ledger_ready_no_runtime_action |
| 工具 | scripts/security/telegram-notification-egress-owner-response-acceptance.py |
| Snapshot | docs/security/telegram-notification-egress-owner-response-acceptance.snapshot.json |
| Source snapshots | docs/security/telegram-notification-egress-owner-request-draft.snapshot.json、docs/security/telegram-notification-egress-migration-plan-draft.snapshot.json |
| 模式 | metadata-only；不讀 secret、不送 Telegram、不呼叫 Bot API、不改 workflow / script / API sender |
| runtime gate | 0 |
1. 目的
telegram_notification_egress_owner_response_acceptance_v1 把 Telegram 通知出口 owner request 草稿與 migration plan 草稿轉成 reviewer 可驗收的帳本。它處理的是既有 18 個 direct Bot API sendMessage call site 的 owner response 收件規則，避免把「CD success、route 200、UI 可見或 Telegram sent」誤判為 delivery receipt 或自動化閉環完成。
這份帳本不是 owner response received，也不是 migration authorized。workflow、ops script 或 API sender 要真的改走 wrapper / gateway 時，仍需要獨立 change evidence、維護窗口、rollback owner 與 runtime approval。
2. 固定數字
| 指標 | 數值 | 解讀 |
|---|---|---|
source_request_draft_count |
11 |
來源 owner request 草稿 |
source_migration_candidate_count |
11 |
來源 migration candidate |
source_direct_bot_api_call_count |
18 |
既有 direct Bot API call site |
acceptance_candidate_count |
11 |
每個 direct egress 檔案一個驗收候選 |
workflow_acceptance_candidate_count |
6 |
Gitea workflow 類 |
ops_script_acceptance_candidate_count |
4 |
Ops script 類 |
api_direct_acceptance_candidate_count |
1 |
API direct sender 類 |
acceptance_field_count |
33 |
每個 candidate 的驗收欄位 |
required_owner_field_count |
19 |
owner response 必填欄位 |
reviewer_check_count |
23 |
reviewer 必檢規則 |
outcome_lane_count |
10 |
收件結果分流 |
forbidden_payload_count |
14 |
禁止出現在回覆中的 payload 類型 |
blocked_action_count |
35 |
帳本階段禁止動作 |
所有 request sent、recipient confirmed、audit event emitted、owner response received / accepted / rejected / quarantined、formatter convergence accepted、redaction contract accepted、delivery receipt accepted、break-glass fallback accepted、maintenance window accepted、rollback owner accepted、postcheck evidence accepted、dedup / fingerprint accepted、no-false-green accepted、migration authorized、workflow / script / API sender modification、Telegram send、Bot API call、workflow dispatch、production deploy、secret collection、raw payload storage、production write、runtime gate、action button 全部維持 0 / false。
3. Reviewer checks
Reviewer 必須確認：
- source owner request draft 與 migration plan 都是目前版本。
- owner identity、decision、decision reason、affected scope 與 followup owner 完整。
- 所有 evidence refs 都是脫敏 metadata，不包含 secret value、hash、partial token、raw message payload 或 raw workflow log。
- message shape contract、
message_readability_guard_ref、redaction contract、formatter convergence、gateway / Alertmanager target、break-glass fallback、delivery receipt、dedup / fingerprint、maintenance window、rollback owner 與 postcheck evidence 都明確存在。 message_readability_guard_ref必須固定指向docs/security/telegram-alert-readability-guard.snapshot.json，確保 direct egress 遷移審查不能繞過告警卡片化、脫敏、runtime_write_gate=0與 no-false-green。no_secret_value_attestation、no_raw_payload_attestation、no_false_green_attestation都存在。- migration authorization 與 runtime approval 必須分離；此帳本不能直接批准 workflow / script / API sender 修改。
- runtime gate 維持
0。
4. Outcome lanes
| Lane | 說明 |
|---|---|
waiting_owner_response |
等待合格 owner response |
quarantine_secret_or_raw_payload |
收到 secret、raw payload 或 raw log 時隔離 |
reject_execution_request |
回覆夾帶立即執行要求時拒收 |
request_owner_route_supplement |
owner、route 或 scope 不完整 |
request_formatter_convergence_supplement |
formatter convergence 或 target 不完整 |
request_redaction_or_receipt_supplement |
redaction contract、delivery receipt 或 dedup 不完整 |
request_maintenance_or_rollback_supplement |
maintenance window 或 rollback owner 不完整 |
ready_for_migration_review |
metadata 完整，可另開 migration review |
owner_review_only_update |
只更新 owner review metadata |
waiting_runtime_gate |
owner review 完成後仍等待 runtime gate |
5. 禁止動作
此帳本階段禁止：
- 標記 owner response received / accepted。
- 送 Telegram、呼叫 Bot API、dispatch workflow、觸發 CD 或 production deploy。
- 修改 workflow、ops script、API sender、chat route、Bot token 或 secret。
- 讀 secret store、收 secret value / hash / partial token / chat id secret。
- 保存 raw message payload、raw workflow log、raw action log、內部協作逐字稿或未脫敏截圖。
- 把 CD success、route
200、UI 可見或 Telegram sent 當作 delivery receipt。 - 跳過 formatter convergence、redaction contract、dedup / fingerprint、break-glass fallback 或 no-false-green review。
- 開 runtime gate 或新增 action button。
6. 驗證指令
python3 scripts/security/telegram-notification-egress-owner-response-acceptance.py --root .
python3 -m json.tool docs/security/telegram-notification-egress-owner-response-acceptance.snapshot.json >/dev/null
python3 -m py_compile scripts/security/telegram-notification-egress-owner-response-acceptance.py
python3 scripts/security/security-mirror-progress-guard.py --root .
7. 完成度
| 項目 | 完成度 | 邊界 |
|---|---|---|
| Owner response acceptance artifact | 100% |
11 個 candidate 已可 reviewer 驗收 |
| Owner response dispatch / received / accepted | 0% |
尚未送件、尚未收件、尚未接受 |
| Direct Bot API convergence | 0% |
尚未修改 workflow / script / API sender |
| Runtime execution | 0% |
不送 Telegram、不呼叫 Bot API、不開 runtime gate |