awoooi/docs/security/AI-PROVIDER-OWNER-RESPONSE-ACCEPTANCE.md

AI Provider / Model Routing Owner Response Acceptance

項目	內容
日期	2026-06-15
狀態	owner_response_acceptance_ledger_ready_no_runtime_action
工具	scripts/security/ai-provider-owner-response-acceptance.py
Snapshot	docs/security/ai-provider-owner-response-acceptance.snapshot.json
Schema	ai_provider_owner_response_acceptance_v1
runtime gate	0

1. 目的

AI provider、模型路由、Ollama proxy、fallback order、成本與隱私邊界已是 C1 高價值配置。這份文件把它們從「只知道要管」推進成可重跑 owner response acceptance 帳本，讓任何 provider 切換、fallback 調整、付費 provider 使用、外部 API 呼叫、prompt 外送、模型版本更新或 agent replacement 都先走只讀證據驗收。

本階段仍只做 source-control 文件、snapshot 與 guard，不呼叫任何模型、不讀 live endpoint、不切 provider、不改 Nginx、不送 prompt、不增加付費 provider 呼叫、不讀 secret、不安裝 SDK、不啟動 shadow / canary、不部署 production。

2. 驗收候選

Surface	範圍	風險	狀態
AI router provider policy / purpose mapping	purpose routing、provider priority、degraded mode	route drift 會造成外部 provider 誤用、成本上升、資料外送或品質下降	waiting_owner_response
Ollama proxy gateway / local fallback boundary	proxy route、local fallback、gateway health	proxy drift 會造成 fallback 失效或錯誤 upstream	waiting_owner_response
Fallback order / circuit breaker	fallback order、timeout、circuit breaker	只剩雲端或跳過本地 fallback 會造成成本與隱私風險	waiting_owner_response
Cost budget / quota / paid provider stop condition	quota、token budget、cost alert、stop condition	付費 provider 失控、告警不足或未設停損	waiting_owner_response
Privacy / data egress / prompt redaction boundary	prompt redaction、資料分級、外部 provider 資料外送	raw prompt、raw log、incident context 或 secrets 被外送	waiting_owner_response
Dry-run / benchmark / replay pack	dry-run、benchmark、fixture replay、quality gate	未經 replay / benchmark 就替換模型或 agent	waiting_owner_response
Model card / model version inventory	model card、version freshness、source-of-truth、redacted endpoint	模型卡片含 raw endpoint 或版本來源漂移	waiting_owner_response
Agent replacement / NemoTron / Hermes / OpenClaw candidate boundary	agent candidate、promotion gate、shadow/canary boundary	未授權 SDK、外部呼叫、shadow/canary 或 production replacement	waiting_owner_response

3. 固定數字

指標	目前值
acceptance candidates	8
write-capable candidates	5
paid-provider related candidates	5
data-egress candidates	6
live-evidence required candidates	6
acceptance fields	37
required owner fields	24
reviewer checks	24
outcome lanes	10
blocked actions	38
owner response received / accepted	0 / 0
dry-run / benchmark / cost / privacy accepted	0 / 0 / 0 / 0
fallback order / rollback owner accepted	0 / 0
runtime gate	0

4. 必填 owner response

每筆 AI provider owner response 必須至少包含：

1. owner role / team、provider owner、decision、decision reason、affected scope。
2. fallback order ref、dry-run result ref、benchmark result ref、quality gate ref。
3. cost review ref、quota budget ref、privacy review ref、data classification ref。
4. prompt redaction ref、secret handling ref、latency / timeout / circuit breaker SLO ref。
5. rollback owner、rollback plan ref、maintenance window、postcheck evidence refs。
6. redacted evidence refs、followup owner、no-secret-value attestation。

缺欄位只能要求補件，不得標記 accepted。

5. 拒收與隔離

以下內容一律拒收或隔離：

• raw prompt、raw log、raw incident payload、未脫敏截圖。
• raw live endpoint、內網位址、可直接連線 URL、API key、token、cookie、private key、env dump、secret value、secret hash 或 partial token。
• 夾帶 provider switch、fallback order change、Ollama proxy change、Nginx reload、env change、production deploy、workflow dispatch、external provider call、paid provider call、prompt send、SDK install、model download、agent runtime enable、shadow / canary enable。
• 只用 provider route 200、dashboard up、模型成功回覆一次或 UI 可見來宣稱 routing / cost / privacy / quality 已驗收。

6. Outcome lanes

Lane	意義
waiting_owner_response	尚未收到 AI provider owner response，全部 accepted / runtime count 維持 0
quarantine_secret_or_raw_payload	收到 secret、raw prompt、raw log、raw endpoint 或未脫敏內容時隔離
reject_execution_request	夾帶 provider switch、外部呼叫、prompt send、Nginx reload、env change 或 deploy 要求時拒收
request_fallback_supplement	缺 fallback order、degraded mode、circuit breaker 或 rollback 時要求補件
request_cost_privacy_supplement	缺 cost、quota、privacy、data classification 或 prompt redaction 時要求補件
request_benchmark_supplement	缺 dry-run、benchmark、fixture replay、quality gate 或 incumbent baseline 時要求補件
legacy_model_card_redaction_required	舊模型卡、runbook 或報表含 raw endpoint / 主機識別時，先改成脫敏 alias
ready_for_ai_provider_review	metadata 合格後，只能進 AI provider reviewer review
owner_review_only_update	只允許更新只讀 owner review ledger，不切 provider、不呼叫模型、不改 proxy
waiting_runtime_gate	即使 owner response accepted，runtime gate 仍需獨立人工批准

7. 完成度

工作	完成度	說明
AI provider owner response acceptance ledger	100%	已新增可重跑 script、snapshot、reviewer checks、outcome lanes 與 blocked actions
AI provider / model routing 只讀成熟度	60% -> 64%	從分類政策推進到 owner response acceptance；仍未收到 owner response
owner response received / accepted	0%	不得假性提高
runtime / provider 切換	0%	不呼叫模型、不切 provider、不改 proxy、不外送資料、不增加付費呼叫

8. 指令

python3 scripts/security/ai-provider-owner-response-acceptance.py \
  --root . \
  --output docs/security/ai-provider-owner-response-acceptance.snapshot.json

固定 committed snapshot 時間：

python3 scripts/security/ai-provider-owner-response-acceptance.py \
  --root . \
  --generated-at 2026-06-15T19:35:00+08:00 \
  --output docs/security/ai-provider-owner-response-acceptance.snapshot.json