# PChome AI 自動化優先工作清單

> 最後更新: 2026-07-11 Asia/Taipei
> 範圍: PChome growth / MOMO mapping AI 自動化主線
> 真相來源: Gitea `dev` / `main`、正式環境 `/health`、正式 DB readback、machine-verifiable artifacts

> 狀態更新：本文件後段大量 preflight / guard / package 紀錄只保留為歷史證據，
> 不再視為業績方案完成度。現行 program truth 以
> `governance/pchome_growth_program_review.json` 與下列 2026-07-10 重排為準，
> `superseded_by=global_product_governance_v2`。

## 2026-07-10 業績閉環重排

正式環境基線：業績最新日 `2026-06-24`，落後 16 天；13,032 個有業績商品中，
只有 35 個曾有外部報價，覆蓋約 0.27%。因此目前不能宣稱「PChome 業績提升完整方案已完成」。

| 順序 | 工作主線 | 狀態 | 下一個完成條件 |
|---|---|---|---|
| P0-1 | 授權業績資料自動取得與匯入 | 程式已完成，待正式來源與新鮮資料閉環 | 最新業績 <= 1 天，source receipt 與 post-verifier 同 run 完成 |
| P0-2 | 全商品身份圖譜與營收加權對應 | 進行中 | 覆蓋 80% 營收商品的 >= 90% |
| P0-3 | 合法多電商資料取得 | 進行中 | 每個啟用來源具 freshness SLO、normalize、matcher、verifier |
| P0-4 | 多平台營收決策引擎 | 已部署，受多來源資料缺口阻擋 | 正式環境以至少 2 個已啟用平台產生可重播決策 |
| P0-5 | 調價、促銷、內容、曝光實驗與歸因 | 未開始 | 同 run 完成 apply、轉換驗證、增量營收歸因與 rollback |
| P1-1 | 專業 UI/UX 作戰 cockpit | V10.776 source-ready，待正式推版與視覺 QA | desktop/mobile 首屏無文字牆、無假圖、只顯示一個主要下一步 |
| P1-2 | Ollama-first MCP / RAG / PixelRAG runtime | 進行中 | 正式 flags 啟用，PixelRAG receipt 可 replay，Qwen3-VL 驗證通過 |
| P1-3 | 資安與治理自動化 | 進行中 | low/medium/high controlled apply 自動閉環，critical 才 break-glass |

已完成且本輪保留：Google Drive 自動匯入、MOMO 同款與單位價資料模型、
PixelRAG blocked-page 分類、外部報價正規化、正式 DB 安全邊界。

本輪修復：來源 seed 不再覆寫 runtime 啟用狀態、營收服務不再只查 MOMO、
新增 Yahoo / ETMall / friDay / Rakuten PixelRAG alias、多平台 evidence 與 actionable 分層、
業績 freshness gate、全 catalog 覆蓋率、漏跑排程追趕，以及首屏來源摘要與過期資料阻擋。

2026-07-11 P0-1 source receipt：新增 Drive → 授權 HTTPS → 授權 IMAP → 受控落地目錄的
自動取得順序、SHA-256 冪等、同交易雙表 replace/verifier/rollback、
`trace_id/span_id/run_id/work_item_id` durable receipt、舊人工暫停旗標 sunset 與首屏來源 cockpit。
程式完成不等於 production closure；正式退出條件仍是取得日期 <= 1 天的授權報表並完成 runtime readback。

### 2026-07-11 外部專業基準落地

- OWASP SSRF Prevention Cheat Sheet：授權 HTTPS provider 採 HTTPS scheme、host/port allowlist、公開 IP 驗證、禁止 redirect，並固定連到已驗證 IP、保留原 hostname TLS 驗證，降低 DNS rebinding / TOCTOU 風險。
- OpenTelemetry Trace Context：receipt 使用 32 位小寫 hex `trace_id` 與 16 位小寫 hex `span_id`，保留後續跨服務 log/trace correlation 契約。
- NIST AI RMF：acquisition run 以 policy/asset mapping、風險決策、量測/verifier 與 retry/rollback/learning writeback 對應 Govern、Map、Measure、Manage；UI 或 source-ready 不得取代 production runtime closure。

## 不可遺漏的插入需求

以下是使用者在主線推進期間插入、且必須保留在完整工作項目裡的要求。後續不得再把這些需求漏掉或變成口頭提醒。

1. 正式環境才是最新版本真相；不得用本機檔案、舊筆記、舊分支蓋過 production truth。
2. 版本不得搞錯；2026-07-11 開工 live truth 為正式環境 `V10.775`，本輪 source 目標為 `V10.776`；完成條件必須包含明確版本 bump、部署與 readback，後續仍以當下 `/health` 為準。
3. GitHub 全面 freeze；不得使用 GitHub、`gh`、GitHub API、GitHub Actions、PR、issue、mirror 或 read-only GitHub 流程。
4. 實作結果必須推到 Gitea `dev` 與 `main`；若改到 runtime 行為，還必須部署到正式環境並回讀。
5. 主方向是 AI 自動化，不是人工審核；人工欄位只能當 evidence / ledger / UI truth，不得阻擋低爆炸半徑、可驗證、可回滾的 controlled apply。
6. 每條主線都要產生實作結果；不能只交計畫、UI 卡片、文件或口頭盤點。
7. 中途插入的所有需求都必須進入本 backlog，且標明優先順序與狀態。
8. 所有工作必須照優先順序推進；除非高優先 blocker 要求，否則不得開支線偏離。
9. 產品體驗要往主流、專業產品網站前進：AI 狀態可見、下一步清楚、繁中介面、營運儀表板密度足夠、一般產品頁不暴露 raw engineering terms。
10. 必須參考外部主流專業網站 / SaaS / observability dashboard 做法：狀態分層、下一步優先、收據可追蹤、drift 監控、automation health visibility。
11. AI 技術自動化要升級為可見能力：agent status、controlled apply、artifact receipts、drift verifier、rollback / re-apply evidence，不能把隱藏人工 gate 當主流程。
12. 每次宣稱完成都必須列出 source truth、runtime truth、測試、production readback、artifact / blocker 狀態。
13. 不把工作丟回給使用者；Codex 收到「批准 / 繼續」後，必須主動補齊 target selector、dry-run / check-mode、rollback、post-apply verifier 與回讀證據。
14. 需要同時看清楚所有工作狀態：已完成、進行中、未開始；不能只報正在做的一小段。

## 優先順序總表

| Priority | 主線 | 狀態 | 為什麼排這裡 |
|---|---|---|---|
| P0 | Runtime truth + AI controlled apply closure | 進行中，核心閉環已完成多段 | 先證明 AI 真的在正式環境可執行、可回讀、可驗證、可回滾 |
| P1 | 產品可視化 + 專業網站體驗 | 進行中 | 使用者要看得到實作結果，AI 自動化不能只藏在 artifact / log |
| P2 | 外部主流 benchmark 落成 guardrails | 已完成第一版，持續擴充 | 把主流專業做法變成可測規則，不只是參考口號 |
| P3 | 擴大 AI 自動化覆蓋面 | 進行中 | 把目前 PChome retry lane 的閉環模式複製到更多安全場景 |
| P4 | Source / deployment governance | 持續進行 | 保證版本、Gitea、正式環境、DB 安全紅線不再混亂 |

## P0 - Runtime Truth And AI Controlled Apply Closure

狀態: 進行中，核心閉環已完成多段。

目的: 先讓 PChome mapping automation 在正式環境真的 execute、verify、stay correct。

已完成:

- 正式環境版本真相 guard：`/health` 是最高真相；2026-07-11 開工基線為 `V10.775`，本輪 source 目標為 `V10.776`。
- Gitea `dev` / `main` source truth 對齊。
- Retry exception controlled apply executor 已落地，目標表為 `pchome_product_matches`。
- 正式 DB 已 controlled apply 4 個 selectors:
  - `14560744 -> DDBH21-A900I79YR-002`
  - `8932783 -> DDBH21-A900I79YR-002`
  - `15132753 -> DDBH21-A900I79YR-002`
  - `14941743 -> DDBH21-A900I79YR-002`
- Executor receipt 已 materialize。
- Receipt replay closeout 已用 artifacts 與 DB readback 補齊。
- AI automation readiness 已可回報:
  - `AI_AUTOMATION_CONTROLLED_APPLY_CLOSEOUT_VERIFIED`
  - controlled apply lane completed
  - receipt replay lane completed
- Drift verifier 已完成:
  - production readback `4/4`
  - `drift_count=0`
  - drift lane completed
- Drift verifier artifact receipt 已完成:
  - materialized artifact count `1`
  - hash match count `1`
- Automated drift monitor / smoke path 已完成:
  - `PChome 受控落地 drift monitor` 已納入 AI automation smoke checks
  - 每次 `/api/ai-automation/smoke` 與每日 smoke 摘要都會例行執行 read-only drift verifier
  - drift detected 或 verifier write-risk 會升為 `critical`
- Drift rollback / re-apply recommendation package 已完成:
  - `direct-mapping-retry-candidate-exception-controlled-apply-drift-recovery-package` 可輸出 read-only recovery package
  - drift detected 時會產生 controlled re-apply SQL shape、rollback SQL shape、selector bindings 與 acceptance gates
  - 0 drift 時會產生 no-op evidence，避免把正常狀態誤報成人工審核
- Compact latest apply / replay / drift / recovery readback endpoint 已完成:
  - `direct-mapping-retry-candidate-exception-controlled-apply-compact-readback-package` 會回傳 apply、replay、drift、recovery 四段 compact receipt
  - 產品面可直接讀取 `product_status`、`next_machine_action`、selector readback、drift count 與 artifact hash 狀態
  - compact readback 自身也可 materialize artifact 並驗證 hash
- Controlled-apply artifact retention policy 已完成:
  - `direct-mapping-retry-candidate-exception-controlled-apply-artifact-retention-package` 會掃描 controlled apply 相關 artifact families
  - 每個 family 依 `keep_latest_per_family` 保留最新 evidence，並額外保護 active compact readback chain
  - 只產生 prune candidates 與 retention receipt，不直接刪檔、不寫 DB、不執行 destructive prune
- Product dashboard first-viewport surface 已完成:
  - PChome 業績成長作戰台第一視窗已接入 AI automation readiness、receipt replay、drift verifier、drift recovery、compact readback 與 artifact retention policy
  - 第一視窗直接顯示「AI 全自動閉環已回讀」、selector readback、drift count、retention 保留數與 automation lane 狀態
  - 頁面讀取採 read-only package，不寫 DB、不刪 artifacts、不執行 prune
- AI debt scanner 顯示產品面清空:
  - `PRODUCT_SURFACE_CLEAR`
  - `finding_count=0`
  - `primary_human_gate_count=0`
- PChome auto-policy authorization guard runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy authorization guard`
  - read-only 組裝 auto-policy DB apply guard lane，檢查 no-secret / no-SQL / no-DB-write / machine-verifiable / exception-only
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_authorization_guard` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_authorization_guard",...}`
  - 不做外部 fetch、不寫 DB、不發 apply authorization，下一個機器動作是補 machine fetch evidence 與後續 controlled authorization lane
- PChome auto-policy decision preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy decision preflight`
  - 以本機 machine evidence adapter 自動推進 `execute_fetch=True` 的 decision preflight ready path
  - 明確標記 `payload_source=local_contract_fixture`、`outbound_network=false`、`business_data_source=false`、`writes_database_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_decision_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_decision_preflight",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不發 apply authorization，下一個機器動作是 authorization decision closeout lane
- PChome auto-policy decision closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy decision closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 decision closeout ready path
  - 明確標記 `post_apply_verifier_required_count=1`、`same_run_truth_required_count=1`、`writes_database_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_decision_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_decision_closeout",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不發 apply authorization，下一個機器動作是 authorization issuer gate lane
- PChome auto-policy authorization issuer gate runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy authorization issuer gate`
  - 以本機 contract fixture + machine evidence adapter 自動推進 issuer gate ready path
  - 明確標記 `required_issuer_evidence_count=9`、`nonsecret_authorization_claim_count=8`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_authorization_issuer_gate` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_authorization_issuer_gate",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing decision preflight lane
- PChome auto-policy signing decision preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing decision preflight`
  - 以本機 contract fixture + machine evidence adapter 自動推進 signing decision preflight ready path
  - 明確標記 `signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_decision_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_decision_preflight",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing decision closeout lane
- PChome auto-policy signing decision closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing decision closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 signing decision closeout ready path
  - 明確標記 `signing_decision_closeout_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_decision_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_decision_closeout",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing issuer guard lane
- PChome auto-policy signing issuer guard runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing issuer guard`
  - 以本機 contract fixture + machine evidence adapter 自動推進 signing issuer guard ready path
  - 明確標記 `signing_issuer_guard_check_count=12`、`signing_decision_closeout_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_issuer_guard` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_issuer_guard",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing issuer closeout lane
- PChome auto-policy signing issuer closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing issuer closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 final signable request package closeout path
  - 明確標記 `signing_issuer_closeout_check_count=12`、`signing_issuer_guard_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_issuer_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_issuer_closeout",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing execution preflight lane
- PChome auto-policy signing execution preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing execution preflight`
  - 以本機 contract fixture + machine evidence adapter 自動推進 operator-held secret boundary preflight path
  - 明確標記 `signing_execution_preflight_check_count=12`、`signing_issuer_closeout_check_count=12`、`operator_held_secret_boundary_count=1`、`signing_execution_input_requirement_count=10`、`signing_execution_abort_condition_count=8`、`rollback_boundary_count=4`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_execution_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_execution_preflight",...}`
  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing execution closeout lane
- PChome auto-policy signing execution closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing execution closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 unsigned signed-authorization receipt boundary closeout path
  - 明確標記 `signing_execution_closeout_check_count=12`、`signing_execution_preflight_check_count=12`、`unsigned_signed_authorization_receipt_boundary_count=1`、`operator_held_secret_boundary_count=1`、`signing_execution_input_requirement_count=10`、`signing_execution_abort_condition_count=8`、`rollback_boundary_count=4`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_execution_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_execution_closeout",...}`
  - 不包含 signed receipt、不包含 signature material、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signed receipt preflight lane
- PChome auto-policy signed receipt preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signed receipt preflight`
  - 以本機 contract fixture + machine evidence adapter 自動推進 external signing receipt evidence boundary preflight path
  - 明確標記 `signed_receipt_preflight_check_count=12`、`signing_execution_closeout_check_count=12`、`external_signing_receipt_evidence_boundary_count=1`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`operator_held_secret_boundary_count=1`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signed_receipt_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signed_receipt_preflight",...}`
  - 不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signed receipt closeout lane
- PChome auto-policy signed receipt closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signed receipt closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 detached receipt verification boundary closeout path
  - 明確標記 `signed_receipt_closeout_check_count=12`、`signed_receipt_preflight_check_count=12`、`external_signing_receipt_evidence_boundary_count=1`、`detached_receipt_verification_boundary_count=1`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`detached_receipt_verification_check_count=10`、`operator_held_secret_boundary_count=1`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signed_receipt_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signed_receipt_closeout",...}`
  - 不執行 detached signature verification、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signed receipt evidence intake lane
- PChome auto-policy signed receipt evidence intake runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signed receipt evidence intake`
  - 以本機 contract fixture + machine evidence adapter 自動推進 detached verification evidence schema intake path
  - 明確標記 `signed_receipt_evidence_intake_check_count=12`、`signed_receipt_closeout_check_count=12`、`detached_verification_evidence_schema_count=1`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`detached_receipt_verification_check_count=10`、`detached_verification_evidence_field_count=12`、`detached_verification_acceptance_gate_count=10`、`operator_held_secret_boundary_count=1`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signed_receipt_evidence_intake` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signed_receipt_evidence_intake",...}`
  - 不執行 detached signature verification、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不接受 plaintext secret、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 detached verification evidence validation lane
- PChome auto-policy detached verification evidence validation runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy detached verification evidence validation`
  - 以本機 contract fixture + machine evidence adapter 自動推進 verifier receipt closeout boundary validation path
  - 明確標記 `detached_verification_evidence_validation_check_count=12`、`signed_receipt_evidence_intake_check_count=12`、`verifier_receipt_closeout_boundary_count=1`、`verifier_receipt_field_count=12`、`verifier_receipt_acceptance_gate_count=10`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`detached_receipt_verification_check_count=10`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_detached_verification_evidence_validation` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_detached_verification_evidence_validation",...}`
  - 不執行 detached signature verification、不持久化 verifier receipt、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不接受 plaintext secret、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 verifier receipt closeout lane
- PChome auto-policy verifier receipt closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy verifier receipt closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 database apply authorization verifier handoff path
  - 明確標記 `verifier_receipt_closeout_check_count=12`、`verifier_receipt_closeout_pass_count=12`、`detached_verification_evidence_validation_check_count=12`、`verifier_receipt_evidence_handoff_count=1`、`verifier_receipt_evidence_handoff_field_count=12`、`verifier_receipt_handoff_acceptance_gate_count=10`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_verifier_receipt_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_verifier_receipt_closeout",...}`
  - 不執行 detached signature verification、不持久化 verifier receipt、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不接受 plaintext secret、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 database apply authorization verifier handoff lane
- PChome auto-policy authorization evidence execution preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy authorization evidence execution preflight`
  - 以本機 contract fixture + machine evidence adapter 自動推進 authorization evidence execution closeout path
  - 明確標記 `authorization_evidence_execution_preflight_check_count=12`、`authorization_evidence_execution_preflight_pass_count=12`、`authorization_evidence_execution_field_count=12`、`authorization_evidence_execution_acceptance_gate_count=10`、`authorization_verifier_receipt_closeout_ready_count=1`、`verifier_receipt_evidence_handoff_count=1`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_authorization_evidence_execution_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_authorization_evidence_execution_preflight",...}`
  - 不執行 authorization evidence、不執行 detached signature verification、不持久化 verifier receipt、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不接受 plaintext secret、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 authorization evidence execution closeout lane
- PChome auto-policy authorization evidence execution closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy authorization evidence execution closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 database apply controlled-apply final preflight path
  - 明確標記 `authorization_evidence_execution_closeout_check_count=12`、`authorization_evidence_execution_closeout_pass_count=12`、`authorization_evidence_execution_closeout_field_count=12`、`authorization_evidence_execution_closeout_acceptance_gate_count=10`、`authorization_evidence_execution_preflight_ready_count=1`、`database_apply_authorization_final_verifier_gate_ready_count=1`、`verifier_receipt_evidence_handoff_count=1`、`required_external_receipt_evidence_count=10`、`external_receipt_acceptance_gate_count=8`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_authorization_evidence_execution_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_authorization_evidence_execution_closeout",...}`
  - 不執行 authorization evidence、不執行 database apply、不執行 detached signature verification、不持久化 verifier receipt、不包含 external signed receipt、不包含 signed receipt、不包含 signature material、不接受 plaintext secret、不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 controlled-apply final preflight lane
- PChome auto-policy controlled-apply final preflight runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy controlled apply final preflight`
  - 以本機 contract fixture + machine evidence adapter 自動推進 controlled dry-run package path
  - 明確標記 `controlled_apply_final_preflight_check_count=12`、`controlled_apply_final_preflight_pass_count=12`、`controlled_apply_final_preflight_field_count=12`、`controlled_apply_final_preflight_acceptance_gate_count=10`、`rollback_binding_count=1`、`rollback_binding_field_count=8`、`post_apply_verifier_binding_count=1`、`post_apply_verifier_binding_field_count=8`、`dry_run_only=true`、`check_mode_only=true`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_controlled_apply_final_preflight` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_controlled_apply_final_preflight",...}`
  - 不執行 authorization evidence、不執行 database apply、不執行 endpoint/SQL、不寫 DB、不讀 secret、不簽發 apply authorization，下一個機器動作是 controlled dry-run package lane
- PChome auto-policy controlled dry-run package runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy controlled dry-run package`
  - 以本機 contract fixture + machine evidence adapter 自動推進 controlled dry-run receipt closeout path
  - 明確標記 `controlled_dry_run_package_check_count=12`、`controlled_dry_run_package_pass_count=12`、`controlled_dry_run_package_field_count=12`、`controlled_dry_run_acceptance_gate_count=10`、`dry_run_execution_receipt_preview_count=1`、`dry_run_execution_receipt_field_count=8`、`dry_run_result_parser_count=1`、`dry_run_result_parser_field_count=10`、`receipt_execution_performed=false`、`receipt_stdout_included=false`、`receipt_stderr_included=false`、`command_shape_execution_allowed=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_controlled_dry_run_package` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_controlled_dry_run_package",...}`
  - 不執行 dry-run、不捕捉 stdout/stderr、不執行 authorization evidence、不執行 database apply、不執行 endpoint/SQL、不寫 DB、不讀 secret、不簽發 apply authorization，下一個機器動作是 controlled dry-run receipt closeout lane
- PChome auto-policy controlled dry-run receipt closeout runtime monitoring 已完成:
  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy controlled dry-run receipt closeout`
  - 以本機 contract fixture + machine evidence adapter 自動推進 controlled dry-run runner readiness path
  - 明確標記 `controlled_dry_run_receipt_closeout_check_count=12`、`controlled_dry_run_receipt_closeout_pass_count=12`、`controlled_dry_run_receipt_closeout_field_count=12`、`controlled_dry_run_receipt_closeout_acceptance_gate_count=10`、`dry_run_result_parser_count=1`、`dry_run_result_parser_field_count=10`、`receipt_validation_report_count=1`、`receipt_validation_field_count=8`、`receipt_validation_status=preview_validated_not_executed`、`validation_execution_performed=false`、`validation_stdout_included=false`、`validation_stderr_included=false`、`validation_database_apply_authorized=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_controlled_dry_run_receipt_closeout` family
  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_controlled_dry_run_receipt_closeout",...}`
  - 不執行 dry-run、不捕捉 stdout/stderr、不執行 authorization evidence、不執行 database apply、不執行 endpoint/SQL、不寫 DB、不讀 secret、不簽發 apply authorization，下一個機器動作是 controlled dry-run runner readiness lane

進行中 / 下一步，必須照順序:

1. 將 auto-policy controlled dry-run receipt closeout 往 controlled dry-run runner readiness lane 推進。

完成標準:

- Gitea `dev` / `main` 已 push。
- runtime code change 已部署正式環境。
- `/health` healthy 且 production version truth PASS。
- 正式 DB readback 與 artifact hash readback 都有證據。
- focused PChome automation 與 AI debt tests 通過。

## P1 - Product Visibility And Professional Website Experience

狀態: 進行中，本輪已完成 `/ai_intelligence`、`/observability/overview`、`/ai_automation_smoke`、`/observability/agent_orchestration`、`/observability/ai_calls`、`/observability/quality_trend`、`/observability/budget`、`/observability/business_intel`、`/observability/host_health`、`/observability/rag_queries`、`/observability/promotion_review` 與 `/observability/ppt_audit_history` 密集 AI 工作台文字密度守門，並新增高可見 AI surfaces route-level HTML readback 防退化 guard、runtime AI smoke readback 與整站 UI/UX Agent inventory。

目的: 讓 AI 自動化在產品裡可見，成為專業營運工作流，而不是只藏在後端。

已完成:

- AI readiness 已聚合主要 automation lanes。
- Controlled apply、receipt replay、drift verifier 已進 readiness。
- 產品層 automation result 已輸出 zero primary human gates。
- PChome dashboard 第一視窗已接入 compact readback 與 artifact retention policy。
- 第一視窗 automation pipeline 已從「等待 verifier」改成顯示受控落地、最新回讀、證據留存的 read-only production 狀態。
- Dashboard AI automation wording guard 已完成:
  - 第一視窗可見文案改為繁中營運語言：異動、最新回讀、證據留存、資料寫入、清理建議
  - 不再把 `retention`、`Compact`、`Artifact`、`DB writes`、`prune` 壓在產品第一視窗
  - `tests/test_pchome_dashboard_ai_wording_guard.py` 已鎖住第一視窗不可退回 raw engineering terms
- `/ai_intelligence` 商品明細價格證據 guard 已完成:
  - 商品列與單品詳情都以 `aria-label="價格證據"` 與 `data-evidence` 固定 PChome 價格、MOMO 參考價、差距、可信度四格。
  - 搜尋欄明確涵蓋商品、分類、編號與 MOMO 候選，排序支援優先級、近 7 天業績、價差、下滑幅度、可信度。
  - `tests/test_ai_intelligence_product_evidence_guardrails.py` 已鎖住四格價格證據、候選待確認 / 待補狀態與搜尋排序契約。
- `/ai_intelligence` 密集 AI 工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-ai-workbench"`，以「AI 作戰 / 證據優先 / 下一步」短標籤取代長說明。
  - KPI note、benchmark detail、alert 副句、mini-card 說明、策略 note、decision copy、來源長句與單品 reason list 從可見 UI 退場。
  - `tests/test_ai_intelligence_text_density_guardrails.py` 已鎖住短任務文案、detail meta 與 explanatory copy hidden contract。
- `/observability/overview` 密集 AI 觀測工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-observability-workbench"`，以「AI 觀測 / 風險優先 / 下一步」短標籤承接 golden signals。
  - hero lede、signal note、route desc、host meta 與資料來源長句從可見 UI 退場，保留狀態、數字與子頁入口。
  - `tests/test_observability_text_density_guardrails.py` 已鎖住 compact marker、第一層狀態數字與 explanatory copy hidden contract。
- `/ai_automation_smoke` 密集 AI 巡檢工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-smoke-workbench"`，以「AI 巡檢 / 風險優先 / 推播摘要」短標籤承接 AI 健康檢查。
  - hero lede、趨勢說明、每日摘要說明與診斷細節提示從可見 UI 退場，保留狀態、數字、趨勢、每日摘要與檢查項目 summary。
  - `tests/test_ai_automation_smoke_text_density_guardrails.py` 已鎖住 compact marker、第一層狀態數字與 explanatory copy hidden contract。
- `/observability/agent_orchestration` 密集 AI Agent 工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-agent-workbench"`，以「AI 分工 / 成本守門 / 知識命中」短標籤承接 Agent 編排狀態。
  - hero 說明、KPI 小註、列內描述、卡片描述與頁尾重複標題從可見 UI 退場，保留呼叫總量、主力路徑、付費成本、知識命中、分工矩陣與工具協作表。
  - `tests/test_agent_orchestration_text_density_guardrails.py` 已鎖住 compact marker、第一層狀態數字與 explanatory copy hidden contract。
- `/observability/ai_calls` 密集 AI 流量工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-ai-calls-workbench"`，以「流量監控 / 成本守門 / 知識命中」短標籤承接 AI 呼叫狀態。
  - hero 說明、KPI 小註、素材說明與頁尾重複標題從可見 UI 退場，保留呼叫總量、用量、成本、延遲、知識命中、錯誤、情境矩陣與最近呼叫。
  - `tests/test_ai_calls_text_density_guardrails.py` 已鎖住 compact marker、第一層狀態數字與 explanatory copy hidden contract。
- `/observability/quality_trend` 密集 AI 品質工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-quality-workbench"`，以「品質回饋 / 知識可靠 / 行動成效」短標籤承接 AI 建議可靠性。
  - hero 說明、KPI 小註與頁尾重複標題從可見 UI 退場，保留反饋總量、最低均分、蒸餾樣本、知識評分、使用情境反饋、根因建議與實際動作成效。
  - `tests/test_quality_trend_text_density_guardrails.py` 已鎖住 compact marker、第一層狀態數字與 explanatory copy hidden contract。
- `/observability/budget` 密集 AI 成本工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-budget-workbench"`，以「成本守門 / 節流狀態 / 知識策略」短標籤承接成本治理。
  - hero 說明、按鈕註解、KPI 小註與頁尾重複標題從可見 UI 退場，保留當月花費、預算使用率、預警、已節流、預算線、成本趨勢、成本集中與 AI 價格決策成效。
  - `tests/test_budget_text_density_guardrails.py` 已鎖住 compact marker、第一層成本訊號與 explanatory copy hidden contract。
- `/observability/business_intel` 密集 AI 商業工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-business-workbench"`，以「戰果追蹤 / 閉環成效 / 競品訊號」短標籤承接 AI 商業狀態。
  - hero 說明、決策節奏註解、KPI 小註、panel 說明與頁尾資料來源從可見 UI 退場，保留高信心未跟進、平均信心分、有效率、競品監測、外部促銷活動監控、策略族群、最近建議與閉環學習紀錄。
  - `tests/test_business_intel_text_density_guardrails.py` 已鎖住 compact marker、第一層商業訊號與 explanatory copy hidden contract。
- `/observability/host_health` 密集 AI runtime 工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-runtime-workbench"`，以「主機級聯 / 自癒閉環 / 成本節流」短標籤承接 AI runtime 狀態。
  - hero 說明、KPI 小註與頁尾重複標題從可見 UI 退場，保留建議服務離線、AIOps 未解、自癒成功率、節流供應商、AI 建議服務主機、健康趨勢、自癒閉環、工具層與事件紀錄。
  - `tests/test_host_health_text_density_guardrails.py` 已鎖住 compact marker、第一層 runtime 訊號與 explanatory copy hidden contract。
- `/observability/rag_queries` 密集 AI 知識工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-knowledge-workbench"`，以「知識命中 / 省模閉環 / 回饋學習」短標籤承接 RAG 召回狀態。
  - hero 說明、KPI 小註與頁尾重複標題從可見 UI 退場，保留查詢數、命中率、省模型、回饋分、查詢串流、使用情境品質與命中內容查閱。
  - `tests/test_rag_queries_text_density_guardrails.py` 已鎖住 compact marker、第一層知識訊號與 explanatory copy hidden contract。
- `/observability/promotion_review` 密集 AI 晉升例外工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-promotion-workbench"`，以「AI 例外 / 去重守門 / 防污染」短標籤承接知識晉升例外狀態。
  - hero 說明、KPI 小註與頁尾重複標題從可見 UI 退場，保留待決策、知識庫、30 日採用、污染攔截、例外佇列、策略權重與最近知識。
  - `tests/test_promotion_review_text_density_guardrails.py` 已鎖住 compact marker、第一層晉升例外訊號與 non-manual wording。
- `/observability/ppt_audit_history` 密集 AI 視覺 QA 工作台文字密度 guard 已完成:
  - 首屏改成 `data-density-guardrail="compact-ppt-workbench"`，以「預覽就緒 / 視覺審核 / 修復閉環」短標籤承接 PPT 產線狀態。
  - hero 說明、KPI 小註、runtime/env var、DB/table wording 與頁尾重複標題從可見 UI 退場，保留最新簡報、產線健康度、最近可預覽簡報、工作隊列、視覺問題追蹤與修復流程。
  - `tests/test_ppt_audit_text_density_guardrails.py` 已鎖住 compact marker、第一層視覺 QA 訊號、non-raw wording 與產出紀錄語言。
- 高可見 AI surfaces route-level HTML readback guard 已完成:
  - Flask client 會實際 render `/observability/overview`、`/observability/ai_calls`、`/observability/quality_trend`、`/observability/budget`、`/observability/business_intel`、`/observability/host_health`、`/observability/rag_queries`、`/observability/agent_orchestration`、`/observability/promotion_review`、`/observability/ppt_audit_history`。
  - 每頁都必須保留 compact density marker，且不得回流 `PPT_VISION_ENABLED=`、`PPT_AUTO_GENERATION_ENABLED=`、`ppt_generation_runs`、DB write raw wording、manual/human gate primary wording、Artifact retention / Compact 回讀等產品面 raw engineering copy。
  - `tests/test_admin_observability_routes.py::test_high_visibility_ai_surfaces_route_html_readback_keeps_compact_contract` 已鎖住 route / HTML readback。
- 高可見 AI surface runtime readback 已完成:
  - `/api/ai-automation/surface-html-readback` 會 read-only 檢查 10 個 AI observability surface contract。
  - `/api/ai-automation/smoke` 已加入 `AI surface HTML readback`，從 7 項 smoke 擴充為 8 項。
  - `/api/ai-automation/scheduled-health-summary` 已輸出 `ai_surface_html_readback` family，讓排程健康摘要也能看見產品頁退化。
  - 此檢查不寫 DB、不發通知、不要求 browser；失敗時 next machine action 是 `repair_ai_surface_html_contract`。
- 整站 UI/UX Agent inventory 已完成:
  - `/api/ai-automation/sitewide-ui-ux-agent` 會掃描真正頁面模板，排除 partial/components/base layouts。
  - 當前基線: 55 個頁面模板、31 個高優先模板、29 個 compact guardrail、0 個待專業化 surface、0 個 raw engineering leak。
  - `/api/ai-automation/sitewide-ui-ux-repair-package` 會產生 no-write controlled repair package，優先修復高曝光頁，且不寫 DB、不執行 shell、不讀 secrets。
  - 四批 controlled UI/UX repair 已完成 AI observability、AI 建議、PPT/CI/CD/業績/比價/成長/供貨風險高優先 surface，整站 repair package 目前為 `no_op`。
- 整站 visual/mobile QA artifact readback 已完成:
  - `scripts/check_responsive_overflow.js --artifact-output data/ai_automation/sitewide_visual_qa_latest.json` 會把 desktop / tablet / mobile overflow QA 輸出為 machine-readable artifact。
  - `/api/ai-automation/sitewide-visual-qa-readback` 只讀 artifact，回報 route_count、viewport_count、failed_count、overflow_issue_count、stale 與 next_machine_action。
  - `/api/ai-automation/smoke` 已加入 `Sitewide visual QA readback`，scheduled health summary 已加入 `sitewide_visual_qa` family，`/metrics` 會輸出對應 Prometheus family status。
  - readback 不寫 DB、不送通知、不啟動 browser；artifact 生成才需要 Playwright/瀏覽器，避免把 visual QA 變成產品 API 的重型副作用。

已完成 / 下一步，必須照順序:

1. 對照外部主流 observability / workflow dashboard pattern，將 benchmark 結論固化為 UI guardrails。
2. 增加專業的「今日 AI 自動化狀態」摘要:
   - 已自動落地什麼
   - 已驗證什麼
   - 異動狀態
   - 下一個機器動作
3. 增加 route / HTML readback，避免產品頁退回 raw engineering wording。
   - 已完成: 高可見 AI observability surfaces 已有 route-level rendered HTML guard。
   - 已完成: 高可見 AI surface readback 已接入 runtime smoke 與 scheduled health summary。
4. 啟動整站 UI/UX Agent，將所有頁面依主流專業 guardrails 排序並產生 controlled repair package。
   - 已完成: Sitewide UI/UX Agent inventory 與 repair package API。
5. 將 desktop / tablet / mobile visual QA 變成 AI automation artifact 與 runtime readback。
   - 已完成: Sitewide visual QA artifact schema、readback API、AI smoke、scheduled family 與 metrics family。

完成標準:

- 使用者不用讀 log / artifact，就能在第一畫面看到 AI 自動化狀態。
- 頁面能回答「發生什麼、是否安全、下一步機器會做什麼」。
- UI 是專業 dashboard pattern，不是裝飾卡片或空泛 marketing copy。

## P2 - External Benchmark And Mainstream Product Practice

狀態: 已完成第一版，後續持續擴充。

目的: 把外部主流專業產品網站 / SaaS / observability dashboard 的做法落到規則與測試。

必須採用的 benchmark 原則:

- 狀態分層清楚: healthy、warning、blocked、completed。
- 下一步優先: next machine action 必須比細節更早被看見。
- Evidence-on-demand: receipts、hashes、raw payload 放詳細層，不壓在主畫面。
- Manual review 是例外處理，不是 primary flow。
- 產品面不顯示 raw stack traces、provider internals、database naming。
- Golden signals: 第一視窗必須能回答已自動落地、已驗證、異動狀態、下一步。
- Dashboard-as-code: benchmark 結論必須進 focused tests，不靠口頭記憶。

已完成:

- 已參考 Grafana、Datadog、New Relic、Atlassian Statuspage 官方資料。
- 已更新 `docs/guides/external_professional_benchmark.md` 的 AI automation dashboard benchmark。
- 已新增 `tests/test_pchome_dashboard_benchmark_guardrails.py`，鎖住狀態分層、下一步優先、證據按需與 golden signals。
- PChome dashboard 第一視窗已新增「今日 AI 自動化狀態」：已自動落地、已驗證、異動狀態、下一步。

下一步:

1. 將同一套 benchmark guardrails 套到 `/ai_intelligence` 與 `/observability/overview`。
   - 已完成: `/ai_intelligence` 與 `/observability/overview` 首屏都有 `AI 自動化狀態` golden-signal strip。
   - 已完成: 兩頁都明確呈現「已自動落地、已驗證、異動狀態、下一步」。
   - 已完成: `tests/test_ai_surface_benchmark_guardrails.py` 鎖住 DOM、下一步優先與 evidence-on-demand wording。
2. 為後續 safe automation lanes 建立同樣的 first-viewport summary。
   - 已完成: `/api/ai/pchome-growth/ai-automation-surface-summary` 會把 readiness safe lanes 收斂成 `golden_signals`、`safe_automation_lanes`、`surface_contract`、`next_machine_action` 與 no-write 安全欄位。
   - 已完成: `/ai_intelligence` 首屏改吃 surface summary，不再自行拼接 receipt replay / drift verifier 欄位。

完成標準:

- benchmark-derived requirements 已被 tests 或 guardrails 固化。
- desktop / mobile 都維持可操作、專業、可掃描。

## P3 - Broader AI Automation Expansion

狀態: 進行中。

目的: 把目前 PChome retry mapping lane 的 controlled apply 閉環模式擴展到更多安全場景。

進行中 / 下一步，必須照順序:

1. 將 auto-policy controlled dry-run receipt closeout 推進到 controlled dry-run runner readiness lane。
2. 對其他 safe mapping backlog lanes 套用 receipt / replay / drift verifier 模式。
3. 為每一類 controlled apply 自動產生 rollback evidence package。
4. 把 AI automation metrics 持續整合進既有 observability surfaces。

完成標準:

- 每個 automation family 都有 preflight、executor、receipt、replay、drift verifier、product readiness。
- 每條 lane 都有 machine-verifiable evidence，且沒有隱藏人工-primary blocker。

## P4 - Source / Deployment Governance

狀態: 持續進行。

目的: 保持 source control、部署、正式環境真相一致，避免版本與環境再次混亂。

持續規則:

- Gitea 是 source-control truth。
- GitHub 維持 freeze。
- 不從未驗證分支部署。
- 不意外 bump version。
- 不 recreate / destroy / prune `momo-db`。
- source-control success、deployment success、production runtime readback 必須分開回報。
- `scripts/ops/report_source_deploy_runtime_truth.py` 必須可輸出 machine-readable P4 report，明確拆開 local / origin / Gitea refs、部署檔案 hash、正式 `/health`、容器狀態與安全紅線。

已完成:

- Source / deploy / runtime truth report 已建立:
  - policy: `p4_source_deployment_runtime_truth_v1`
  - source truth: local HEAD、origin `main` / `dev`、Gitea SSH `main` / `dev`
  - deployment truth: tracked file SHA256 readback
  - runtime truth: production `/health` version/status 與 optional container readback
  - safety truth: GitHub freeze、`momo-db` protected、no `--remove-orphans`、no secret read、no DB write

完成標準:

- 每次 push / deploy 都回報 Gitea head、production health、version truth、相關 readback。

## Current Work Queue

| Priority | Work item | Status | Latest evidence | Next action |
|---|---|---|---|---|
| P0.1 | Controlled apply executor | 已完成 | `DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_EXECUTED`, 4 DB rows | 納入 drift verifier 監控 |
| P0.2 | Executor receipt | 已完成 | executor receipt artifact generated | 進 compact summary |
| P0.3 | Receipt replay closeout | 已完成 | `DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_RECEIPT_REPLAYED`, readback `4/4` | 作為 baseline |
| P0.4 | Product readiness visibility | 已完成 | `AI_AUTOMATION_CONTROLLED_APPLY_CLOSEOUT_VERIFIED` | 接到 UI first viewport |
| P0.5 | Drift verifier | 已完成 | `DRIFT_VERIFIED`, `drift_count=0`, readback `4/4` | 由 monitor 持續檢查 |
| P0.6 | Drift verifier artifact | 已完成 | drift artifact hash match `1` | 增加 latest compact readback |
| P0.7 | Automated drift monitor | 已完成 | smoke check `PChome 受控落地 drift monitor` | 納入每日 smoke 與 runtime readback |
| P0.8 | Drift rollback / re-apply package | 已完成 | drift recovery package route + focused tests | 接入 compact readback |
| P0.9 | Compact latest apply / replay / drift / recovery readback endpoint | 已完成 | compact readback route + focused tests | 接入 product dashboard first viewport |
| P0.10 | Controlled-apply artifact retention policy | 已完成 | retention policy route + focused tests | 接入 product dashboard first viewport |
| P1.1 | Dashboard AI automation first-viewport surface | 已完成 | dashboard command center reads compact + retention packages | P1.2 wording guard |
| P1.2 | UI wording guard for no raw engineering terms | 已完成 | focused wording guard test | P2.1 benchmark guardrails |
| P1.3 | AI intelligence product evidence guardrails | 已完成 | detail rows + single product detail expose four evidence cells + focused guard tests | P2 / P3 automation surfaces |
| P1.4 | AI intelligence compact workbench text-density guardrails | 已完成 | `/ai_intelligence` first viewport and drilldown hide explanatory copy; focused density guard test | P2.2 benchmark guardrails and future AI surfaces |
| P1.5 | Observability compact workbench text-density guardrails | 已完成 | `/observability/overview` first viewport hides explanatory copy; focused density guard test | Apply density guard to remaining high-visibility AI surfaces |
| P1.6 | AI automation smoke compact workbench text-density guardrails | 已完成 | `/ai_automation_smoke` first viewport hides explanatory copy; focused density guard test | Apply density guard to remaining high-visibility AI surfaces |
| P1.7 | Agent orchestration compact workbench text-density guardrails | 已完成 | `/observability/agent_orchestration` first viewport hides explanatory copy; focused density guard test | Apply density guard to remaining high-visibility AI surfaces |
| P1.8 | AI calls compact workbench text-density guardrails | 已完成 | `/observability/ai_calls` first viewport hides explanatory copy; focused density guard test | Apply density guard to remaining high-visibility AI surfaces |
| P1.9 | Quality trend compact workbench text-density guardrails | 已完成 | `/observability/quality_trend` first viewport hides explanatory copy; focused density guard test | Apply density guard to remaining high-visibility AI surfaces |
| P1.10 | Promotion review compact AI exception workbench guardrails | 已完成 | `/observability/promotion_review` first viewport hides explanatory copy and avoids manual-primary wording; focused density guard test | Apply density guard to PPT audit surface |
| P1.11 | PPT audit compact AI visual QA workbench guardrails | 已完成 | `/observability/ppt_audit_history` first viewport hides explanatory copy and avoids env/table wording; focused density guard test | P1.12 route-level HTML readback guard |
| P1.12 | High-visibility AI surface route HTML readback guard | 已完成 | 10 observability routes render compact markers and block raw engineering wording in Flask client readback | Continue P1 surface sweep and P3 automation expansion |
| P1.13 | Runtime AI surface HTML readback automation | 已完成 | `/api/ai-automation/surface-html-readback` + AI smoke check + scheduled health family + focused tests | P3 safe lane expansion |
| P1.14 | Sitewide UI/UX Agent inventory and repair package | 已完成 | 55 page templates inventoried, 31 high-priority, 15 controlled repair candidates, 0 raw engineering leaks; first repairs applied to `ai_history` and `ai_recommend` | Apply next controlled UI/UX repairs |
| P2.1 | External benchmark encoded into requirements | 已完成 | benchmark guide + focused guard test + first-viewport status | P3.1 safe lane expansion |
| P3.1 | Extend receipt / replay / drift pattern to more lanes | 已完成 | direct mapping candidate decision lane closeout route + focused tests | P3.2 scheduled automation health summaries |
| P3.2 | Scheduled automation health summaries | 已完成 | `/api/ai-automation/scheduled-health-summary` + smoke service focused tests | P3.3 rollback evidence packages |
| P3.3 | Rollback evidence packages | 已完成 | controlled apply rollback evidence route + focused tests | P3.4 observability metrics integration |
| P3.4 | Observability metrics integration | 已完成 | `/metrics` exports scheduled health summary gauges + focused tests; AI surface HTML readback now feeds smoke and scheduled health | P3.5 auto-policy guard monitoring |
| P3.5 | PChome auto-policy authorization guard monitoring | 已完成 | AI smoke + scheduled family + metrics family read no-write/no-secret/exception-only guard; focused tests | machine fetch evidence / authorization decision preflight lane |
| P3.6 | PChome auto-policy machine evidence decision preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove local contract fixture, no-network machine evidence, decision preflight ready, no DB write, no human primary gate | authorization decision closeout lane |
| P3.7 | PChome auto-policy authorization decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove decision closeout ready, post-apply verifier bound, same-run truth required, no DB write, no apply authorization | P3.8 authorization issuer gate monitoring |
| P3.8 | PChome auto-policy authorization issuer gate monitoring | 已完成 | AI smoke + scheduled family + metrics family prove issuer gate ready, nonsecret envelope bound, no DB write, no signing, no apply authorization | P3.9 signing decision preflight monitoring |
| P3.9 | PChome auto-policy signing decision preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision preflight ready, signing inputs bound, no DB write, no signing, no apply authorization | P3.10 signing decision closeout monitoring |
| P3.10 | PChome auto-policy signing decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision closeout ready, unsigned package bound, no DB write, no signing, no apply authorization | P3.11 signing issuer guard monitoring |
| P3.11 | PChome auto-policy signing issuer guard monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing issuer guard ready, future signable boundary bound, no DB write, no signing, no apply authorization | P3.12 signing issuer closeout monitoring |
| P3.12 | PChome auto-policy signing issuer closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove final signable request package ready, no DB write, no signing, no apply authorization | P3.13 signing execution preflight monitoring |
| P3.13 | PChome auto-policy signing execution preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove operator-held secret boundary, 10 nonsecret inputs, 8 abort conditions, 4 rollback boundaries, no secret read, no DB write, no signing | P3.14 signing execution closeout monitoring |
| P3.14 | PChome auto-policy signing execution closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove unsigned signed-authorization receipt boundary, no signed receipt, no signature material, no secret read, no DB write, no signing | P3.15 signed receipt preflight monitoring |
| P3.15 | PChome auto-policy signed receipt preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove external signing receipt evidence boundary, 10 receipt evidence fields, 8 acceptance gates, no signed receipt, no signature material, no secret read, no DB write, no signing | P3.16 signed receipt closeout monitoring |
| P3.16 | PChome auto-policy signed receipt closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove detached receipt verification boundary, 10 receipt evidence fields, 8 acceptance gates, 10 detached checks, no detached verification execution, no signed receipt, no signature material, no secret read, no DB write, no signing | P3.17 signed receipt evidence intake monitoring |
| P3.17 | PChome auto-policy signed receipt evidence intake monitoring | 已完成 | AI smoke + scheduled family + metrics family prove detached verification evidence schema, 12 evidence fields, 10 detached acceptance gates, no detached verification execution, no signed receipt, no signature material, no plaintext secret, no secret read, no DB write, no signing | P3.18 detached verification evidence validation monitoring |
| P3.18 | PChome auto-policy detached verification evidence validation monitoring | 已完成 | AI smoke + scheduled family + metrics family prove verifier receipt closeout boundary, 12 verifier receipt fields, 10 verifier acceptance gates, no detached verification execution, no verifier receipt persist, no signed receipt, no signature material, no plaintext secret, no secret read, no DB write, no signing | P3.19 verifier receipt closeout monitoring |
| P3.19 | PChome auto-policy verifier receipt closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove verifier receipt evidence handoff, 12 handoff fields, 10 handoff acceptance gates, no detached verification execution, no verifier receipt persist, no signed receipt, no signature material, no plaintext secret, no secret read, no DB write, no signing | P3.20 authorization evidence execution preflight monitoring |
| P3.20 | PChome auto-policy authorization evidence execution preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove database apply authorization verifier handoff, 12 execution fields, 10 execution acceptance gates, no authorization evidence execution, no detached verification execution, no verifier receipt persist, no signed receipt, no signature material, no plaintext secret, no secret read, no DB write, no signing | P3.21 authorization evidence execution closeout monitoring |
| P3.21 | PChome auto-policy authorization evidence execution closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove database apply authorization final verifier gate, 12 closeout fields, 10 closeout acceptance gates, no authorization evidence execution, no database apply, no detached verification execution, no verifier receipt persist, no signed receipt, no signature material, no plaintext secret, no secret read, no DB write, no signing | P3.22 controlled-apply final preflight monitoring |
| P3.22 | PChome auto-policy controlled-apply final preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove rollback binding, post-apply verifier binding, 12 final preflight fields, 10 acceptance gates, dry-run-only/check-mode-only, no authorization evidence execution, no database apply, no endpoint/SQL, no secret read, no DB write, no signing | P3.23 controlled dry-run package monitoring |
| P3.23 | PChome auto-policy controlled dry-run package monitoring | 已完成 | AI smoke + scheduled family + metrics family prove receipt preview, result parser, non-executable command shape, 12 package fields, 10 acceptance gates, no dry-run execution, no stdout/stderr, no authorization evidence execution, no database apply, no endpoint/SQL, no secret read, no DB write, no signing | P3.24 controlled dry-run receipt closeout monitoring |
| P3.24 | PChome auto-policy controlled dry-run receipt closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove parser closeout, receipt validation report, 12 closeout fields, 10 acceptance gates, no dry-run execution, no stdout/stderr, no authorization evidence execution, no database apply, no endpoint/SQL, no secret read, no DB write, no signing | P3.25 controlled dry-run runner readiness monitoring |
| P4.1 | Source / deployment / runtime truth package | 已完成 | `scripts/ops/report_source_deploy_runtime_truth.py` + focused tests | 每次 Gitea push / production deploy 後執行 P4 report |
| P2.2 | Benchmark guardrails applied to core AI surfaces | 已完成 | `/ai_intelligence` + `/observability/overview` golden-signal strips + focused tests | 後續 safe automation lanes 套同樣 first-viewport summary |

## 後續回報格式

每次 continuation 必須回報:

```text
current_priority:
- item: ...
- reason: ...

implemented:
- ...

verification:
- tests: ...
- gitea: ...
- production: ...
- artifacts: ...

next_priority:
- ...
```
