feat(smoke): monitor pchome signing issuer guard

docs/AI_INTELLIGENCE_MODULE_SOT.md

@@ -1,8 +1,8 @@
 # PChome 業績成長自動化作戰系統 — AI 競價情報模組 Single Source of Truth
 
 > **最後更新**: 2026-07-03 (台北時間)
-> **狀態**: 🟢 四 AI Agent 自動化閉環已落地；LLM 路由紅線升級為 Ollama-first 三主機級聯；PChome 後台業績匯入韌性已補強；產品定位正名為「PChome 業績成長自動化作戰系統」；外部市場來源正規化層、自動同步、作戰清單與價格參考表優先讀取、CSV 備援預檢、前台操作入口、高可見頁面繁中化守門、比價/作戰 UI 工作台化、AI 密集工作台文字密度守門、跨平台來源治理、商品身份 UI 契約、sitewide visual QA runtime readback、PChome auto-policy authorization guard monitoring、decision preflight machine evidence monitoring、decision closeout monitoring、authorization issuer gate monitoring、signing decision preflight monitoring 與 signing decision closeout monitoring 已建立，GCP embedding 熔斷延後處理、110 proxy rescue 與 direct host health skip 已建立
-> **適用版本**: V10.731
+> **狀態**: 🟢 四 AI Agent 自動化閉環已落地；LLM 路由紅線升級為 Ollama-first 三主機級聯；PChome 後台業績匯入韌性已補強；產品定位正名為「PChome 業績成長自動化作戰系統」；外部市場來源正規化層、自動同步、作戰清單與價格參考表優先讀取、CSV 備援預檢、前台操作入口、高可見頁面繁中化守門、比價/作戰 UI 工作台化、AI 密集工作台文字密度守門、跨平台來源治理、商品身份 UI 契約、sitewide visual QA runtime readback、PChome auto-policy authorization guard monitoring、decision preflight machine evidence monitoring、decision closeout monitoring、authorization issuer gate monitoring、signing decision preflight monitoring、signing decision closeout monitoring 與 signing issuer guard monitoring 已建立，GCP embedding 熔斷延後處理、110 proxy rescue 與 direct host health skip 已建立
+> **適用版本**: V10.732
 
 ---
 
@@ -247,6 +247,7 @@ SQL漏斗(~300筆)
 - `/api/ai-automation/smoke` 必須包含 `PChome auto-policy authorization issuer gate`：以本機 deterministic contract fixture 與 machine evidence adapter 推進 no-write issuer gate ready path，並明確回報 `required_issuer_evidence_count=9`、`nonsecret_authorization_claim_count=8`、`payload_source=local_contract_fixture`、`outbound_network=false`、`business_data_source=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`。此 check 不讀 secret、不執行 shell/SQL、不寫 DB、不簽發 apply authorization；`/api/ai-automation/scheduled-health-summary` 需輸出 `pchome_auto_policy_authorization_issuer_gate` family，`/metrics` 需暴露對應 `momo_ai_automation_scheduled_health_family_status`。
 - `/api/ai-automation/smoke` 必須包含 `PChome auto-policy signing decision preflight`：以本機 deterministic contract fixture 與 machine evidence adapter 推進 no-write signing decision preflight ready path，並明確回報 `signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`payload_source=local_contract_fixture`、`outbound_network=false`、`business_data_source=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_required_in_preview=false`。此 check 不讀 secret、不執行 shell/SQL、不寫 DB、不簽發 apply authorization；`/api/ai-automation/scheduled-health-summary` 需輸出 `pchome_auto_policy_signing_decision_preflight` family，`/metrics` 需暴露對應 `momo_ai_automation_scheduled_health_family_status`。
 - `/api/ai-automation/smoke` 必須包含 `PChome auto-policy signing decision closeout`：以本機 deterministic contract fixture 與 machine evidence adapter 推進 no-write signing decision closeout ready path，並明確回報 `signing_decision_closeout_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`payload_source=local_contract_fixture`、`outbound_network=false`、`business_data_source=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`、`secret_material_required_in_preview=false`。此 check 不讀 secret、不執行 shell/SQL、不寫 DB、不簽發 apply authorization；`/api/ai-automation/scheduled-health-summary` 需輸出 `pchome_auto_policy_signing_decision_closeout` family，`/metrics` 需暴露對應 `momo_ai_automation_scheduled_health_family_status`。
+- `/api/ai-automation/smoke` 必須包含 `PChome auto-policy signing issuer guard`：以本機 deterministic contract fixture 與 machine evidence adapter 推進 no-write signing issuer guard ready path，並明確回報 `signing_issuer_guard_check_count=12`、`signing_decision_closeout_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`payload_source=local_contract_fixture`、`outbound_network=false`、`business_data_source=false`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`、`secret_material_required_in_preview=false`、`ready_for_future_signable_request_boundary=true`。此 check 不讀 secret、不執行 shell/SQL、不寫 DB、不簽發 apply authorization；`/api/ai-automation/scheduled-health-summary` 需輸出 `pchome_auto_policy_signing_issuer_guard` family，`/metrics` 需暴露對應 `momo_ai_automation_scheduled_health_family_status`。
 - 健康檢查 API 會將最近檢查結果保存到 JSONL，頁面顯示最近狀態趨勢。
 - 健康檢查歷史支援 JSONL 匯出、清理與每日「正常 / 注意 / 嚴重」摘要。
 - 健康檢查每日摘要支援手動 Telegram 推播，並由 `momo-scheduler` 每日 09:10 呼叫 `run_ai_smoke_daily_summary_task()`。
@@ -854,6 +855,7 @@ POSTGRES_HOST=momo-db
 | 2026-07-03 | PChome auto-policy authorization issuer gate 必須有 runtime monitoring | V10.729 起 `/api/ai-automation/smoke`、`/api/ai-automation/scheduled-health-summary` 與 `/metrics` 必須輸出 `PChome auto-policy authorization issuer gate` / `pchome_auto_policy_authorization_issuer_gate`；此 runtime check 自動驗證 issuer gate ready path、required issuer evidence、nonsecret authorization claims 與 final nonsecret envelope，但明確標記 `writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`，不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization。 |
 | 2026-07-03 | PChome auto-policy signing decision preflight 必須有 runtime monitoring | V10.730 起 `/api/ai-automation/smoke`、`/api/ai-automation/scheduled-health-summary` 與 `/metrics` 必須輸出 `PChome auto-policy signing decision preflight` / `pchome_auto_policy_signing_decision_preflight`；此 runtime check 自動驗證 signing decision preflight ready path、signing decision input requirements 與 rejection policy，但明確標記 `writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_required_in_preview=false`，不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization。 |
 | 2026-07-03 | PChome auto-policy signing decision closeout 必須有 runtime monitoring | V10.731 起 `/api/ai-automation/smoke`、`/api/ai-automation/scheduled-health-summary` 與 `/metrics` 必須輸出 `PChome auto-policy signing decision closeout` / `pchome_auto_policy_signing_decision_closeout`；此 runtime check 自動驗證 signing decision closeout ready path、unsigned signing decision package、post-apply verifier requirement 與 same-run production truth requirement，但明確標記 `writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`、`secret_material_required_in_preview=false`，不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization。 |
+| 2026-07-03 | PChome auto-policy signing issuer guard 必須有 runtime monitoring | V10.732 起 `/api/ai-automation/smoke`、`/api/ai-automation/scheduled-health-summary` 與 `/metrics` 必須輸出 `PChome auto-policy signing issuer guard` / `pchome_auto_policy_signing_issuer_guard`；此 runtime check 自動驗證 signing issuer guard ready path、future signable request boundary、post-apply verifier requirement 與 same-run production truth requirement，但明確標記 `writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`、`ready_for_database_apply_now=false`、`issues_database_apply_authorization=false`、`signs_database_apply_authorization=false`、`secret_material_included=false`、`secret_material_required_in_preview=false`，不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization。 |
 | 2026-06-29 | PChome DB apply 授權 lane 必須先通過 no-write guard / decision preflight / decision closeout / issuer gate / signing-decision preflight / signing-decision closeout / signing-issuer guard | V10.725 的 PChome mapping backlog auto-policy 已新增 `/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-lane-guard`、`/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-decision-preflight`、`/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-decision-closeout`、`/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-issuer-gate`、`/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-signing-decision-preflight`、`/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-signing-decision-closeout` 與 `/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-signing-issuer-guard`；這些 endpoint 只驗證 final exact request package、same-run production truth requirement、secret rejection、rollback boundary、lane entry requirements、decision input requirements、rejection policy、post-apply verifier、future authorization decision package、final nonsecret authorization envelope、signing decision preflight inputs、unsigned signing decision package 與 signable request boundary，不讀 secret、不執行 shell/SQL、不寫 DB，也不簽發 database apply authorization。 |
 | 2026-06-29 | PChome DB apply 授權簽署發行者 lane 必須先產出 final signable request package | V10.725 的 PChome mapping backlog auto-policy 新增 `/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-signing-issuer-closeout`；此 endpoint 只把 signing-issuer guard 的 signable request boundary 收斂成 final signable request package 與 closeout contract，確認 fresh production truth、post-apply verifier、migration hash、secret boundary 與 no-side-effect checks，不讀 secret、不簽發 authorization、不執行 shell/SQL、不寫 DB，也不代表正式 DB apply 已授權。 |
 | 2026-06-29 | PChome DB apply 授權簽署執行 lane 必須先通過 operator-held secret boundary preflight | V10.725 的 PChome mapping backlog auto-policy 新增 `/api/ai/pchome-growth/mapping-backlog/auto-policy-db-apply-authorization-signing-execution-preflight`；此 endpoint 只把 final signable request package 轉成 future signing execution preflight package、operator-held secret boundary contract、nonsecret signing inputs、command-shape preview、rollback boundary 與 abort conditions，不讀 secret、不接受 plaintext secret、不簽發 authorization、不執行 shell/SQL、不寫 DB，也不代表正式 DB apply 已授權。 |

docs/guides/pchome_ai_automation_priority_backlog.md

@@ -9,7 +9,7 @@
 以下是使用者在主線推進期間插入、且必須保留在完整工作項目裡的要求。後續不得再把這些需求漏掉或變成口頭提醒。
 
 1. 正式環境才是最新版本真相；不得用本機檔案、舊筆記、舊分支蓋過 production truth。
-2. 版本不得搞錯；目前正式環境 `/health` 版本維持 `V10.731`，除非有明確版本 bump、部署與 readback。
+2. 版本不得搞錯；目前正式環境 `/health` 版本維持 `V10.732`，除非有明確版本 bump、部署與 readback。
 3. GitHub 全面 freeze；不得使用 GitHub、`gh`、GitHub API、GitHub Actions、PR、issue、mirror 或 read-only GitHub 流程。
 4. 實作結果必須推到 Gitea `dev` 與 `main`；若改到 runtime 行為，還必須部署到正式環境並回讀。
 5. 主方向是 AI 自動化，不是人工審核；人工欄位只能當 evidence / ledger / UI truth，不得阻擋低爆炸半徑、可驗證、可回滾的 controlled apply。
@@ -41,7 +41,7 @@
 
 已完成:
 
-- 正式環境版本真相 guard：`/health` 是最高真相，目前維持 `V10.731`。
+- 正式環境版本真相 guard：`/health` 是最高真相，目前維持 `V10.732`。
 - Gitea `dev` / `main` source truth 對齊。
 - Retry exception controlled apply executor 已落地，目標表為 `pchome_product_matches`。
 - 正式 DB 已 controlled apply 4 個 selectors:
@@ -127,10 +127,17 @@
   - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_decision_closeout` family
   - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_decision_closeout",...}`
   - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing issuer guard lane
+- PChome auto-policy signing issuer guard runtime monitoring 已完成:
+  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing issuer guard`
+  - 以本機 contract fixture + machine evidence adapter 自動推進 signing issuer guard ready path
+  - 明確標記 `signing_issuer_guard_check_count=12`、`signing_decision_closeout_check_count=12`、`signing_decision_input_requirement_count=10`、`signing_decision_rejection_reason_count=11`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`primary_human_gate_count=0`
+  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_issuer_guard` family
+  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_issuer_guard",...}`
+  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing issuer closeout lane
 
 進行中 / 下一步，必須照順序:
 
-1. 將 auto-policy signing decision closeout 往 signing issuer guard lane 推進。
+1. 將 auto-policy signing issuer guard 往 signing issuer closeout lane 推進。
 
 完成標準:
 
@@ -297,7 +304,7 @@
 
 進行中 / 下一步，必須照順序:
 
-1. 將 auto-policy signing decision closeout 推進到 signing issuer guard lane。
+1. 將 auto-policy signing issuer guard 推進到 signing issuer closeout lane。
 2. 對其他 safe mapping backlog lanes 套用 receipt / replay / drift verifier 模式。
 3. 為每一類 controlled apply 自動產生 rollback evidence package。
 4. 把 AI automation metrics 持續整合進既有 observability surfaces。
@@ -374,7 +381,8 @@
 | P3.7 | PChome auto-policy authorization decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove decision closeout ready, post-apply verifier bound, same-run truth required, no DB write, no apply authorization | P3.8 authorization issuer gate monitoring |
 | P3.8 | PChome auto-policy authorization issuer gate monitoring | 已完成 | AI smoke + scheduled family + metrics family prove issuer gate ready, nonsecret envelope bound, no DB write, no signing, no apply authorization | P3.9 signing decision preflight monitoring |
 | P3.9 | PChome auto-policy signing decision preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision preflight ready, signing inputs bound, no DB write, no signing, no apply authorization | P3.10 signing decision closeout monitoring |
-| P3.10 | PChome auto-policy signing decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision closeout ready, unsigned package bound, no DB write, no signing, no apply authorization | P3.11 signing issuer guard lane |
+| P3.10 | PChome auto-policy signing decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision closeout ready, unsigned package bound, no DB write, no signing, no apply authorization | P3.11 signing issuer guard monitoring |
+| P3.11 | PChome auto-policy signing issuer guard monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing issuer guard ready, future signable boundary bound, no DB write, no signing, no apply authorization | P3.12 signing issuer closeout lane |
 | P4.1 | Source / deployment / runtime truth package | 已完成 | `scripts/ops/report_source_deploy_runtime_truth.py` + focused tests | 每次 Gitea push / production deploy 後執行 P4 report |
 | P2.2 | Benchmark guardrails applied to core AI surfaces | 已完成 | `/ai_intelligence` + `/observability/overview` golden-signal strips + focused tests | 後續 safe automation lanes 套同樣 first-viewport summary |