diff --git a/docs/guides/ai_automation_mainline_work_items.md b/docs/guides/ai_automation_mainline_work_items.md index 3779683..79a2410 100644 --- a/docs/guides/ai_automation_mainline_work_items.md +++ b/docs/guides/ai_automation_mainline_work_items.md @@ -1,6 +1,6 @@ # AI Automation Mainline Work Items -> Updated: 2026-07-15 13:40 Asia/Taipei +> Updated: 2026-07-15 17:16 Asia/Taipei > Governance: `global_product_governance_v2` + ADR-038 > Current P0: `GROWTH-P0-001 comparison coverage truth + autonomous refresh` @@ -26,7 +26,7 @@ | 8 | `RAG-P0-001` | Not started | Internal RAG candidate canary | V10.770 stops at candidate preview. Exit: bounded pgvector candidate canary, signature/readback/feedback receipt, no price write and no premature `ai_insights` promotion. Next: `run_internal_rag_candidate_canary`. | | 9 | `MCP-P0-001` | In progress (`federation_source_ready`) | MCP/RAG production runtime closure | V10.796 source adds a strict public aggregate receipt for canonical `ewoooc` and `momo-pro-system` identities without opening authenticated internal APIs or exposing endpoint/tool payload data. Exit still requires V10.796 production `/health`, two fresh AWOOOI durable receipts with fingerprint recompute, live MCP servers/router/RAG, approved caller/tool boundary and production query canary. Current source readiness must not be reported as runtime closure. | | 10 | `SEC-P0-004` | Not started | Security operations lifecycle and metrics | Add durable security incident state and publish MTTA, MTTR, recurrence, false positive, human intervention, verifier pass, rollback and freshness. Exit: detect-to-learn production receipt. | -| 11 | `REL-P0-001` | In progress (`runtime_verified_cd_degraded`) | Formal deploy and visible proof discipline | Gitea main is `c091c466c203d7e26c8ed576f573e7e930df34d1`; Action #1133 is waiting because no matching `ewoooc-host` runner is online and therefore provides no CD execution evidence. A bounded exact-object fallback deployed V10.801 from archive SHA-256 `1f21a9c823fd76dd32c622d227eca47022ec101d0863b516e34cc1bbbe29f2c8`; host/container hashes, structured health, canary, DB/growth readback and visible receipts are under `/home/ollama/momo-deploy-backups/ewoooc-20260715T051727Z-c091c46/`. Internal/external `/health` is healthy at V10.801, three application containers are healthy, and `momo-db` remains unchanged at `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Desktop 1280x720 and mobile 390x844 production-code/data render smoke both show `24/50` without horizontal overflow; formal network login remains enforced. Runner recovery remains a release-governance gap and is not replaced by fallback evidence. | +| 11 | `REL-P0-001` | In progress (`runtime_verified_cd_degraded`) | Formal deploy and visible proof discipline | Production runtime source object is `d74aa60`; the corresponding dev runtime merge is `c0182b2`. Host 110 still exposes only paused `vibework-dedicated-runner`, with no matching EwoooC runner, so this release has no formal CD execution receipt. Bounded exact-object fallbacks deployed the analytics contract at V10.807; the contract archive SHA-256 is `7c6fc794ac699c6a42f7be8871cbc37f1bb2cfc5c4b7db1598ef8bc6f6d85cca` and final label archive SHA-256 is `9829ffb22f9989444eb80996cfa9fd481dd0c579547e6c5c6cd6ba9aea82d2cd`, with rollback copies under `/home/ollama/momo-deploy-backups/analytics-period-contract-20260715T090919Z-ec40d16` and `/home/ollama/momo-deploy-backups/analytics-period-label-20260715T091335Z-d74aa60`. Internal/external `/health` is healthy at V10.807; app-only recreate preserved scheduler, Telegram bot and `momo-db` ID `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Runner recovery remains a release-governance gap and is not replaced by fallback evidence. | ### GROWTH-P0-001 Fixed Execution Lanes @@ -38,6 +38,17 @@ These lanes are one ordered current P0, not optional side work. They must advanc | B. Verified same-item evidence | In progress | TOP50 fixed cohort: `24` verified, `1` candidate/source validation, `25` unmatched. Count coverage is `48%`; revenue-weighted coverage is `NT$204,975 / NT$354,062 = 57.9%`. V10.797 outer-pack false exact candidates were quarantined without deletion; V10.798 normalizes nested quantity, V10.799 fixes cohort membership, and V10.801 run `7b3b140c076b43be8c79bd85448fbc49` added three independently verified Yahoo offers without changing fingerprint `7b74504fcc1e1801c2ca2b42`. | Continue the next revenue-weighted unresolved batch only when source evidence is fresh, preserve deterministic identity/unit/variant gates, and publish count/revenue deltas against the same fingerprint per run. | | C. Platform runtime coverage | In progress (`runtime_canary_activated`) | V10.801 is live; Yahoo run `7b3b140c076b43be8c79bd85448fbc49` separated one unit-price candidate, wrote/read back three exact offers and atomically enabled the source after exceeding the two-offer threshold. Formal runtime is now `2/15`; PixelRAG remains evidence-only. | Repeat bounded refresh on schedule, monitor expiry/recurrence/rollback signals, then implement the next approved structured source contract for Shopee, Coupang, ETMall, Friday or Rakuten without treating blocked pages as product data. | +### Analytics Period-Linkage Closure + +This bounded interruption is closed and control returns to `GROWTH-P0-001` without changing its lane order. + +| Completion layer | Status | Production evidence | +|---|---|---| +| Program | Completed for the four primary analysis tabs | Daily sales, sales analysis, growth analysis and monthly summary now share one canonical day/month/range contract; cross-tab links preserve the selected period. | +| Asset coverage | `4/4` pages and `2/2` sales async APIs verified | Daily KPI/calendar/charts/Top 10, growth KPI/series, monthly KPI/tables/charts and sales KPI/charts/YoY/detail table all use the active period. Historical current-snapshot mixing and blank monthly charts are replaced by explicit honest states. | +| Runtime closure | V10.807 production verified | `2026-04` daily has 30 labels; growth exposes only `2026-04`; monthly reports zero current rows without borrowing another month; sales loads 35,240 April records, renders 25 table rows from a 300-row API result, and aligns YoY to `2025-04-01..04-30` versus `2026-04-01..04-30` at `NT$10,635,583 -> NT$16,848,774 (+58.42%)`. Desktop/mobile overflow is zero and the temporary read-only QA service/tunnel were removed. | +| Verification | Passed with bounded residual | Full regression before the final API/schema edge fixes: `2,113 passed / 9 skipped`; final analytics scope: `20 passed`, JavaScript/Python/Jinja compile checks and diff checks passed. Formal CD remains degraded because no matching runner executed the release. | + ## P1 | Order | ID | Status | Work item | Exit evidence / next machine action | @@ -47,10 +58,10 @@ These lanes are one ordered current P0, not optional side work. They must advanc | 14 | `APPSEC-P1-001` | In progress | CSP and DOM/XSS hardening | Security headers are present and CSP is report-only. Collect violations, remove high-risk `innerHTML`/inline sinks, then enforce CSP by canary. | | 15 | `APPSEC-P1-002` | Not started | Unsafe shared-cache serialization removal | Replace writable pickle caches in dashboard/daily-sales/EDM/sales with constrained JSON or signed schema. | | 16 | `ARCH-P1-001` | In progress | Split oversized policy/executor/verifier modules | Current top debts include 44k-line PChome mapping and 14k-line smoke service. Split by bounded family and independent tests. | -| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | V10.801 first viewport now shows `24/50 = 48%`, `活躍商品 32/1,853`, and formal platform `2/15` instead of the old unqualified 10% card. A production-code/data isolated read-only render smoke passed at 1280x720 and 390x844 with no horizontal overflow; the temporary process/tunnel was closed and production network login stayed enforced. Continue the same first-viewport, progressive-disclosure, accessibility and loading/error/degraded-state coverage across every remaining primary page. | +| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | V10.807 closes period linkage across all four primary analysis tabs. Desktop/mobile production-code/data smoke has zero horizontal overflow; selected-period labels now appear on weekly trend and action-list sections, current-period empty data is explicit, and stale all-year labels were removed. The broader site-wide first-viewport, progressive-disclosure, accessibility and loading/error/degraded-state audit remains in progress. | | 18 | `PIXELRAG-P1-001` | Not started | Ollama-first multimodal embedding benchmark | Verify approved visual embedding on GCP-A -> GCP-B -> 111 and design pgvector-compatible visual metadata; FAISS remains disallowed without ADR. | | 19 | `MARKET-P1-001` | In progress | Marketplace source contracts | Yahoo Shopping V10.801 is active in production with public-boundary allowlists, bounded streaming/rate, provenance, current product-detail readback, stock/spec/variant guards, source-specific promotion partition and exact canary activation. Three fresh verified offers drive formal decisions; the deferred unit-price candidate does not. Shopee, Coupang, ETMall, Friday and Rakuten still require equivalent structured contracts, and blocked pages remain non-product data. | -| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | V10.801 workstation source baseline is `2,106 passed / 9 skipped / 0 failed`; focused promotion-policy/Yahoo/source-readiness/same-item scope is `63 passed`. Production host/container hashes, internal/external health, scheduler registration, 3/3 exact DB readback, source activation, fixed cohort and desktop/mobile visible smoke are verified. Action #1133 remains waiting without runner execution, so CI/CD parity is not claimed; exact fallback receipts remain separate evidence. | +| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | Latest broad regression before the final analytics API/schema edge fixes is `2,113 passed / 9 skipped / 0 failed`; the final analytics/date-linkage scope is `20 passed`. V10.807 production page/API/network and mobile/desktop evidence is verified, but no matching EwoooC runner executed this release, so CI/CD parity is not claimed and exact-object fallback receipts remain separate evidence. | ## P2