wooo/ewoooc
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(governance): record V10.794 growth runtime truth

Browse Source
This commit is contained in:
ogt
2026-07-14 21:40:37 +08:00
parent 4c0472ab2e
commit de6933c137
2 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/AI_INTELLIGENCE_MODULE_SOT.md
View File

@@ -1,11 +1,20 @@
# PChome 業績成長自動化作戰系統 — AI 競價情報模組 Single Source of Truth
> **最後更新**: 2026-07-14 (台北時間)
> **狀態**: 🟠 Partial。SEC-P0-001 deny-by-default access control 已完成 production closure；V10.788 database identity/RBAC source 與自動 cutover 已實作、等待 production canary/receipt。四 Agent、PixelRAG、MCP/RAG registry、PChome controlled-preview families 與多項 smoke/readback 已建立，但 full asset reconciliation、software supply chain、same-run controlled apply、restore drill、internal RAG canary 與 MCP/RAG runtime closure 尚未全部完成。任何局部 receipt 不得代表整體閉環完成。
> **適用版本**: V10.788
> **狀態**: 🟠 Partial。V10.794 已把 PChome TOP50 比價主指標改為業績加權覆蓋、建立 MOMO 同商品 controlled apply 與 durable receipt/post-verifier，並完成 production 桌機/手機可見驗證；目前業績覆蓋為 40%，但仍有 45/50 商品未形成正式同商品證據、外部平台 runtime 僅 1/15。SEC-P0-001 已完成 production closure，SEC-P0-002 維持 production hybrid canary-ready；full asset reconciliation、software supply chain、統一 controlled-apply envelope、restore drill、internal RAG canary 與 MCP/RAG runtime closure 尚未全部完成。任何局部 receipt 不得代表整體閉環完成。
> **適用版本**: V10.794
---
## 零之負二、PChome 比價可信度與同商品自動閉環（V10.794）
- 儀表板主要 KPI 使用 TOP50 近 7 天業績加權覆蓋，不再把原始商品筆數 `5/50 = 10%` 當成唯一或主要成效。Production readback 為可比價業績 `NT$40,201 / NT$100,507 = 40%`；10% 仍保留為商品覆蓋透明度，不得隱藏或改寫。
- TOP50 production partition 為 `5` 件正式可比價、`4` 件候選驗證、`41` 件未對應；剩餘 `45/50` 是 current P0 的真實 coverage gap，不得因 UI 改善標示完成。
- `pchome_same_item_reconciliation_v1` 以同一 `trace_id/run_id/work_item_id` 串接來源、正規化、SOT diff、AI candidate、風險政策、check-mode、bounded execution、exact DB post-verifier 與 durable per-target receipt。只有獨立同商品與規格驗證通過者可寫 `external_offers`；候選、阻擋頁與無安全候選 run 一律 no-write。
- 第一輪 production canary 寫入 2 件獨立驗證 MOMO 同商品；修正動態 TOP50 導致的 verifier 漂移後，exact DB identity/fingerprint replay 為 `2/2`。第二輪 run `d3db6b69a5fc46e4ad59424299d549cb` 無安全候選，4/4 durable receipts 為 `no_write`、0 failed，post-verifier terminal 為 `no_write_verified`，scheduler 依 1 小時 cooldown 自動重試。
- 最新業績日為 `2026-07-13`，資料延遲 1 天、decision-ready；receipt `3f46ee5cee7e4f249f6405440acde05f` 為 `completed_no_write`，證明在資料新鮮且無新候選時安全不寫。即時 source readiness probe 為 `0/4`，上一筆 source reconciliation 為 `1/4`，此 continuity drift 必須持續自動 reconciliation，不得把單次新鮮度等同來源冗餘完成。
- Dashboard 的 mapping backlog 與 AI automation evidence 已改為結構化 grid 與 progressive disclosure，desktop/mobile 均無水平溢位；這只代表該頁可見 UX closure，完整全站 UI/UX 仍依 `UX-P1-001` 推進。
## 零之負一、資訊安全與治理自動化基準（2026-07-10）
- ADR-038 採 NIST CSF 2.0 `GOVERN / IDENTIFY / PROTECT / DETECT / RESPOND / RECOVER` 作為 program 結構，OWASP ASVS 5.0.0 L2 作為應用基準，NIST SSDF SP 800-218 v1.1 作為供應鏈基準。

14
docs/guides/ai_automation_mainline_work_items.md
View File

@@ -1,6 +1,6 @@
# AI Automation Mainline Work Items
> Updated: 2026-07-14 18:50 Asia/Taipei
> Updated: 2026-07-14 21:40 Asia/Taipei
> Governance: `global_product_governance_v2` + ADR-038
> Current P0: `GROWTH-P0-001 comparison coverage truth + autonomous refresh`
@@ -17,7 +17,7 @@
| Order | ID | Status | Work item | Exit evidence / next machine action |
|---:|---|---|---|---|
| 1 | `SEC-P0-001` | Completed | Deny-by-default route access control | `governance/evidence/SEC-P0-001-20260711T122758Z.json` plus the current runtime receipt prove anonymous matrix 8/8 denied, public `/metrics` 404, exact internal target up, EwoooC product markers present, Prometheus identity preserved and `momo-db` unchanged. |
| 2 | `GROWTH-P0-001` | In progress (`degraded`) | Comparison coverage truth + autonomous refresh | V10.790 is live. Production contract `pchome_sales_source_reconciliation_v1` now reconciles all four sales-source adapters, persists cross-run state, schedules bounded retry/fallback and deduplicates source-state alerts. Runtime coverage remains `1/4`: Google Drive is ready but has returned zero Excel files for 39 consecutive probes; HTTPS, IMAP and local adapters remain disabled until authorized runtime configuration exists. Latest sales date is still `2026-06-24` (20 days stale), so operational decisions remain paused. Comparison truth remains TOP 50 `5 ready + 4 candidate validation + 41 unmatched = 50`, active seven-day catalog `23/1,938`, and registered platform runtime `1/15`. Next: execute lanes A -> B -> C below until freshness and verified coverage gates close. |
| 2 | `GROWTH-P0-001` | In progress (`runtime_partial`) | Comparison coverage truth + autonomous refresh | V10.794 is live. Sales freshness is decision-ready at `2026-07-13` (1-day lag), but source continuity has a live drift: current readiness probe `0/4` versus latest reconciliation receipt `1/4`. TOP50 truth is `5 ready + 4 candidate validation + 41 unmatched`; count coverage remains `10%`, while the primary revenue-weighted KPI is `NT$40,201 / NT$100,507 = 40%`. Same-item controlled apply has independently verified and committed 2 MOMO offers; the latest no-safe-candidate run produced 4/4 durable no-write receipts and zero failures. Registered platform runtime remains `1/15`. Next: execute lanes A -> B -> C until continuity and the remaining `45/50` evidence gap close. |
| 3 | `SEC-P0-002` | In progress (`canary_ready`) | Database identity + least-privilege RBAC | V10.789 is live and `governance/auth_identity_runtime_receipt.json` verifies required tables, two active admins, durable lockout, session revocation, trusted proxy policy and no-secret mutation audit readiness. Runtime is intentionally hybrid because zero database-admin success receipts have been captured; `auto` retires shared authority after two durable successes without a manual review gate. Next: capture database-admin login receipts and verify automatic database-only cutover. |
| 4 | `SEC-P0-003` | In progress | Webhook trust and replay protection | Telegram secret-token verification code exists; production secret activation remains unproven. Exit: secret provisioned outside source, required mode enabled, invalid-secret 401 and authorized callback canary pass. |
| 5 | `SUPPLY-P0-001` | In progress | Gitea-only secure software supply chain | Gitea-native checkout, secret-safe `.dockerignore`, commit-bound source receipt and governance gate are active. Exit: exact dependency lock, internal SAST/SCA/secret scan, SBOM, image digest/provenance, vulnerability SLA and production digest readback. |
@@ -26,7 +26,7 @@
| 8 | `RAG-P0-001` | Not started | Internal RAG candidate canary | V10.770 stops at candidate preview. Exit: bounded pgvector candidate canary, signature/readback/feedback receipt, no price write and no premature `ai_insights` promotion. Next: `run_internal_rag_candidate_canary`. |
| 9 | `MCP-P0-001` | In progress | MCP/RAG production runtime closure | Registry and smoke wiring exist, but runtime flags/ports must be live. Exit: MCP servers healthy, router enabled, RAG enabled, approved caller/tool boundary and production query canary pass. |
| 10 | `SEC-P0-004` | Not started | Security operations lifecycle and metrics | Add durable security incident state and publish MTTA, MTTR, recurrence, false positive, human intervention, verifier pass, rollback and freshness. Exit: detect-to-learn production receipt. |
| 11 | `REL-P0-001` | In progress | Formal deploy and visible proof discipline | Gitea main source is `f2201e12bcfc0b9ce31d695857897e88e89ab7de`; dev carries the same source change as `3c142c19500f50b4b8edd0da10cb9b6f9a5617ba`. Actions #1122 is waiting because no `ewoooc-host` runner is online. A bounded exact-Git-object fallback deployed the six changed runtime files as V10.790 with staging/target SHA-256 verification and rollback backup `/home/ollama/momo-deploy-backups/ewoooc-20260714T184231-f2201e1`. Production health is green, all three application containers are healthy, and `momo-db` remained unchanged at `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Next: restore the dedicated runner and require commit-bound automated CD/post-verifier proof for subsequent runtime changes. |
| 11 | `REL-P0-001` | In progress | Formal deploy and visible proof discipline | Gitea runtime source is main `4c0472a461e83d32cfd1dcab55b85ce0899c7b0c`; dev carries the same runtime changes through `2022e27`. Actions #1126 is waiting because no matching `ewoooc-host` runner is online, not because tests or source failed. A bounded exact-Git-object fallback deployed V10.794 with staging/target SHA-256 verification and rollback backup `/home/ollama/momo-deploy-backups/ewoooc-20260714T133003Z-4c0472a`. Production `/health` is healthy at V10.794; all three application containers are healthy and retain their expected identities; `momo-db` remained running and unchanged at `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Desktop/mobile visible QA confirms the 40% revenue KPI and structured evidence panels without horizontal overflow. Next: restore the dedicated runner and require commit-bound automated CD/post-verifier proof for subsequent runtime changes. |
### GROWTH-P0-001 Fixed Execution Lanes
@@ -34,8 +34,8 @@ These lanes are one ordered current P0, not optional side work. They must advanc
| Lane | Status | Production baseline | Next machine action |
|---|---|---|---|
| A. Sales freshness | In progress (`degraded`) | Latest sales date `2026-06-24`, age 20 days. Production reconciliation covers all four registered adapters but only Google Drive is runtime-ready (`1/4`); it has returned zero Excel files for 39 consecutive probes. Durable receipts `ec85cf440fdc4c648eb18b681718ec7d` and `6dfa8cdc74a846ee91f3c71962942af1` prove bounded retry and cross-run state. The scheduler sent one state-change notification, then independently suppressed the duplicate with fingerprint `f3539ef9dff5e9c824c2`. | Continue fixed 30-minute Google Drive probes; automatically include HTTPS, IMAP or local sources as soon as their authorized runtime configuration becomes ready; transactionally import the first newer report; independently verify the snapshot date and only then release freshness-dependent decisions. |
| B. Verified same-item evidence | In progress | TOP 50: `5` verified, `4` candidate/source validation, `41` unmatched. Active seven-day catalog: `23/1,938` mapped (`1.19%`). The first bounded MOMO catch-up scanned 7 products and correctly wrote 0 unverified offers. | Prioritize unmatched products by revenue contribution, replay deterministic identity and unit/variant checks across approved sources, promote only independently verified same-item evidence, and publish coverage delta per run. |
| A. Sales freshness | In progress (`freshness_closed_continuity_drift`) | Latest sales date `2026-07-13`, age 1 day; freshness is decision-ready and receipt `3f46ee5cee7e4f249f6405440acde05f` closed as `completed_no_write` with no manual review. The current live readiness probe reports `0/4`, while the persisted source reconciliation reports Google Drive ready at `1/4`; HTTPS, IMAP and local remain disabled. | Keep decisions released while freshness is <=1 day; automatically reconcile the current `0/4` versus `1/4` readiness drift, continue bounded probes, and require the next-day snapshot plus independent receipt before considering source continuity stable. |
| B. Verified same-item evidence | In progress | TOP50: `5` verified, `4` candidate/source validation, `41` unmatched. Count coverage is `10%`; revenue-weighted coverage is `NT$40,201 / NT$100,507 = 40%`. The first production canary independently verified and committed 2 exact MOMO offers; exact identity/fingerprint DB replay passed `2/2`. Latest run `d3db6b69a5fc46e4ad59424299d549cb` found no safe candidate and correctly persisted 4/4 `no_write` receipts, 0 failed, with a passing no-write post-verifier and 1-hour retry. | Continue revenue-prioritized bounded runs over the remaining 45 products, replay deterministic identity/unit/variant checks, promote only independent verifier passes, and publish both count and revenue coverage deltas per run. |
| C. Platform runtime coverage | In progress | `1/15` registered external sources currently contributes formal runtime data (`6.7%`). PixelRAG remains evidence-only. | Activate approved structured adapters in source-contract order, use PixelRAG/OCR/VLM only to generate replayable candidates, classify anti-bot pages as blocked evidence, and require provenance/freshness/verifier receipts before formal price promotion. |
## P1
@@ -47,10 +47,10 @@ These lanes are one ordered current P0, not optional side work. They must advanc
| 14 | `APPSEC-P1-001` | In progress | CSP and DOM/XSS hardening | Security headers are present and CSP is report-only. Collect violations, remove high-risk `innerHTML`/inline sinks, then enforce CSP by canary. |
| 15 | `APPSEC-P1-002` | Not started | Unsafe shared-cache serialization removal | Replace writable pickle caches in dashboard/daily-sales/EDM/sales with constrained JSON or signed schema. |
| 16 | `ARCH-P1-001` | In progress | Split oversized policy/executor/verifier modules | Current top debts include 44k-line PChome mapping and 14k-line smoke service. Split by bounded family and independent tests. |
| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | Complete first-viewport cockpit, progressive disclosure, text-density reduction, Traditional Chinese product copy, accessibility, loading/error/empty/degraded states and desktop/mobile visual smoke. |
| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | V10.794 closes the PChome growth dashboard slice: primary KPI is 40% revenue coverage, raw 10% count coverage remains secondary truth, mapping/automation text walls are structured grids, and desktop/mobile visual smoke shows no horizontal overflow. Continue the same first-viewport, progressive-disclosure, accessibility and state coverage across every remaining primary page. |
| 18 | `PIXELRAG-P1-001` | Not started | Ollama-first multimodal embedding benchmark | Verify approved visual embedding on GCP-A -> GCP-B -> 111 and design pgvector-compatible visual metadata; FAISS remains disallowed without ADR. |
| 19 | `MARKET-P1-001` | In progress | Marketplace source contracts | Finish stable, public-boundary, provenance and rate-limit contracts for Shopee, Coupang, Yahoo, ETMall, Friday and Rakuten; blocked pages remain non-product data. |
| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | V10.790 full local baseline is 2,065 passed / 9 skipped / 0 failed. Observability QA and the security governance release gate both pass with zero blocking failures. Next: reproduce the same terminal in Gitea CI after runner recovery, split deterministic release tests from nightly integration and production canaries, and prevent workstation disk pressure from invalidating evidence. |
| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | V10.794 full local baseline is 2,073 passed / 9 skipped / 0 failed; post-verifier and UI hotfix regression scope is 97 passed. Security governance strict gate passes with zero blocking failures. Next: reproduce the same terminal in Gitea CI after runner recovery, split deterministic release tests from nightly integration and production canaries, and prevent workstation disk pressure from invalidating evidence. |
## P2