ewoooc/docs/guides/ai_automation_mainline_work_items.md

AI Automation Mainline Work Items

Updated: 2026-07-14 18:50 Asia/Taipei Governance: global_product_governance_v2 + ADR-038 Current P0: GROWTH-P0-001 comparison coverage truth + autonomous refresh

Source Of Truth

• Production runtime receipt/post-verifier/durable DB receipt is authoritative.
• Gitea main, deploy marker, CD run and production readback are the only source/deploy truth; GitHub remains frozen.
• Source/test/UI/CD green does not mean runtime closure.
• Completion must report program, asset coverage and runtime closure separately.
• PixelRAG visual evidence cannot write formal prices or ai_insights before identity, PromotionGate and internal RAG canary proof.

Ordered P0

Order	ID	Status	Work item	Exit evidence / next machine action
1	SEC-P0-001	Completed	Deny-by-default route access control	governance/evidence/SEC-P0-001-20260711T122758Z.json plus the current runtime receipt prove anonymous matrix 8/8 denied, public /metrics 404, exact internal target up, EwoooC product markers present, Prometheus identity preserved and momo-db unchanged.
2	GROWTH-P0-001	In progress (degraded)	Comparison coverage truth + autonomous refresh	V10.790 is live. Production contract pchome_sales_source_reconciliation_v1 now reconciles all four sales-source adapters, persists cross-run state, schedules bounded retry/fallback and deduplicates source-state alerts. Runtime coverage remains 1/4: Google Drive is ready but has returned zero Excel files for 39 consecutive probes; HTTPS, IMAP and local adapters remain disabled until authorized runtime configuration exists. Latest sales date is still 2026-06-24 (20 days stale), so operational decisions remain paused. Comparison truth remains TOP 50 5 ready + 4 candidate validation + 41 unmatched = 50, active seven-day catalog 23/1,938, and registered platform runtime 1/15. Next: execute lanes A -> B -> C below until freshness and verified coverage gates close.
3	SEC-P0-002	In progress (canary_ready)	Database identity + least-privilege RBAC	V10.789 is live and governance/auth_identity_runtime_receipt.json verifies required tables, two active admins, durable lockout, session revocation, trusted proxy policy and no-secret mutation audit readiness. Runtime is intentionally hybrid because zero database-admin success receipts have been captured; auto retires shared authority after two durable successes without a manual review gate. Next: capture database-admin login receipts and verify automatic database-only cutover.
4	SEC-P0-003	In progress	Webhook trust and replay protection	Telegram secret-token verification code exists; production secret activation remains unproven. Exit: secret provisioned outside source, required mode enabled, invalid-secret 401 and authorized callback canary pass.
5	SUPPLY-P0-001	In progress	Gitea-only secure software supply chain	Gitea-native checkout, secret-safe .dockerignore, commit-bound source receipt and governance gate are active. Exit: exact dependency lock, internal SAST/SCA/secret scan, SBOM, image digest/provenance, vulnerability SLA and production digest readback.
6	GOV-P0-001	In progress	Canonical full asset graph + runtime reconciliation	governance/ewoooc_asset_inventory.json seeds hosts, services, data, AI, routes, supply chain, observability and recovery. Exit: same-run probe receipt for every asset; drift auto-creates work items.
7	GOV-P0-002	Not started	Unified controlled-apply envelope	Introduce one trace_id/run_id/work_item_id across sensor, identity, SOT diff, decision, risk, dry-run, execution, verifier, rollback/retry and learning acknowledgement. Start with EventRouter + AutoHeal.
8	RAG-P0-001	Not started	Internal RAG candidate canary	V10.770 stops at candidate preview. Exit: bounded pgvector candidate canary, signature/readback/feedback receipt, no price write and no premature ai_insights promotion. Next: run_internal_rag_candidate_canary.
9	MCP-P0-001	In progress	MCP/RAG production runtime closure	Registry and smoke wiring exist, but runtime flags/ports must be live. Exit: MCP servers healthy, router enabled, RAG enabled, approved caller/tool boundary and production query canary pass.
10	SEC-P0-004	Not started	Security operations lifecycle and metrics	Add durable security incident state and publish MTTA, MTTR, recurrence, false positive, human intervention, verifier pass, rollback and freshness. Exit: detect-to-learn production receipt.
11	REL-P0-001	In progress	Formal deploy and visible proof discipline	Gitea main source is f2201e12bcfc0b9ce31d695857897e88e89ab7de; dev carries the same source change as 3c142c19500f50b4b8edd0da10cb9b6f9a5617ba. Actions #1122 is waiting because no ewoooc-host runner is online. A bounded exact-Git-object fallback deployed the six changed runtime files as V10.790 with staging/target SHA-256 verification and rollback backup /home/ollama/momo-deploy-backups/ewoooc-20260714T184231-f2201e1. Production health is green, all three application containers are healthy, and momo-db remained unchanged at cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d. Next: restore the dedicated runner and require commit-bound automated CD/post-verifier proof for subsequent runtime changes.

GROWTH-P0-001 Fixed Execution Lanes

These lanes are one ordered current P0, not optional side work. They must advance in this order and keep formal-price writes behind verified same-item evidence.

Lane	Status	Production baseline	Next machine action
A. Sales freshness	In progress (degraded)	Latest sales date 2026-06-24, age 20 days. Production reconciliation covers all four registered adapters but only Google Drive is runtime-ready (1/4); it has returned zero Excel files for 39 consecutive probes. Durable receipts ec85cf440fdc4c648eb18b681718ec7d and 6dfa8cdc74a846ee91f3c71962942af1 prove bounded retry and cross-run state. The scheduler sent one state-change notification, then independently suppressed the duplicate with fingerprint f3539ef9dff5e9c824c2.	Continue fixed 30-minute Google Drive probes; automatically include HTTPS, IMAP or local sources as soon as their authorized runtime configuration becomes ready; transactionally import the first newer report; independently verify the snapshot date and only then release freshness-dependent decisions.
B. Verified same-item evidence	In progress	TOP 50: 5 verified, 4 candidate/source validation, 41 unmatched. Active seven-day catalog: 23/1,938 mapped (1.19%). The first bounded MOMO catch-up scanned 7 products and correctly wrote 0 unverified offers.	Prioritize unmatched products by revenue contribution, replay deterministic identity and unit/variant checks across approved sources, promote only independently verified same-item evidence, and publish coverage delta per run.
C. Platform runtime coverage	In progress	1/15 registered external sources currently contributes formal runtime data (6.7%). PixelRAG remains evidence-only.	Activate approved structured adapters in source-contract order, use PixelRAG/OCR/VLM only to generate replayable candidates, classify anti-bot pages as blocked evidence, and require provenance/freshness/verifier receipts before formal price promotion.

P1

Order	ID	Status	Work item	Exit evidence / next machine action
12	RES-P1-001	Not started	Backup/offsite/restore automation	Fresh checksum and offsite coverage plus isolated non-destructive restore drill with measured RPO/RTO.
13	PLAT-P1-001	Not started	Non-root container and capability hardening	Shadow non-root image, writable-path inventory, capability drop/read-only filesystem canary, three-app rollout.
14	APPSEC-P1-001	In progress	CSP and DOM/XSS hardening	Security headers are present and CSP is report-only. Collect violations, remove high-risk innerHTML/inline sinks, then enforce CSP by canary.
15	APPSEC-P1-002	Not started	Unsafe shared-cache serialization removal	Replace writable pickle caches in dashboard/daily-sales/EDM/sales with constrained JSON or signed schema.
16	ARCH-P1-001	In progress	Split oversized policy/executor/verifier modules	Current top debts include 44k-line PChome mapping and 14k-line smoke service. Split by bounded family and independent tests.
17	UX-P1-001	In progress	Professional full-site UI/UX	Complete first-viewport cockpit, progressive disclosure, text-density reduction, Traditional Chinese product copy, accessibility, loading/error/empty/degraded states and desktop/mobile visual smoke.
18	PIXELRAG-P1-001	Not started	Ollama-first multimodal embedding benchmark	Verify approved visual embedding on GCP-A -> GCP-B -> 111 and design pgvector-compatible visual metadata; FAISS remains disallowed without ADR.
19	MARKET-P1-001	In progress	Marketplace source contracts	Finish stable, public-boundary, provenance and rate-limit contracts for Shopee, Coupang, Yahoo, ETMall, Friday and Rakuten; blocked pages remain non-product data.
20	QA-P1-001	In progress	Deterministic test and CI governance	V10.790 full local baseline is 2,065 passed / 9 skipped / 0 failed. Observability QA and the security governance release gate both pass with zero blocking failures. Next: reproduce the same terminal in Gitea CI after runner recovery, split deterministic release tests from nightly integration and production canaries, and prevent workstation disk pressure from invalidating evidence.

P2

Order	ID	Status	Work item	Exit evidence / next machine action
21	GOV-P2-001	Not started	Continuous NIST/ASVS control trend	Persist governance snapshots, compare control/asset/runtime drift and create ordered work items automatically.
22	DATA-P2-001	Not started	Data classification and retention enforcement	Classify business, personal, operational and model data; automate retention, deletion eligibility and audit evidence without destructive default actions.
23	CHAOS-P2-001	Not started	Controlled resilience exercises	Run non-destructive model-host, MCP, queue, Telegram and app-container failure drills with rollback and learning receipts.

Completed Foundations

These are reusable foundations, not proof that the full program is complete.

Status	Capability	Current boundary
Completed	Multi-commerce PixelRAG visual evidence for momo, pchome, shopee_tw, coupang_tw, yahoo_shopping_tw, etmall_tw, friday_tw, rakuten_tw	Evidence-only; blocked pages are not product data.
Completed	External MCP/RAG capability inventory	Registry/integration readback exists; runtime enablement remains P0.
Completed	PixelRAG receipt -> RAG candidate replay	Candidate-only; no formal knowledge or price write.
Completed	Source-contract replay worker	Public-boundary artifact receipts only.
Completed	Marketplace adapter preflight and dry-run	Deterministic no-write contracts.
Completed	Marketplace identity matcher replay	Candidate identity only.
Completed	PromotionGate replay	No production write.
Completed	Embedding-signature guard replay	Signature readiness only.
Completed	Candidate knowledge replay	Internal RAG preview only; canary remains P0.
Completed	PixelRAG application portfolio	Commerce/RAG/UX/ops/marketing/governance inventory.
Completed	Ollama-first VLM route readiness and replay worker	Evidence-bound artifact output; no direct price write.
Completed	Platform probe worker	Shopee/Coupang barriers become structured fallback/backoff receipts.

Definition Of Done

A work item can be Completed only when the same production run contains:

1. sensor/source receipt;
2. normalized canonical asset identity;
3. source-of-truth diff;
4. AI decision and candidate action;
5. risk/policy decision;
6. check-mode/dry-run receipt;
7. idempotent bounded execution receipt;
8. independent post-verifier and rollback/no-write terminal;
9. incident/Telegram/KM/RAG/MCP/PlayBook durable acknowledgement.

Missing any stage means partial, degraded or blocked_with_safe_next_action.