{
  "schema_version": "ai_agent_host_stateful_version_inventory_v1",
  "generated_at": "2026-06-11T15:31:00+08:00",
  "program_status": {
    "overall_completion_percent": 86,
    "current_task_id": "P2-402F",
    "next_task_id": "P2-402G",
    "read_only_mode": true,
    "runtime_authority": "host_stateful_readonly_inventory_no_upgrade_or_restart",
    "status_note": "已建立 host OS / K3s / stateful services 版本只讀盤點與 maintenance window 批准包；仍不執行 SSH、kubectl、升級、重啟、drain、restore、Telegram 實發或外部版本查詢。"
  },
  "source_refs": [
    {
      "ref_id": "service_endpoints",
      "path": "docs/reference/SERVICE-ENDPOINTS.md",
      "usage": "主機、K3s VIP、AI、資料庫、監控、DevOps、備份與安全端點來源。"
    },
    {
      "ref_id": "deployment_layout",
      "path": "docs/evaluations/ai_agent_deployment_layout_2026-06-11.json",
      "usage": "AI Agent 在 188 / 110 / 112 / 120 / 121 的只讀佈建與 gate 來源。"
    },
    {
      "ref_id": "version_freshness",
      "path": "docs/evaluations/ai_agent_version_freshness_snapshot_2026-06-11.json",
      "usage": "P2-402B 已明確把 host / K3s live version probe 留給 P2-402F gate。"
    },
    {
      "ref_id": "latest_cd_evidence",
      "path": "Gitea cd.yaml run 2667 log",
      "usage": "部署過程只讀看到 121/125 login banner 與 rollout evidence；未使用 SSH 手動命令，未收 secret value。"
    },
    {
      "ref_id": "hard_rules_high_value_config",
      "path": "docs/HARD_RULES.md#high-value-config-control",
      "usage": "主機、K3s、workflow、secret、backup、AI provider 與 runtime config 變更必須 source-of-truth、owner gate、diff、rollback 與驗證。"
    }
  ],
  "operation_boundaries": {
    "read_only_inventory_allowed": true,
    "ssh_login_allowed": false,
    "host_command_execution_allowed": false,
    "kubectl_command_execution_allowed": false,
    "apt_upgrade_allowed": false,
    "os_release_upgrade_allowed": false,
    "kernel_upgrade_allowed": false,
    "k3s_upgrade_allowed": false,
    "kubelet_restart_allowed": false,
    "node_drain_allowed": false,
    "reboot_allowed": false,
    "stateful_service_restart_allowed": false,
    "database_migration_allowed": false,
    "backup_delete_allowed": false,
    "restore_execution_allowed": false,
    "image_pull_allowed": false,
    "package_install_allowed": false,
    "external_version_lookup_allowed": false,
    "active_network_scan_allowed": false,
    "telegram_direct_send_allowed": false,
    "telegram_gateway_queue_write_allowed": false,
    "secret_plaintext_allowed": false,
    "conversation_transcript_allowed": false
  },
  "approval_boundaries": {
    "host_readonly_probe_approved": false,
    "ssh_probe_approved": false,
    "kubectl_probe_approved": false,
    "maintenance_window_approved": false,
    "apt_upgrade_approved": false,
    "kernel_upgrade_approved": false,
    "k3s_upgrade_approved": false,
    "node_drain_approved": false,
    "reboot_approved": false,
    "stateful_restart_approved": false,
    "stateful_upgrade_approved": false,
    "backup_restore_drill_approved": false,
    "telegram_send_approved": false
  },
  "agent_roles": [
    {
      "agent": "OpenClaw",
      "role": "仲裁者",
      "responsibility": "判斷 host / K3s / stateful 版本盤點是否可進 owner gate，禁止在證據不足時推升級或重啟。"
    },
    {
      "agent": "Hermes",
      "role": "執行規劃者",
      "responsibility": "整理 repo evidence、probe 草案、maintenance window packet 與 rollback checklist，不執行命令。"
    },
    {
      "agent": "NemoTron",
      "role": "研究助理",
      "responsibility": "在 dry-run / human-review 邊界內協助摘要版本 skew 與相依性風險，不做生產建議最終裁決。"
    }
  ],
  "host_inventory": [
    {
      "host_id": "host_188_ai_db_monitoring_backup",
      "display_name": "188 AI / DB / monitoring / backup host",
      "known_addresses": [
        "192.168.0.188"
      ],
      "primary_surfaces": [
        "Ollama",
        "OpenClaw",
        "PostgreSQL",
        "Redis",
        "SignOz",
        "ClickHouse",
        "Prometheus",
        "Alertmanager",
        "MinIO"
      ],
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "host_update_authorized": false,
      "reboot_authorized": false,
      "maintenance_window_required": true,
      "next_evidence_needed": [
        "os-release",
        "kernel version",
        "docker / container runtime version",
        "stateful service versions",
        "backup freshness"
      ],
      "blocked_actions": [
        "apt upgrade",
        "kernel upgrade",
        "reboot",
        "stateful restart",
        "backup delete",
        "restore execution"
      ]
    },
    {
      "host_id": "host_110_devops_registry",
      "display_name": "110 DevOps / registry host",
      "known_addresses": [
        "192.168.0.110"
      ],
      "primary_surfaces": [
        "Gitea",
        "Harbor registry",
        "Sentry",
        "Langfuse",
        "Prometheus blackbox exporter"
      ],
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "host_update_authorized": false,
      "reboot_authorized": false,
      "maintenance_window_required": true,
      "next_evidence_needed": [
        "os-release",
        "Gitea version",
        "registry version",
        "Sentry / Langfuse version",
        "runner health"
      ],
      "blocked_actions": [
        "workflow change",
        "runner restart",
        "registry image delete",
        "host package upgrade",
        "reboot"
      ]
    },
    {
      "host_id": "host_112_kali_readonly",
      "display_name": "112 Kali scanner read-only host",
      "known_addresses": [
        "192.168.0.112"
      ],
      "primary_surfaces": [
        "Kali scanner API",
        "security evidence collector"
      ],
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "host_update_authorized": false,
      "reboot_authorized": false,
      "maintenance_window_required": true,
      "next_evidence_needed": [
        "scanner service version",
        "tool package baseline",
        "active scan gate state"
      ],
      "blocked_actions": [
        "active scan",
        "credentialed scan",
        "tool upgrade",
        "reboot"
      ]
    },
    {
      "host_id": "host_120_k3s_master_blocked",
      "display_name": "120 K3s master / blocked recovery host",
      "known_addresses": [
        "192.168.0.120"
      ],
      "primary_surfaces": [
        "K3s server",
        "control-plane recovery context"
      ],
      "version_observation_status": "blocked_host_live_probe_not_run",
      "readonly_only": true,
      "host_update_authorized": false,
      "reboot_authorized": false,
      "maintenance_window_required": true,
      "next_evidence_needed": [
        "reachability evidence",
        "K3s version",
        "node readiness",
        "kubelet status"
      ],
      "blocked_actions": [
        "ssh probe",
        "node drain",
        "K3s upgrade",
        "kubelet restart",
        "reboot"
      ]
    },
    {
      "host_id": "host_121_k3s_peer",
      "display_name": "121 K3s peer host",
      "known_addresses": [
        "192.168.0.121",
        "192.168.0.125"
      ],
      "primary_surfaces": [
        "K3s server",
        "VIP endpoint",
        "AWOOOI API/Web/Worker rollout evidence"
      ],
      "version_observation_status": "cd_login_banner_observed_os_only",
      "observed_evidence_summary": "Gitea CD run 2667 login banner observed Ubuntu 22.04.5 LTS and kernel 5.15.0-179-generic on the deploy target; this is deployment evidence only, not a full host version inventory.",
      "readonly_only": true,
      "host_update_authorized": false,
      "reboot_authorized": false,
      "maintenance_window_required": true,
      "next_evidence_needed": [
        "K3s version",
        "kubectl version",
        "container runtime version",
        "node readiness",
        "pending package updates with owner gate"
      ],
      "blocked_actions": [
        "apt upgrade",
        "do-release-upgrade",
        "node drain",
        "K3s upgrade",
        "reboot"
      ]
    }
  ],
  "k3s_inventory": {
    "cluster_id": "awoooi_prod_k3s",
    "api_endpoint": "192.168.0.125:6443",
    "version_observation_status": "repo_reference_only_kubectl_probe_not_run",
    "skew_policy_required": true,
    "upgrade_authorized": false,
    "nodes": [
      {
        "node_id": "k3s_120",
        "host_id": "host_120_k3s_master_blocked",
        "role": "server",
        "readonly_only": true,
        "drain_authorized": false,
        "kubelet_restart_authorized": false,
        "version_observation_status": "blocked_host_live_probe_not_run"
      },
      {
        "node_id": "k3s_121",
        "host_id": "host_121_k3s_peer",
        "role": "server",
        "readonly_only": true,
        "drain_authorized": false,
        "kubelet_restart_authorized": false,
        "version_observation_status": "rollout_evidence_only_version_probe_not_run"
      }
    ],
    "required_pre_change_evidence": [
      "kubectl version --client/output redacted",
      "K3s server version",
      "node readiness",
      "current ArgoCD sync / health",
      "version skew policy assessment",
      "rollback ref"
    ]
  },
  "stateful_services": [
    {
      "service_id": "postgresql",
      "display_name": "PostgreSQL",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#資料庫-1921680188",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "redis",
      "display_name": "Redis",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#資料庫-1921680188",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "minio",
      "display_name": "MinIO",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#備份-1921680188",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "clickhouse",
      "display_name": "ClickHouse",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "signoz",
      "display_name": "SignOz",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "prometheus",
      "display_name": "Prometheus",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "alertmanager",
      "display_name": "Alertmanager",
      "host_id": "host_188_ai_db_monitoring_backup",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "gitea",
      "display_name": "Gitea",
      "host_id": "host_110_devops_registry",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#devops-1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "harbor_registry",
      "display_name": "Harbor / registry",
      "host_id": "host_110_devops_registry",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#devops-1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "sentry",
      "display_name": "Sentry",
      "host_id": "host_110_devops_registry",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "langfuse",
      "display_name": "Langfuse",
      "host_id": "host_110_devops_registry",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#監控-1921680188--1921680110",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    },
    {
      "service_id": "argocd",
      "display_name": "ArgoCD",
      "host_id": "host_121_k3s_peer",
      "endpoint_ref": "docs/reference/SERVICE-ENDPOINTS.md#k3s-叢集管理",
      "version_observation_status": "repo_reference_only_live_probe_not_run",
      "readonly_only": true,
      "restart_authorized": false,
      "upgrade_authorized": false,
      "backup_required_before_change": true
    }
  ],
  "readonly_probe_plan": [
    {
      "step_id": "repo_endpoint_map",
      "display_name": "Repo endpoint map 對齊",
      "planned_output": "整理 SERVICE-ENDPOINTS、runtime surface、deployment layout 的主機與服務 mapping。",
      "run_now_allowed": false,
      "mutation_allowed": false
    },
    {
      "step_id": "cd_banner_evidence_extract",
      "display_name": "CD banner evidence 摘要",
      "planned_output": "只讀引用最新 CD login banner / rollout log，標註其侷限，不當成完整版本盤點。",
      "run_now_allowed": false,
      "mutation_allowed": false
    },
    {
      "step_id": "host_readonly_probe_packet",
      "display_name": "Host readonly probe packet",
      "planned_output": "準備 os-release、kernel、container runtime、package pending summary 的 owner approval request。",
      "run_now_allowed": false,
      "mutation_allowed": false
    },
    {
      "step_id": "k3s_version_skew_packet",
      "display_name": "K3s version skew packet",
      "planned_output": "準備 K3s / kubectl / node readiness / skew policy 的只讀證據欄位。",
      "run_now_allowed": false,
      "mutation_allowed": false
    },
    {
      "step_id": "stateful_service_version_packet",
      "display_name": "Stateful service version packet",
      "planned_output": "準備 PostgreSQL、Redis、MinIO、Gitea、Harbor、監控服務的版本與備份前置欄位。",
      "run_now_allowed": false,
      "mutation_allowed": false
    },
    {
      "step_id": "maintenance_window_packet",
      "display_name": "Maintenance window approval packet",
      "planned_output": "產出 owner、affected scope、backup、rollback、smoke、communication 與 risk acceptance 欄位。",
      "run_now_allowed": false,
      "mutation_allowed": false
    }
  ],
  "maintenance_window_approval_package": {
    "package_id": "host_stateful_maintenance_window_packet_v1",
    "approval_required_before_probe": true,
    "approval_required_before_change": true,
    "break_glass_record_required": true,
    "required_fields": [
      "owner",
      "decision",
      "maintenance_window",
      "affected_hosts",
      "affected_services",
      "backup_snapshot_ref",
      "rollback_owner",
      "rollback_plan",
      "smoke_plan",
      "communication_plan",
      "risk_acceptance"
    ],
    "forbidden_fields": [
      "secret value",
      "private key",
      "authorization header",
      "cookie",
      "session payload",
      "work-window transcript",
      "推理鏈"
    ],
    "minimum_smoke_plan": [
      "public health",
      "internal NodePort health when applicable",
      "stateful service ready check",
      "backup freshness readback",
      "rollback ref readback"
    ]
  },
  "telegram_policy": {
    "status": "draft_only",
    "direct_send_allowed": false,
    "gateway_queue_write_allowed": false,
    "allowed_digest_types_after_gate": [
      "action_required_missing_evidence",
      "critical_version_skew",
      "maintenance_window_owner_response_needed",
      "rollout_failure"
    ],
    "success_noise_suppression": true
  },
  "display_redaction_contract": {
    "conversation_transcript_display_allowed": false,
    "redaction_required": true,
    "allowed_frontend_fields": [
      "整體完成度",
      "目前任務",
      "下一任務",
      "主機版本盤點摘要",
      "K3s skew gate",
      "stateful services 摘要",
      "maintenance window approval package"
    ],
    "forbidden_frontend_content": [
      "工作視窗對話內容",
      "secret 明文",
      "private key",
      "authorization header",
      "cookie",
      "提示詞全文",
      "推理鏈",
      "瀏覽器 session 上下文"
    ]
  },
  "rollups": {
    "host_count": 5,
    "k3s_node_count": 2,
    "stateful_service_count": 12,
    "readonly_probe_step_count": 6,
    "maintenance_required_field_count": 11,
    "host_ids": [
      "host_110_devops_registry",
      "host_112_kali_readonly",
      "host_120_k3s_master_blocked",
      "host_121_k3s_peer",
      "host_188_ai_db_monitoring_backup"
    ],
    "stateful_service_ids": [
      "alertmanager",
      "argocd",
      "clickhouse",
      "gitea",
      "harbor_registry",
      "langfuse",
      "minio",
      "postgresql",
      "prometheus",
      "redis",
      "sentry",
      "signoz"
    ],
    "ssh_login_allowed_count": 0,
    "kubectl_command_execution_allowed_count": 0,
    "apt_upgrade_allowed_count": 0,
    "k3s_upgrade_allowed_count": 0,
    "node_drain_allowed_count": 0,
    "reboot_allowed_count": 0,
    "stateful_service_restart_allowed_count": 0,
    "telegram_direct_send_allowed_count": 0,
    "conversation_transcript_allowed_count": 0
  },
  "next_actions": [
    {
      "task_id": "P2-402G",
      "priority": "P2",
      "summary": "把可委派能力接入 governance UI，顯示 autonomy level、gate、owner、Telegram policy。",
      "gate": "frontend_ui_change_approval_required"
    }
  ]
}
