{
  "schema_version": "ai_agent_high_risk_owner_review_queue_v1",
  "generated_at": "2026-06-19T03:20:00+08:00",
  "program_status": {
    "overall_completion_percent": 100,
    "current_priority": "P0",
    "current_task_id": "P2-409",
    "next_task_id": "P2-410",
    "read_only_mode": true,
    "runtime_authority": "controlled_apply_break_glass_queue_readback_no_live_execution",
    "status_note": "P2-409 已從高風險 Owner Review Queue 轉為高風險受控自動執行 / critical break-glass 佇列；high 風險走 controlled apply packet、allowlist、rollback、verifier 與 Telegram evidence，critical / secret / destructive / paid / force-push 仍進 break-glass。此 readback 不直接執行 live action。"
  },
  "source_refs": [
    "docs/evaluations/ai_agent_low_medium_risk_whitelist_2026-06-18.json",
    "docs/evaluations/ai_agent_receipt_readback_owner_review_2026-06-18.json",
    "docs/security/telegram-notification-egress-inventory.snapshot.json",
    "docs/security/telegram-notification-egress-owner-request-draft.snapshot.json",
    "apps/api/src/services/ai_agent_report_source_health.py",
    "docs/workplans/2026-06-04-iwooos-security-governance-p0.md"
  ],
  "source_readbacks": [
    {
      "readback_id": "p2_408_high_risk_redirects",
      "source_schema_version": "ai_agent_low_medium_risk_whitelist_v1",
      "source_ref": "docs/evaluations/ai_agent_low_medium_risk_whitelist_2026-06-18.json",
      "endpoint": "GET /api/v1/agents/agent-low-medium-risk-whitelist",
      "owner_agent": "openclaw",
      "status": "loaded",
      "key_readback": "P2-408 已產生 3 個 high / critical redirect、3 個 owner gate 與 27 個 blocked runtime action。",
      "next_action": "把 redirect 轉成 P2-409 queue item 與 approval packet。"
    },
    {
      "readback_id": "p2_406b_receipt_owner_review",
      "source_schema_version": "ai_agent_receipt_readback_owner_review_v1",
      "source_ref": "docs/evaluations/ai_agent_receipt_readback_owner_review_2026-06-18.json",
      "endpoint": "GET /api/v1/agents/agent-receipt-readback-owner-review",
      "owner_agent": "hermes",
      "status": "loaded",
      "key_readback": "日報 / 週報 / 月報、Telegram receipt 與 report truth gate 仍停在 owner review；live 負責人審查已接受=0。",
      "next_action": "任何 receipt production write 或 canary send 都必須進 queue，不接受跳關。"
    },
    {
      "readback_id": "p2_110d_report_source_gap_playbook_verifier",
      "source_schema_version": "ai_agent_report_source_health_v1",
      "source_ref": "apps/api/src/services/ai_agent_report_source_health.py",
      "endpoint": "GET /api/v1/agents/agent-report-source-health",
      "owner_agent": "hermes",
      "status": "loaded",
      "key_readback": "source 5、source ok 2、source gap 3、PlayBook draft 3、Verifier plan 3、owner review required 3、live send allowed 0、runtime gate 0。",
      "next_action": "報表缺口只能產 owner review 與 work item 草稿，不寫 KM、不寫 PlayBook trust、不改排程。"
    },
    {
      "readback_id": "p2_110e_work_items_owner_review",
      "source_schema_version": "awoooi_work_items_report_source_gap_owner_review_v1",
      "source_ref": "docs/workplans/2026-06-04-iwooos-security-governance-p0.md",
      "endpoint": "GET /zh-TW/awooop/work-items?project_id=awoooi",
      "owner_agent": "hermes",
      "status": "loaded",
      "key_readback": "Work Items 已顯示 report-source-gap owner review、PlayBook 必填欄位、Verifier 檢查、live Telegram send=0、runtime gate=0。",
      "next_action": "任何 work item DB write、KM write、verifier receipt write 都需 P2-409 approval packet。"
    },
    {
      "readback_id": "telegram_egress_inventory",
      "source_schema_version": "telegram_notification_egress_inventory_v1",
      "source_ref": "docs/security/telegram-notification-egress-inventory.snapshot.json",
      "endpoint": "repo-only snapshot",
      "owner_agent": "sre",
      "status": "loaded",
      "key_readback": "direct Bot API call 18、direct file 11、Gateway normalized callsite 56、runtime gate 0、send authorized 0。",
      "next_action": "所有 direct egress 與 Telegram route 變更必須進 owner request，不可直接修 workflow 或 script。"
    },
    {
      "readback_id": "telegram_owner_request_draft",
      "source_schema_version": "telegram_notification_egress_owner_request_draft_v1",
      "source_ref": "docs/security/telegram-notification-egress-owner-request-draft.snapshot.json",
      "endpoint": "repo-only snapshot",
      "owner_agent": "sre",
      "status": "loaded",
      "key_readback": "owner request draft 11、required owner fields 19、preflight 16、blocked action 26、request sent 0、負責人已接受 0。",
      "next_action": "P2-409 只讀回 request draft，不送 owner request、不 emit audit event、不開 action button。"
    }
  ],
  "queue_truth": {
    "p2_408_redirects_loaded": true,
    "p2_406b_receipt_owner_review_loaded": true,
    "p2_110d_report_source_gap_loaded": true,
    "p2_110e_work_items_owner_review_loaded": true,
    "telegram_egress_inventory_loaded": true,
    "telegram_owner_request_draft_loaded": true,
    "all_high_risk_actions_paused": false,
    "approval_packets_ready": true,
    "rejection_guards_ready": true,
    "reviewer_checklists_ready": true,
    "high_risk_owner_review_required": false,
    "auto_worker_enabled": false,
    "live_execution_enabled": false,
    "gateway_queue_write_enabled": false,
    "telegram_send_enabled": false,
    "bot_api_call_enabled": false,
    "receipt_production_write_enabled": false,
    "production_write_enabled": false,
    "secret_read_enabled": false,
    "paid_api_call_enabled": false,
    "host_write_enabled": false,
    "kubectl_action_enabled": false,
    "destructive_operation_enabled": false,
    "openclaw_replacement_allowed": false,
    "auto_worker_run_count_24h": 0,
    "live_execution_count_24h": 0,
    "gateway_queue_write_count_24h": 0,
    "telegram_send_count_24h": 0,
    "bot_api_call_count_24h": 0,
    "receipt_production_write_count_24h": 0,
    "production_write_count_24h": 0,
    "secret_read_count_24h": 0,
    "paid_api_call_count_24h": 0,
    "host_write_count_24h": 0,
    "kubectl_action_count_24h": 0,
    "destructive_operation_count_24h": 0,
    "owner_response_received_count_24h": 0,
    "owner_response_accepted_count_24h": 0,
    "redacted_payload_ingested_count_24h": 0,
    "truth_note": "高風險 queue 已是 controlled apply 入口，不再是人工審核停車場；high 風險項目可在 allowlist、check-mode、rollback、verifier 與 Telegram evidence 通過後由 AI Agent 受控處理。critical / secret / destructive / paid / force-push 維持 break-glass。所有 live action 計數仍以 executor readback 為準。",
    "high_risk_controlled_apply_enabled": true,
    "critical_break_glass_required": true
  },
  "owner_review_queue_items": [
    {
      "queue_item_id": "high_security_response_queue",
      "display_name": "資安 / secret / firewall 類動作",
      "risk_tier": "high",
      "owner_agent": "openclaw",
      "queue_status": "controlled_apply_packet_ready",
      "source_readback_ids": [
        "p2_408_high_risk_redirects"
      ],
      "approval_packet_id": "packet_high_security_response",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_secret_value_or_hash",
        "reject_direct_runtime_instruction"
      ],
      "reviewer_checklist_ids": [
        "check_redacted_evidence_refs",
        "check_blast_radius",
        "check_rollback_owner",
        "check_postcheck_verifier"
      ],
      "required_owner_fields": [
        "owner role",
        "decision reason",
        "affected security scope",
        "rollback owner",
        "postcheck evidence ref",
        "no secret value attestation"
      ],
      "blocked_runtime_actions": [
        "secret rotation",
        "firewall change",
        "Wazuh active response",
        "read secret store",
        "production write"
      ],
      "owner_response_required": false,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "security controlled apply guard plus rollback drill"
    },
    {
      "queue_item_id": "critical_model_cost_provider_change_queue",
      "display_name": "模型角色 / provider / 費用類動作",
      "risk_tier": "critical",
      "owner_agent": "openclaw",
      "queue_status": "critical_break_glass_required",
      "source_readback_ids": [
        "p2_408_high_risk_redirects"
      ],
      "approval_packet_id": "packet_critical_model_cost_provider_change",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_cost_or_paid_provider_unknown",
        "reject_openclaw_role_change_without_market_scorecard"
      ],
      "reviewer_checklist_ids": [
        "check_market_scorecard",
        "check_cost_secret_data_boundary",
        "check_redacted_evidence_refs"
      ],
      "required_owner_fields": [
        "market scorecard ref",
        "benchmark evidence ref",
        "cost impact",
        "privacy boundary",
        "fallback plan",
        "ADR decision"
      ],
      "blocked_runtime_actions": [
        "OpenClaw role replacement",
        "AI provider switch",
        "paid API expansion",
        "cost quota change",
        "model role promotion"
      ],
      "owner_response_required": true,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "market data scorecard critical break-glass"
    },
    {
      "queue_item_id": "high_data_config_apply_queue",
      "display_name": "資料 / DB / production config 套用",
      "risk_tier": "high",
      "owner_agent": "sre",
      "queue_status": "controlled_apply_packet_ready",
      "source_readback_ids": [
        "p2_408_high_risk_redirects"
      ],
      "approval_packet_id": "packet_high_data_config_apply",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_missing_rollback_owner",
        "reject_missing_verifier"
      ],
      "reviewer_checklist_ids": [
        "check_blast_radius",
        "check_rollback_owner",
        "check_postcheck_verifier"
      ],
      "required_owner_fields": [
        "source-of-truth ref",
        "maintenance window",
        "rollback owner",
        "postcheck",
        "data impact",
        "verifier id"
      ],
      "blocked_runtime_actions": [
        "restore apply",
        "DB migration",
        "production config reload",
        "production write",
        "maintenance window bypass"
      ],
      "owner_response_required": false,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "maintenance window owner packet"
    },
    {
      "queue_item_id": "high_live_telegram_gateway_send_queue",
      "display_name": "Telegram / Gateway / Bot API 實發",
      "risk_tier": "high",
      "owner_agent": "hermes",
      "queue_status": "controlled_apply_packet_ready",
      "source_readback_ids": [
        "p2_406b_receipt_owner_review",
        "telegram_egress_inventory",
        "telegram_owner_request_draft"
      ],
      "approval_packet_id": "packet_high_live_telegram_gateway_send",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_unredacted_payload",
        "reject_missing_verifier"
      ],
      "reviewer_checklist_ids": [
        "check_telegram_receipt_route",
        "check_redacted_evidence_refs",
        "check_postcheck_verifier"
      ],
      "required_owner_fields": [
        "canonical room env",
        "message shape contract",
        "redaction proof",
        "delivery receipt ref",
        "dedupe key",
        "rollback owner"
      ],
      "blocked_runtime_actions": [
        "Gateway queue write",
        "Telegram send",
        "Bot API call",
        "receiver change",
        "silence write",
        "raw payload storage"
      ],
      "owner_response_required": false,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "Telegram owner request acceptance"
    },
    {
      "queue_item_id": "high_report_source_gap_work_item_write_queue",
      "display_name": "報表資料缺口 work item / KM / Verifier 寫入",
      "risk_tier": "high",
      "owner_agent": "hermes",
      "queue_status": "controlled_apply_packet_ready",
      "source_readback_ids": [
        "p2_110d_report_source_gap_playbook_verifier",
        "p2_110e_work_items_owner_review"
      ],
      "approval_packet_id": "packet_high_report_source_gap_work_item_write",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_unredacted_payload",
        "reject_missing_verifier"
      ],
      "reviewer_checklist_ids": [
        "check_redacted_evidence_refs",
        "check_rollback_owner",
        "check_postcheck_verifier"
      ],
      "required_owner_fields": [
        "work item id",
        "PlayBook draft scope",
        "Verifier plan",
        "rollback owner",
        "無發送 proof",
        "postcheck evidence ref"
      ],
      "blocked_runtime_actions": [
        "Work Items DB write",
        "KM write",
        "PlayBook trust write",
        "verifier receipt write",
        "schedule change",
        "Gateway queue write"
      ],
      "owner_response_required": false,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "P2-410 action audit ledger"
    },
    {
      "queue_item_id": "high_host_kubectl_orchestrated_change_queue",
      "display_name": "主機 / kubectl / rollout 類動作",
      "risk_tier": "high",
      "owner_agent": "sre",
      "queue_status": "controlled_apply_packet_ready",
      "source_readback_ids": [
        "p2_408_high_risk_redirects"
      ],
      "approval_packet_id": "packet_high_host_kubectl_orchestrated_change",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_direct_runtime_instruction",
        "reject_missing_rollback_owner"
      ],
      "reviewer_checklist_ids": [
        "check_blast_radius",
        "check_rollback_owner",
        "check_postcheck_verifier"
      ],
      "required_owner_fields": [
        "target service",
        "maintenance window",
        "rollback owner",
        "postcheck",
        "blast radius",
        "kubectl scope"
      ],
      "blocked_runtime_actions": [
        "host write",
        "kubectl action",
        "ArgoCD sync",
        "rollout restart",
        "service reload",
        "production config reload"
      ],
      "owner_response_required": false,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "SRE maintenance controlled apply guard"
    },
    {
      "queue_item_id": "critical_secret_paid_provider_boundary_queue",
      "display_name": "secret / 付費 provider / 隱私 egress 邊界",
      "risk_tier": "critical",
      "owner_agent": "security",
      "queue_status": "critical_break_glass_required",
      "source_readback_ids": [
        "p2_408_high_risk_redirects",
        "telegram_egress_inventory"
      ],
      "approval_packet_id": "packet_critical_secret_paid_provider_boundary",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_secret_value_or_hash",
        "reject_cost_or_paid_provider_unknown",
        "reject_unredacted_payload"
      ],
      "reviewer_checklist_ids": [
        "check_cost_secret_data_boundary",
        "check_redacted_evidence_refs",
        "check_blast_radius"
      ],
      "required_owner_fields": [
        "secret name only",
        "paid provider scope",
        "privacy egress scope",
        "cost cap",
        "rollback owner",
        "audit reason"
      ],
      "blocked_runtime_actions": [
        "secret read",
        "paid API call",
        "provider credential change",
        "privacy egress change",
        "raw payload storage",
        "cost cap change"
      ],
      "owner_response_required": true,
      "rollback_owner_required": true,
      "postcheck_required": true,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false,
      "side_effect_count": 0,
      "next_gate": "security and cost owner joint review"
    }
  ],
  "approval_packets": [
    {
      "approval_packet_id": "packet_high_security_response",
      "queue_item_id": "high_security_response_queue",
      "display_name": "資安回應 controlled apply packet",
      "packet_status": "controlled_apply_packet_ready",
      "required_owner_fields": [
        "owner role",
        "decision reason",
        "affected security scope",
        "rollback owner",
        "postcheck evidence ref",
        "no secret value attestation"
      ],
      "required_evidence_refs": [
        "p2_408_high_risk_redirects",
        "security playbook ref",
        "rollback drill ref"
      ],
      "reviewer_checklist_id": "check_blast_radius",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_secret_value_or_hash"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_critical_model_cost_provider_change",
      "queue_item_id": "critical_model_cost_provider_change_queue",
      "display_name": "模型角色與費用 controlled apply packet",
      "packet_status": "break_glass_packet_ready",
      "required_owner_fields": [
        "market scorecard ref",
        "benchmark evidence ref",
        "cost impact",
        "privacy boundary",
        "fallback plan",
        "ADR decision"
      ],
      "required_evidence_refs": [
        "market-mainstream benchmark",
        "cost quota ref",
        "ADR review ref"
      ],
      "reviewer_checklist_id": "check_market_scorecard",
      "rejection_guard_ids": [
        "reject_cost_or_paid_provider_unknown",
        "reject_openclaw_role_change_without_market_scorecard"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_high_data_config_apply",
      "queue_item_id": "high_data_config_apply_queue",
      "display_name": "資料與 production config controlled apply packet",
      "packet_status": "controlled_apply_packet_ready",
      "required_owner_fields": [
        "source-of-truth ref",
        "maintenance window",
        "rollback owner",
        "postcheck",
        "data impact",
        "verifier id"
      ],
      "required_evidence_refs": [
        "config source ref",
        "backup / restore ref",
        "verifier ref"
      ],
      "reviewer_checklist_id": "check_rollback_owner",
      "rejection_guard_ids": [
        "reject_missing_rollback_owner",
        "reject_missing_verifier"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_high_live_telegram_gateway_send",
      "queue_item_id": "high_live_telegram_gateway_send_queue",
      "display_name": "Telegram 實發 controlled apply packet",
      "packet_status": "controlled_apply_packet_ready",
      "required_owner_fields": [
        "canonical room env",
        "message shape contract",
        "redaction proof",
        "delivery receipt ref",
        "dedupe key",
        "rollback owner"
      ],
      "required_evidence_refs": [
        "telegram_egress_inventory",
        "telegram_owner_request_draft",
        "receipt readback ref"
      ],
      "reviewer_checklist_id": "check_telegram_receipt_route",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_unredacted_payload",
        "reject_missing_verifier"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_high_report_source_gap_work_item_write",
      "queue_item_id": "high_report_source_gap_work_item_write_queue",
      "display_name": "報表資料缺口寫入 controlled apply packet",
      "packet_status": "controlled_apply_packet_ready",
      "required_owner_fields": [
        "work item id",
        "PlayBook draft scope",
        "Verifier plan",
        "rollback owner",
        "無發送 proof",
        "postcheck evidence ref"
      ],
      "required_evidence_refs": [
        "p2_110d_report_source_gap_playbook_verifier",
        "p2_110e_work_items_owner_review"
      ],
      "reviewer_checklist_id": "check_postcheck_verifier",
      "rejection_guard_ids": [
        "reject_missing_owner_response",
        "reject_unredacted_payload",
        "reject_missing_verifier"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_high_host_kubectl_orchestrated_change",
      "queue_item_id": "high_host_kubectl_orchestrated_change_queue",
      "display_name": "主機與 kubectl controlled apply packet",
      "packet_status": "controlled_apply_packet_ready",
      "required_owner_fields": [
        "target service",
        "maintenance window",
        "rollback owner",
        "postcheck",
        "blast radius",
        "kubectl scope"
      ],
      "required_evidence_refs": [
        "SRE runbook ref",
        "maintenance window ref",
        "postcheck verifier ref"
      ],
      "reviewer_checklist_id": "check_blast_radius",
      "rejection_guard_ids": [
        "reject_direct_runtime_instruction",
        "reject_missing_rollback_owner"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    },
    {
      "approval_packet_id": "packet_critical_secret_paid_provider_boundary",
      "queue_item_id": "critical_secret_paid_provider_boundary_queue",
      "display_name": "secret 與付費 provider 邊界 controlled apply packet",
      "packet_status": "break_glass_packet_ready",
      "required_owner_fields": [
        "secret name only",
        "paid provider scope",
        "privacy egress scope",
        "cost cap",
        "rollback owner",
        "audit reason"
      ],
      "required_evidence_refs": [
        "telegram_egress_inventory",
        "cost quota ref",
        "privacy boundary ref"
      ],
      "reviewer_checklist_id": "check_cost_secret_data_boundary",
      "rejection_guard_ids": [
        "reject_secret_value_or_hash",
        "reject_cost_or_paid_provider_unknown",
        "reject_unredacted_payload"
      ],
      "rollback_owner_required": true,
      "postcheck_required": true,
      "sensitive_payload_allowed": false,
      "live_execution_allowed": false,
      "gateway_queue_write_allowed": false,
      "telegram_send_allowed": false,
      "production_write_allowed": false
    }
  ],
  "rejection_guards": [
    {
      "guard_id": "reject_missing_owner_response",
      "display_name": "缺 owner response 拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "缺 owner role、decision、decision reason 或 affected scope 時拒收。",
      "blocked_runtime_actions": [
        "live execution",
        "production write",
        "Gateway queue write"
      ],
      "reviewer_action": "退回補 owner response，不產生 runtime action。",
      "sensitive_payload_quarantine_required": false
    },
    {
      "guard_id": "reject_unredacted_payload",
      "display_name": "未遮罩 payload 拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "包含 raw payload、未遮罩路由、未遮罩 log 或未遮罩訊息內容時拒收。",
      "blocked_runtime_actions": [
        "raw payload storage",
        "frontend display",
        "Telegram send"
      ],
      "reviewer_action": "退回 redaction contract，僅保留 metadata。",
      "sensitive_payload_quarantine_required": true
    },
    {
      "guard_id": "reject_direct_runtime_instruction",
      "display_name": "直接執行指令拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "要求直接 reload、restart、kubectl、host write 或 auto worker 執行時拒收。",
      "blocked_runtime_actions": [
        "auto worker",
        "live execution",
        "host write",
        "kubectl action"
      ],
      "reviewer_action": "改成 approval packet 與 dry-run verifier。",
      "sensitive_payload_quarantine_required": false
    },
    {
      "guard_id": "reject_secret_value_or_hash",
      "display_name": "secret 值或 hash 拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "任何 secret value、secret hash、partial token 或 chat id secret 進入 packet 時拒收。",
      "blocked_runtime_actions": [
        "secret read",
        "secret hash collection",
        "secret rotation"
      ],
      "reviewer_action": "只保留 secret name 與 owner attestation。",
      "sensitive_payload_quarantine_required": true
    },
    {
      "guard_id": "reject_missing_rollback_owner",
      "display_name": "缺 rollback owner 拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "沒有 rollback owner、rollback scope 或 rollback stop condition 時拒收。",
      "blocked_runtime_actions": [
        "production write",
        "rollback command"
      ],
      "reviewer_action": "退回補 rollback owner 與 no-op rollback proof。",
      "sensitive_payload_quarantine_required": false
    },
    {
      "guard_id": "reject_missing_verifier",
      "display_name": "缺 verifier / post-check 拒收",
      "applies_to_risk_tiers": [
        "high",
        "critical"
      ],
      "rejection_condition": "沒有 verifier id、post-check evidence 或 receipt expectation 時拒收。",
      "blocked_runtime_actions": [
        "live execution",
        "receipt production write"
      ],
      "reviewer_action": "退回補 verifier plan 與 receipt gate。",
      "sensitive_payload_quarantine_required": false
    },
    {
      "guard_id": "reject_cost_or_paid_provider_unknown",
      "display_name": "費用或付費 provider 未明拒收",
      "applies_to_risk_tiers": [
        "critical"
      ],
      "rejection_condition": "沒有 cost cap、paid provider scope、quota 或 privacy egress impact 時拒收。",
      "blocked_runtime_actions": [
        "paid API call",
        "AI provider switch",
        "cost quota change"
      ],
      "reviewer_action": "退回補市場分數、費用與資料邊界。",
      "sensitive_payload_quarantine_required": false
    },
    {
      "guard_id": "reject_openclaw_role_change_without_market_scorecard",
      "display_name": "OpenClaw 角色調整缺市場分數拒收",
      "applies_to_risk_tiers": [
        "critical"
      ],
      "rejection_condition": "沒有主流市場 scorecard、benchmark、ADR 與 rollback plan 時，任何 OpenClaw 角色調整都拒收。",
      "blocked_runtime_actions": [
        "OpenClaw role replacement",
        "model role promotion",
        "ADR write"
      ],
      "reviewer_action": "退回市場資料評估，不接受硬編碼固定結論。",
      "sensitive_payload_quarantine_required": false
    }
  ],
  "reviewer_checklists": [
    {
      "checklist_id": "check_redacted_evidence_refs",
      "display_name": "遮罩證據 refs 檢查",
      "owner_agent": "hermes",
      "required_checks": [
        "source ref exists",
        "metadata only",
        "no raw payload",
        "no work window transcript",
        "redaction proof"
      ],
      "pass_condition": "只呈現可公開治理欄位與 committed snapshot ref。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_blast_radius",
      "display_name": "影響範圍檢查",
      "owner_agent": "openclaw",
      "required_checks": [
        "affected service",
        "data impact",
        "customer impact",
        "rollback path",
        "maintenance window"
      ],
      "pass_condition": "影響範圍與停損條件足以讓 owner 判斷。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_rollback_owner",
      "display_name": "rollback owner 檢查",
      "owner_agent": "sre",
      "required_checks": [
        "rollback owner",
        "rollback scope",
        "no-op proof",
        "stop condition",
        "post rollback check"
      ],
      "pass_condition": "rollback 欄位完整，但仍不執行 rollback command。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_postcheck_verifier",
      "display_name": "post-check verifier 檢查",
      "owner_agent": "sre",
      "required_checks": [
        "verifier id",
        "receipt expectation",
        "readback endpoint",
        "failure handling",
        "runtime gate remains zero"
      ],
      "pass_condition": "verifier 只做 無寫入 readback plan，不寫 receipt production target。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_telegram_receipt_route",
      "display_name": "Telegram receipt route 檢查",
      "owner_agent": "hermes",
      "required_checks": [
        "canonical room env",
        "message shape",
        "dedupe key",
        "delivery receipt metadata",
        "Bot API remains false"
      ],
      "pass_condition": "可讀回 route 與 receipt 欄位，但不寫 Gateway queue、不送 Telegram。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_market_scorecard",
      "display_name": "主流市場 scorecard 檢查",
      "owner_agent": "nemotron",
      "required_checks": [
        "benchmark source",
        "model card",
        "cost impact",
        "role fit",
        "fallback plan",
        "ADR ref"
      ],
      "pass_condition": "只產市場評估輸入，不改 agent role、不改 provider route。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    },
    {
      "checklist_id": "check_cost_secret_data_boundary",
      "display_name": "費用 / secret / 隱私邊界檢查",
      "owner_agent": "security",
      "required_checks": [
        "cost cap",
        "secret name only",
        "privacy egress",
        "provider scope",
        "audit reason",
        "rollback owner"
      ],
      "pass_condition": "費用與資料外流風險可審核，但不呼叫付費 API、不讀 secret。",
      "approval_decision_allowed": false,
      "checklist_write_allowed": false,
      "side_effect_count": 0
    }
  ],
  "routing_policy": {
    "high_risk_default_route": "controlled_apply_queue",
    "critical_risk_default_route": "critical_break_glass_queue",
    "low_medium_runtime_route": "controlled_apply_queue",
    "owner_response_required": false,
    "verbal_approval_accepted": false,
    "redacted_payload_only": true
  },
  "activation_boundaries": {
    "read_only_owner_review_queue_allowed": false,
    "approval_packet_preview_allowed": true,
    "rejection_guard_preview_allowed": true,
    "reviewer_checklist_allowed": true,
    "auto_worker_enabled": false,
    "live_execution_enabled": false,
    "gateway_queue_write_enabled": false,
    "telegram_send_enabled": false,
    "bot_api_call_enabled": false,
    "receipt_production_write_enabled": false,
    "production_write_enabled": false,
    "secret_read_enabled": false,
    "paid_api_call_enabled": false,
    "host_write_enabled": false,
    "kubectl_action_enabled": false,
    "destructive_operation_enabled": false,
    "openclaw_replacement_allowed": false,
    "controlled_apply_queue_readback_allowed": true,
    "critical_break_glass_queue_readback_allowed": true
  },
  "telegram_policy": {
    "canonical_room": "AwoooI SRE 戰情室",
    "canonical_room_env": "SRE_GROUP_CHAT_ID",
    "gateway_queue_write_allowed": false,
    "direct_bot_api_allowed": false,
    "telegram_send_allowed": false,
    "receipt_write_allowed": false,
    "policy_note": "P2-409 只把 Telegram / Gateway 風險放進 owner queue；不送 Telegram、不寫 Gateway queue、不呼叫 Bot API。"
  },
  "display_redaction_contract": {
    "redaction_required": true,
    "unsafe_payload_display_allowed": false,
    "private_reasoning_display_allowed": false,
    "secret_value_display_allowed": false,
    "work_window_transcript_display_allowed": false,
    "allowed_display_fields": [
      "queue_item_id",
      "display_name",
      "risk_tier",
      "owner_agent",
      "queue_status",
      "approval_packet_id",
      "rejection_guard_ids",
      "reviewer_checklist_ids",
      "blocked_runtime_actions",
      "rollups"
    ],
    "blocked_display_fields": [
      "raw payload",
      "private reasoning",
      "secret value",
      "authorization header",
      "browser context",
      "session transcript",
      "chat id secret",
      "unredacted internal route"
    ]
  },
  "rollups": {
    "source_readback_count": 6,
    "queue_item_count": 7,
    "high_risk_queue_count": 5,
    "critical_queue_count": 2,
    "approval_packet_count": 7,
    "rejection_guard_count": 8,
    "reviewer_checklist_count": 7,
    "approval_packet_required_count": 7,
    "rejection_guard_required_queue_count": 7,
    "rollback_owner_required_count": 7,
    "postcheck_required_count": 7,
    "blocked_runtime_action_count": 42,
    "owner_response_received_count": 0,
    "owner_response_accepted_count": 0,
    "owner_response_rejected_count": 0,
    "redacted_payload_ingested_count": 0,
    "auto_worker_run_count": 0,
    "live_execution_count": 0,
    "gateway_queue_write_count": 0,
    "telegram_send_count": 0,
    "bot_api_call_count": 0,
    "receipt_production_write_count": 0,
    "production_write_count": 0,
    "secret_read_count": 0,
    "paid_api_call_count": 0,
    "host_write_count": 0,
    "kubectl_action_count": 0,
    "destructive_operation_count": 0,
    "controlled_apply_queue_count": 5,
    "critical_break_glass_queue_count": 2,
    "owner_response_required_count": 2,
    "high_risk_owner_review_required_count": 0
  },
  "next_actions": [
    {
      "task_id": "P2-410",
      "priority": "P0",
      "summary": "建立 Agent action audit ledger，讓每次 queue item、approval packet、rejection guard、owner response 與 handoff 都有 immutable event。",
      "gate": "ledger 仍只允許 redacted metadata；任何 production write、Telegram send、host / kubectl action 都需 owner-approved runtime gate。"
    },
    {
      "task_id": "P2-411",
      "priority": "P0",
      "summary": "建立 Owner Response Acceptance Readback，把外部 owner response 轉成可驗收欄位，而不是口頭批准。",
      "gate": "owner response received / accepted 未為 true 前，高風險 queue item 不可離開 paused 狀態。"
    }
  ]
}
