feat(governance): 新增 AI Agent 專業任務擴展

docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md

@@ -638,6 +638,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator
 | `docs/evaluations/ai_agent_report_runtime_dry_run_2026-06-12.json` + `GET /api/v1/agents/agent-report-runtime-dry-run` | P2-403M 報表 runtime no-write dry-run 證據包；建立 5 個 dry-run artifact、3 個 SRE 戰情室 queue digest 草案、4 個 readback verifier case、3 個 Agent dry-run role 與 6 個 operator checkpoint；不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 delivery receipt、不啟動 worker、不跑 verifier live readback、不讀 secret，已由 P2-403N fixture readback 承接 |
 | `docs/evaluations/ai_agent_report_runtime_fixture_readback_2026-06-12.json` + `GET /api/v1/agents/agent-report-runtime-fixture-readback` | P2-403N fixture smoke / queue preview readback / verifier dry-run 證據包；建立 5 個 fixture smoke、3 個 SRE 戰情室 queue preview readback、4 個 verifier dry-run case、3 個 Agent fixture role 與 5 個 operator checkpoint；不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 delivery receipt、不啟動 worker、不跑 verifier live readback、不讀 secret，下一步 P2-404 |
 | `docs/evaluations/ai_agent_runtime_worker_shadow_gate_2026-06-12.json` + `GET /api/v1/agents/agent-runtime-worker-shadow-gate` | P2-404 runtime worker shadow / no-write execution evidence gate；建立 5 個 shadow candidate、4 個 no-write replay、4 個 verifier shadow case、3 個 Agent shadow role 與 6 個 operator checkpoint；shadow live worker、Gateway queue write、Telegram send、Bot API、delivery receipt、auto worker、verifier live readback、production write 與 secret read 全部 `0 / false`，下一步 P2-101 |
+| `docs/evaluations/ai_agent_professional_task_expansion_2026-06-15.json` + `GET /api/v1/agents/agent-professional-task-expansion` | P2-405A AI Agent 專業任務擴展與 Telegram Runtime Bridge；承接 12-Agent War Room、P2-403 report/runtime 鏈與 monitoring owner response acceptance，固定 24 類專業任務、8 個任務領域、5 段 Telegram bridge、6 種訊息類型、MCP/RAG stack、日報 / 週報 / 月報 / action-required 報告契約，並接入 governance automation inventory 卡片；需批准任務 `19`、low / medium / high / critical = `3 / 10 / 6 / 5`；Gateway queue write、Telegram send、Bot API、delivery receipt、production write、secret read、paid API、host write 與 kubectl action 全部 `0 / false`，下一步 P2-405B 完整 no-send message preview / canary approval package |
 | `docs/evaluations/ai_agent_operation_permission_model_2026-06-12.json` + `GET /api/v1/agents/agent-operation-permission-model` | P2-101 操作類別權限模型；建立 5 條 permission lane、13 類 operation category、3 個 Agent permission role、8 個 gate transition 與 5 個 operator decision template；runtime execution、Gateway queue write、Telegram send、Bot API、delivery receipt、auto worker、verifier live readback、production write、secret / paid provider、host command 與 destructive action 全部 `0 / false`，已由 P2-102 承接 |
 | `docs/evaluations/ai_agent_candidate_operation_dry_run_evidence_2026-06-12.json` + `GET /api/v1/agents/agent-candidate-operation-dry-run-evidence` | P2-102 候選操作 dry-run 證據；13 類候選操作全部具備 input / output evidence hash、side-effect count、verifier plan、rollback/no-op plan 與人工 handoff；6 個 verifier plan、7 個 gate evidence requirement、5 個 operator handoff；runtime、Gateway queue、Telegram、production write、secret / paid provider 與 destructive action 全部 `0 / false`，已由 P2-103 承接 |
 | `docs/evaluations/ai_agent_task_result_audit_trail_2026-06-13.json` + `GET /api/v1/agents/agent-task-result-audit-trail` | P2-103 任務結果稽核軌跡；8 條 result route、6 個 writeback contract、7 個 audit checkpoint、5 個 operator handoff；把 diagnostic-only、repair candidate、execution failed、provider unmatched、report zero-signal 等結果固定到 KM 草稿、LOGBOOK 證據、audit trail、timeline 與人工下一步；KM / LOGBOOK / audit DB / timeline / PlayBook trust / Gateway queue / Telegram 寫入全為 `0 / false`，已由 P2-104 承接 |
@@ -840,6 +841,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence
 64. 建立 owner response preflight 與拒收邊界。✅ P2-143 已完成正式驗證；承接 P2-141 decision input prep 與 P2-142 War Room 基線，固定 response intake lane `5`、required owner field `18`、intake validation check `6`、rejection guard `6`、operator action `5`、waiting external response `5`；owner response received / accepted / rejected、redacted payload ingested、reviewer queue write、Gateway queue write、Telegram send、Bot API、result capture、learning、PlayBook trust、production write、secret read、destructive operation 仍為 `0 / false`；feature commit `755b0a8d`、deploy marker `667d6329`、Gitea code-review `2961` / CD `2960` success、本地 P2-142 War Room + P2-139 至 P2-143 regression `37 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、禁用外露值掃描、production API readback 與 desktop / mobile smoke 通過。下一步 P2-144 owner response readback。
 65. 建立 owner response readback。✅ P2-144 已完成正式驗證；承接 P2-143 preflight，固定 response readback lane `5`、required owner field `18`、readback validation check `6`、readback rejection guard `6`、operator action `5`、waiting external response `5`、no external response received lane `5`；owner response received / accepted / rejected、redacted payload ingested、reviewer queue write、Gateway queue write、Telegram send、Bot API、result capture、learning、PlayBook trust、production write、secret read、destructive operation 仍為 `0 / false`；feature commit `8795f100`、deploy marker `ac938037`、Gitea code-review `2965` / CD `2964` success；本地 P2-139 至 P2-144 regression `45 passed`，rebase 後含 tenants regression 的推送前回歸 `47 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、value-only 禁用外露值掃描、i18n key parity 與 diff check 通過；production API readback、desktop / mobile smoke、水平溢位 `0`、危險控制 `0`、工作溝通片語命中 `0` 已完成。下一步 P2-145 owner response acceptance gate。
 66. 建立 owner response acceptance gate。✅ P2-145 已完成並正式驗證；承接 P2-144 readback，固定 acceptance gate lane `5`、required owner field `18`、acceptance validation check `6`、acceptance rejection guard `6`、operator action `5`、blocked no external response `5`、no acceptable external response `5`；owner response received / accepted / rejected、redacted payload ingested、reviewer queue write、Gateway queue write、Telegram send、Bot API、result capture、learning、PlayBook trust、production write、secret read、destructive operation 仍為 `0 / false`；feature commit `386dbd07`、deploy marker `36fbfc6b`、Gitea code-review `2969` / CD `2968` success；P2-144 + P2-145 regression `16 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、顯示值工作視窗污染掃描、i18n key parity、diff check、production API readback、in-app browser smoke、desktop / mobile smoke、水平溢位 `0`、P2-145 卡片操作控制 `0`、工作溝通片語命中 `0` 已完成。下一步 P2-146 acceptance receipt preview，且必須等合格、遮罩、欄位完整、可驗證來源的外部正式回覆後才能建立 receipt preview。
+66a. 建立 AI Agent 專業任務擴展與 Telegram Runtime Bridge。✅ P2-405A 本地完成；承接 12-Agent War Room、P2-403 report/runtime 鏈與 monitoring owner response acceptance，固定 24 類專業任務、8 個領域、5 段 Telegram bridge、6 種訊息類型與 MCP/RAG stack，並接入 governance automation inventory 卡片；需批准任務 `19`、low / medium / high / critical = `3 / 10 / 6 / 5`；Gateway queue write、Telegram send、Bot API、delivery receipt、production write、secret read、paid API、host write、kubectl action 仍為 `0 / false`。下一步 P2-405B 完整 no-send message preview / canary approval package；這不占用 P2-146 owner response receipt preview。
 67. 新增 P0 配置控管優先序前台可視化。✅ 正式驗證完成；`/zh-TW/iwooos` 已集中顯示 Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類即時風險配置；owner response `0 / 0`、live evidence `0`、執行期 `0`、操作按鈕 `0`；feature commit `e992af89`、deploy marker `ed651a98`、Gitea code-review `2971` / CD `2970` success；本地與正式 in-app browser、desktop `1440x1100`、mobile `390x844` smoke 通過。這不是 Nginx live conf 讀取、`nginx -t`、reload、DNS / TLS probe、certbot renew、ArgoCD sync、kubectl、workflow / secret 修改、public route change、agent-bounty runtime、payout / withdrawal、production write 或 runtime gate。
 68. 補強 P0 高價值配置 Gate path pattern、工作樹 preflight、owner packet 與 coverage snapshot。✅ 本地完成；`k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` 已納入 high-value config classification，Nginx public gateway 與 DNS / TLS / certbot sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；gate snapshot 顯示 `changed_files=6`、`matched=6`、`categories=3`、`c0=2`、`c1=0`；預設模式已可讀取 staged / unstaged / untracked，臨時 `k8s/nginx/*` smoke 命中 C0；owner packet snapshot `packets=3 / c0=2 / runtime_gate=0`；coverage snapshot `categories=14 / c0=8 / avg=67 / runtime_gate=0`；owner evidence 仍 `provided=false / complete=false`，runtime execution 仍 `false`。這不是 live config read、`nginx -t`、reload、certbot renew、DNS / TLS probe、host write、active scan、workflow 修改、secret 收集、production write 或 runtime gate。
 69. 同步高價值配置 Owner Packet 前台 projection。✅ 已完成並正式驗證；`/zh-TW/iwooos` 與 `/zh-TW/awooop` 已顯示 owner packet snapshot `packet=3 / c0=2`、最高命中 `C0 / P0`、Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；request sent、received、accepted、runtime gate 與 action buttons 仍為 `0`；本地與正式 desktop / mobile / in-app browser smoke 已通過，水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0`。不得因此調高 IwoooS headline。
@@ -892,6 +894,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence
 | `docs/evaluations/ai_agent_report_runtime_dry_run_2026-06-12.json` + `GET /api/v1/agents/agent-report-runtime-dry-run` | P2-403M 報表 runtime no-write dry-run 證據包；5 個 dry-run artifact、3 個 queue digest 草案、4 個 readback verifier case、3 個 Agent dry-run role、6 個 operator checkpoint；不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 delivery receipt、不啟動 worker、不跑 verifier live readback |
 | `docs/evaluations/ai_agent_report_runtime_fixture_readback_2026-06-12.json` + `GET /api/v1/agents/agent-report-runtime-fixture-readback` | P2-403N fixture smoke / queue preview readback / verifier dry-run 證據包；5 個 fixture smoke、3 個 queue preview readback、4 個 verifier dry-run case、3 個 Agent fixture role、5 個 operator checkpoint；不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 delivery receipt、不啟動 worker、不跑 verifier live readback |
 | `docs/evaluations/ai_agent_runtime_worker_shadow_gate_2026-06-12.json` + `GET /api/v1/agents/agent-runtime-worker-shadow-gate` | P2-404 runtime worker shadow / no-write execution evidence gate；5 個 shadow candidate、4 個 no-write replay、4 個 verifier shadow case、3 個 Agent shadow role、6 個 operator checkpoint；不啟動 live worker、不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 production target |
+| `docs/evaluations/ai_agent_professional_task_expansion_2026-06-15.json` + `GET /api/v1/agents/agent-professional-task-expansion` | P2-405A AI Agent 專業任務擴展與 Telegram Runtime Bridge；24 類專業任務、8 個領域、5 段 Telegram bridge、6 種訊息類型、MCP/RAG stack、治理頁 P2-405A 卡片；不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 production target、不讀 secret、不用 paid API |
 | `docs/evaluations/ai_agent_operation_permission_model_2026-06-12.json` + `GET /api/v1/agents/agent-operation-permission-model` | P2-101 操作類別權限模型；5 條 permission lane、13 類 operation category、3 個 Agent permission role、8 個 gate transition、5 個 operator decision template；不啟動 runtime worker、不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 production target、不讀 secret |
 | `docs/evaluations/ai_agent_candidate_operation_dry_run_evidence_2026-06-12.json` + `GET /api/v1/agents/agent-candidate-operation-dry-run-evidence` | P2-102 候選操作 dry-run 證據；13 類候選操作、13 組 dry-run evidence、6 個 verifier plan、7 個 gate evidence requirement、5 個 operator handoff；不啟動 runtime worker、不寫 Gateway queue、不送 Telegram、不呼叫 Bot API、不寫 production target、不讀 secret、不執行 destructive action |
 | `docs/evaluations/ai_agent_task_result_audit_trail_2026-06-13.json` + `GET /api/v1/agents/agent-task-result-audit-trail` | P2-103 任務結果稽核軌跡；8 條 result route、6 個 writeback contract、7 個 audit checkpoint、5 個 operator handoff；不寫 KM、不 runtime append LOGBOOK、不寫 audit DB、不寫 timeline、不更新 PlayBook trust、不寫 Gateway queue、不送 Telegram |
@@ -4977,3 +4980,16 @@ Trigger commit `f5cd37b7` 與 deploy marker `0ba92357` 已把 governance UI 的
 - `iwooos-config-control-guard.py`、`security-mirror-progress-guard.py` 與高價值配置 coverage 已鎖住新 artifact；`monitoring_alerting_observability` 只讀治理成熟度 `62% -> 66%`，高價值配置平均只讀治理成熟度 `68% -> 69%`。
 
 **裁決：** 這是 owner response acceptance 只讀帳本，不是 owner response received / accepted / rejected、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse config change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。
+
+### 2026-06-15 10:40 (台北) — §3.2 / §5 — 新增 AI Agent 專業任務擴展與 Telegram Runtime Bridge — 把專業委派與 TG 群組整合前置門檻固定成 no-send guard artifact
+
+**觸發**：統帥要求繼續專業評估 AI Agent 還可以承接哪些工作，並指出 Telegram 群組 / TG Bot 需要真正納入整體監控、報表、告警與審核路徑。既有 12-Agent War Room 已定義分工，但還缺一份可由 API 讀回、可測試、可禁止誤啟用的專業任務擴展契約。
+
+**已推進：**
+- 新增 `docs/schemas/ai_agent_professional_task_expansion_v1.schema.json`、`docs/evaluations/ai_agent_professional_task_expansion_2026-06-15.json`、`apps/api/src/services/ai_agent_professional_task_expansion.py` 與 `GET /api/v1/agents/agent-professional-task-expansion`。
+- 新增 `docs/ai/AI_AGENT_PROFESSIONAL_TASK_EXPANSION_2026-06-15.md`，把 24 類專業任務拆成 SRE / Observability、Security / IwoooS、DevOps / Release、Data / Backup / DR、Supply Chain、Product / UI / QA、AI Governance / Replay / Market、Telegram / Reports / Receipts 8 個領域。
+- `/zh-TW/governance?tab=automation-inventory` 新增 P2-405A 卡片，顯示任務數、風險分層、Telegram bridge、脫敏狀態與 live / send / write = 0。
+- Telegram Runtime Bridge 固定 5 段：no-send preview、queue preview readback、approved canary、日週月報 digest、action-required digest；所有 live send / queue write / Bot API call / receipt write 仍為 `0 / false`。
+- 任務風險 rollup 固定：總任務 `24`、需批准 `19`、low / medium / high / critical = `3 / 10 / 6 / 5`；高風險與 critical 任務必須保留 approval gate。
+
+**裁決：** 這是專業任務與 Telegram 整合的只讀擴展契約，不是 Telegram send、Gateway queue write、Bot API call、delivery receipt write、production write、host write、kubectl action、secret read、paid API call 或 runtime authorization；下一步 P2-405B 只能做完整 no-send message preview 與 canary approval package，可讓統帥看到將來 TG 訊息長相，但仍不得實發。