awoooi

wooo/awoooi

Fork 0

Commit Graph

Author	SHA1	Message	Date
OG T	0f5fecfef5	fix(sprint5.1): 首席架構師審查修正 — S1×4 S2×2 S3×1 Some checks failed CD Pipeline / build-and-deploy (push) Failing after 1m40s Details S1-1: service_registry/velero_client/preflight_service 改用 structlog S1-2: velero_client datetime.now(UTC) 改用 now_taipei()（台北時區鐵律） S1-3: Guardrail 失敗改為保守拒絕（原放行方向與安全目標相悖） S1-4: service_registry import 移至模組頂部（移除函數內 import） S2-1: telegram_gateway T1-T6 六個通知方法補齊 try/except S2-2: webhooks.py Langfuse URL 改用 settings.LANGFUSE_URL（移除硬寫內網 IP） S3-3: velero_client trigger_emergency_backup 改為 kubectl apply Backup CRD （原 kubectl create backup 語法不存在，審查發現靜默失敗風險）審查評分: 70/100 → 修正後預計 90+/100 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-08 16:36:18 +08:00
OG T	88696dba9b	feat(sprint5.1): Data Safety Guardrails 全鏈路整合 (L1-L5) Some checks failed CD Pipeline / build-and-deploy (push) Failing after 1m33s Details Type Sync Check / check-type-sync (push) Failing after 58s Details Layer 0 - K8s RBAC: - k8s/rbac/api-velero-reader.yaml: awoooi-executor SA Velero backup reader Layer 1 - DB Migration (已在 188 執行): - M-002: approval_records 新增 approval_level/votes/required_votes - M-003: alert_event_type ENUM 新增 8 個值 Layer 2 - IaC: - ops/config/service-registry.yaml: 全服務 Stateful 分級清單 (BLOCK/CRITICAL_HITL/STANDARD_HITL/AUTO) Layer 3 - Python Services: - service_registry.py: 讀取 YAML，提供 is_blocked/requires_multisig/get_required_votes - velero_client.py: kubectl 查詢 Velero 備份年齡，失敗 fallback 999h - preflight_service.py: Pre-flight 安全檢查 (Q2/Q4 決策) Layer 1-M001 - Playbook model: - playbook.py: 新增 requires_approval_level/stateful_targets/requires_pre_backup Layer 4 - 業務邏輯: - alert_operation_log_repository.py: 新增 8 個 event_type (Guardrail/Pre-flight/MultiSig/備份) - auto_repair_service.py: 注入 Service Registry Guardrail 檢查 (BLOCK → 直接拒絕) - webhooks.py: ALERT_RECEIVED 溯源記錄 + auto_repair flag Q9 + Langfuse trace_id Q10 - db/models.py: ApprovalRecord 同步 approval_level/votes/required_votes 欄位 - docker-health-monitor.sh: 純感知層改造（移除所有 docker restart 邏輯） Layer 5 - Telegram 通知: - telegram_gateway.py: T1-T6 六個新通知方法 (Guardrail/Pre-flight/Backup/MultiSig/ChangeApplied) 參考: ADR-062 Data Safety Guardrails, ADR-063 Service Registry IaC Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-08 16:24:09 +08:00

Author

SHA1

Message

Date

OG T

0f5fecfef5

fix(sprint5.1): 首席架構師審查修正 — S1×4 S2×2 S3×1

CD Pipeline / build-and-deploy (push) Failing after 1m40s

Details

S1-1: service_registry/velero_client/preflight_service 改用 structlog
S1-2: velero_client datetime.now(UTC) 改用 now_taipei()（台北時區鐵律）
S1-3: Guardrail 失敗改為保守拒絕（原放行方向與安全目標相悖）
S1-4: service_registry import 移至模組頂部（移除函數內 import）
S2-1: telegram_gateway T1-T6 六個通知方法補齊 try/except
S2-2: webhooks.py Langfuse URL 改用 settings.LANGFUSE_URL（移除硬寫內網 IP）
S3-3: velero_client trigger_emergency_backup 改為 kubectl apply Backup CRD
      （原 kubectl create backup 語法不存在，審查發現靜默失敗風險）

審查評分: 70/100 → 修正後預計 90+/100

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-08 16:36:18 +08:00

OG T

88696dba9b

feat(sprint5.1): Data Safety Guardrails 全鏈路整合 (L1-L5)

CD Pipeline / build-and-deploy (push) Failing after 1m33s

Details

Type Sync Check / check-type-sync (push) Failing after 58s

Details

Layer 0 - K8s RBAC:
  - k8s/rbac/api-velero-reader.yaml: awoooi-executor SA Velero backup reader

Layer 1 - DB Migration (已在 188 執行):
  - M-002: approval_records 新增 approval_level/votes/required_votes
  - M-003: alert_event_type ENUM 新增 8 個值

Layer 2 - IaC:
  - ops/config/service-registry.yaml: 全服務 Stateful 分級清單 (BLOCK/CRITICAL_HITL/STANDARD_HITL/AUTO)

Layer 3 - Python Services:
  - service_registry.py: 讀取 YAML，提供 is_blocked/requires_multisig/get_required_votes
  - velero_client.py: kubectl 查詢 Velero 備份年齡，失敗 fallback 999h
  - preflight_service.py: Pre-flight 安全檢查 (Q2/Q4 決策)

Layer 1-M001 - Playbook model:
  - playbook.py: 新增 requires_approval_level/stateful_targets/requires_pre_backup

Layer 4 - 業務邏輯:
  - alert_operation_log_repository.py: 新增 8 個 event_type (Guardrail/Pre-flight/MultiSig/備份)
  - auto_repair_service.py: 注入 Service Registry Guardrail 檢查 (BLOCK → 直接拒絕)
  - webhooks.py: ALERT_RECEIVED 溯源記錄 + auto_repair flag Q9 + Langfuse trace_id Q10
  - db/models.py: ApprovalRecord 同步 approval_level/votes/required_votes 欄位
  - docker-health-monitor.sh: 純感知層改造（移除所有 docker restart 邏輯）

Layer 5 - Telegram 通知:
  - telegram_gateway.py: T1-T6 六個新通知方法 (Guardrail/Pre-flight/Backup/MultiSig/ChangeApplied)

參考: ADR-062 Data Safety Guardrails, ADR-063 Service Registry IaC

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-08 16:24:09 +08:00

2 Commits