608 lines
22 KiB
JSON
608 lines
22 KiB
JSON
{
|
|
"schema_version": "dependency_drift_check_plan_v1",
|
|
"generated_at": "2026-06-04T20:52:25+08:00",
|
|
"program_status": {
|
|
"overall_completion_percent": 99,
|
|
"current_priority": "P1",
|
|
"current_task_id": "P1-205",
|
|
"next_task_id": "P1-206",
|
|
"read_only_mode": true
|
|
},
|
|
"source_refs": [
|
|
"docs/evaluations/package_supply_chain_inventory_2026-06-04.json",
|
|
"docs/evaluations/javascript_package_inventory_2026-06-04.json",
|
|
"docs/evaluations/docker_build_surface_inventory_2026-06-04.json",
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json",
|
|
"docs/evaluations/agent_market_governance_snapshot_2026-06-04.json",
|
|
"docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md",
|
|
"docs/HARD_RULES.md"
|
|
],
|
|
"rollups": {
|
|
"total_cadence_items": 5,
|
|
"total_local_checks": 5,
|
|
"total_external_source_candidates": 10,
|
|
"by_domain": {
|
|
"python": 2,
|
|
"javascript": 3,
|
|
"docker": 3,
|
|
"policy": 1,
|
|
"cve": 2,
|
|
"license": 2,
|
|
"agent_market": 4,
|
|
"external_sources": 2,
|
|
"approval_package": 1
|
|
},
|
|
"read_only_local_check_ids": [
|
|
"python_manifest_drift_local_check",
|
|
"javascript_lockfile_drift_local_check",
|
|
"dockerfile_surface_drift_local_check",
|
|
"dependency_policy_consistency_local_check",
|
|
"agent_market_snapshot_freshness_local_check"
|
|
],
|
|
"approval_required_source_ids": [
|
|
"osv_advisory_candidate",
|
|
"github_advisory_candidate",
|
|
"pypi_registry_candidate",
|
|
"npm_registry_candidate",
|
|
"docker_hub_manifest_candidate",
|
|
"ghcr_manifest_candidate",
|
|
"package_license_metadata_candidate",
|
|
"deps_dev_license_candidate",
|
|
"agent_official_release_candidate",
|
|
"agent_benchmark_signal_candidate"
|
|
],
|
|
"design_only_cadence_ids": [
|
|
"daily_repo_drift_readonly",
|
|
"weekly_external_source_review",
|
|
"weekly_agent_market_watch_review",
|
|
"monthly_upgrade_approval_batch",
|
|
"failure_only_notification_review"
|
|
]
|
|
},
|
|
"cadence_policy": {
|
|
"timezone": "Asia/Taipei",
|
|
"items": [
|
|
{
|
|
"cadence_id": "daily_repo_drift_readonly",
|
|
"domain": "javascript",
|
|
"frequency": "daily design; activation requires P1-206 approval package or operator approval",
|
|
"activation_status": "design_only",
|
|
"owner_agent": "hermes",
|
|
"allowed_now": [
|
|
"read committed JSON snapshots",
|
|
"compare repo manifests and lockfiles",
|
|
"emit read-only drift report design"
|
|
],
|
|
"blocked_now": [
|
|
"pnpm install",
|
|
"npm audit",
|
|
"package upgrade",
|
|
"lockfile write",
|
|
"workflow activation"
|
|
],
|
|
"planned_output": "future docs/evaluations/dependency_drift_run_YYYY-MM-DD.json",
|
|
"failure_notification": "failure-only AwoooP / Telegram event after schedule is explicitly approved"
|
|
},
|
|
{
|
|
"cadence_id": "weekly_external_source_review",
|
|
"domain": "external_sources",
|
|
"frequency": "weekly design; external calls blocked until source approval",
|
|
"activation_status": "blocked_until_approval",
|
|
"owner_agent": "openclaw",
|
|
"allowed_now": [
|
|
"source list review",
|
|
"cost and rate-limit analysis",
|
|
"approval package preparation"
|
|
],
|
|
"blocked_now": [
|
|
"external CVE lookup",
|
|
"external license lookup",
|
|
"registry freshness lookup",
|
|
"paid API call"
|
|
],
|
|
"planned_output": "future external-source approval package",
|
|
"failure_notification": "only notify when approved source health check fails or data staleness exceeds threshold"
|
|
},
|
|
{
|
|
"cadence_id": "weekly_agent_market_watch_review",
|
|
"domain": "agent_market",
|
|
"frequency": "weekly design; market lookup remains approval-bound",
|
|
"activation_status": "blocked_until_approval",
|
|
"owner_agent": "nemotron",
|
|
"allowed_now": [
|
|
"read existing agent-market snapshots",
|
|
"offline comparison against committed evidence",
|
|
"prepare source approval package"
|
|
],
|
|
"blocked_now": [
|
|
"SDK installation",
|
|
"paid API call",
|
|
"shadow/canary",
|
|
"production routing",
|
|
"unapproved external market lookup"
|
|
],
|
|
"planned_output": "future agent-market watch source approval package",
|
|
"failure_notification": "failure-only AwoooP / Telegram event after approved cadence is active"
|
|
},
|
|
{
|
|
"cadence_id": "monthly_upgrade_approval_batch",
|
|
"domain": "approval_package",
|
|
"frequency": "monthly design; package generation only after P1-206",
|
|
"activation_status": "design_only",
|
|
"owner_agent": "openclaw",
|
|
"allowed_now": [
|
|
"define approval package fields",
|
|
"map dependency risk rules to upgrade candidates"
|
|
],
|
|
"blocked_now": [
|
|
"package upgrade",
|
|
"lockfile write",
|
|
"docker build",
|
|
"image rebuild",
|
|
"registry push"
|
|
],
|
|
"planned_output": "future P1-206 approval package template",
|
|
"failure_notification": "operator review only when a high/critical candidate cannot be triaged"
|
|
},
|
|
{
|
|
"cadence_id": "failure_only_notification_review",
|
|
"domain": "external_sources",
|
|
"frequency": "each approved scheduled run",
|
|
"activation_status": "design_only",
|
|
"owner_agent": "hermes",
|
|
"allowed_now": [
|
|
"document notification contract",
|
|
"define success suppression and failure escalation"
|
|
],
|
|
"blocked_now": [
|
|
"Telegram routing change",
|
|
"Alertmanager rule change",
|
|
"workflow activation"
|
|
],
|
|
"planned_output": "future notification contract for scheduled drift checks",
|
|
"failure_notification": "success stays quiet; failed run, stale source, rate-limit exhaustion, or schema mismatch notifies AwoooP / Telegram"
|
|
}
|
|
]
|
|
},
|
|
"local_check_plan": [
|
|
{
|
|
"check_id": "python_manifest_drift_local_check",
|
|
"domain": "python",
|
|
"status": "read_only_design",
|
|
"owner_agent": "hermes",
|
|
"frequency": "daily or pre-merge after approval",
|
|
"input_refs": [
|
|
"apps/api/pyproject.toml",
|
|
"apps/api/requirements.txt",
|
|
"packages/lewooogo-data/pyproject.toml",
|
|
"packages/lewooogo-brain/pyproject.toml",
|
|
"docs/evaluations/package_supply_chain_inventory_2026-06-04.json"
|
|
],
|
|
"planned_output": "python manifest drift report; no requirements rewrite",
|
|
"allowed_now": [
|
|
"read manifests",
|
|
"compare committed dependency specifiers",
|
|
"flag authority drift"
|
|
],
|
|
"blocked_now": [
|
|
"pip install",
|
|
"uv sync",
|
|
"requirements delete",
|
|
"lockfile write",
|
|
"docker build"
|
|
],
|
|
"acceptance_criteria": [
|
|
"reports pyproject / requirements drift without modifying either file",
|
|
"maps drift to P1-204 severity rules",
|
|
"emits approval package requirement for any remediation"
|
|
]
|
|
},
|
|
{
|
|
"check_id": "javascript_lockfile_drift_local_check",
|
|
"domain": "javascript",
|
|
"status": "read_only_design",
|
|
"owner_agent": "hermes",
|
|
"frequency": "daily or pre-merge after approval",
|
|
"input_refs": [
|
|
"package.json",
|
|
"apps/web/package.json",
|
|
"packages/shared-types/package.json",
|
|
"pnpm-lock.yaml",
|
|
"docs/evaluations/javascript_package_inventory_2026-06-04.json"
|
|
],
|
|
"planned_output": "pnpm importer specifier drift report; no pnpm install",
|
|
"allowed_now": [
|
|
"read package manifests",
|
|
"read pnpm-lock.yaml",
|
|
"compare importer specifiers"
|
|
],
|
|
"blocked_now": [
|
|
"pnpm install",
|
|
"pnpm update",
|
|
"npm audit",
|
|
"lockfile write",
|
|
"package publish"
|
|
],
|
|
"acceptance_criteria": [
|
|
"reports missing/mismatch/extra dependencies",
|
|
"keeps lockfile untouched",
|
|
"flags shared-types publish boundary for approval package"
|
|
]
|
|
},
|
|
{
|
|
"check_id": "dockerfile_surface_drift_local_check",
|
|
"domain": "docker",
|
|
"status": "read_only_design",
|
|
"owner_agent": "hermes",
|
|
"frequency": "weekly or Dockerfile-change after approval",
|
|
"input_refs": [
|
|
"apps/api/Dockerfile",
|
|
"apps/web/Dockerfile",
|
|
"docs/evaluations/docker_build_surface_inventory_2026-06-04.json"
|
|
],
|
|
"planned_output": "Dockerfile surface drift report; no build or pull",
|
|
"allowed_now": [
|
|
"read Dockerfiles",
|
|
"compare FROM and COPY --from references",
|
|
"compare build-time network fetch patterns"
|
|
],
|
|
"blocked_now": [
|
|
"docker build",
|
|
"image pull",
|
|
"image rebuild",
|
|
"registry push",
|
|
"production routing"
|
|
],
|
|
"acceptance_criteria": [
|
|
"reports base image, digest pin, binary source, network fetch, and healthcheck drift",
|
|
"does not contact registries",
|
|
"maps remediation to P1-206 approval package"
|
|
]
|
|
},
|
|
{
|
|
"check_id": "dependency_policy_consistency_local_check",
|
|
"domain": "policy",
|
|
"status": "read_only_design",
|
|
"owner_agent": "openclaw",
|
|
"frequency": "weekly after approval",
|
|
"input_refs": [
|
|
"docs/evaluations/package_supply_chain_inventory_2026-06-04.json",
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json",
|
|
"docs/ai/AI_AGENT_AUTOMATION_WORKLIST_2026-06-04.md"
|
|
],
|
|
"planned_output": "policy consistency report for severity rules and next actions",
|
|
"allowed_now": [
|
|
"read committed policies",
|
|
"validate rollups",
|
|
"detect stale next_action references"
|
|
],
|
|
"blocked_now": [
|
|
"policy override",
|
|
"approval bypass",
|
|
"production change"
|
|
],
|
|
"acceptance_criteria": [
|
|
"catches stale P1 task references",
|
|
"keeps operation_boundaries false",
|
|
"requires OpenClaw/HITL for any gate change"
|
|
]
|
|
},
|
|
{
|
|
"check_id": "agent_market_snapshot_freshness_local_check",
|
|
"domain": "agent_market",
|
|
"status": "read_only_design",
|
|
"owner_agent": "nemotron",
|
|
"frequency": "weekly after approval",
|
|
"input_refs": [
|
|
"docs/evaluations/agent_market_governance_snapshot_2026-06-04.json",
|
|
"docs/ai/agent-market-watch-sources.v1.json",
|
|
"docs/runbooks/OPENCLAW-REPLACEMENT-EVALUATION.md"
|
|
],
|
|
"planned_output": "agent-market freshness report using committed snapshots only",
|
|
"allowed_now": [
|
|
"read committed market governance snapshots",
|
|
"compare stale source timestamps",
|
|
"prepare source approval package"
|
|
],
|
|
"blocked_now": [
|
|
"unapproved external market lookup",
|
|
"SDK installation",
|
|
"paid API call",
|
|
"shadow/canary",
|
|
"production routing"
|
|
],
|
|
"acceptance_criteria": [
|
|
"keeps Nemotron at offline expert role until replay evidence improves",
|
|
"detects stale market evidence without claiming current market truth",
|
|
"routes replacement questions to OpenClaw/HITL approval boundaries"
|
|
]
|
|
}
|
|
],
|
|
"external_source_candidates": [
|
|
{
|
|
"source_id": "osv_advisory_candidate",
|
|
"domain": "cve",
|
|
"source_type": "public vulnerability advisory API candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "free_public_candidate",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache advisory responses per package/version for at least 24h after approval",
|
|
"data_retention_policy": "store only package, version, advisory id, severity, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only vulnerability lookup",
|
|
"severity mapping to dependency_risk_policy_v1"
|
|
],
|
|
"blocked_now": [
|
|
"external CVE lookup",
|
|
"automated remediation",
|
|
"package upgrade"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "github_advisory_candidate",
|
|
"domain": "cve",
|
|
"source_type": "advisory database candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "unknown_until_review",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache advisory ids and affected ranges; avoid repeated queries",
|
|
"data_retention_policy": "store minimal advisory metadata and source timestamp",
|
|
"permitted_after_approval": [
|
|
"cross-check high and critical advisories"
|
|
],
|
|
"blocked_now": [
|
|
"external advisory lookup",
|
|
"paid API call",
|
|
"package upgrade"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "pypi_registry_candidate",
|
|
"domain": "python_registry",
|
|
"source_type": "Python package registry freshness candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "free_public_candidate",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache package release metadata per package for 24h after approval",
|
|
"data_retention_policy": "store package name, current specifier, latest seen version, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only version freshness comparison"
|
|
],
|
|
"blocked_now": [
|
|
"registry lookup",
|
|
"pip install",
|
|
"uv sync",
|
|
"package upgrade"
|
|
],
|
|
"owner_agent": "hermes",
|
|
"evidence_refs": [
|
|
"apps/api/pyproject.toml",
|
|
"docs/evaluations/package_supply_chain_inventory_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "npm_registry_candidate",
|
|
"domain": "javascript_registry",
|
|
"source_type": "JavaScript package registry freshness candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "free_public_candidate",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache package dist-tag and version metadata for 24h after approval",
|
|
"data_retention_policy": "store package name, current specifier, lockfile version, latest seen version, and source timestamp",
|
|
"permitted_after_approval": [
|
|
"read-only package freshness comparison"
|
|
],
|
|
"blocked_now": [
|
|
"registry lookup",
|
|
"npm audit",
|
|
"pnpm install",
|
|
"package upgrade",
|
|
"lockfile write"
|
|
],
|
|
"owner_agent": "hermes",
|
|
"evidence_refs": [
|
|
"apps/web/package.json",
|
|
"pnpm-lock.yaml",
|
|
"docs/evaluations/javascript_package_inventory_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "docker_hub_manifest_candidate",
|
|
"domain": "docker_registry",
|
|
"source_type": "container image manifest freshness candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "free_public_candidate",
|
|
"rate_limit_risk": "high",
|
|
"cache_policy": "cache image tag and digest metadata for 24h after approval; throttle by image",
|
|
"data_retention_policy": "store image ref, tag, digest, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only digest freshness comparison"
|
|
],
|
|
"blocked_now": [
|
|
"image pull",
|
|
"docker build",
|
|
"image rebuild",
|
|
"registry push"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"apps/api/Dockerfile",
|
|
"apps/web/Dockerfile",
|
|
"docs/evaluations/docker_build_surface_inventory_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "ghcr_manifest_candidate",
|
|
"domain": "docker_registry",
|
|
"source_type": "GHCR image manifest freshness candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "unknown_until_review",
|
|
"rate_limit_risk": "high",
|
|
"cache_policy": "cache image tag and digest metadata for 24h after approval; no pull",
|
|
"data_retention_policy": "store image ref, tag, digest, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only digest freshness comparison"
|
|
],
|
|
"blocked_now": [
|
|
"image pull",
|
|
"docker build",
|
|
"image rebuild",
|
|
"registry push"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"apps/api/Dockerfile",
|
|
"docs/evaluations/docker_build_surface_inventory_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "package_license_metadata_candidate",
|
|
"domain": "license",
|
|
"source_type": "package metadata license field candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "free_public_candidate",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache package license metadata for 7 days after approval",
|
|
"data_retention_policy": "store package name, version, license expression, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only license metadata comparison"
|
|
],
|
|
"blocked_now": [
|
|
"external license lookup",
|
|
"legal conclusion",
|
|
"package publish",
|
|
"package upgrade"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json",
|
|
"packages/shared-types/package.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "deps_dev_license_candidate",
|
|
"domain": "license",
|
|
"source_type": "dependency graph and license metadata candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "unknown_until_review",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache normalized dependency/license metadata for 7 days after approval",
|
|
"data_retention_policy": "store only package, version, license, dependency path summary, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only transitive license review"
|
|
],
|
|
"blocked_now": [
|
|
"external license lookup",
|
|
"legal conclusion",
|
|
"package upgrade"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"docs/evaluations/dependency_risk_policy_2026-06-04.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "agent_official_release_candidate",
|
|
"domain": "agent_market",
|
|
"source_type": "official release notes, docs, changelog, or repository release candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "unknown_until_review",
|
|
"rate_limit_risk": "medium",
|
|
"cache_policy": "cache source snapshots and version metadata for 7 days after approval",
|
|
"data_retention_policy": "store product name, version or release marker, source timestamp, summary, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only AI Agent market version watch",
|
|
"candidate emergence detection",
|
|
"operator review queue update"
|
|
],
|
|
"blocked_now": [
|
|
"unapproved market lookup",
|
|
"SDK installation",
|
|
"paid API call",
|
|
"shadow/canary",
|
|
"production routing"
|
|
],
|
|
"owner_agent": "nemotron",
|
|
"evidence_refs": [
|
|
"docs/evaluations/agent_market_governance_snapshot_2026-06-04.json",
|
|
"docs/ai/agent-market-watch-sources.v1.json"
|
|
]
|
|
},
|
|
{
|
|
"source_id": "agent_benchmark_signal_candidate",
|
|
"domain": "agent_market",
|
|
"source_type": "public benchmark, leaderboard, or evaluation report candidate",
|
|
"approval_status": "approval_required",
|
|
"auth_required": false,
|
|
"cost_profile": "unknown_until_review",
|
|
"rate_limit_risk": "unknown",
|
|
"cache_policy": "cache benchmark snapshot references for 7 days after approval",
|
|
"data_retention_policy": "store benchmark name, candidate name, score summary, source timestamp, and lookup time",
|
|
"permitted_after_approval": [
|
|
"read-only market score evidence refresh",
|
|
"OpenClaw replacement evidence queue update"
|
|
],
|
|
"blocked_now": [
|
|
"unapproved market lookup",
|
|
"replacement decision",
|
|
"shadow/canary",
|
|
"production routing"
|
|
],
|
|
"owner_agent": "openclaw",
|
|
"evidence_refs": [
|
|
"docs/runbooks/OPENCLAW-REPLACEMENT-EVALUATION.md",
|
|
"docs/evaluations/agent_market_governance_snapshot_2026-06-04.json"
|
|
]
|
|
}
|
|
],
|
|
"notification_policy": {
|
|
"success_notification": "成功檢查預設不即時通知，避免洗版；結果只寫入 committed snapshot 或治理看板。",
|
|
"failure_notification": "失敗、schema mismatch、來源過期、rate-limit exhaustion、成本邊界不明或 high/critical policy hit 才通知 AwoooP / Telegram。",
|
|
"operator_review_trigger": "任何外部來源啟用、SDK 安裝、付費 API、shadow/canary、生產路由、套件升級、lockfile 寫入或 image rebuild 都必須進人工批准。"
|
|
},
|
|
"operation_boundaries": {
|
|
"read_only_plan_allowed": true,
|
|
"schedule_activation_allowed": false,
|
|
"workflow_write_allowed": false,
|
|
"external_cve_lookup_allowed": false,
|
|
"external_license_lookup_allowed": false,
|
|
"registry_lookup_allowed": false,
|
|
"agent_market_external_lookup_allowed": false,
|
|
"sdk_installation_allowed": false,
|
|
"paid_api_call_allowed": false,
|
|
"package_installation_allowed": false,
|
|
"package_upgrade_allowed": false,
|
|
"lockfile_write_allowed": false,
|
|
"docker_build_allowed": false,
|
|
"image_pull_allowed": false,
|
|
"image_rebuild_allowed": false,
|
|
"registry_push_allowed": false,
|
|
"shadow_or_canary_allowed": false,
|
|
"production_routing_allowed": false
|
|
},
|
|
"approval_boundaries": {
|
|
"sdk_installation_allowed": false,
|
|
"paid_api_call_allowed": false,
|
|
"shadow_or_canary_allowed": false,
|
|
"production_routing_allowed": false,
|
|
"destructive_operation_allowed": false
|
|
}
|
|
}
|