設計 v1.0（定稿）：三條 CI、一個簽章金庫

%%{init: {'theme':'base','themeVariables':{'primaryColor':'#E2F0F1','primaryTextColor':'#14201F','primaryBorderColor':'#0E7C86','secondaryColor':'#EEF2F3','secondaryTextColor':'#14201F','tertiaryColor':'#FBFCFC','tertiaryTextColor':'#14201F','lineColor':'#4A5A5C','textColor':'#14201F','mainBkg':'#E2F0F1','nodeBorder':'#0E7C86','nodeTextColor':'#14201F','edgeLabelBackground':'#FBFCFC','titleColor':'#14201F','clusterBkg':'#FBFCFC','clusterBorder':'#E4EAEB','actorBkg':'#E2F0F1','actorTextColor':'#14201F','actorBorder':'#0E7C86','actorLineColor':'#C7D1D2','signalColor':'#4A5A5C','signalTextColor':'#14201F','labelBoxBkgColor':'#EEF2F3','labelBoxBorderColor':'#C7D1D2','labelTextColor':'#14201F','loopTextColor':'#14201F','noteBkgColor':'#F6EBD5','noteTextColor':'#14201F','noteBorderColor':'#9C6B12','activationBkgColor':'#EEF2F3','activationBorderColor':'#C7D1D2','sequenceNumberColor':'#FFFFFF','fontSize':'20px'},'sequence':{'actorFontSize':20,'messageFontSize':19,'noteFontSize':18,'actorMargin':60,'messageMargin':42,'boxMargin':12,'useMaxWidth':false}}}%%
sequenceDiagram
  autonumber
  actor P as 發版的人
  participant GL as GitLab BE pipeline（188 runner）
  participant FE as FE pipeline（188 runner）
  participant V as Vault（172）
  participant H as Harbor／R2
  participant US as 更新站
  participant T as 190 測試機
  P->>GL: 打受保護 tag v1.29.0，Run pipeline
  GL->>GL: verify：守衛、pytest、弱掃 lockfile
  GL->>FE: trigger（mirror），等 FE 綠
  FE-->>GL: FE 映像 tag
  GL->>GL: build：Nuitka、BE／init 映像
  GL->>T: rehearse：190 清掉重灌舊版、灌 STG dump、用新包升級
  GL->>GL: package：SBOM＋弱掃放行門、打包
  GL->>V: 用 GitLab job 身分登入，讀 R2／Harbor／更新站祕密
  GL->>H: 推映像、上傳安裝包
  GL->>V: transit/sign guidant-release（canonical 清單）
  V-->>GL: 簽名（鑰匙不出 Vault）
  GL->>US: register-draft，附蓋好章的清單；草稿只給 190 看
  P->>T: 更新中心「立即檢查」→ 更新到 1.29.0
  T->>US: 回報升級成功
  P->>GL: 按手動 job「發布」
  GL->>US: 帶 GitLab job 身分呼叫 publish
  US->>US: 核：BE 專案、受保護 tag、190 已回報成功
  US-->>GL: published
  Note over US: 客戶的「立即檢查」從這一刻看得到 1.29.0

%%{init: {'theme':'base','themeVariables':{'primaryColor':'#E2F0F1','primaryTextColor':'#14201F','primaryBorderColor':'#0E7C86','secondaryColor':'#EEF2F3','secondaryTextColor':'#14201F','tertiaryColor':'#FBFCFC','tertiaryTextColor':'#14201F','lineColor':'#4A5A5C','textColor':'#14201F','mainBkg':'#E2F0F1','nodeBorder':'#0E7C86','nodeTextColor':'#14201F','edgeLabelBackground':'#FBFCFC','titleColor':'#14201F','clusterBkg':'#FBFCFC','clusterBorder':'#E4EAEB','actorBkg':'#E2F0F1','actorTextColor':'#14201F','actorBorder':'#0E7C86','actorLineColor':'#C7D1D2','signalColor':'#4A5A5C','signalTextColor':'#14201F','labelBoxBkgColor':'#EEF2F3','labelBoxBorderColor':'#C7D1D2','labelTextColor':'#14201F','loopTextColor':'#14201F','noteBkgColor':'#F6EBD5','noteTextColor':'#14201F','noteBorderColor':'#9C6B12','activationBkgColor':'#EEF2F3','activationBorderColor':'#C7D1D2','sequenceNumberColor':'#FFFFFF','fontSize':'20px'},'sequence':{'actorFontSize':20,'messageFontSize':19,'noteFontSize':18,'actorMargin':60,'messageMargin':42,'boxMargin':12,'useMaxWidth':false}}}%%
sequenceDiagram
  autonumber
  actor P as 開發者
  participant GL as GitLab BE pipeline（188 runner）
  participant V as Vault（172）
  participant T as 190 測試機
  P->>GL: 任一 branch，勾 internal_test（可加 skip_be），Run pipeline
  GL->>GL: verify：守衛、pytest
  GL->>GL: build（skip_be 時沿用上一顆 BE 映像）
  GL->>GL: 打包（不跑 SBOM／弱掃）
  GL->>V: transit/sign guidant-test
  V-->>GL: 測試章簽名
  GL->>T: scp 安裝包＋清單，install.sh --upgrade --force
  T-->>GL: 升級結果
  Note over T: 測試章只有 190 認得；包流出去別台都裝不了

%%{init: {'theme':'base','themeVariables':{'primaryColor':'#E2F0F1','primaryTextColor':'#14201F','primaryBorderColor':'#0E7C86','secondaryColor':'#EEF2F3','secondaryTextColor':'#14201F','tertiaryColor':'#FBFCFC','tertiaryTextColor':'#14201F','lineColor':'#4A5A5C','textColor':'#14201F','mainBkg':'#E2F0F1','nodeBorder':'#0E7C86','nodeTextColor':'#14201F','edgeLabelBackground':'#FBFCFC','titleColor':'#14201F','clusterBkg':'#FBFCFC','clusterBorder':'#E4EAEB','actorBkg':'#E2F0F1','actorTextColor':'#14201F','actorBorder':'#0E7C86','actorLineColor':'#C7D1D2','signalColor':'#4A5A5C','signalTextColor':'#14201F','labelBoxBkgColor':'#EEF2F3','labelBoxBorderColor':'#C7D1D2','labelTextColor':'#14201F','loopTextColor':'#14201F','noteBkgColor':'#F6EBD5','noteTextColor':'#14201F','noteBorderColor':'#9C6B12','activationBkgColor':'#EEF2F3','activationBorderColor':'#C7D1D2','sequenceNumberColor':'#FFFFFF'}}}%%
flowchart LR
  subgraph trig["人按"]
    T1["BE：Run pipeline（tag 或 branch）"]
    T2["Agent：Run pipeline（tag 或 branch）"]
    T3["FE／jedi：任意 push"]
  end
  subgraph be["BE pipeline（188 shell runner）"]
    B1["verify"]
    B2["trigger FE（mirror）"]
    B4["build：Nuitka、BE／init 映像"]
    B5["rehearse：190 舊庫升級排練（測試包跳過）"]
    B6["package：SBOM 放行門 → 打包 → Harbor → R2（測試包只打包）"]
    B6s["sign：Vault 正式章或測試章"]
    B6d["正式：register-draft 帶章／測試：scp 升 190"]
    B7["publish（手動、只在受保護 tag）"]
    B1 --> B2 --> B4 --> B5 --> B6 --> B6s --> B6d --> B7
  end
  subgraph fe["FE pipeline（188 shell runner）"]
    F1["verify：lint、vitest、npm 弱掃"]
    F2["build：FE 映像 → Harbor；dist-console artifact"]
  end
  subgraph ag["Agent pipeline（188 shell runner，與 BE 串行）"]
    G1["verify"] --> G2["build：Nuitka、拉 FE dist-console、Agent 映像"] --> G3["rehearse"] --> G4["package＋sign＋register-draft product=agent"] --> G5["publish（手動）"]
  end
  T1 --> B1
  T2 --> G1
  T3 --> F1
  B2 -.-> F1