--- title: FR-186 Agent 本體資安掃描第二輪 status: 🔎 35 棒 2026-11-09 全部掃完並驗收（1 高 14 中 15 低）；修正卡在 FR-195；本頁逐棒進度表與跨 arc 總表待結案時補 lede: "FR-177 之後 Agent 又進了 199 個 commit（授權照、長輪詢、首次設定、TPM 加密都是新程式），整包重掃一次：新程式有沒有洞、上次 22 條修正有沒有守住。只掃不修。" notion: parent: {id: CM-3675, title: "FR-186 Agent 本體資安掃描第二輪（35 棒 6 批，整包重掃，Opus 1M effort low，只掃不修）", url: "https://app.notion.com/p/FR-186-Agent-35-6-Opus-1M-effort-low-412346da4cd0815881d7f1aa1876dfb9"} children: - {id: CM-3676, title: "S1a 首次設定、換主系統、改本機位址（FR-179／183 新程式）", url: "https://app.notion.com/p/FR-186-S1a-Agent-FR-179-183-5-999-Opus-1M-effort-low-412346da4cd0814691aceb3c04b9f68f", status: Not started} - {id: CM-3677, title: "S1b 註冊、憑證與 Agent 身分", url: "https://app.notion.com/p/FR-186-S1b-Agent-Agent-5-1133-Opus-1M-effort-low-412346da4cd081f59e0ddbbe68932ffa", status: Not started} - {id: CM-3678, title: "S2 主系統通道、信任錨、憑證換發、設定拉取", url: "https://app.notion.com/p/FR-186-S2-Agent-8-1029-Opus-1M-effort-low-412346da4cd081e4ae87d5e64281ee1d", status: Not started} - {id: CM-3679, title: "S3 長輪詢指令通道（FR-181 新程式）", url: "https://app.notion.com/p/FR-186-S3-Agent-FR-181-11-1065-Opus-1M-effort-low-412346da4cd081f1b41de5d983e63f63", status: Not started} - {id: CM-3680, title: "S4 8443 資料面與證據檔取送", url: "https://app.notion.com/p/FR-186-S4-Agent-8443-13-869-Opus-1M-effort-low-412346da4cd08106b159f79b6b08c6da", status: Not started} - {id: CM-3681, title: "S5 線上更新鏈", url: "https://app.notion.com/p/FR-186-S5-Agent-4-1014-Opus-1M-effort-low-412346da4cd08191988dcea4bfe04aea", status: Not started} - {id: CM-3682, title: "S6 檢測規則包下載與解壓", url: "https://app.notion.com/p/FR-186-S6-Agent-3-1081-Opus-1M-effort-low-412346da4cd081e59f2fc1983e58a0fa", status: Not started} - {id: CM-3683, title: "S7 簽章驗證核心、啟動完整性閘、漏洞庫同步", url: "https://app.notion.com/p/FR-186-S7-Agent-8-1047-Opus-1M-effort-low-412346da4cd081ab8e85ee199093fb85", status: Not started} - {id: CM-3684, title: "S8 授權目標清冊與結果回報 outbox", url: "https://app.notion.com/p/FR-186-S8-Agent-outbox-6-994-Opus-1M-effort-low-412346da4cd081f98181c2f144ee092b", status: Not started} - {id: CM-3685, title: "L1 Agent 授權照與 sync 閘門（FR-182 新程式）", url: "https://app.notion.com/p/FR-186-L1-Agent-Agent-sync-FR-182-12-911-Opus-1M-effort-low-412346da4cd0818086c8c2b8a3cd8ea4", status: Not started} - {id: CM-3686, title: "I1 主控台本機登入、鎖定與 session", url: "https://app.notion.com/p/FR-186-I1-Agent-session-9-1222-Opus-1M-effort-low-412346da4cd081bf90d9f8a0c680c36a", status: Not started} - {id: CM-3687, title: "I2 LDAP 登入、離線操作者、來源網段白名單", url: "https://app.notion.com/p/FR-186-I2-Agent-LDAP-9-1104-Opus-1M-effort-low-412346da4cd08199a7edec5e5bffe88d", status: Not started} - {id: CM-3688, title: "K1 主控台守門殼、頁面與紀錄路由", url: "https://app.notion.com/p/FR-186-K1-Agent-10-984-Opus-1M-effort-low-412346da4cd081f5a268ef9e4ecb106a", status: Not started} - {id: CM-3689, title: "K2 主控台操作路由：維運、掃描、網診、工具、檔案", url: "https://app.notion.com/p/FR-186-K2-Agent-5-1065-Opus-1M-effort-low-412346da4cd081029f55c6949bb5dd88", status: Not started} - {id: CM-3690, title: "K3 主控台聚合層：總覽、心跳欄位、更新頁", url: "https://app.notion.com/p/FR-186-K3-Agent-4-754-Opus-1M-effort-low-412346da4cd0810c9f43e4e355112fd7", status: Not started} - {id: CM-3691, title: "F1 瀏覽器直傳 8444、儲存設定與檔案保護", url: "https://app.notion.com/p/FR-186-F1-Agent-8444-11-996-Opus-1M-effort-low-412346da4cd081f79214e6e6d3d01d7a", status: Not started} - {id: CM-3692, title: "C1 SonarQube connector（單檔）", url: "https://app.notion.com/p/FR-186-C1-Agent-SonarQube-connector-1-1711-Opus-1M-effort-low-412346da4cd081a182c3fdb57619f797", status: Not started} - {id: CM-3693, title: "C2 CINC Auditor／InSpec connector", url: "https://app.notion.com/p/FR-186-C2-Agent-CINC-Auditor-InSpec-connector-3-1126-Opus-1M-effort-low-412346da4cd08154b256c72bf4ea1338", status: Not started} - {id: CM-3694, title: "C3 Nmap connector＋SSH 主機金鑰", url: "https://app.notion.com/p/FR-186-C3-Agent-Nmap-connector-SSH-2-790-Opus-1M-effort-low-412346da4cd081b3b5f6dfdee1972da3", status: Not started} - {id: CM-3695, title: "C4 OWASP ZAP connector＋工具 TLS", url: "https://app.notion.com/p/FR-186-C4-Agent-OWASP-ZAP-connector-TLS-3-802-Opus-1M-effort-low-412346da4cd081fe9011ded28c0f2cb5", status: Not started} - {id: CM-3696, title: "C5 OpenSCAP＋OpenVAS connector", url: "https://app.notion.com/p/FR-186-C5-Agent-OpenSCAP-OpenVAS-connector-3-881-Opus-1M-effort-low-412346da4cd081cb879ecc19e65d1ffa", status: Not started} - {id: CM-3697, title: "C6 SBOM 三檔、connector 基底與登記、工具執行紀錄", url: "https://app.notion.com/p/FR-186-C6-Agent-SBOM-connector-6-1091-Opus-1M-effort-low-412346da4cd081318094f1c39c99733f", status: Not started} - {id: CM-3698, title: "X1 掃描任務執行與工具帳密", url: "https://app.notion.com/p/FR-186-X1-Agent-14-1152-Opus-1M-effort-low-412346da4cd081fc9d8ada6ab97e3fee", status: Not started} - {id: CM-3699, title: "X2 執行紀錄、本機上傳槽、工具參數白名單", url: "https://app.notion.com/p/FR-186-X2-Agent-12-1050-Opus-1M-effort-low-412346da4cd081199d1fdab35488546d", status: Not started} - {id: CM-3700, title: "N1 網路診斷探測", url: "https://app.notion.com/p/FR-186-N1-Agent-11-907-Opus-1M-effort-low-412346da4cd0817c8f13cda03d2e32fc", status: Not started} - {id: CM-3701, title: "N2 網路診斷執行、判讀、儀表板、報告與限制", url: "https://app.notion.com/p/FR-186-N2-Agent-10-1302-Opus-1M-effort-low-412346da4cd08169bdf6ebd81e283ac7", status: Not started} - {id: CM-3702, title: "P1 祕密保管、診斷包、維運指令、錯誤追蹤", url: "https://app.notion.com/p/FR-186-P1-Agent-8-965-Opus-1M-effort-low-412346da4cd081be9a74cb277248a5ca", status: Not started} - {id: CM-3703, title: "P2 稽核與系統日誌、模組登記", url: "https://app.notion.com/p/FR-186-P2-Agent-8-1035-Opus-1M-effort-low-412346da4cd08177a953f9b5e7e2154e", status: Not started} - {id: CM-3704, title: "P3 容器、背景元件、健康檢查、設定、共用寫檔", url: "https://app.notion.com/p/FR-186-P3-Agent-8-977-Opus-1M-effort-low-412346da4cd081499f36d75a2eae7ef8", status: Not started} - {id: CM-3705, title: "P4 模組接線與 sync 小功能", url: "https://app.notion.com/p/FR-186-P4-Agent-sync-16-1049-Opus-1M-effort-low-412346da4cd081dda264ea0725371d06", status: Not started} - {id: CM-3706, title: "H3 主機端設定檔加密、TPM 密封、本機管理員與註冊腳本（FR-179 新程式）", url: "https://app.notion.com/p/FR-186-H3-Agent-TPM-FR-179-8-1128-Opus-1M-effort-low-412346da4cd081179e07d97c77f58557", status: Not started} - {id: CM-3707, title: "H4 主機端升級與清除腳本", url: "https://app.notion.com/p/FR-186-H4-Agent-8-1292-Opus-1M-effort-low-412346da4cd081cfaf69cf4edd541e2e", status: Not started} - {id: CM-3708, title: "H5 容器部署設定：compose、Dockerfile、systemd", url: "https://app.notion.com/p/FR-186-H5-Agent-compose-Dockerfile-systemd-4-768-Opus-1M-effort-low-412346da4cd08113938ff259c4a4a7e2", status: Not started} - {id: CM-3709, title: "H1 主機安裝程式 install.sh（tarball 版，單檔）", url: "https://app.notion.com/p/FR-186-H1-Agent-install-sh-tarball-1-3267-Opus-1M-effort-low-412346da4cd081c99a5dc2d608f98f5e", status: Not started} - {id: CM-3710, title: "H2 主機安裝程式 install.sh（compose 版，單檔）", url: "https://app.notion.com/p/FR-186-H2-Agent-install-sh-compose-1-2998-Opus-1M-effort-low-412346da4cd08140b115c467e8d374f6", status: Not started} relates: [FR-177, FR-179, FR-181, FR-182, FR-183, FR-185] --- # FR-186 Agent 本體資安掃描第二輪 > 🔴 **35 棒已全部掃完並驗收：1 條高、14 條中、15 條低，全部在 Agent。修正卡開在 [FR-195](../FR-195-2611-agent-security-fixes/README.md)（母卡 CM-3822）。** 逐棒報告在 Agent repo `docs/security-scan/FR-186/scan-*.md`；下方「35 棒」表的狀態欄尚未逐列更新。 > 資安掃描系列第八個 arc。跨 arc 結論在 [`security-scan-consolidated/`](../security-scan-consolidated/index.html)；作業手冊 `.claude/skills/security-scan-lead/SKILL.md`。前一輪 [FR-177](../FR-177-2611-agent-security-scan/README.md)。 ## 掃什麼、為什麼 FR-177 掃的是 Agent `63334f4`，22 條全修完。之後 FR-179／181／182／183／185 又進了 199 個 commit、134 個檔、約 6,000 行，其中授權照、長輪詢指令通道、首次設定與換主系統、主機端設定檔加密與 TPM 密封是全新的；22 條修正本身也沒被工具複查過。 範圍是整包出貨給客戶的程式：`guidant_agent/` 全部、`common/integrity`、`common/util`、`config/config.py`、`main_app.py`、兩份 `install.sh` 與 `scripts/install/lib/`、compose 部署設定。不掃：`scripts/build/`（自家 CI，不出貨）、tests、docs、純 error code 表、空 `__init__.py`。合計約 40,500 行。 ## 切法 每棒約 1,000 行（FR-177 驗證的安全線，研究員讀太多會被工具 180 秒看門狗誤殺），按業務模組垂直切，同批範圍不重疊、只新增報告檔，合回不衝突。FR-177 掃過的棒沿用舊卡「重點看什麼」並加一條回歸檢查（對應總表 #219～240）；新程式的棒由首腦讀碼後寫重點。 兩支 `install.sh` 各約 3,000 行、中文 2.4 萬字，超過安全線，各自單獨一批（批 5、6），卡上寫「第二個 `failed` 就停」；跑不完再拆成按函式區段的子棒。 ## 35 棒 | 批 | 棒 | 卡 | 範圍 | 檔／行 | 狀態 | |---|---|---|---|---|---| | 1 | S1a 首次設定、換主系統、改本機位址（FR-179／183 新程式） | CM-3676 | `guidant_agent/sync/app/enroll_service.py`、`guidant_agent/sync/enroll_command.py`、`guidant_agent/sync/base_url_command.py`、`guidant_agent/console/api/setup_routes.py`、`guidant_agent/console/api/cloud_change_routes.py` | 5 檔／999 行 | 未開工 | | 1 | S1b 註冊、憑證與 Agent 身分 | CM-3677 | `guidant_agent/sync/app/enroll.py`、`guidant_agent/sync/domain/registration.py`、`guidant_agent/sync/domain/agent_auth.py`、`guidant_agent/sync/adapters/cert_files.py`、`guidant_agent/platform/agent_identity.py` | 5 檔／1133 行 | 未開工 | | 1 | S2 主系統通道、信任錨、憑證換發、設定拉取 | CM-3678 | `guidant_agent/sync/app/cert_renew.py`、`guidant_agent/sync/app/cloud_trust.py`、`guidant_agent/sync/ports/cloud_trust.py`、`guidant_agent/sync/adapters/cloud_channel.py`、`guidant_agent/sync/adapters/cloud_http.py`、`guidant_agent/sync/ports/cloud_channel.py`、`guidant_agent/sync/app/agent_status.py`、`guidant_agent/sync/app/config_pull.py` | 8 檔／1029 行 | 未開工 | | 1 | S3 長輪詢指令通道（FR-181 新程式） | CM-3679 | `guidant_agent/sync/app/command_pull.py`、`guidant_agent/sync/app/reply_sender.py`、`guidant_agent/sync/app/task_intake.py`、`guidant_agent/sync/ports/command_handler.py`、`guidant_agent/files/api/commands.py`、`guidant_agent/scan/api/commands.py`、`guidant_agent/sync/app/log_query.py`、`guidant_agent/platform/query_args.py`、`guidant_agent/sync/api/cmd_logs.py`、`guidant_agent/sync/app/task_queue.py`、`guidant_agent/sync/__init__.py` | 11 檔／1065 行 | 未開工 | | 1 | S4 8443 資料面與證據檔取送 | CM-3680 | `guidant_agent/sync/api/data_plane_server.py`、`guidant_agent/sync/api/data_plane_auth.py`、`guidant_agent/sync/api/cmd_config.py`、`guidant_agent/sync/api/cmd_credentials.py`、`guidant_agent/sync/api/cmd_restart.py`、`guidant_agent/sync/api/cmd_tasks.py`、`guidant_agent/sync/api/cmd_update.py`、`guidant_agent/shared/tls_server.py`、`guidant_agent/files/api/blob.py`、`guidant_agent/files/api/blob_route.py`、`guidant_agent/files/app/blob_ops.py`、`guidant_agent/files/app/evidence_files.py`、`guidant_agent/files/app/evidence_sha256.py` | 13 檔／869 行 | 未開工 | | 1 | S5 線上更新鏈 | CM-3681 | `guidant_agent/sync/app/update_sync.py`、`guidant_agent/sync/app/update_events.py`、`guidant_agent/sync/app/update_log_upload.py`、`guidant_agent/console/api/update_routes.py` | 4 檔／1014 行 | 未開工 | | 1 | S6 檢測規則包下載與解壓 | CM-3682 | `guidant_agent/sync/app/profile_cache.py`、`guidant_agent/sync/app/profile_sync.py`、`guidant_agent/shared/archive_safety.py` | 3 檔／1081 行 | 未開工 | | 1 | S7 簽章驗證核心、啟動完整性閘、漏洞庫同步 | CM-3683 | `guidant_agent/sync/app/vulndb_sync.py`、`guidant_agent/sync/app/vulndb_bundle.py`、`common/integrity/__init__.py`、`common/integrity/public_keys.py`、`common/integrity/startup_gate.py`、`common/integrity/verify.py`、`main_app.py`、`guidant_agent/platform/agent_tree_verify.py` | 8 檔／1047 行 | 未開工 | | 2 | S8 授權目標清冊與結果回報 outbox | CM-3684 | `guidant_agent/sync/app/allowed_targets.py`、`guidant_agent/sync/app/outbox.py`、`guidant_agent/sync/app/event_sender.py`、`guidant_agent/sync/adapters/outbox_repo.py`、`guidant_agent/sync/ports/target_authorizer.py`、`guidant_agent/sync/ports/result_outbox.py` | 6 檔／994 行 | 未開工 | | 2 | L1 Agent 授權照與 sync 閘門（FR-182 新程式） | CM-3685 | `guidant_agent/license/__init__.py`、`guidant_agent/license/app/check.py`、`guidant_agent/license/app/gate.py`、`guidant_agent/license/app/install.py`、`guidant_agent/license/app/online_activate.py`、`guidant_agent/license/app/opener.py`、`guidant_agent/license/app/store.py`、`guidant_agent/license/domain/status.py`、`guidant_agent/console/api/license_routes.py`、`guidant_agent/platform/fingerprint.py`、`guidant_agent/platform/host_identity.py`、`guidant_agent/platform/bootstrap.py` | 12 檔／911 行 | 未開工 | | 2 | I1 主控台本機登入、鎖定與 session | CM-3686 | `guidant_agent/identity/app/local_login.py`、`guidant_agent/identity/app/local_auth.py`、`guidant_agent/identity/app/session.py`、`guidant_agent/identity/app/session_file.py`、`guidant_agent/identity/app/credentials.py`、`guidant_agent/identity/app/local_credentials.py`、`guidant_agent/identity/domain/lockout.py`、`guidant_agent/identity/adapters/credential_repo.py`、`guidant_agent/console/api/local_auth_routes.py` | 9 檔／1222 行 | 未開工 | | 2 | I2 LDAP 登入、離線操作者、來源網段白名單 | CM-3687 | `guidant_agent/identity/adapters/ldap_source.py`、`guidant_agent/identity/app/ldap_source.py`、`guidant_agent/identity/app/offline_operators.py`、`guidant_agent/identity/app/offline_login_window.py`、`guidant_agent/identity/app/allow_cidr.py`、`guidant_agent/identity/domain/allow_cidr.py`、`guidant_agent/identity/ports/source_cidr_guard.py`、`guidant_agent/identity/adapters/operator_repo.py`、`guidant_agent/console/api/ldap_routes.py` | 9 檔／1104 行 | 未開工 | | 2 | K1 主控台守門殼、頁面與紀錄路由 | CM-3688 | `guidant_agent/console/api/__init__.py`、`guidant_agent/console/api/pages.py`、`guidant_agent/console/__init__.py`、`guidant_agent/console/app/body_limit.py`、`guidant_agent/console/app/inline_policy.py`、`guidant_agent/console/app/view_audit.py`、`guidant_agent/console/migrations.py`、`guidant_agent/console/api/log_routes.py`、`guidant_agent/console/api/keys_routes.py`、`guidant_agent/console/api/runs_routes.py` | 10 檔／984 行 | 未開工 | | 2 | K2 主控台操作路由：維運、掃描、網診、工具、檔案 | CM-3689 | `guidant_agent/console/api/ops_routes.py`、`guidant_agent/console/api/scan_routes.py`、`guidant_agent/console/api/netdiag_routes.py`、`guidant_agent/console/api/tools.py`、`guidant_agent/console/api/files.py` | 5 檔／1065 行 | 未開工 | | 2 | K3 主控台聚合層：總覽、心跳欄位、更新頁 | CM-3690 | `guidant_agent/console/app/overview.py`、`guidant_agent/console/app/heartbeat.py`、`guidant_agent/console/app/targets.py`、`guidant_agent/console/app/update_console.py` | 4 檔／754 行 | 未開工 | | 2 | F1 瀏覽器直傳 8444、儲存設定與檔案保護 | CM-3691 | `guidant_agent/files/api/browser_plane.py`、`guidant_agent/files/app/storage_settings.py`、`guidant_agent/files/app/storage_stats.py`、`guidant_agent/files/app/storage_trust.py`、`guidant_agent/files/app/file_protect.py`、`guidant_agent/files/app/setup_cert.py`、`guidant_agent/files/app/ports.py`、`guidant_agent/files/__init__.py`、`guidant_agent/files/adapters/customer_files_repo.py`、`guidant_agent/files/migrations.py`、`guidant_agent/files/ports/evidence_store.py` | 11 檔／996 行 | 未開工 | | 3 | C1 SonarQube connector（單檔） | CM-3692 | `guidant_agent/scan/adapters/connectors/sonarqube.py` | 1 檔／1711 行 | 未開工 | | 3 | C2 CINC Auditor／InSpec connector | CM-3693 | `guidant_agent/scan/adapters/connectors/inspec.py`、`guidant_agent/scan/adapters/connectors/inspec_config.py`、`guidant_agent/scan/adapters/connectors/inspec_host_keys.py` | 3 檔／1126 行 | 未開工 | | 3 | C3 Nmap connector＋SSH 主機金鑰 | CM-3694 | `guidant_agent/scan/adapters/connectors/nmap.py`、`guidant_agent/scan/adapters/connectors/ssh_host_keys.py` | 2 檔／790 行 | 未開工 | | 3 | C4 OWASP ZAP connector＋工具 TLS | CM-3695 | `guidant_agent/scan/adapters/connectors/zap.py`、`guidant_agent/scan/adapters/connectors/zap_client.py`、`guidant_agent/scan/adapters/connectors/tool_tls.py` | 3 檔／802 行 | 未開工 | | 3 | C5 OpenSCAP＋OpenVAS connector | CM-3696 | `guidant_agent/scan/adapters/connectors/openscap.py`、`guidant_agent/scan/adapters/connectors/openvas.py`、`guidant_agent/scan/adapters/connectors/openvas_tls.py` | 3 檔／881 行 | 未開工 | | 3 | C6 SBOM 三檔、connector 基底與登記、工具執行紀錄 | CM-3697 | `guidant_agent/scan/adapters/connectors/sbom_scan.py`、`guidant_agent/scan/adapters/connectors/sbom_tools.py`、`guidant_agent/scan/adapters/connectors/sbom_coverage.py`、`guidant_agent/scan/adapters/connectors/base.py`、`guidant_agent/scan/adapters/connectors/__init__.py`、`guidant_agent/scan/adapters/connectors/tool_run_log.py` | 6 檔／1091 行 | 未開工 | | 3 | X1 掃描任務執行與工具帳密 | CM-3698 | `guidant_agent/scan/app/task_executor.py`、`guidant_agent/scan/app/running_tasks.py`、`guidant_agent/scan/app/task_sinks.py`、`guidant_agent/scan/app/credential_handover.py`、`guidant_agent/scan/app/credential_resolver.py`、`guidant_agent/scan/app/credential_store.py`、`guidant_agent/scan/app/secret_form.py`、`guidant_agent/scan/adapters/credential_store.py`、`guidant_agent/scan/api/routes/credential_route.py`、`guidant_agent/scan/api/routes/detection_route.py`、`guidant_agent/scan/ports/secret_fields.py`、`guidant_agent/scan/ports/connector.py`、`guidant_agent/scan/app/cancel.py`、`guidant_agent/scan/app/probe.py` | 14 檔／1152 行 | 未開工 | | 3 | X2 執行紀錄、本機上傳槽、工具參數白名單 | CM-3699 | `guidant_agent/scan/app/local_runs.py`、`guidant_agent/scan/app/scan_input.py`、`guidant_agent/scan/app/probe_runner.py`、`guidant_agent/scan/app/sync_ports.py`、`guidant_agent/scan/app/catalog.py`、`guidant_agent/scan/adapters/local_runs_repo.py`、`guidant_agent/scan/adapters/scan_input_files.py`、`guidant_agent/scan/domain/local_run.py`、`guidant_agent/scan/domain/summary.py`、`guidant_agent/scan/domain/tool_params.py`、`guidant_agent/scan/migrations.py`、`guidant_agent/scan/ports/scan_input_slots.py` | 12 檔／1050 行 | 未開工 | | 4 | N1 網路診斷探測 | CM-3700 | `guidant_agent/netdiag/adapters/probes` | 11 檔／907 行 | 未開工 | | 4 | N2 網路診斷執行、判讀、儀表板、報告與限制 | CM-3701 | `guidant_agent/netdiag/app`、`guidant_agent/netdiag/domain`、`guidant_agent/netdiag/__init__.py` | 10 檔／1302 行 | 未開工 | | 4 | P1 祕密保管、診斷包、維運指令、錯誤追蹤 | CM-3702 | `guidant_agent/platform/secret_store.py`、`guidant_agent/platform/support_bundle.py`、`guidant_agent/platform/ops.py`、`guidant_agent/platform/local_ops.py`、`guidant_agent/platform/local_state_cli.py`、`guidant_agent/platform/error_tracking` | 8 檔／965 行 | 未開工 | | 4 | P2 稽核與系統日誌、模組登記 | CM-3703 | `guidant_agent/platform/audit_log.py`、`guidant_agent/platform/audit_pipeline.py`、`guidant_agent/platform/audit_import.py`、`guidant_agent/platform/local_db`、`guidant_agent/shared/audit.py`、`guidant_agent/platform/registry.py` | 8 檔／1035 行 | 未開工 | | 4 | P3 容器、背景元件、健康檢查、設定、共用寫檔 | CM-3704 | `guidant_agent/platform/container.py`、`guidant_agent/platform/background.py`、`guidant_agent/platform/health.py`、`guidant_agent/platform/clock_skew.py`、`guidant_agent/platform/disk_space.py`、`config/config.py`、`guidant_agent/shared/secure_file.py`、`guidant_agent/shared/timeouts.py` | 8 檔／977 行 | 未開工 | | 4 | P4 模組接線與 sync 小功能 | CM-3705 | `guidant_agent/scan/__init__.py`、`guidant_agent/identity/__init__.py`、`guidant_agent/identity/ports/__init__.py`、`guidant_agent/sync/app/agent_name.py`、`guidant_agent/sync/app/keys_view.py`、`guidant_agent/sync/app/file_protect_sync.py`、`guidant_agent/sync/app/tool_schemas.py`、`guidant_agent/sync/app/console_ticket.py`、`guidant_agent/sync/ports/upload_ticket.py`、`guidant_agent/shared/heartbeat_wake.py`、`common/util` | 16 檔／1049 行 | 未開工 | | 4 | H3 主機端設定檔加密、TPM 密封、本機管理員與註冊腳本（FR-179 新程式） | CM-3706 | `scripts/install/lib/secrets.sh`、`scripts/install/lib/secrets_cmds.sh`、`scripts/install/lib/tpm.sh`、`scripts/install/lib/local_admin.sh`、`scripts/install/lib/enroll.sh`、`scripts/install/lib/set_base_url.sh`、`scripts/install/lib/console_allow_cidr.sh`、`scripts/install/lib/systemd/guidant-agent-secrets.service` | 8 檔／1128 行 | 未開工 | | 4 | H4 主機端升級與清除腳本 | CM-3707 | `scripts/install/lib/upgrade_order.sh`、`scripts/install/lib/upgrade_runner.sh`、`scripts/install/lib/upgrade_guard.sh`、`scripts/install/lib/image_verify.sh`、`scripts/install/lib/wipe.sh`、`scripts/install/lib/systemd/guidant-agent-upgrade-boot-check.service`、`scripts/install/lib/systemd/guidant-agent-upgrade-order.path`、`scripts/install/lib/systemd/guidant-agent-upgrade-order.service` | 8 檔／1292 行 | 未開工 | | 4 | H5 容器部署設定：compose、Dockerfile、systemd | CM-3708 | `deploy/docker-compose.yml`、`deploy/Dockerfile.runtime`、`deploy/.env.example`、`scripts/build/systemd/guidant-agent.service` | 4 檔／768 行 | 未開工 | | 5 | H1 主機安裝程式 install.sh（tarball 版，單檔） | CM-3709 | `scripts/install/install.sh` | 1 檔／3267 行 | 未開工 | | 6 | H2 主機安裝程式 install.sh（compose 版，單檔） | CM-3710 | `deploy/install.sh` | 1 檔／2998 行 | 未開工 | ## 怎麼跑 同 FR-177：子卡 Repo＝`agent`，Model `opus`、Effort `low`（工作坊補 `[1m]`），開場 prompt 在本 repo `.claude/workshop-prompts/dispatch-<卡號>.md`，前兩行是啟動指令與成本承認句。報告寫在 Agent 卡工作區的 `docs/security-scan/FR-186/`。 ## 驗收 每棒照手冊第五節七步。修正卡全部掃完、驗完才統一開，同檔同根因併一張。掃到 CRITICAL 當場回報決策者。