DocOps Writeback Runs

Sandbox POST guard wiring（M3）：`drive-writeback-real` POST executor 已接入 M3 闸门链，但 feature flag 默认关闭，不执行真实 Drive 写回。legacy C3 中文短语不适用于 M3 sandbox real writeback。

implementationWiringReady=true · sandboxReadyForFutureImplementation=ready · nextAction: POST guard wired · feature flag off · sandbox real writeback remains disabled

Audit payload preview

{
  "sandbox": true,
  "targetLabel": "99_test",
  "targetDocId": "1C4PBDNgESdQZ4EBLB_2AteLTx-Qs863BWLTIBhMOJqw",
  "phraseVerified": false,
  "lockKey": "docops-sandbox-writeback:91296ba0-3c81-4940-8234-6cb2ceb13dfb:1C4PBDNgESdQZ4EBLB_2AteLTx-Qs863BWLTIBhMOJqw",
  "patchId": null,
  "rollbackNoteSnapshot": "## Rollback target\n\nsuggestion: 刷新 stale 文档元数据\n\n## Proposed change summary\n\n刷新 stale 文档元数据 (refresh_stale_content). no patch yet; request type refresh_stale_content may generate patch before dry-run.\n\n## Rollback method\n\n1. Do not apply this change request to Drive.\n2. If a future dry-run or real writeback was attempted, revert using the latest dry-run revision hint and reopen this change request.\n3. Keep doc_change_requests status at approved until human review decides otherwise.\n\n## Verification after rollback\n\nConfirm doc_change_requests.rollback_note is present, dry-run eligibility no longer lists rollback_note_missing, and no Drive writeback run succeeded for this CR.\n\n## Safety boundary\n\n- No Drive writeback executed in this step\n- Real writeback remains blocked\n- Production remains false",
  "dryRunRunId": "b5961d4c-7f7a-44fe-8ab2-bd508119b216",
  "production": false,
  "driveWriteback": false,
  "realWriteback": false,
  "readbackRequired": true
}

Sandbox implementation wiring checklist

• POST guard: wired into drive-writeback-real
• feature flag: off
• target: 99_test only
• phrase: required
• one-run lock: required
• readback: required
• audit payload: preview only
• real writeback: disabled

Writeback gate M1：仅定义 dry-run / real-writeback 边界；本阶段不启用真实 Drive writeback。 approved_for_writeback 只是写回候选，不等于已写回。

approved_for_writeback is a writeback candidate only — not Drive writeback, not auto writeback, not production.

Required gates (all blocked for real writeback in M1)

• human_phrase
• allowlist
• rollback_note
• dry_run_success
• audit_log
• one_run_lock

State machine — M1 allowed

• not_eligible
• candidate
• dry_run_ready
• human_gate_required
• real_writeback_blocked

State machine — M1 forbidden

• real_writeback_ready_future
• real_writeback_started
• real_writeback_succeeded

Dry-run allowed only if

• change_request exists
• patch exists or can be generated
• target document is allowlisted
• rollback note exists or can be generated
• production=false
• Drive writeback remains false

Real writeback requires (all blocked in M1)

• explicit human approval phrase
• allowlisted document id
• patch preview accepted
• rollback note generated
• writeback dry-run succeeded
• environment != production or production explicitly blocked
• one-run lock
• audit log
• manual final confirmation

Final gate audit（M2）：dry-run 成功只是前置条件，不等于真实 Drive 写回许可。本面板列出 patch / rollback / dry-run / allowlist / human phrase / one-run lock / audit log / production 边界与最终阻断原因。

3 dry-run succeeded CR(s) · 3 final gate blocked · Drive writeback remains blocked

Target CR final gate checklist

Final blocked reasons

• real_writeback_not_enabled
• drive_writeback_disabled
• human_phrase_required
• one_run_lock_required
• final_audit_required

All dry-run succeeded CR audits

Per-CR dry-run eligibility（M2）：展示 patch preview / rollback note / allowlist reason / dry-run 状态；Generate patch preview 仅写 staging doc_change_request_patches；Generate & save rollback note 仅写 staging rollback_note；Run dry-run 仅写 doc_writeback_runs，不写 Drive。

只读展示 writeback 运行记录，含 dry run 预演结果。本页不会写回 Drive、不会调用 Google Drive API、不会调用 GitHub API、不会开 repo PR。