# 审计 — Layer 3 宿主机巡检 Telegram 打通

## 范围

| 文件 | 变更 |
|------|------|
| `server/infrastructure/env_file.py` | `.env` upsert/read（UTF-8 LF） |
| `server/application/services/ops_patrol_sync.py` | Telegram → `/app/.env`、persist 卷、host `.env.prod` |
| `server/api/settings.py` | `set_setting` 钩子；`GET/POST ops-patrol/*` |
| `deploy/health_monitor.sh` | `load_telegram_from_db` MySQL 回退 |
| `deploy/deploy-production.sh` | 部署成功自动 `install_ops_cron.sh` |
| `deploy/nexus-1panel.sh` | `sync_env_prod_to_volume` 含 Telegram 键 |
| `frontend/src/pages/SettingsPage.vue` | Layer 3 巡检状态与同步 UI |
| `frontend/src/types/api.ts` | `OpsPatrol*` 类型 |
| `tests/test_ops_patrol_sync.py` | 7 用例 |
| `docs/changelog/2026-06-07-ops-patrol-layer3-telegram.md` | changelog |
| `docs/design/plans/2026-06-07-ops-patrol-layer3-telegram.md` | 技术说明 |
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |

## Step 3 规则扫描

| H | 规则 | 结论 |
|---|------|------|
| H1 | Layer-3 与设置页 Telegram 脱节 | FIXED — 保存时 sync + DB 回退 |
| H2 | `.env` 写入破坏不可变键 | SAFE — 仅 upsert `NEXUS_TELEGRAM_*` |
| H3 | 宿主机 cron 未安装 | FIXED — deploy 自动 install_ops_cron |
| H4 | env 同步失败静默 | SAFE — 记录 warning；DB 回退保底 |
| H5 | 敏感 Token 泄露至日志 | SAFE — 无 log token；审计仅写布尔标志 |

## Closure

| H | 判定 | 依据 |
|---|------|------|
| H1–H5 | FIXED / SAFE | 代码 + pytest 7/7 |

## DoD

- [x] pytest `test_ops_patrol_sync.py` + `test_settings_telegram.py` 13 passed
- [x] changelog / audit / plan
- [x] 无 SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL 变更

## 验证

`.venv/bin/pytest tests/test_ops_patrol_sync.py tests/test_settings_telegram.py -q`