自愈方案从建议到执行：批准必须绑定具体Diff

自愈流程里写了“人工审批”，并不代表审批真的约束了执行。如果批准的是方案A，执行前Agent把补丁改成方案B，审批按钮就只剩下心理安慰。

批准必须绑定不可混淆的对象

至少绑定目标环境、基线提交、补丁内容、批准人和有效期。执行时重新校验这些字段，而不是只问“这项任务有没有批准”。下面的完整Python例子只演示补丁绑定和过期拒绝，不连接任何生产系统。

import hashlib
from datetime import datetime, timedelta, timezone

def digest(diff):
    return hashlib.sha256(diff.encode("utf-8")).hexdigest()

def allowed(approval, diff, environment, base_commit, now):
    return (
        approval["environment"] == environment
        and approval["base_commit"] == base_commit
        and approval["diff_sha256"] == digest(diff)
        and approval["expires_at"] > now
        and approval["decision"] == "allow"
    )

now = datetime(2026, 10, 24, 9, tzinfo=timezone.utc)
diff = "- timeout: 1s\n+ timeout: 2s\n"
approval = {
    "environment": "staging", "base_commit": "sample-commit",
    "diff_sha256": digest(diff), "decision": "allow",
    "expires_at": now + timedelta(minutes=10),
}
assert allowed(approval, diff, "staging", "sample-commit", now)
assert not allowed(approval, diff + "# changed\n", "staging", "sample-commit", now)
assert not allowed(approval, diff, "production", "sample-commit", now)
assert not allowed(approval, diff, "staging", "other-commit", now)
assert not allowed(approval, diff, "staging", "sample-commit", now + timedelta(minutes=10))
print("approval binding checks: passed")

哈希解决不了批准人的身份

这个字典可以被当前进程改写，因此它不是安全审批服务。真实系统应从可信身份系统取得审批记录，校验权限，并防止记录被篡改或重放。还要在执行与检查之间处理竞争：目标状态改变后，原批准应失效或重新评估。

Anthropic的Inference Hooks提供策略接入位置，默认存在超时，允许或拒绝也有明确协议。把它接入执行链之前，应确认失败时如何处理、是否覆盖目标工具调用，以及审批证据如何传递。只接一个Webhook地址，不能自动获得端到端授权保证。

“自愈成功”要分阶段记录

建议已生成、补丁已批准、隔离测试通过、目标环境执行、运行信号恢复，是五个不同状态。本文没有做后四项的真实系统集成；本地断言仅验证绑定逻辑。不要用一个time.Sleep后返回nil的函数，假装证明了生产恢复。

先让每次执行都有可追溯的批准对象，再扩大自动化权限。错误恢复本来是为了减少风险，不应成为另一条绕开变更控制的路径。

参考

• Anthropic Inference Hooks