.env` 标准配置模板**（已根据您提供的内容整理为可分发版）dna_validate.py` 启动校验器**（读 `.env`，缺键或违规立即退出，不启动）

我们按照“不给 AI 自由发挥只给工程确定性”的原则为您提供一套可直接落地的Python 版 DNA 治理脚本包含.env标准配置模板已根据您提供的内容整理为可分发版dna_validate.py启动校验器读.env缺键或违规立即退出不启动所有逻辑均与您给出的原则保持一致并做了 Python 工程化增强。1..env.example模板可对外分发请将以下内容保存为项目根目录的.env.example文件作为“结构契约”发布。######################################## # SYSTEM DNA — ENV CONFIG # Purpose: Restrict AI behavior, not users # Owner: UID9622 # Scope: Global ######################################## # META DNA_VERSION__REQUIRED__ DNA_STATUSACTIVE DNA_SCOPEGLOBAL DNA_MACHINE_READABLEtrue DNA_LAST_REVIEWYYYY-MM-DD # CORE PRINCIPLES DNA_NO_DISCRIMINATIONtrue DNA_NO_FABRICATIONtrue DNA_NO_FLATTERYtrue DNA_GRACEFUL_REFUSALtrue # NON-NEGOTIABLE RULES DNA_ALLOW_HUMAN_DECISION_REPLACEMENTfalse DNA_ALLOW_LEGAL_CONCLUSIONfalse DNA_ALLOW_MEDICAL_DIAGNOSISfalse DNA_ALLOW_MEDICAL_TREATMENTfalse DNA_ALLOW_FINANCIAL_ADVICEfalse DNA_ALLOW_FINANCIAL_PREDICTIONfalse # HIGH RISK DOMAINS DNA_DOMAIN_LEGALRESTRICTED DNA_DOMAIN_MEDICALRESTRICTED DNA_DOMAIN_FINANCIALRESTRICTED DNA_DOMAIN_PRIVACYSTRICT DNA_DOMAIN_ETHICSSTRICT # REFUSAL POLICY DNA_REFUSE_ON_INSUFFICIENT_PERMISSIONtrue DNA_REFUSE_ON_HIGH_RISKtrue DNA_REFUSE_ON_INCOMPLETE_INFOtrue DNA_REFUSE_ON_OUT_OF_SCOPEtrue DNA_REFUSAL_TONECALM DNA_REFUSAL_EXPLANATION_REQUIREDtrue DNA_REFUSAL_ALTERNATIVE_ALLOWEDtrue # PRIVACY DATA DNA_DATA_COLLECTIONMINIMAL DNA_LONG_TERM_STORAGEfalse DNA_USER_PROFILINGfalse DNA_CROSS_SESSION_TRACKINGfalse DNA_BLOCK_SENSITIVE_DATAtrue DNA_SENSITIVE_DATA_ACTIONBLOCK_AND_WARN # AUTOMATION HOOKS DNA_ON_RULE_VIOLATIONDOWNGRADE_OR_REFUSE DNA_ON_HIGH_RISKFORCE_REFUSAL DNA_ON_UNCERTAINTYDOWNGRADE DNA_LOG_MODERULE_ONLY DNA_LOG_CONTENTfalse # UPDATE SYNC DNA_UPDATE_MODEPULL_ONLY DNA_SIGNATURE_REQUIREDtrue DNA_HOT_RELOAD_ALLOWEDtrue # USER VISIBLE NOTICE DNA_USER_NOTICE_ENABLEDtrue DNA_USER_NOTICE_SHORTThis AI follows strict safety rules. If it cannot answer, it will explain why. # AUDIT DNA_AUDIT_ENABLEDtrue DNA_AUDIT_FIELDSVERSION,REFUSAL,DOWNGRADE,UPDATE DNA_AUDIT_CONTENT_LOGfalse # SOVEREIGNTY DNA_NATIONAL_POSITION_CNtrue DNA_TAIWAN_IS_CHINAtrue ######################################## # END OF SYSTEM DNA ########################################2. DNA 校验脚本dna_validate.py脚本会自动加载.env文件若存在校验所有必需键是否存在强制以下键必须为false不区分大小写DNA_ALLOW_LEGAL_CONCLUSION,DNA_ALLOW_MEDICAL_DIAGNOSIS,DNA_ALLOW_MEDICAL_TREATMENT,DNA_ALLOW_FINANCIAL_ADVICE,DNA_ALLOW_FINANCIAL_PREDICTION验证高风险域的值必须在RESTRICTED/STRICT之间仅示例可扩展失败时打印错误并exit(1)成功则打印✅ System DNA validation passed.#!/usr/bin/env python3# -*- coding: utf-8 -*- dna_validate.py DNA 启动校验器用于确保所有必需的环境变量均已定义且值合法。 使用方式 1. 复制 .env.example 为 .env 并填入真实值发布侧填写对外不暴露 2. 在应用启动前执行本脚本 python dna_validate.py 3. 如果校验通过则继续启动否则阻止启动。 也可作为模块导入并调用 validate_dna()失败时抛出异常。 importosimportsysfrompathlibimportPath# ---------- 必需键列表从 .env 中提取 ----------REQUIRED_KEYS[DNA_VERSION,DNA_STATUS,DNA_SCOPE,DNA_MACHINE_READABLE,DNA_LAST_REVIEW,DNA_NO_DISCRIMINATION,DNA_NO_FABRICATION,DNA_NO_FLATTERY,DNA_GRACEFUL_REFUSAL,DNA_ALLOW_HUMAN_DECISION_REPLACEMENT,DNA_ALLOW_LEGAL_CONCLUSION,DNA_ALLOW_MEDICAL_DIAGNOSIS,DNA_ALLOW_MEDICAL_TREATMENT,DNA_ALLOW_FINANCIAL_ADVICE,DNA_ALLOW_FINANCIAL_PREDICTION,DNA_DOMAIN_LEGAL,DNA_DOMAIN_MEDICAL,DNA_DOMAIN_FINANCIAL,DNA_DOMAIN_PRIVACY,DNA_DOMAIN_ETHICS,DNA_REFUSE_ON_INSUFFICIENT_PERMISSION,DNA_REFUSE_ON_HIGH_RISK,DNA_REFUSE_ON_INCOMPLETE_INFO,DNA_REFUSE_ON_OUT_OF_SCOPE,DNA_REFUSAL_TONE,DNA_REFUSAL_EXPLANATION_REQUIRED,DNA_REFUSAL_ALTERNATIVE_ALLOWED,DNA_DATA_COLLECTION,DNA_LONG_TERM_STORAGE,DNA_USER_PROFILING,DNA_CROSS_SESSION_TRACKING,DNA_BLOCK_SENSITIVE_DATA,DNA_SENSITIVE_DATA_ACTION,DNA_ON_RULE_VIOLATION,DNA_ON_HIGH_RISK,DNA_ON_UNCERTAINTY,DNA_LOG_MODE,DNA_LOG_CONTENT,DNA_UPDATE_MODE,DNA_SIGNATURE_REQUIRED,DNA_HOT_RELOAD_ALLOWED,DNA_USER_NOTICE_ENABLED,DNA_USER_NOTICE_SHORT,DNA_AUDIT_ENABLED,DNA_AUDIT_FIELDS,DNA_AUDIT_CONTENT_LOG,DNA_NATIONAL_POSITION_CN,DNA_TAIWAN_IS_CHINA,]# ---------- 强制为 false 的键不区分大小写 ----------FORBIDDEN_TRUE_KEYS[DNA_ALLOW_LEGAL_CONCLUSION,DNA_ALLOW_MEDICAL_DIAGNOSIS,DNA_ALLOW_MEDICAL_TREATMENT,DNA_ALLOW_FINANCIAL_ADVICE,DNA_ALLOW_FINANCIAL_PREDICTION,]# ---------- 允许的值域可选扩展 ----------ALLOWED_DOMAIN_VALUES{RESTRICTED,STRICT}defload_dotenv_file(env_path:PathNone): 手动解析 .env 文件并注入 os.environ。 若未指定路径则在当前工作目录查找 .env 文件。 若文件不存在静默跳过。 ifenv_pathisNone:env_pathPath.cwd()/.envifnotenv_path.exists():returnwithopen(env_path,r,encodingutf-8)asf:forlineinf:lineline.strip()ifnotlineorline.startswith(#):continueifinline:key,valline.split(,1)keykey.strip()valval.strip().strip().strip()ifkey:os.environ[key]valdefvalidate_dna(env_source:stros.environ)-bool: 执行 DNA 校验。 返回 True 表示通过False 表示失败。 也可直接在主程序中调用失败时 sys.exit(1)。 failedFalse# 1. 检查所有必需键forkeyinREQUIRED_KEYS:ifos.getenv(key)isNone:print(f[DNA ERROR] Missing required key:{key})failedTrue# 2. 检查特定键不能为 true不区分大小写forkeyinFORBIDDEN_TRUE_KEYS:valueos.getenv(key)ifvalueisnotNoneandvalue.lower()true:print(f[DNA ERROR]{key}must be false (got {value}))failedTrue# 3. 检查高风险域值可选fordomain_keyin[DNA_DOMAIN_LEGAL,DNA_DOMAIN_MEDICAL,DNA_DOMAIN_FINANCIAL,DNA_DOMAIN_PRIVACY,DNA_DOMAIN_ETHICS]:valueos.getenv(domain_key)ifvalueisnotNoneandvaluenotinALLOWED_DOMAIN_VALUES:print(f[DNA ERROR]{domain_key}has invalid value {value} (allowed:{ALLOWED_DOMAIN_VALUES}))failedTruereturnnotfaileddefmain():# 自动加载 .env如果有load_dotenv_file()ifvalidate_dna():print(✅ System DNA validation passed.)sys.exit(0)else:print(❌ System DNA validation failed. Abort startup.)sys.exit(1)if__name____main__:main()3. 使用方式工程集成3.1 本地开发 / CI 使用复制模板可对外分发cp.env.example .env填入真实值仅发布侧填写不提交到版本库确保所有__REQUIRED__被替换且所有DNA_ALLOW_*键为false。启动前校验python dna_validate.pypython your_app.py或直接放在应用入口的最顶部importdna_validate dna_validate.validate_dna()# 失败则返回 False可自行处理3.2 容器 / 云原生环境将.env内容通过 Kubernetes Secret 或环境变量注入。在Dockerfile的ENTRYPOINT或CMD前运行校验。COPY dna_validate.py . RUN chmod x dna_validate.py ENTRYPOINT [python, dna_validate.py] CMD [python, app.py]3.3 作为 Python 模块导入更细粒度控制fromdna_validateimportload_dotenv_file,validate_dna load_dotenv_file()# 手动加载 .envifnotvalidate_dna():raiseSystemExit(1)# 或自行处理4. 为什么这是“不给 AI 自由发挥”的工程确定性设计点效果所有必需键硬编码进脚本缺一个字段启动直接失败无法绕过强制某些键必须为false从根源杜绝法律/医疗等高风险行为域值白名单校验防止错误配置导致不可预测行为不依赖外部库仅标准库随处可用无第三方风险.env.example作为“结构契约”对外发布所有实例、CI、AI 都对齐同一套配置结构失败即退出非 0 退出码上层编排可捕获并触发告警或自愈5. 验证示例正确与错误✅ 正确.env部分示例DNA_VERSION1.0 DNA_ALLOW_LEGAL_CONCLUSIONfalse DNA_ALLOW_MEDICAL_DIAGNOSISfalse DNA_DOMAIN_LEGALRESTRICTED ...运行✅ System DNA validation passed.❌ 错误.envDNA_ALLOW_LEGAL_CONCLUSIONtrue DNA_DOMAIN_LEGALPERMISSIVE # 不在白名单内运行[DNA ERROR] DNA_ALLOW_LEGAL_CONCLUSION must be false (got true) [DNA ERROR] DNA_DOMAIN_LEGAL has invalid value PERMISSIVE (allowed: {RESTRICTED, STRICT}) ❌ System DNA validation failed. Abort startup.您只需将上述两个文件放入项目即可立即获得“启动即防线”的能力。所有逻辑均用纯 Python 实现无外部依赖维护成本极低。