wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): 新增 SSH network 事故回讀 gate
All checks were successful
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / tests (push) Successful in 1m36s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m54s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m45s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-15 19:26:24 +08:00
parent 3d0c3cc8e2
commit 09aeebb767
16 changed files with 4205 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
docs/security/high-value-config-control-coverage.snapshot.json
View File

@@ -412,9 +412,9 @@
"action_buttons_allowed": false,
"category_id": "ssh_firewall_network_access",
"control_tier": "C1",
"coverage_percent": 62,
"coverage_status": "incident_change_evidence_acceptance_ready_needs_network_owner_evidence",
"current_gap": "owner response acceptance 帳本已固定 16 個 SSH / network acceptance candidate，端口 / 防火牆事故型變更證據驗收帳本已固定 14 個 change evidence candidate；仍缺 owner-provided change / incident evidence、actor、before / after state、service health impact、operator notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence。",
"coverage_percent": 64,
"coverage_status": "post_incident_readback_plan_ready_needs_network_owner_evidence",
"current_gap": "owner response acceptance、端口 / 防火牆事故型變更證據驗收與 post-incident readback plan 都已固定；仍缺 owner-provided change / incident evidence、actor、before / after state、service / AI provider / monitoring impact、operator notification、cross-project sync、restoration evidence、recurrence guard、maintenance window、rollback owner 與 post-check evidence。",
"evidence_refs": [
"docs/HARD_RULES.md",
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
@@ -425,10 +425,12 @@
"docs/security/SSH-NETWORK-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/ssh-network-owner-response-acceptance.snapshot.json",
"docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json"
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json",
"docs/security/SSH-NETWORK-POST-INCIDENT-READBACK-PLAN.md",
"docs/security/ssh-network-post-incident-readback-plan.snapshot.json"
],
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
"next_owner_action": "補端口 / 防火牆變更的 change / incident ref、actor role / team、affected scope、before / after state、service dependency、customer impact、service health impact、operator notification、cross-project sync、rollback owner 與 post-check 指標。",
"next_owner_action": "補端口 / 防火牆事故回讀包：change / incident ref、actor role / team、affected scope、before / after state、service dependency、public route impact、AI provider impact、monitoring alert impact、operator notification、cross-project sync、restoration evidence、recurrence guard、rollback owner 與 post-check 指標。",
"owner_response_accepted": false,
"owner_response_received": false,
"owner_response_required": true,
@@ -639,8 +641,8 @@
"websocket_route_change_authorized": false,
"workflow_modification_authorized": false
},
"generated_at": "2026-06-11T21:30:00+08:00",
"git_commit": "403b29df",
"generated_at": "2026-06-15T19:40:00+08:00",
"git_commit": "3d0c3cc8",
"lowest_coverage_categories": [
{
"category_id": "docker_compose_systemd_host_config",
@@ -649,13 +651,6 @@
"label": "Docker Compose / systemd / host service config",
"next_owner_action": "補 owner-provided live hash / disposition、change / incident ref、actor role / team、before / after state、Docker daemon state、compose / systemd state、failed unit review、port binding、服務依賴圖、cold-start sequence、route recovery、operator notification、cross-project sync、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。"
},
{
"category_id": "ssh_firewall_network_access",
"coverage_percent": 62,
"current_gap": "owner response acceptance 帳本已固定 16 個 SSH / network acceptance candidate，端口 / 防火牆事故型變更證據驗收帳本已固定 14 個 change evidence candidate；仍缺 owner-provided change / incident evidence、actor、before / after state、service health impact、operator notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence。",
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
"next_owner_action": "補端口 / 防火牆變更的 change / incident ref、actor role / team、affected scope、before / after state、service dependency、customer impact、service health impact、operator notification、cross-project sync、rollback owner 與 post-check 指標。"
},
{
"category_id": "k8s_production_gitops",
"coverage_percent": 64,
@@ -669,6 +664,13 @@
"current_gap": "已固定 owner response acceptance、restore recovery backfill、remote delete guard、retention runway、credential recovery metadata-only 與 backup health no-false-green 只讀帳本；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。",
"label": "Backup / restore / escrow / retention",
"next_owner_action": "補 restore drill approval package、freshness SLO、隔離 restore target、依賴圖、資料分級、offsite remote delete guard、credential recovery non-secret proof、retention runway、observer / stop condition、rollback owner、validation plan 與 no-secret-value evidence。"
},
{
"category_id": "ssh_firewall_network_access",
"coverage_percent": 64,
"current_gap": "owner response acceptance、端口 / 防火牆事故型變更證據驗收與 post-incident readback plan 都已固定；仍缺 owner-provided change / incident evidence、actor、before / after state、service / AI provider / monitoring impact、operator notification、cross-project sync、restoration evidence、recurrence guard、maintenance window、rollback owner 與 post-check evidence。",
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
"next_owner_action": "補端口 / 防火牆事故回讀包：change / incident ref、actor role / team、affected scope、before / after state、service dependency、public route impact、AI provider impact、monitoring alert impact、operator notification、cross-project sync、restoration evidence、recurrence guard、rollback owner 與 post-check 指標。"
}
],
"next_collection_order": [