wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): 新增 SSH network 事故回讀 gate
All checks were successful
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / tests (push) Successful in 1m36s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m54s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m45s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-15 19:26:24 +08:00
parent 3d0c3cc8e2
commit 09aeebb767
16 changed files with 4205 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/security/high-value-config-control-coverage.py
View File

@@ -175,8 +175,8 @@ CONTROL_STATUS_BY_CATEGORY = {
"next_owner_action": "補 owner-provided live hash / disposition、change / incident ref、actor role / team、before / after state、Docker daemon state、compose / systemd state、failed unit review、port binding、服務依賴圖、cold-start sequence、route recovery、operator notification、cross-project sync、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。",
},
"ssh_firewall_network_access": {
"coverage_status": "incident_change_evidence_acceptance_ready_needs_network_owner_evidence",
"coverage_percent": 62,
"coverage_status": "post_incident_readback_plan_ready_needs_network_owner_evidence",
"coverage_percent": 64,
"evidence_refs": [
"docs/HARD_RULES.md",
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
@@ -188,9 +188,11 @@ CONTROL_STATUS_BY_CATEGORY = {
"docs/security/ssh-network-owner-response-acceptance.snapshot.json",
"docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json",
"docs/security/SSH-NETWORK-POST-INCIDENT-READBACK-PLAN.md",
"docs/security/ssh-network-post-incident-readback-plan.snapshot.json",
],
"current_gap": "owner response acceptance 帳本已固定 16 個 SSH / network acceptance candidate，端口 / 防火牆事故型變更證據驗收帳本已固定 14 個 change evidence candidate；仍缺 owner-provided change / incident evidence、actor、before / after state、service health impact、operator notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence。",
"next_owner_action": "補端口 / 防火牆變更的 change / incident ref、actor role / team、affected scope、before / after state、service dependency、customer impact、service health impact、operator notification、cross-project sync、rollback owner 與 post-check 指標。",
"current_gap": "owner response acceptance、端口 / 防火牆事故型變更證據驗收與 post-incident readback plan 都已固定；仍缺 owner-provided change / incident evidence、actor、before / after state、service / AI provider / monitoring impact、operator notification、cross-project sync、restoration evidence、recurrence guard、maintenance window、rollback owner 與 post-check evidence。",
"next_owner_action": "補端口 / 防火牆事故回讀包：change / incident ref、actor role / team、affected scope、before / after state、service dependency、public route impact、AI provider impact、monitoring alert impact、operator notification、cross-project sync、restoration evidence、recurrence guard、rollback owner 與 post-check 指標。",
},
"ai_provider_model_routing": {
"coverage_status": "owner_response_acceptance_ready_needs_provider_owner_evidence",
@@ -389,6 +391,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]:
"alert_chain_no_false_green_backfill_ready_needs_live_evidence_receipt",
"change_evidence_acceptance_ready_needs_network_owner_evidence",
"incident_change_evidence_acceptance_ready_needs_network_owner_evidence",
"post_incident_readback_plan_ready_needs_network_owner_evidence",
"policy_ready_needs_drift_evidence",
"inventory_needed",
"repo_only_inventory_ready_needs_live_owner_evidence",