diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 1e7d1097b..bc50be25f 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,31 @@ +## 2026-06-14｜高價值配置 Owner Request 草稿包本地完成 + +**背景**：P0-13 已將高價值配置 Owner Packet 轉成送件前預檢與 reviewer intake lanes；下一步需要把三包預檢結果整理成可人工核對的 request draft 與 handoff envelope，但仍不得送件、不得建立 audit event、不得把草稿解讀成 owner response。 + +**完成項目**： +- 新增 `scripts/security/high-value-config-owner-request-draft.py`，從 committed intake preflight snapshot 產生 metadata-only request draft。 +- 新增 `docs/security/high-value-config-owner-request-draft.snapshot.json`，固定 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`、`blocked_request_count=16`。 +- 新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md`，說明 handoff envelope、三包草稿、送後不變條件與完成度。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、request ids、handoff fields 與每份草稿 false flags。 +- P0 總帳、供應鏈進度、Owner Packet 主文件、收件預檢文件與 MASTER 已同步 P0-14。 + +**本地驗證**： +- `python3 -m json.tool docs/security/high-value-config-owner-request-draft.snapshot.json` 通過。 +- `python3 -m json.tool docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json` 通過。 +- `python3 -m py_compile scripts/security/high-value-config-owner-request-draft.py scripts/security/high-value-config-owner-packet-intake-preflight.py scripts/security/security-mirror-progress-guard.py` 通過。 +- 產生器 smoke：`HIGH_VALUE_CONFIG_OWNER_REQUEST_DRAFT_OK drafts=3 c0=2 fields=27 sent=0 runtime_gate=0`。 +- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。 +- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。 +- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=812`。 +- `git diff --check` 通過。 +- diff-only 工作溝通片語掃描通過；未加入工作溝通原文、委派 XML 或內部抱怨內容。 +- Snapshot assertion 通過：`OWNER_REQUEST_DRAFT_ASSERTIONS_OK drafts=3 c0=2 fields=27 sent=0 runtime_gate=0`。 + +**完成度與邊界**： +- P0-14 高價值配置 Owner Request 草稿包：`100%`。 +- Production browser verification：不適用；本輪只改 repo 內文件、snapshot、guard 與產生器，不變更前端 bundle 或 runtime。 +- request sent、recipient confirmed、audit event emitted、owner response received / accepted / rejected、reviewer queue write、live evidence、runtime gate、action buttons、Nginx live config、`nginx -t`、reload、DNS / TLS live probe、certbot renew、ArgoCD sync、kubectl action、workflow / secret 修改、public route change、agent-bounty runtime、host write、active scan、production write 全部維持 `0 / false`。 + ## 2026-06-14｜高價值配置 Owner Packet 收件預檢本地完成 **背景**：高價值配置 Owner Packet、前台摘要與 posture projection 已同步為 `packet=3 / c0=2`；下一步需建立 request dispatch 前的低摩擦收件預檢與 reviewer intake lanes，避免 C0 補件在真正送 owner request 前被誤讀成已送件、已收件或已授權。 diff --git a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md index de38a569d..4e21cd69d 100644 --- a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md +++ b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md @@ -15,6 +15,12 @@ 本階段仍不是 request sent、不是 owner response received、不是 accepted record、不是 reviewer queue write，也不是 Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan、agent-bounty runtime、payout / withdrawal 或 production write 授權。 +## 1.1 2026-06-14 Request Draft + +已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包預檢結果轉成人工送件前可核對的 request draft 與 handoff envelope。 + +目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。 + ## 2. 目前摘要 | 指標 | 值 | 說明 | diff --git a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md index aef7da474..6d5721c86 100644 --- a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md +++ b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md @@ -33,6 +33,12 @@ P0.2 已能將變更分類成 C0 / C1 / C2 / C3。本文件與工具負責下一 目前固定為 `dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16`。此 artifact 只表示收件框架已準備，不代表 request sent、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。 +## 1.3 2026-06-14 Request draft + +已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包收件預檢轉成人工送件前可核對的 request draft。 + +目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。 + ## 2. Canonical 欄位 高價值配置 packet 對齊 S4.9 canonical owner response envelope，使用以下欄位： diff --git a/docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md b/docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md new file mode 100644 index 000000000..dc6b34641 --- /dev/null +++ b/docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md @@ -0,0 +1,98 @@ +# IwoooS 高價值配置 Owner Request 草稿包 + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-14 | +| 狀態 | `owner_request_draft_ready_not_dispatched` | +| 工具 | `scripts/security/high-value-config-owner-request-draft.py` | +| 輸入 | `docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json` | +| Snapshot | `docs/security/high-value-config-owner-request-draft.snapshot.json` | +| runtime gate | `0` | + +## 1. 目的 + +本文件承接高價值配置 Owner Packet 收件預檢，將三包 owner packet 轉成可人工核對的 request draft 與 handoff envelope。它只負責固定未來送件前的內容格式、禁止 payload 與送後不變條件。 + +本階段仍不是 request sent、不是 recipient confirmed、不是 owner response received、不是 reviewer accepted、不是 audit event emitted，也不是 Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan、agent-bounty runtime、payout / withdrawal 或 production write 授權。 + +## 2. 草稿摘要 + +| 指標 | 值 | 說明 | +|------|----|------| +| request draft count | `3` | DNS / TLS / certbot、Nginx public gateway、security evidence tooling | +| C0 request draft count | `2` | DNS / TLS / certbot 與 Nginx public gateway | +| handoff envelope field count | `11` | 送件前交接封套欄位 | +| required owner field total | `27` | 三包各九欄 | +| forbidden payload count | `12` | token、secret、private key、cookie、session、raw sensitive live config 等 | +| blocked request count | `16` | repo / refs / workflow / runner / host / scan / runtime / payout 等要求全部拒收 | +| request sent | `0` | 尚未送 request | +| recipient confirmed | `0` | 尚未確認收件角色 | +| audit event emitted | `0` | 尚未建立送件稽核事件 | +| received / accepted / rejected | `0 / 0 / 0` | 尚未收到或驗收任何 owner response | +| runtime gate | `0` | 未開啟 | + +## 3. Handoff Envelope + +| 欄位 | 內容規則 | +|------|----------| +| `request_id` | 固定對應高價值配置 owner request，不建立 runtime action id | +| `stage_id` | 固定 `P0-14` | +| `packet_id` | 對應來源 owner packet | +| `recipient_role_or_team` | 只填 role / team；不得填 token、cookie、session 或私人聯絡資訊 | +| `sender_role_or_team` | 只填送件操作角色；不得把 AwoooP approval 視為資安批准 | +| `requested_response_window` | 可填人工約定窗口；空值不得阻擋 `0 / false` gate | +| `allowed_response_format` | 只接受九個 canonical owner 欄位與允許 decision | +| `redacted_evidence_refs` | 僅指向既有文件、snapshot、ticket id、hash 或 quarantine pointer | +| `forbidden_payloads` | secret、repo archive、DB dump、runner token、raw sensitive live config 等全部拒收 | +| `followup_owner` | 只記後續補證 role / team | +| `not_approval` | 必須為 `true` | + +## 4. 三包草稿 + +| Request | Priority | Control tier | 邊界 | +|---------|----------|--------------|------| +| `high_value_config_owner_request:dns_tls_certbot` | `P0` | `C0` | 只要求 domain / TLS / certbot owner 補件，不代表 certbot renew、DNS 變更或 public HTTPS route change | +| `high_value_config_owner_request:nginx_public_gateway` | `P0` | `C0` | 只要求 Nginx public gateway owner 補件，不代表 live conf 讀取、`nginx -t`、reload 或 route change | +| `high_value_config_owner_request:security_evidence_tooling` | `P3` | `C3` | 只要求文件 / snapshot / guard 類證據補件，不代表 runtime gate 提升 | + +## 5. 送後不變條件 + +即使未來真的由人工送出 request，也只能在有可稽核送件 metadata 後，另行記錄真實 `request_sent_count`。不得因草稿、送件、AwoooP approval、UI 可見或 CD success 同步拉高 received / accepted / rejected、reviewer queue、runtime gate 或 action button。 + +送件後仍需經過： + +1. owner response 收件預檢。 +2. 敏感 payload 隔離。 +3. 執行要求拒收。 +4. 跨包一致性檢查。 +5. reviewer validation。 +6. security acceptance record。 +7. 獨立人工 runtime approval、維護窗口、rollback 與 post-check。 + +## 6. 指令 + +產生 committed snapshot： + +```bash +python3 scripts/security/high-value-config-owner-request-draft.py \ + --root . \ + --intake-preflight-report docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json \ + --output docs/security/high-value-config-owner-request-draft.snapshot.json \ + --generated-at 2026-06-14T18:45:00+08:00 +``` + +驗證 guard： + +```bash +python3 scripts/security/security-mirror-progress-guard.py --root . +``` + +## 7. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| request draft artifact | `100%` | 產生器、snapshot 與文件已固定 | +| request dispatch | `0%` | 尚未送 owner request | +| owner response received | `0%` | 尚未收到正式回覆 | +| reviewer accepted | `0%` | 尚未建立 security acceptance record | +| runtime gate | `0%` | 未授權且未開啟 | diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index f08e9517a..cb92c7e19 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -7,7 +7,7 @@ | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 | | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | -| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | +| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | @@ -388,6 +388,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons | 高價值配置 Owner Packet 前台同步 | 正式驗證完成 | `/iwooos` 與 `/awooop` 已同步 owner packet snapshot，顯示 `packet=3 / c0=2`、Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；本地與正式 desktop / mobile / in-app browser smoke 已確認必要文字與 boundary keys 可見、水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0` | 這是前台 read-only projection 對齊，不是 owner request sent、owner response received / accepted、Nginx reload、certbot renew、DNS / TLS probe、workflow 修改、secret rotation、agent-bounty runtime、host write、active scan、production write 或 runtime gate；headline 仍不提高 | | IwoooS posture projection Owner Packet 數字同步 | 本地完成 | `iwooos-posture-projection.snapshot.json`、`iwooos_posture_projection_v1.schema.json` 與 `security-mirror-progress-guard.py` 已同步 `high_value_config_owner_packet_count=3`、`high_value_config_owner_packet_c0_packet_count=2` | 這是 committed evidence / schema / guard drift closure，不是前端 bundle、CD、runtime gate、owner request sent、owner response received / accepted 或 production write；不需要 production browser smoke | | 高價值配置 Owner Packet 收件預檢 | 本地完成 | `high-value-config-owner-packet-intake-preflight.snapshot.json` 已固定 `packet_count=3`、`c0_packet_count=2`、`dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16`，並由 `security-mirror-progress-guard.py` 鎖住 packet ids、check ids、lane ids 與 false flags | 這是 request dispatch 前的只讀預檢與 reviewer intake lanes，不是 request sent、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；不需要 production browser smoke | +| 高價值配置 Owner Request 草稿包 | 本地完成 | `high-value-config-owner-request-draft.snapshot.json` 已固定 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`、`request_sent_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、handoff fields 與 false flags | 這是人工送件前草稿與 handoff envelope，不是 request sent、recipient confirmed、audit event emitted、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；不需要 production browser smoke | | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate | | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item | | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 | diff --git a/docs/security/high-value-config-owner-request-draft.snapshot.json b/docs/security/high-value-config-owner-request-draft.snapshot.json new file mode 100644 index 000000000..1c4e92696 --- /dev/null +++ b/docs/security/high-value-config-owner-request-draft.snapshot.json @@ -0,0 +1,406 @@ +{ + "execution_boundaries": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "audit_event_emitted": false, + "dispatch_authorized": false, + "dns_tls_change_authorized": false, + "host_write_authorized": false, + "nginx_reload_authorized": false, + "not_authorization": true, + "production_write_authorized": false, + "recipient_confirmed": false, + "request_sent": false, + "reviewer_queue_write": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "workflow_modification_authorized": false + }, + "forbidden_payloads": [ + "token", + "secret", + "private_key", + "cookie", + "session", + "authorization_header", + "runner_token", + "webhook_secret", + "db_dump", + "repo_archive", + "git_object_pack", + "raw_sensitive_live_config" + ], + "generated_at": "2026-06-14T18:45:00+08:00", + "git_commit": "ddd9e433", + "handoff_envelope_fields": [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval" + ], + "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", + "request_drafts": [ + { + "accepted_response": false, + "action_buttons_allowed": false, + "affected_files": [ + "scripts/ops/188-registry-certbot-fix.sh", + "scripts/ops/fix-188-registry-certbot-renewal.sh" + ], + "allowed_response_format": { + "allowed_decisions": [ + "confirm", + "defer", + "reject", + "request_more_evidence" + ], + "fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "followup_owner", + "rollback_owner", + "maintenance_window", + "validation_plan" + ], + "redacted_evidence_refs_only": true + }, + "audit_event_emitted": false, + "blocked_requests": [ + "repo_create", + "visibility_change", + "refs_sync", + "refs_delete", + "force_push", + "workflow_modify", + "runner_enable", + "secret_value_submit", + "ssh_host_modify", + "nginx_reload", + "dns_tls_modify", + "argocd_sync", + "kubectl_apply", + "active_scan", + "agent_bounty_runtime_execute", + "payout_or_withdrawal" + ], + "category_id": "dns_tls_certbot", + "control_tier": "C0", + "followup_owner": "pending_followup_owner", + "forbidden_payloads": [ + "token", + "secret", + "private_key", + "cookie", + "session", + "authorization_header", + "runner_token", + "webhook_secret", + "db_dump", + "repo_archive", + "git_object_pack", + "raw_sensitive_live_config" + ], + "handoff_envelope_fields": [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval" + ], + "label": "DNS / TLS / certbot / certificate path", + "not_approval": true, + "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", + "packet_id": "high_value_config_owner_packet:dns_tls_certbot", + "priority": "P0", + "production_write_authorized": false, + "received_response": false, + "recipient_confirmed": false, + "recipient_role_or_team": "pending_owner_role_or_team", + "redacted_evidence_refs": [ + "docs/security/high-value-config-owner-packet.snapshot.json", + "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" + ], + "rejected_response": false, + "request_id": "high_value_config_owner_request:dns_tls_certbot", + "request_sent": false, + "requested_response_window": "not_scheduled", + "required_gate": "domain_tls_owner_response_required", + "required_validation": [ + "domain_inventory", + "certificate_path_check", + "renewal_window", + "acme_path_smoke", + "public_https_smoke", + "rollback_ref" + ], + "reviewer_queue_write": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sender_role_or_team": "iwooos_security_reviewer", + "stage_id": "P0-14", + "status": "draft_not_dispatched" + }, + { + "accepted_response": false, + "action_buttons_allowed": false, + "affected_files": [ + "k8s/nginx/awoooi-prod.conf" + ], + "allowed_response_format": { + "allowed_decisions": [ + "confirm", + "defer", + "reject", + "request_more_evidence" + ], + "fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "followup_owner", + "rollback_owner", + "maintenance_window", + "validation_plan" + ], + "redacted_evidence_refs_only": true + }, + "audit_event_emitted": false, + "blocked_requests": [ + "repo_create", + "visibility_change", + "refs_sync", + "refs_delete", + "force_push", + "workflow_modify", + "runner_enable", + "secret_value_submit", + "ssh_host_modify", + "nginx_reload", + "dns_tls_modify", + "argocd_sync", + "kubectl_apply", + "active_scan", + "agent_bounty_runtime_execute", + "payout_or_withdrawal" + ], + "category_id": "nginx_public_gateway", + "control_tier": "C0", + "followup_owner": "pending_followup_owner", + "forbidden_payloads": [ + "token", + "secret", + "private_key", + "cookie", + "session", + "authorization_header", + "runner_token", + "webhook_secret", + "db_dump", + "repo_archive", + "git_object_pack", + "raw_sensitive_live_config" + ], + "handoff_envelope_fields": [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval" + ], + "label": "Nginx / reverse proxy / public route", + "not_approval": true, + "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", + "packet_id": "high_value_config_owner_packet:nginx_public_gateway", + "priority": "P0", + "production_write_authorized": false, + "received_response": false, + "recipient_confirmed": false, + "recipient_role_or_team": "pending_owner_role_or_team", + "redacted_evidence_refs": [ + "docs/security/high-value-config-owner-packet.snapshot.json", + "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" + ], + "rejected_response": false, + "request_id": "high_value_config_owner_request:nginx_public_gateway", + "request_sent": false, + "requested_response_window": "not_scheduled", + "required_gate": "public_gateway_owner_response_required", + "required_validation": [ + "rendered_diff", + "nginx_t", + "affected_route_smoke", + "admin_route_smoke_if_affected", + "acme_path_smoke_if_affected", + "rollback_ref" + ], + "reviewer_queue_write": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sender_role_or_team": "iwooos_security_reviewer", + "stage_id": "P0-14", + "status": "draft_not_dispatched" + }, + { + "accepted_response": false, + "action_buttons_allowed": false, + "affected_files": [ + "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md", + "docs/security/high-value-config-change-gate.snapshot.json", + "scripts/security/high-value-config-change-gate.py" + ], + "allowed_response_format": { + "allowed_decisions": [ + "confirm", + "defer", + "reject", + "request_more_evidence" + ], + "fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "followup_owner", + "rollback_owner", + "maintenance_window", + "validation_plan" + ], + "redacted_evidence_refs_only": true + }, + "audit_event_emitted": false, + "blocked_requests": [ + "repo_create", + "visibility_change", + "refs_sync", + "refs_delete", + "force_push", + "workflow_modify", + "runner_enable", + "secret_value_submit", + "ssh_host_modify", + "nginx_reload", + "dns_tls_modify", + "argocd_sync", + "kubectl_apply", + "active_scan", + "agent_bounty_runtime_execute", + "payout_or_withdrawal" + ], + "category_id": "security_evidence_tooling", + "control_tier": "C3", + "followup_owner": "pending_followup_owner", + "forbidden_payloads": [ + "token", + "secret", + "private_key", + "cookie", + "session", + "authorization_header", + "runner_token", + "webhook_secret", + "db_dump", + "repo_archive", + "git_object_pack", + "raw_sensitive_live_config" + ], + "handoff_envelope_fields": [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval" + ], + "label": "Security evidence / snapshot / guard tooling", + "not_approval": true, + "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", + "packet_id": "high_value_config_owner_packet:security_evidence_tooling", + "priority": "P3", + "production_write_authorized": false, + "received_response": false, + "recipient_confirmed": false, + "recipient_role_or_team": "pending_owner_role_or_team", + "redacted_evidence_refs": [ + "docs/security/high-value-config-owner-packet.snapshot.json", + "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" + ], + "rejected_response": false, + "request_id": "high_value_config_owner_request:security_evidence_tooling", + "request_sent": false, + "requested_response_window": "not_scheduled", + "required_gate": "security_evidence_owner_review_required", + "required_validation": [ + "snapshot_parse", + "guard_smoke", + "doc_secret_sanity", + "no_runtime_gate_increase" + ], + "reviewer_queue_write": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sender_role_or_team": "iwooos_security_reviewer", + "stage_id": "P0-14", + "status": "draft_not_dispatched" + } + ], + "schema_version": "high_value_config_owner_request_draft_v1", + "send_after_conditions": [ + "必須先重新確認 gitea/main、P0 總帳與另一個 AwoooP Session 基線。", + "只能送出脫敏欄位與禁止條款，不得附 secret value、raw payload 或執行命令。", + "只有真實人工送件 metadata 存在時，才能另行記錄 request_sent_count。", + "送件後不得同步拉高 received / accepted / rejected / reviewer queue / runtime gate。" + ], + "source_intake_preflight_schema_version": "high_value_config_owner_packet_intake_preflight_v1", + "source_intake_preflight_status": "request_dispatch_preflight_ready", + "status": "owner_request_draft_ready_not_dispatched", + "summary": { + "accepted_response_count": 0, + "action_button_count": 0, + "audit_event_emitted_count": 0, + "blocked_request_count": 16, + "c0_request_draft_count": 2, + "c1_request_draft_count": 0, + "dispatch_preflight_check_count": 9, + "forbidden_payload_count": 12, + "handoff_envelope_field_count": 11, + "received_response_count": 0, + "recipient_confirmed_count": 0, + "rejected_response_count": 0, + "request_draft_count": 3, + "request_sent_count": 0, + "required_owner_field_total": 27, + "reviewer_intake_lane_count": 5, + "reviewer_queue_write_count": 0, + "runtime_gate_count": 0 + } +} diff --git a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md index c40ba9268..fc38407ec 100644 --- a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md +++ b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md @@ -688,6 +688,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator | `/zh-TW/iwooos` + `/zh-TW/awooop` 高價值配置 Owner Packet 前台同步 | 最新 owner packet snapshot 已投影到 IwoooS 與 AwoooP 前台，正式顯示 `packet=3 / c0=2`、最高命中 `C0 / P0`，並列出 Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；request sent、received、accepted、runtime gate、action buttons 仍全部為 `0`；feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；本地與正式 desktop / mobile / in-app browser smoke 已確認必要文字、boundary keys、水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0` | 這是前台 read-only projection 對齊，不是 owner request sent、owner response received / accepted、Nginx reload、certbot renew、DNS / TLS probe、workflow 修改、secret rotation、agent-bounty runtime、host write、active scan、production write 或 runtime gate | | `docs/security/iwooos-posture-projection.snapshot.json` + schema + guard | IwoooS posture projection Owner Packet 數字漂移已收斂；`high_value_config_owner_packet_count` 從 `1` 同步為 `3`，`high_value_config_owner_packet_c0_packet_count` 從 `0` 同步為 `2`，schema const 與 `security-mirror-progress-guard.py` expectation 已同步；request / received / accepted / runtime gate 仍全部為 `0` | 這是 committed evidence / schema / guard drift closure，不是前端 bundle、CD、owner request sent、owner response received / accepted、production write 或 runtime gate | | `docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json` + `scripts/security/high-value-config-owner-packet-intake-preflight.py` | 高價值配置 Owner Packet 收件預檢已本地完成；承接 `packet=3 / c0=2` owner packet snapshot，固定 9 項 request dispatch preflight、5 條 reviewer intake lane、27 個 required owner fields 與 16 類 blocked request；`security-mirror-progress-guard.py` 已鎖住 schema、summary、false flags、packet ids、check ids 與 lane ids；request sent、received、accepted、rejected、reviewer queue write、runtime gate、action buttons 仍全部為 `0` | 這是 request dispatch 前只讀 artifact，不是 owner request sent、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate | +| `docs/security/high-value-config-owner-request-draft.snapshot.json` + `scripts/security/high-value-config-owner-request-draft.py` | 高價值配置 Owner Request 草稿包已本地完成；承接收件預檢 snapshot，固定 3 份 request draft、2 份 C0 request draft、11 欄 handoff envelope、27 個 required owner fields、12 類 forbidden payload 與 16 類 blocked request；`security-mirror-progress-guard.py` 已鎖住 schema、summary、false flags、request ids、handoff fields 與每份草稿 false flags；request sent、recipient confirmed、audit event emitted、received、accepted、rejected、reviewer queue write、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft 與 handoff envelope，不是 request sent、recipient confirmed、audit event emitted、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate | | `docs/evaluations/ai_agent_live_read_model_gate_2026-06-11.json` + `GET /api/v1/agents/agent-live-read-model-gate` | P2-403B AgentSession / Redis Streams live read model gate；定義 safe fields、Redis envelope、worker gate、rollback plan 與 no-write smoke，不連 DB、不讀寫 Redis、不啟動 worker | #### 3.2.1c 2026-06-11 AI Agent 主動營運委派與版本生命週期契約 @@ -827,6 +828,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence 69. 同步高價值配置 Owner Packet 前台 projection。✅ 已完成並正式驗證；`/zh-TW/iwooos` 與 `/zh-TW/awooop` 已顯示 owner packet snapshot `packet=3 / c0=2`、最高命中 `C0 / P0`、Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；request sent、received、accepted、runtime gate 與 action buttons 仍為 `0`；本地與正式 desktop / mobile / in-app browser smoke 已通過，水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0`。不得因此調高 IwoooS headline。 70. 收斂 IwoooS posture projection Owner Packet 數字漂移。✅ 本地完成；`iwooos-posture-projection.snapshot.json`、`iwooos_posture_projection_v1.schema.json` 與 `security-mirror-progress-guard.py` 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；request sent、received、accepted 與 runtime gate 仍全部為 `0`。這不是前端 bundle、CD、owner response accepted、production write 或 runtime gate，下一步回到高價值配置 owner response request dispatch / reviewer intake。 71. 建立高價值配置 Owner Packet 收件預檢與 reviewer intake。✅ 本地完成；新增 `high-value-config-owner-packet-intake-preflight.py`、snapshot 與說明文件，將三包 owner packet 轉成 `dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16` 的只讀預檢；`security-mirror-progress-guard.py` 已固定 schema、summary、false flags、packet ids、check ids 與 lane ids；request sent、received、accepted、rejected、reviewer queue write、runtime gate、action buttons 仍全部為 `0`。這不是 owner request sent、owner response received / accepted、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate。 +72. 建立高價值配置 Owner Request 草稿包與 dispatch handoff。✅ 本地完成；新增 `high-value-config-owner-request-draft.py`、snapshot 與說明文件，將三包收件預檢轉成 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12` 的人工送件前草稿包；`security-mirror-progress-guard.py` 已固定 schema、summary、false flags、request ids、handoff fields 與每份草稿 false flags；request sent、recipient confirmed、audit event emitted、received、accepted、rejected、reviewer queue write、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate。 #### 3.2.1d 2026-06-11 Agent 互動、學習與成長證據面 @@ -4699,3 +4701,16 @@ Trigger commit `f5cd37b7` 與 deploy marker `0ba92357` 已把 governance UI 的 - P0 總帳、供應鏈進度與 MASTER artifact 表已同步 P0-13。 **裁決：** 這是 request dispatch 前的只讀預檢與 reviewer intake artifact，不是 request sent、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 + +### 2026-06-14 18:45 (台北) — §3.2 / §5 — 新增高價值配置 Owner Request 草稿包 — 把三包預檢轉成送件前 handoff envelope + +**觸發**：高價值配置 Owner Packet 收件預檢已固定 `checks=9 / lanes=5`；下一步需要把可送件內容整理成三份 request draft，但仍不得真的送件或建立 audit event。 + +**已推進：** +- 新增 `scripts/security/high-value-config-owner-request-draft.py`，讀取 `high-value-config-owner-packet-intake-preflight.snapshot.json`，產生人工送件前草稿包。 +- 新增 `docs/security/high-value-config-owner-request-draft.snapshot.json`，固定 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`、`request_sent_count=0`。 +- 新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md`，說明 handoff envelope、三包草稿、送後不變條件與完成度。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、request ids、handoff fields 與每份草稿 false flags。 +- P0 總帳、供應鏈進度、Owner Packet 主文件、收件預檢文件與 MASTER artifact 表已同步 P0-14。 + +**裁決：** 這是人工送件前的 request draft 與 handoff envelope，不是 request sent、recipient confirmed、audit event emitted、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index 80f42b1ae..0086fd4c2 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -78,6 +78,7 @@ | P0-11 | 高價值配置 Owner Packet 前台同步 | local 100%；production 100% | `/zh-TW/iwooos` 與 `/zh-TW/awooop` 已同步 latest owner packet snapshot，顯示 `packet=3 / c0=2`、Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；request sent、received、accepted、runtime gate 與 action buttons 仍全部為 `0` | Feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；本地與正式 desktop / mobile / in-app browser smoke：IwoooS 與 AwoooP 均 HTTP `200`、必要文字與 boundary keys 可見、水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0`；headline 不提高 | | P0-12 | IwoooS posture projection Owner Packet count sync | 100% | `iwooos-posture-projection.snapshot.json` 與 schema 已從舊 `packet=1 / c0=0` 同步為 `packet=3 / c0=2`，避免 committed projection 與前台 / owner packet snapshot 分叉；request / received / accepted / runtime gate 仍為 `0` | `security-mirror-progress-guard.py` expectation 已同步；後續驗證以 JSON parse、schema parse、progress guard、owner response guard、doc secret sanity、diff check 為準；不需要 production browser smoke | | P0-13 | 高價值配置 Owner Packet 收件預檢 / reviewer intake | 100% | 已新增 `high-value-config-owner-packet-intake-preflight.py`、snapshot 與文件，把三包 owner packet 轉成送件前 9 項預檢、5 條 reviewer intake lane、27 個 required owner fields 與 16 類 blocked request；request sent、received、accepted、rejected、reviewer queue write、runtime gate、action button 仍全部為 `0` | `HIGH_VALUE_CONFIG_OWNER_PACKET_INTAKE_PREFLIGHT_OK packets=3 c0=2 checks=9 lanes=5 runtime_gate=0`；progress guard 已固定 snapshot schema、summary、false flags、packet ids、check ids 與 lane ids；純 repo 內文件 / snapshot / guard，不需要 production browser smoke | +| P0-14 | 高價值配置 Owner Request 草稿包 / dispatch handoff | 100% | 已新增 `high-value-config-owner-request-draft.py`、snapshot 與文件，把三包預檢轉成 3 份 request draft、11 欄 handoff envelope、27 個 required owner fields、12 類 forbidden payload 與 16 類 blocked request；request sent、recipient confirmed、audit event、received、accepted、runtime gate 仍全部為 `0` | `HIGH_VALUE_CONFIG_OWNER_REQUEST_DRAFT_OK drafts=3 c0=2 fields=27 sent=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、request ids、handoff fields 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke | ## 3. S4.9 Owner Response Gate 規範 diff --git a/scripts/security/high-value-config-owner-request-draft.py b/scripts/security/high-value-config-owner-request-draft.py new file mode 100644 index 000000000..f29d71db7 --- /dev/null +++ b/scripts/security/high-value-config-owner-request-draft.py @@ -0,0 +1,232 @@ +#!/usr/bin/env python3 +""" +IwoooS 高價值配置 owner request 草稿包產生器。 + +本工具讀取 owner packet intake preflight snapshot，產生可人工送件前核對 +的 request draft 與 handoff envelope。它不送件、不確認收件人、不建立 +audit event、不寫 reviewer queue、不開 runtime gate。 +""" + +from __future__ import annotations + +import argparse +import json +import subprocess +import sys +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + +HANDOFF_ENVELOPE_FIELDS = [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval", +] + +FORBIDDEN_PAYLOADS = [ + "token", + "secret", + "private_key", + "cookie", + "session", + "authorization_header", + "runner_token", + "webhook_secret", + "db_dump", + "repo_archive", + "git_object_pack", + "raw_sensitive_live_config", +] + +NOT_APPROVAL_STATEMENT = ( + "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、" + "不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、" + "production write 或 runtime gate 授權。" +) + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def load_json(path: Path) -> dict[str, Any]: + return json.loads(path.read_text(encoding="utf-8")) + + +def request_id_for(packet: dict[str, Any]) -> str: + return packet["packet_id"].replace("high_value_config_owner_packet:", "high_value_config_owner_request:") + + +def request_draft(packet: dict[str, Any], intake_report: dict[str, Any]) -> dict[str, Any]: + request_id = request_id_for(packet) + return { + "request_id": request_id, + "status": "draft_not_dispatched", + "stage_id": "P0-14", + "packet_id": packet["packet_id"], + "category_id": packet["category_id"], + "label": packet["label"], + "priority": packet["priority"], + "control_tier": packet["control_tier"], + "required_gate": packet["required_gate"], + "recipient_role_or_team": "pending_owner_role_or_team", + "sender_role_or_team": "iwooos_security_reviewer", + "requested_response_window": "not_scheduled", + "allowed_response_format": { + "fields": packet["required_owner_fields"], + "allowed_decisions": intake_report.get("allowed_decisions", []), + "redacted_evidence_refs_only": True, + }, + "redacted_evidence_refs": [ + "docs/security/high-value-config-owner-packet.snapshot.json", + "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json", + ], + "affected_files": packet.get("affected_files", []), + "required_validation": packet.get("required_validation", []), + "forbidden_payloads": FORBIDDEN_PAYLOADS, + "blocked_requests": intake_report.get("blocked_requests", []), + "handoff_envelope_fields": HANDOFF_ENVELOPE_FIELDS, + "followup_owner": "pending_followup_owner", + "not_approval": True, + "not_approval_statement": NOT_APPROVAL_STATEMENT, + "request_sent": False, + "recipient_confirmed": False, + "audit_event_emitted": False, + "received_response": False, + "accepted_response": False, + "rejected_response": False, + "reviewer_queue_write": False, + "runtime_gate": False, + "action_buttons_allowed": False, + "secret_value_collection_allowed": False, + "production_write_authorized": False, + } + + +def build_report(root: Path, intake_report: dict[str, Any], generated_at: str | None) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + intake_packets = intake_report.get("intake_packets", []) + drafts = [request_draft(packet, intake_report) for packet in intake_packets] + c0_drafts = [draft for draft in drafts if draft.get("control_tier") == "C0"] + c1_drafts = [draft for draft in drafts if draft.get("control_tier") == "C1"] + required_owner_field_total = sum(len(draft["allowed_response_format"]["fields"]) for draft in drafts) + + return { + "schema_version": "high_value_config_owner_request_draft_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "source_intake_preflight_schema_version": intake_report.get("schema_version"), + "source_intake_preflight_status": intake_report.get("status"), + "status": "owner_request_draft_ready_not_dispatched", + "summary": { + "request_draft_count": len(drafts), + "c0_request_draft_count": len(c0_drafts), + "c1_request_draft_count": len(c1_drafts), + "dispatch_preflight_check_count": intake_report.get("summary", {}).get( + "dispatch_preflight_check_count", 0 + ), + "reviewer_intake_lane_count": intake_report.get("summary", {}).get("reviewer_intake_lane_count", 0), + "handoff_envelope_field_count": len(HANDOFF_ENVELOPE_FIELDS), + "required_owner_field_total": required_owner_field_total, + "forbidden_payload_count": len(FORBIDDEN_PAYLOADS), + "blocked_request_count": len(intake_report.get("blocked_requests", [])), + "request_sent_count": 0, + "recipient_confirmed_count": 0, + "audit_event_emitted_count": 0, + "received_response_count": 0, + "accepted_response_count": 0, + "rejected_response_count": 0, + "reviewer_queue_write_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + }, + "execution_boundaries": { + "dispatch_authorized": False, + "request_sent": False, + "recipient_confirmed": False, + "audit_event_emitted": False, + "reviewer_queue_write": False, + "runtime_execution_authorized": False, + "secret_value_collection_allowed": False, + "production_write_authorized": False, + "host_write_authorized": False, + "nginx_reload_authorized": False, + "dns_tls_change_authorized": False, + "workflow_modification_authorized": False, + "active_scan_authorized": False, + "action_buttons_allowed": False, + "not_authorization": True, + }, + "handoff_envelope_fields": HANDOFF_ENVELOPE_FIELDS, + "forbidden_payloads": FORBIDDEN_PAYLOADS, + "not_approval_statement": NOT_APPROVAL_STATEMENT, + "request_drafts": drafts, + "send_after_conditions": [ + "必須先重新確認 gitea/main、P0 總帳與另一個 AwoooP Session 基線。", + "只能送出脫敏欄位與禁止條款，不得附 secret value、raw payload 或執行命令。", + "只有真實人工送件 metadata 存在時，才能另行記錄 request_sent_count。", + "送件後不得同步拉高 received / accepted / rejected / reviewer queue / runtime gate。", + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser(description="IwoooS 高價值配置 owner request 草稿包產生器") + parser.add_argument("--root", default=".", help="repo root") + parser.add_argument( + "--intake-preflight-report", + default="docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json", + help="high-value-config-owner-packet-intake-preflight.py 輸出的 JSON", + ) + parser.add_argument("--output", help="寫出 JSON 報告") + parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") + args = parser.parse_args() + + root = Path(args.root).resolve() + intake_report = load_json(root / args.intake_preflight_report) + report = build_report(root, intake_report, args.generated_at) + payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + + if args.output: + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(payload + "\n", encoding="utf-8") + else: + print(payload) + + summary = report["summary"] + print( + "HIGH_VALUE_CONFIG_OWNER_REQUEST_DRAFT_OK " + f"drafts={summary['request_draft_count']} " + f"c0={summary['c0_request_draft_count']} " + f"fields={summary['required_owner_field_total']} " + f"sent={summary['request_sent_count']} " + f"runtime_gate={summary['runtime_gate_count']}", + file=sys.stderr, + ) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index 68b12a3ac..855bdf34b 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -91,6 +91,9 @@ def validate(root: Path) -> None: high_value_config_owner_packet_intake = load_json( security_dir / "high-value-config-owner-packet-intake-preflight.snapshot.json" ) + high_value_config_owner_request_draft = load_json( + security_dir / "high-value-config-owner-request-draft.snapshot.json" + ) host_service_config_inventory = load_json(security_dir / "host-service-config-inventory.snapshot.json") ssh_network_access_inventory = load_json(security_dir / "ssh-network-access-inventory.snapshot.json") backup_restore_escrow_inventory = load_json(security_dir / "backup-restore-escrow-inventory.snapshot.json") @@ -3588,6 +3591,136 @@ def validate(root: Path) -> None: f"high_value_config_owner_packet_intake.{packet['packet_id']}.{false_key}", packet[false_key], ) + assert_equal( + "high_value_config_owner_request_draft.schema_version", + high_value_config_owner_request_draft["schema_version"], + "high_value_config_owner_request_draft_v1", + ) + assert_equal( + "high_value_config_owner_request_draft.source_intake_preflight_schema_version", + high_value_config_owner_request_draft["source_intake_preflight_schema_version"], + "high_value_config_owner_packet_intake_preflight_v1", + ) + assert_equal( + "high_value_config_owner_request_draft.status", + high_value_config_owner_request_draft["status"], + "owner_request_draft_ready_not_dispatched", + ) + expected_high_value_config_owner_request_draft_summary = { + "request_draft_count": 3, + "c0_request_draft_count": 2, + "c1_request_draft_count": 0, + "dispatch_preflight_check_count": 9, + "reviewer_intake_lane_count": 5, + "handoff_envelope_field_count": 11, + "required_owner_field_total": 27, + "forbidden_payload_count": 12, + "blocked_request_count": 16, + "request_sent_count": 0, + "recipient_confirmed_count": 0, + "audit_event_emitted_count": 0, + "received_response_count": 0, + "accepted_response_count": 0, + "rejected_response_count": 0, + "reviewer_queue_write_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + } + for key, expected in expected_high_value_config_owner_request_draft_summary.items(): + assert_equal( + f"high_value_config_owner_request_draft.summary.{key}", + high_value_config_owner_request_draft["summary"][key], + expected, + ) + for false_key in [ + "dispatch_authorized", + "request_sent", + "recipient_confirmed", + "audit_event_emitted", + "reviewer_queue_write", + "runtime_execution_authorized", + "secret_value_collection_allowed", + "production_write_authorized", + "host_write_authorized", + "nginx_reload_authorized", + "dns_tls_change_authorized", + "workflow_modification_authorized", + "active_scan_authorized", + "action_buttons_allowed", + ]: + assert_false( + f"high_value_config_owner_request_draft.execution_boundaries.{false_key}", + high_value_config_owner_request_draft["execution_boundaries"][false_key], + ) + assert_true( + "high_value_config_owner_request_draft.execution_boundaries.not_authorization", + high_value_config_owner_request_draft["execution_boundaries"]["not_authorization"], + ) + expected_high_value_config_owner_request_draft_ids = [ + "high_value_config_owner_request:dns_tls_certbot", + "high_value_config_owner_request:nginx_public_gateway", + "high_value_config_owner_request:security_evidence_tooling", + ] + assert_equal( + "high_value_config_owner_request_draft.request_ids", + [item["request_id"] for item in high_value_config_owner_request_draft["request_drafts"]], + expected_high_value_config_owner_request_draft_ids, + ) + expected_high_value_config_owner_request_handoff_fields = [ + "request_id", + "stage_id", + "packet_id", + "recipient_role_or_team", + "sender_role_or_team", + "requested_response_window", + "allowed_response_format", + "redacted_evidence_refs", + "forbidden_payloads", + "followup_owner", + "not_approval", + ] + assert_equal( + "high_value_config_owner_request_draft.handoff_envelope_fields", + high_value_config_owner_request_draft["handoff_envelope_fields"], + expected_high_value_config_owner_request_handoff_fields, + ) + for draft in high_value_config_owner_request_draft["request_drafts"]: + assert_equal( + f"high_value_config_owner_request_draft.{draft['request_id']}.stage_id", + draft["stage_id"], + "P0-14", + ) + assert_equal( + f"high_value_config_owner_request_draft.{draft['request_id']}.status", + draft["status"], + "draft_not_dispatched", + ) + assert_equal( + f"high_value_config_owner_request_draft.{draft['request_id']}.response_field_count", + len(draft["allowed_response_format"]["fields"]), + 9, + ) + assert_true( + f"high_value_config_owner_request_draft.{draft['request_id']}.not_approval", + draft["not_approval"], + ) + for false_key in [ + "request_sent", + "recipient_confirmed", + "audit_event_emitted", + "received_response", + "accepted_response", + "rejected_response", + "reviewer_queue_write", + "runtime_gate", + "action_buttons_allowed", + "secret_value_collection_allowed", + "production_write_authorized", + ]: + assert_false( + f"high_value_config_owner_request_draft.{draft['request_id']}.{false_key}", + draft[false_key], + ) expected_iwooos_surface_ids = [ "security_compliance", "legacy_security",