From 0b01d6e385bfdda102fc386ee42bff62e8a3b05f Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 19 May 2026 23:06:21 +0800 Subject: [PATCH] feat(web): add IwoooS owner decision candidates --- apps/web/messages/en.json | 43 +++++ apps/web/messages/zh-TW.json | 43 +++++ apps/web/src/app/[locale]/iwooos/page.tsx | 65 ++++++++ docs/LOGBOOK.md | 14 ++ .../iwooos_posture_projection_v1.schema.json | 91 +++++++++++ docs/security/IWOOOS-POSTURE-PROJECTION.md | 22 ++- .../security/SECURITY-MIRROR-STATUS-ROLLUP.md | 3 +- .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 4 +- .../iwooos-posture-projection.snapshot.json | 150 +++++++++++++++++- ...ecurity-mirror-status-rollup.snapshot.json | 10 ++ .../security-mirror-progress-guard.py | 88 ++++++++++ 11 files changed, 527 insertions(+), 6 deletions(-) diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 624a10cee..2b9fd3cf5 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -1629,6 +1629,49 @@ "next": "active runtime gates=0; action buttons=false" } } + }, + "hostOwnerDecisionCandidates": { + "title": "Host Owner Decision Candidate Packets", + "subtitle": "After reviewer outcome reaches the owner-decision candidate lane, IwoooS only displays the human decision packets. It does not create decision records, mark approval, or open runtime gates.", + "packetLabel": "Candidate packet", + "decisionLabel": "Human decision scope", + "items": { + "scopeApprovalCandidate": { + "title": "Scope approval candidate", + "body": "Confirm hosts, networks, services, exclusions, and observation purpose are readable for the owner.", + "decision": "display scope candidate only; owner decision received=0" + }, + "scanModeCandidate": { + "title": "Scan mode candidate", + "body": "Separate observe-only, future active scan, and credentialed scan modes so the candidate packet is not mistaken for scan approval.", + "decision": "display mode options only; active scan=false" + }, + "credentialHandlingCandidate": { + "title": "Credential handling candidate", + "body": "Describe metadata-only handling, accountable owner, and retention boundary without requesting or storing sensitive material.", + "decision": "display handling principle only; collection=false" + }, + "maintenanceWindowCandidate": { + "title": "Maintenance window candidate", + "body": "If later host update or tuning is involved, display candidate maintenance window and constraints first.", + "decision": "display time window only; host update=false" + }, + "rollbackOwnerCandidate": { + "title": "Rollback owner candidate", + "body": "Display future rollback owner, recovery route, and human contact point so accountability is clear before any change.", + "decision": "display owner pointer only; change=false" + }, + "validationMetricsCandidate": { + "title": "Validation metrics candidate", + "body": "List future post-check metrics, baselines, and review evidence pointers as material for later human gate evaluation.", + "decision": "display validation items only; runtime gate=false" + }, + "runtimeGateCandidate": { + "title": "Runtime gate candidate", + "body": "Any later host action still requires a separate runtime gate and cannot execute from an owner-decision candidate.", + "decision": "display gate candidate only; action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index a97aa9b78..4e1f8daf8 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -1630,6 +1630,49 @@ "next": "active runtime gates=0；action buttons=false" } } + }, + "hostOwnerDecisionCandidates": { + "title": "主機 Owner Decision Candidate Packets", + "subtitle": "Reviewer outcome 進到 owner decision 候選後，IwoooS 只顯示需要人工判讀的決策包。不建立 decision record、不標示 approved、不開 runtime gate。", + "packetLabel": "候選包", + "decisionLabel": "人工決策範圍", + "items": { + "scopeApprovalCandidate": { + "title": "Scope approval candidate", + "body": "確認主機、網段、服務、排除範圍與觀察目的都能被 owner 讀懂。", + "decision": "只顯示 scope 候選；owner decision received=0" + }, + "scanModeCandidate": { + "title": "Scan mode candidate", + "body": "把 observe-only、未來 active scan 或 credentialed scan 的差異拆清楚，避免候選包被誤認為掃描授權。", + "decision": "只顯示模式選項；active scan=false" + }, + "credentialHandlingCandidate": { + "title": "Credential handling candidate", + "body": "只描述 metadata-only handling、責任人與保存邊界，不要求或保存敏感素材。", + "decision": "只顯示處理原則；collection=false" + }, + "maintenanceWindowCandidate": { + "title": "Maintenance window candidate", + "body": "若未來涉及主機更新或調校，先顯示候選維護窗口與限制條件。", + "decision": "只顯示時間範圍；host update=false" + }, + "rollbackOwnerCandidate": { + "title": "Rollback owner candidate", + "body": "顯示未來 rollback owner、復原路徑與人工聯絡點，避免變更前缺少責任邊界。", + "decision": "只顯示 owner pointer；change=false" + }, + "validationMetricsCandidate": { + "title": "Validation metrics candidate", + "body": "列出未來 post-check metrics、baseline 與回看 evidence pointer，作為後續 gate 的人工判讀素材。", + "decision": "只顯示驗證項目；runtime gate=false" + }, + "runtimeGateCandidate": { + "title": "Runtime gate candidate", + "body": "任何後續主機動作仍需獨立 runtime gate，不能由 owner decision candidate 直接執行。", + "decision": "只顯示 gate 候選；action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 3059dee0c..63fd3ab48 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -137,6 +137,13 @@ type HostEvidenceReviewerOutcomeLane = { tone: 'steady' | 'warn' | 'locked' } +type HostOwnerDecisionCandidatePacket = { + key: string + packet: string + icon: typeof ShieldCheck + tone: 'steady' | 'warn' | 'locked' +} + const postureMetrics: PostureMetric[] = [ { key: 'overall', value: '58%', tone: 'warn' }, { key: 'framework', value: '80-85%', tone: 'steady' }, @@ -318,6 +325,16 @@ const hostEvidenceReviewerOutcomeLanes: HostEvidenceReviewerOutcomeLane[] = [ { key: 'runtimeGateRequired', lane: 'O7', icon: FileWarning, tone: 'locked' }, ] +const hostOwnerDecisionCandidatePackets: HostOwnerDecisionCandidatePacket[] = [ + { key: 'scopeApprovalCandidate', packet: 'D1', icon: Radar, tone: 'warn' }, + { key: 'scanModeCandidate', packet: 'D2', icon: Activity, tone: 'locked' }, + { key: 'credentialHandlingCandidate', packet: 'D3', icon: Lock, tone: 'locked' }, + { key: 'maintenanceWindowCandidate', packet: 'D4', icon: Clock3, tone: 'warn' }, + { key: 'rollbackOwnerCandidate', packet: 'D5', icon: FileWarning, tone: 'warn' }, + { key: 'validationMetricsCandidate', packet: 'D6', icon: CheckCircle2, tone: 'warn' }, + { key: 'runtimeGateCandidate', packet: 'D7', icon: ShieldCheck, tone: 'locked' }, +] + const evidenceItems = [ 'iwooos-posture-projection.snapshot.json', 'security-rollout-policy.snapshot.json', @@ -816,6 +833,34 @@ function HostEvidenceReviewerOutcomeCard({ item }: { item: HostEvidenceReviewerO ) } +function HostOwnerDecisionCandidateCard({ item }: { item: HostOwnerDecisionCandidatePacket }) { + const t = useTranslations('iwooos.hostOwnerDecisionCandidates') + const Icon = item.icon + return ( +
+
+
+ + {t('packetLabel')} +
+ {item.packet} +
+

+ {t(`items.${item.key}.title` as never)} +

+

+ {t(`items.${item.key}.body` as never)} +

+
+
{t('decisionLabel')}
+
+ {t(`items.${item.key}.decision` as never)} +
+
+
+ ) +} + export default function IwoooSPage({ params }: { params: { locale: string } }) { const t = useTranslations('iwooos') @@ -1068,6 +1113,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) { +
+
+

{t('hostOwnerDecisionCandidates.title')}

+

+ {t('hostOwnerDecisionCandidates.subtitle')} +

+
+
+ {hostOwnerDecisionCandidatePackets.map(item => ( + + ))} +
+
+
None: "s2_20_iwooos_host_evidence_review_handoff_packets", "s2_21_iwooos_host_evidence_reviewer_checklist", "s2_22_iwooos_host_evidence_reviewer_outcome_lanes", + "s2_23_iwooos_host_owner_decision_candidate_packets", ] assert_equal( "progress_delta_ledger.delta_ids", @@ -418,6 +419,15 @@ def validate(root: Path) -> None: "host_rollback_missing_outcome_lane", "host_runtime_gate_required_outcome_lane", ] + expected_iwooos_host_owner_decision_candidate_packet_ids = [ + "host_scope_approval_candidate_packet", + "host_scan_mode_candidate_packet", + "host_credential_handling_candidate_packet", + "host_maintenance_window_candidate_packet", + "host_rollback_owner_candidate_packet", + "host_validation_metrics_candidate_packet", + "host_runtime_gate_candidate_packet", + ] assert_equal( "iwooos_projection.summary.frontend_surface_coverage_group_count", iwooos_projection["summary"]["frontend_surface_coverage_group_count"], @@ -483,6 +493,11 @@ def validate(root: Path) -> None: iwooos_projection["summary"]["host_evidence_reviewer_outcome_lane_count"], len(expected_iwooos_host_evidence_reviewer_outcome_lane_ids), ) + assert_equal( + "iwooos_projection.summary.host_owner_decision_candidate_packet_count", + iwooos_projection["summary"]["host_owner_decision_candidate_packet_count"], + len(expected_iwooos_host_owner_decision_candidate_packet_ids), + ) iwooos_progress = iwooos_projection["progress"] assert_equal("iwooos_projection.progress.overall_percent", iwooos_progress["overall_percent"], progress["overall_percent"]) assert_equal( @@ -1215,6 +1230,75 @@ def validate(root: Path) -> None: f"iwooos_projection.host_evidence_reviewer_outcome_lanes.{item['lane_id']}.not_authorization", item["not_authorization"], ) + iwooos_host_owner_decision_candidate_packets = iwooos_projection["host_owner_decision_candidate_packets"] + assert_equal( + "iwooos_projection.host_owner_decision_candidate_packets.ids", + [item["packet_id"] for item in iwooos_host_owner_decision_candidate_packets], + expected_iwooos_host_owner_decision_candidate_packet_ids, + ) + assert_equal( + "iwooos_projection.host_owner_decision_candidate_packets.display_order", + [item["display_order"] for item in iwooos_host_owner_decision_candidate_packets], + list(range(1, len(expected_iwooos_host_owner_decision_candidate_packet_ids) + 1)), + ) + expected_iwooos_host_owner_decision_scopes = [ + "scope_boundary_hosts_networks_services_exclusions", + "observe_only_future_active_or_credentialed_scan_mode", + "metadata_only_credential_handling_boundary", + "future_maintenance_window_constraints", + "rollback_owner_and_recovery_path", + "post_check_metrics_and_baseline_pointer", + "separate_runtime_gate_requirement", + ] + assert_equal( + "iwooos_projection.host_owner_decision_candidate_packets.decision_scopes", + [item["decision_scope"] for item in iwooos_host_owner_decision_candidate_packets], + expected_iwooos_host_owner_decision_scopes, + ) + for item in iwooos_host_owner_decision_candidate_packets: + assert_equal( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.display_mode", + item["display_mode"], + "owner_decision_candidate_only", + ) + assert_equal( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.owner_decision_received_count", + item["owner_decision_received_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.owner_decision_accepted_count", + item["owner_decision_accepted_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.owner_approval_record_created", + item["owner_approval_record_created"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.runtime_gate_opened", + item["runtime_gate_opened"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.raw_payload_allowed", + item["raw_payload_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.secret_value_collection_allowed", + item["secret_value_collection_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.runtime_execution_authorized", + item["runtime_execution_authorized"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.action_buttons_allowed", + item["action_buttons_allowed"], + ) + assert_true( + f"iwooos_projection.host_owner_decision_candidate_packets.{item['packet_id']}.not_authorization", + item["not_authorization"], + ) assert_equal( "iwooos_projection.non_blocking_lane_ids", iwooos_projection["non_blocking_lane_ids"], @@ -1246,6 +1330,7 @@ def validate(root: Path) -> None: "display_host_evidence_review_handoff_packets", "display_host_evidence_reviewer_checklist", "display_host_evidence_reviewer_outcome_lanes", + "display_host_owner_decision_candidate_packets", "display_evidence_refs", "display_forbidden_actions", ]: @@ -1287,6 +1372,9 @@ def validate(root: Path) -> None: "treat_host_reviewer_outcome_as_approval", "mark_host_reviewer_outcome_passed", "open_runtime_gate_from_reviewer_outcome", + "treat_host_owner_decision_candidate_as_approval", + "mark_host_owner_decision_approved", + "open_runtime_gate_from_owner_decision_candidate", "apply_runtime_blocking_control", "switch_github_primary", "production_deploy",