wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(web): add IwoooS queue review checklist

Browse Source
This commit is contained in:
Your Name
2026-05-20 10:02:22 +08:00
parent 9f740bb0a1
commit 0b8514ef8d
11 changed files with 608 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/security/IWOOOS-POSTURE-PROJECTION.md
View File

@@ -63,6 +63,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
31. 7 個 host owner decision record formal candidate review checklist items，顯示 formal candidate packets 進入後續人工紀錄前仍需只讀核對的條件。
32. 8 個 host owner decision record formal candidate review outcome lanes，顯示 candidate review 後的只讀結果分流與下一步。
33. 8 個 host owner decision record formal record queue packets，顯示人工正式紀錄佇列需要看的資料包，但不 enqueue、不建立 decision record、不開 runtime gate。
34. 8 個 host owner decision record formal record queue review checklist items，顯示佇列資料包進人工正式紀錄審查前仍需只讀核對的條件。
## 3.1 既有前端資安頁面整合
@@ -520,6 +521,25 @@ S2.35 將 ready for human record queue 後的人工正式紀錄佇列資料拆
這個 queue packet board 不代表正式紀錄佇列已 enqueue、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把人工正式紀錄佇列需要看的資料包顯示出來，避免把佇列可讀性誤解成執行授權。
## 3.27 Host Owner Decision Record Formal Record Queue Review Checklist
S2.36 將 formal record queue packets 後的人工正式紀錄佇列核對拆成八個只讀 checklist items。這一層只回答「佇列資料包是否可供未來人工正式紀錄審查」，不標記 review passed、不 enqueue、不建立 decision record、不建立 approval record、不開 runtime gate。
| 順序 | Queue review check | 來源 packet | 保護邊界 |
|------|--------------------|-------------|----------|
| 1 | Queue identity traceable | Queue identity packet | trace only；queue enqueued=0 |
| 2 | Queue decision summary readable | Queue decision summary packet | summary only；record created=false |
| 3 | Queue scope and expiry fresh | Queue scope and expiry packet | scope check only；finalized=0 |
| 4 | Queue scan limits not authorization | Queue scan limits packet | scan authorized=false |
| 5 | Queue credential boundary metadata-only | Queue credential boundary packet | secret collection=false |
| 6 | Queue maintenance and rollback linked | Queue maintenance and rollback packet | host change=false |
| 7 | Queue validation gate separate | Queue validation and runtime gate packet | active gates=0 |
| 8 | Queue no-execution attestation present | Queue no-execution attestation packet | action buttons=false |
每個 queue review check 都固定 `display_mode=owner_decision_record_formal_record_queue_review_checklist_only`、`formal_record_queue_review_passed_count=0`、`formal_record_queue_enqueued_count=0`、`decision_record_created=false`、`owner_decision_received_count=0`、`owner_decision_accepted_count=0`、`owner_approval_record_created=false`、`runtime_gate_opened=false`、`raw_payload_allowed=false`、`secret_value_collection_allowed=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
這個 queue review checklist 不代表正式紀錄佇列核對已通過、正式紀錄已 enqueue、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把佇列資料包進人工正式紀錄前的核對條件顯示出來，避免把 checklist 可見性誤解成執行授權。
## 4. 仍禁止
IwoooS 不得提供下列輸出：
@@ -552,7 +572,8 @@ IwoooS 不得提供下列輸出：
26. 把 owner decision record formal candidate review 當成 approval、標記 formal candidate review passed / finalized、從 formal candidate review 建立 decision record，或從 formal candidate review 開 runtime gate。
27. 把 owner decision record formal candidate review outcome 當成 approval、標記 formal candidate review outcome passed / finalized、從 formal candidate review outcome 建立 decision record，或從 formal candidate review outcome 開 runtime gate。
28. 把 owner decision record formal record queue packet 當成 approval、由前端 enqueue formal record queue、從 formal record queue packet 建立或接受 decision record，或從 formal record queue packet 開 runtime gate。
29. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
29. 把 owner decision record formal record queue review checklist 當成 approval、標記 queue review passed、由 queue review enqueue 或建立 decision record，或從 queue review 開 runtime gate。
30. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
## 5. 驗證