wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add owner response reviewer checklist

Browse Source
This commit is contained in:
Your Name
2026-05-19 10:37:16 +08:00
parent 2774bf8708
commit 0c04d46dfb
19 changed files with 315 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
scripts/security/source-control-owner-response-guard.py
View File

@@ -297,6 +297,18 @@ EXPECTED_ROLLUP_STATE_TRANSITION_RULES = [
"transition-post-update-stays-waiting-runtime-gate",
]
EXPECTED_ROLLUP_REVIEWER_CHECKLIST = [
"checklist-confirm-lane-and-template",
"checklist-confirm-required-owner-fields",
"checklist-confirm-redacted-evidence-refs",
"checklist-confirm-source-packet-preflight",
"checklist-confirm-cross-packet-consistency",
"checklist-confirm-no-sensitive-payload",
"checklist-confirm-no-execution-intent",
"checklist-confirm-read-only-update-scope",
"checklist-confirm-followup-runtime-gate-still-required",
]
def load_json(path: Path) -> dict[str, Any]:
return json.loads(path.read_text(encoding="utf-8"))
@@ -349,6 +361,11 @@ def validate(root: Path) -> None:
rollup_summary["owner_response_validation_state_transition_rule_count"],
len(EXPECTED_ROLLUP_STATE_TRANSITION_RULES),
)
assert_equal(
"rollup.owner_response_validation_reviewer_checklist_count",
rollup_summary["owner_response_validation_reviewer_checklist_count"],
len(EXPECTED_ROLLUP_REVIEWER_CHECKLIST),
)
assert_true("rollup.quarantine_required", rollup_summary["quarantine_required"])
assert_equal("rollup.primary_ready_count", rollup_summary["primary_ready_count"], 0)
@@ -774,6 +791,29 @@ def validate(root: Path) -> None:
item["execution_authorized"],
)
reviewer_checklist = rollup["owner_response_validation_reviewer_checklist"]
assert_equal(
"owner_response_validation_reviewer_checklist.ids",
[item["checklist_id"] for item in reviewer_checklist],
EXPECTED_ROLLUP_REVIEWER_CHECKLIST,
)
assert_equal(
"owner_response_validation_reviewer_checklist.display_order",
[item["display_order"] for item in reviewer_checklist],
list(range(1, len(EXPECTED_ROLLUP_REVIEWER_CHECKLIST) + 1)),
)
for item in reviewer_checklist:
assert_equal(
f"owner_response_validation_reviewer_checklist.{item['checklist_id']}.awooop_display_mode",
item["awooop_display_mode"],
"display_reviewer_checklist_only",
)
assert_false(
f"owner_response_validation_reviewer_checklist.{item['checklist_id']}.execution_authorized",
item["execution_authorized"],
)
assert_true(f"owner_response_validation_reviewer_checklist.{item['checklist_id']}.not_approval", item["not_approval"])
first_lane = LANES[0]
first_collection_item = collection_order_by_id[first_lane["lane_id"]]
first_missing_lane = missing_lane_by_id[first_lane["lane_id"]]