wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): 新增主機服務配置只讀清冊
Some checks failed
CD Pipeline / tests (push) Successful in 1m28s
Details
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-11 21:41:41 +08:00
parent 0a82648ef6
commit 118967cabc
16 changed files with 1362 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

209
docs/schemas/host_service_config_inventory_v1.schema.json Normal file
View File

@@ -0,0 +1,209 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://awoooi.wooo.work/schemas/host_service_config_inventory_v1.schema.json",
"title": "IwoooS Docker / systemd / host service repo-only 清冊",
"type": "object",
"additionalProperties": false,
"required": [
"schema_version",
"generated_at",
"git_commit",
"status",
"source_scope",
"summary",
"execution_boundaries",
"expected_host_scopes",
"config_surfaces",
"write_capable_surfaces",
"next_collection_order",
"operator_interpretation"
],
"properties": {
"schema_version": {
"const": "host_service_config_inventory_v1"
},
"generated_at": {
"type": "string"
},
"git_commit": {
"type": "string"
},
"status": {
"const": "repo_only_inventory_ready"
},
"source_scope": {
"const": "committed_repo_files_only"
},
"summary": {
"type": "object",
"additionalProperties": false,
"required": [
"surface_count",
"source_exists_count",
"expected_host_scope_count",
"docker_compose_source_count",
"host_repair_whitelist_count",
"systemd_restart_surface_count",
"write_capable_surface_count",
"surfaces_requiring_owner_response_count",
"surfaces_requiring_live_evidence_count",
"owner_response_received_count",
"owner_response_accepted_count",
"live_evidence_received_count",
"restart_window_accepted_count",
"rollback_owner_accepted_count",
"runtime_gate_count",
"action_button_count",
"coverage_percent_after_inventory",
"coverage_percent_before_inventory"
],
"properties": {
"surface_count": { "const": 9 },
"source_exists_count": { "const": 9 },
"expected_host_scope_count": { "const": 5 },
"docker_compose_source_count": { "const": 5 },
"host_repair_whitelist_count": { "const": 2 },
"systemd_restart_surface_count": { "const": 1 },
"write_capable_surface_count": { "const": 3 },
"surfaces_requiring_owner_response_count": { "const": 9 },
"surfaces_requiring_live_evidence_count": { "const": 8 },
"owner_response_received_count": { "const": 0 },
"owner_response_accepted_count": { "const": 0 },
"live_evidence_received_count": { "const": 0 },
"restart_window_accepted_count": { "const": 0 },
"rollback_owner_accepted_count": { "const": 0 },
"runtime_gate_count": { "const": 0 },
"action_button_count": { "const": 0 },
"coverage_percent_after_inventory": { "const": 50 },
"coverage_percent_before_inventory": { "const": 42 }
}
},
"execution_boundaries": {
"type": "object",
"additionalProperties": { "const": false },
"required": [
"runtime_execution_authorized",
"host_write_authorized",
"ssh_read_authorized",
"ssh_write_authorized",
"docker_compose_action_authorized",
"systemctl_action_authorized",
"service_restart_authorized",
"sudo_action_authorized",
"live_host_read_authorized",
"secret_value_collection_allowed",
"active_scan_authorized",
"repair_bot_execution_authorized",
"ansible_apply_authorized",
"action_buttons_allowed"
]
},
"expected_host_scopes": {
"type": "array",
"minItems": 5,
"items": { "type": "string" }
},
"config_surfaces": {
"type": "array",
"minItems": 9,
"maxItems": 9,
"items": {
"$ref": "#/$defs/config_surface"
}
},
"write_capable_surfaces": {
"type": "array",
"minItems": 3,
"maxItems": 3,
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"surface_id",
"label",
"config_kind",
"expected_host_scope",
"service_scope",
"required_gate"
],
"properties": {
"surface_id": { "type": "string" },
"label": { "type": "string" },
"config_kind": { "type": "string" },
"expected_host_scope": { "type": "string" },
"service_scope": {
"type": "array",
"items": { "type": "string" }
},
"required_gate": {
"const": "owner_response_plus_maintenance_window_plus_rollback_owner"
}
}
}
},
"next_collection_order": {
"type": "array",
"minItems": 9,
"items": { "type": "string" }
},
"operator_interpretation": {
"type": "array",
"items": { "type": "string" }
}
},
"$defs": {
"config_surface": {
"type": "object",
"additionalProperties": false,
"required": [
"surface_id",
"label",
"source_path",
"expected_host_scope",
"config_kind",
"service_scope",
"control_tier",
"current_state",
"requires_live_evidence",
"requires_owner_response",
"next_owner_action",
"source_exists",
"line_count",
"sha256",
"owner_response_received",
"owner_response_accepted",
"live_evidence_received",
"restart_window_accepted",
"rollback_owner_accepted",
"runtime_gate_open",
"action_buttons_allowed"
],
"properties": {
"surface_id": { "type": "string" },
"label": { "type": "string" },
"source_path": { "type": "string" },
"expected_host_scope": { "type": "string" },
"config_kind": { "type": "string" },
"service_scope": {
"type": "array",
"items": { "type": "string" }
},
"control_tier": { "const": "C1" },
"current_state": { "type": "string" },
"requires_live_evidence": { "type": "boolean" },
"requires_owner_response": { "const": true },
"next_owner_action": { "type": "string" },
"source_exists": { "const": true },
"line_count": { "type": "integer", "minimum": 1 },
"sha256": { "type": "string", "minLength": 64, "maxLength": 64 },
"owner_response_received": { "const": false },
"owner_response_accepted": { "const": false },
"live_evidence_received": { "const": false },
"restart_window_accepted": { "const": false },
"rollback_owner_accepted": { "const": false },
"runtime_gate_open": { "const": false },
"action_buttons_allowed": { "const": false }
}
}
}
}

95
docs/schemas/iwooos_posture_projection_v1.schema.json
View File

@@ -176,6 +176,25 @@
"high_value_config_control_coverage_runtime_gate_count",
"high_value_config_control_coverage_action_button_count",
"high_value_config_control_coverage_lowest_category_count",
"host_service_config_inventory_first_layer",
"host_service_config_inventory_surface_count",
"host_service_config_inventory_source_exists_count",
"host_service_config_inventory_expected_host_scope_count",
"host_service_config_inventory_docker_compose_source_count",
"host_service_config_inventory_host_repair_whitelist_count",
"host_service_config_inventory_systemd_restart_surface_count",
"host_service_config_inventory_write_capable_surface_count",
"host_service_config_inventory_owner_response_required_count",
"host_service_config_inventory_owner_response_received_count",
"host_service_config_inventory_owner_response_accepted_count",
"host_service_config_inventory_live_evidence_required_count",
"host_service_config_inventory_live_evidence_received_count",
"host_service_config_inventory_restart_window_accepted_count",
"host_service_config_inventory_rollback_owner_accepted_count",
"host_service_config_inventory_runtime_gate_count",
"host_service_config_inventory_action_button_count",
"host_service_config_inventory_coverage_percent_before_inventory",
"host_service_config_inventory_coverage_percent_after_inventory",
"high_value_config_owner_packet_first_layer",
"high_value_config_owner_packet_summary_count",
"high_value_config_owner_packet_item_count",
@@ -524,6 +543,82 @@
"type": "integer",
"const": 4
},
"host_service_config_inventory_first_layer": {
"type": "boolean",
"const": true
},
"host_service_config_inventory_surface_count": {
"type": "integer",
"const": 9
},
"host_service_config_inventory_source_exists_count": {
"type": "integer",
"const": 9
},
"host_service_config_inventory_expected_host_scope_count": {
"type": "integer",
"const": 5
},
"host_service_config_inventory_docker_compose_source_count": {
"type": "integer",
"const": 5
},
"host_service_config_inventory_host_repair_whitelist_count": {
"type": "integer",
"const": 2
},
"host_service_config_inventory_systemd_restart_surface_count": {
"type": "integer",
"const": 1
},
"host_service_config_inventory_write_capable_surface_count": {
"type": "integer",
"const": 3
},
"host_service_config_inventory_owner_response_required_count": {
"type": "integer",
"const": 9
},
"host_service_config_inventory_owner_response_received_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_owner_response_accepted_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_live_evidence_required_count": {
"type": "integer",
"const": 8
},
"host_service_config_inventory_live_evidence_received_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_restart_window_accepted_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_rollback_owner_accepted_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_runtime_gate_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_action_button_count": {
"type": "integer",
"const": 0
},
"host_service_config_inventory_coverage_percent_before_inventory": {
"type": "integer",
"const": 42
},
"host_service_config_inventory_coverage_percent_after_inventory": {
"type": "integer",
"const": 50
},
"high_value_config_owner_packet_first_layer": {
"type": "boolean",
"const": true