wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add low-friction non-blocking lanes

Browse Source
This commit is contained in:
Your Name
2026-05-19 14:44:21 +08:00
parent e40d62524f
commit 1b879aacd3
22 changed files with 334 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
scripts/security/security-mirror-progress-guard.py
View File

@@ -45,6 +45,7 @@ def validate(root: Path) -> None:
dry_run = load_json(security_dir / "security-mirror-dry-run.snapshot.json")
owner_rollup = load_json(security_dir / "source-control-owner-response-validation-rollup.snapshot.json")
primary_gate = load_json(security_dir / "source-control-primary-readiness-gate.snapshot.json")
rollout_policy = load_json(security_dir / "security-rollout-policy.snapshot.json")
manifest_count = manifest["contract_count"]
readiness_summary = readiness["summary"]
@@ -117,6 +118,7 @@ def validate(root: Path) -> None:
"s4_13_owner_response_validation_parallel_session_conflict_lanes",
"s4_13_owner_response_validation_parallel_session_recovery_checks",
"s4_13_owner_response_validation_parallel_session_recovery_outcome_lanes",
"s1_3_low_friction_non_blocking_escalation_lanes",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -147,6 +149,62 @@ def validate(root: Path) -> None:
assert_false("rollup.secret_value_collection_allowed", rollup_summary["secret_value_collection_allowed"])
assert_false("rollup.secret_value_detected", rollup_summary["secret_value_detected"])
assert_equal("rollout_policy.schema_version", rollout_policy["schema_version"], "security_rollout_policy_v1")
assert_equal("rollout_policy.default_mode", rollout_policy["default_mode"], "observe")
assert_equal("rollout_policy.enforcement_level", rollout_policy["enforcement_level"], "mirror_only")
assert_equal("rollout_policy.non_blocking_escalation_lane_count", rollout_policy["non_blocking_escalation_lane_count"], 7)
expected_low_friction_lane_ids = [
"lane-low-medium-observation",
"lane-owner-response-missing",
"lane-mirror-data-incomplete",
"lane-source-control-drift-draft",
"lane-kali-observe-finding",
"lane-workflow-secret-name-gap",
"lane-progress-display-holding",
]
non_blocking_lanes = rollout_policy["non_blocking_escalation_lanes"]
assert_equal(
"rollout_policy.non_blocking_escalation_lanes.ids",
[item["lane_id"] for item in non_blocking_lanes],
expected_low_friction_lane_ids,
)
assert_equal(
"rollout_policy.non_blocking_escalation_lanes.display_order",
[item["display_order"] for item in non_blocking_lanes],
list(range(1, len(expected_low_friction_lane_ids) + 1)),
)
for item in non_blocking_lanes:
if item["initial_mode"] not in {"observe", "warn"}:
raise SystemExit(
f"BLOCKED rollout_policy.non_blocking_escalation_lanes.{item['lane_id']}.initial_mode: "
f"expected observe/warn, got {item['initial_mode']!r}"
)
assert_true(
f"rollout_policy.non_blocking_escalation_lanes.{item['lane_id']}.owner_review_required_before_blocking",
item["owner_review_required_before_blocking"],
)
assert_false(
f"rollout_policy.non_blocking_escalation_lanes.{item['lane_id']}.runtime_blocking_allowed",
item["runtime_blocking_allowed"],
)
assert_equal(
f"rollout_policy.non_blocking_escalation_lanes.{item['lane_id']}.awooop_display_mode",
item["awooop_display_mode"],
"display_low_friction_non_blocking_lane_only",
)
assert_true(
f"rollout_policy.non_blocking_escalation_lanes.{item['lane_id']}.not_authorization",
item["not_authorization"],
)
rollout_outputs = rollout_policy["allowed_awooop_outputs"]
for output in [
"display_non_blocking_escalation_lanes",
"create_followup_without_blocking",
"show_owner_review_required_before_blocking",
"keep_runtime_blocking_false",
]:
assert_contains("rollout_policy.allowed_awooop_outputs", rollout_outputs, output)
owner_summary = owner_rollup["summary"]
assert_equal("owner_rollup.total_received_response_count", owner_summary["total_received_response_count"], 0)
assert_equal("owner_rollup.total_accepted_response_count", owner_summary["total_accepted_response_count"], 0)