wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add owner response state transitions

Browse Source
This commit is contained in:
Your Name
2026-05-19 10:04:45 +08:00
parent 68b7862987
commit 2774bf8708
19 changed files with 338 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
scripts/security/source-control-owner-response-guard.py
View File

@@ -287,6 +287,16 @@ EXPECTED_ROLLUP_DISPLAY_SECTIONS = [
"display-latest-local-validation",
]
EXPECTED_ROLLUP_STATE_TRANSITION_RULES = [
"transition-waiting-to-received-pending-validation",
"transition-missing-required-fields-to-request-more-evidence",
"transition-sensitive-payload-to-mirror-quarantine",
"transition-execution-request-to-hard-rejected",
"transition-cross-packet-conflict-to-owner-review",
"transition-validation-pass-to-read-only-update",
"transition-post-update-stays-waiting-runtime-gate",
]
def load_json(path: Path) -> dict[str, Any]:
return json.loads(path.read_text(encoding="utf-8"))
@@ -334,6 +344,11 @@ def validate(root: Path) -> None:
rollup_summary["owner_response_validation_display_section_count"],
len(EXPECTED_ROLLUP_DISPLAY_SECTIONS),
)
assert_equal(
"rollup.owner_response_validation_state_transition_rule_count",
rollup_summary["owner_response_validation_state_transition_rule_count"],
len(EXPECTED_ROLLUP_STATE_TRANSITION_RULES),
)
assert_true("rollup.quarantine_required", rollup_summary["quarantine_required"])
assert_equal("rollup.primary_ready_count", rollup_summary["primary_ready_count"], 0)
@@ -730,6 +745,35 @@ def validate(root: Path) -> None:
)
assert_true(f"owner_response_validation_display_sections.{item['section_id']}.not_approval", item["not_approval"])
state_transition_rules = rollup["owner_response_validation_state_transition_rules"]
assert_equal(
"owner_response_validation_state_transition_rules.ids",
[item["rule_id"] for item in state_transition_rules],
EXPECTED_ROLLUP_STATE_TRANSITION_RULES,
)
assert_equal(
"owner_response_validation_state_transition_rules.display_order",
[item["display_order"] for item in state_transition_rules],
list(range(1, len(EXPECTED_ROLLUP_STATE_TRANSITION_RULES) + 1)),
)
for item in state_transition_rules:
assert_equal(
f"owner_response_validation_state_transition_rules.{item['rule_id']}.awooop_display_mode",
item["awooop_display_mode"],
"display_state_transition_rule_only",
)
assert_false(
f"owner_response_validation_state_transition_rules.{item['rule_id']}.execution_authorized",
item["execution_authorized"],
)
assert_true(f"owner_response_validation_state_transition_rules.{item['rule_id']}.not_approval", item["not_approval"])
for blocked_update in item["blocked_updates"]:
if blocked_update in {"create_runtime_gate", "enqueue_execution", "add_action_button"}:
assert_false(
f"owner_response_validation_state_transition_rules.{item['rule_id']}.runtime_execution_authorized",
item["execution_authorized"],
)
first_lane = LANES[0]
first_collection_item = collection_order_by_id[first_lane["lane_id"]]
first_missing_lane = missing_lane_by_id[first_lane["lane_id"]]