diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 41ac5b84c..77a405d27 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -3796,7 +3796,8 @@ "surfaces": { "runs": "Run Monitor / Run Detail", "governance": "Governance Events / SLO", - "workItems": "Work Chain" + "workItems": "Work Chain", + "iwooos": "IwoooS / Security Mirror" }, "items": { "sourceDossier": { @@ -3817,6 +3818,9 @@ "frontendConsole": { "title": "AwoooP Operator Console productization" }, + "iwooosSecurityMirror": { + "title": "IwoooS security mirror read-only work item" + }, "mcpGateway": { "title": "MCP Gateway usage evidence overview" }, @@ -3831,6 +3835,7 @@ "telegramCallbacks": "Detail and history buttons cannot depend only on Redis TTL or stale snapshots", "governanceDispatch": "Governance alerts must enter dispatch and expose skipped / pending / repaired", "frontendConsole": "Completed and in-progress work must be trackable from the frontend", + "iwooosSecurityMirror": "Track security mesh progress and boundaries as read-only only; do not create scan, execute, repair, deploy, primary switch, or runtime gate actions", "mcpGateway": "MCP usage must show agent, tool, scope, and blocked reason", "timelineContract": "Incident, Approval, Evidence, KM, and Timeline must not contradict each other" }, @@ -3843,6 +3848,9 @@ "governanceUnavailable": "Governance events API is not responding; pending dispatch: {queued}", "governanceQueueMissing": "Governance dispatch table is not ready; unresolved governance alerts: {unresolved}", "frontendConsole": "This page now reads production APIs instead of a static list", + "iwooosSecurityMirror": "Overall {headline}; framework {framework}; landing {runtime}; active runtime gates={gates}", + "iwooosSecurityMirrorOwner": "Owner response is still waiting; production_landing_enabled=false", + "iwooosSecurityMirrorBoundary": "execution_router_linked=false; runtime_execution_authorized=false; action_buttons_allowed=false", "mcpReady": "MCP Gateway gate is not currently a top gap", "mcpMissing": "Quality summary still reports an MCP Gateway observation gap", "remediationHistory": "Dry-run history: {count}x; latest {preview}", diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index b8a6a2c09..3c80b9975 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -3797,7 +3797,8 @@ "surfaces": { "runs": "Run 監控 / Run Detail", "governance": "治理事件 / SLO", - "workItems": "工作鏈路" + "workItems": "工作鏈路", + "iwooos": "IwoooS / 資安鏡像" }, "items": { "sourceDossier": { @@ -3818,6 +3819,9 @@ "frontendConsole": { "title": "AwoooP Operator Console 產品化" }, + "iwooosSecurityMirror": { + "title": "IwoooS 資安鏡像只讀工作項" + }, "mcpGateway": { "title": "MCP Gateway 使用證據總覽" }, @@ -3832,6 +3836,7 @@ "telegramCallbacks": "按下詳情與歷史不能再只依賴 Redis TTL 或舊快照", "governanceDispatch": "治理告警必須進 dispatch，並標示 skipped / pending / repaired", "frontendConsole": "已完成與推進中的工作必須能從前端直接追蹤", + "iwooosSecurityMirror": "只讀追蹤資安網進度與邊界；不得建立 scan、execute、repair、deploy、primary switch 或 runtime gate", "mcpGateway": "MCP 使用必須看得到 agent、tool、scope 與 blocked 原因", "timelineContract": "Incident、Approval、Evidence、KM、Timeline 不得互相矛盾" }, @@ -3844,6 +3849,9 @@ "governanceUnavailable": "治理事件 API 目前無法回應；pending dispatch：{queued}", "governanceQueueMissing": "治理 dispatch 表尚未就緒；未解治理告警：{unresolved}", "frontendConsole": "本頁已改讀 production API，而非靜態清單", + "iwooosSecurityMirror": "整體 {headline}；框架 {framework}；落地 {runtime}；active runtime gates={gates}", + "iwooosSecurityMirrorOwner": "Owner response 仍等待；production_landing_enabled=false", + "iwooosSecurityMirrorBoundary": "execution_router_linked=false；runtime_execution_authorized=false；action_buttons_allowed=false", "mcpReady": "MCP Gateway gate 目前未列為主要缺口", "mcpMissing": "品質總覽仍指出 MCP Gateway 觀測缺口", "remediationHistory": "試跑歷史：{count} 次；上次 {preview}", diff --git a/apps/web/src/app/[locale]/awooop/work-items/page.tsx b/apps/web/src/app/[locale]/awooop/work-items/page.tsx index 1cc7f8fd1..c80e41014 100644 --- a/apps/web/src/app/[locale]/awooop/work-items/page.tsx +++ b/apps/web/src/app/[locale]/awooop/work-items/page.tsx @@ -271,6 +271,25 @@ function buildWorkItems( evidence: t("evidence.frontendConsole"), href: "/awooop/work-items", }, + { + id: "iwooosSecurityMirror", + phase: "S2.54", + status: "watching", + surfaceKey: "iwooos", + source: "security_mirror_status_rollup_v1 / iwooos_posture_projection_v1", + gateKey: "iwooosSecurityMirror", + evidence: t("evidence.iwooosSecurityMirror", { + headline: "58%", + framework: "80-85%", + runtime: "35-40%", + gates: 0, + }), + evidenceDetails: [ + t("evidence.iwooosSecurityMirrorOwner"), + t("evidence.iwooosSecurityMirrorBoundary"), + ], + href: "/iwooos", + }, { id: "mcpGateway", phase: "T18", diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 9ddcd698e..804027bfb 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,17 @@ +## 2026-05-20 | 資安供應鏈 S2.54：AwoooP Work-Items IwoooS Security Mirror Candidate + +**背景**：S2.53 已把 IwoooS / security mirror 狀態放到 AwoooP 首頁，但首頁卡片仍偏狀態摘要；本輪把同一個資安鏡像狀態放進 `/awooop/work-items` 的工作鏈路，讓另一個 AwoooP Session 與使用者都能把它當「可追蹤工作項」理解，而不是把它誤認成可執行 action queue。 + +**完成**： +- `/awooop/work-items` 新增 `S2.54`「IwoooS 資安鏡像只讀工作項」，狀態為觀察期，前端操作面為 IwoooS / 資安鏡像，連到 `/iwooos`。 +- 工作項顯示整體 58%、框架 80-85%、落地 35-40%、active runtime gates=0，並顯示 owner response waiting 與四個 false 邊界。 +- `security_mirror_status_rollup_v1` micro progress ledger 新增 `s2_54_awooop_work_items_iwooos_security_mirror_candidate`，並新增 `show_awooop_work_items_iwooos_security_mirror_candidate` next safe action。 +- `security-mirror-progress-guard.py` 開始驗證 AwoooP work-items 的 S2.54 工作項、IwoooS link、watching 狀態、source contract 與 i18n 鍵。 + +**仍禁止**： +- AwoooP work-items 的 S2.54 觀察項不代表 production landing、deployment proof、read-only consumption evidence、execution router、runtime gate、action button、Kali `/execute`、SSH 登入、主機更新、GitHub primary、Gitea/GitHub refs mutation 或 blocking control。 +- 整體資安網 headline 仍是 58%；框架 / 治理 / 文件 / schema / read-only evidence 仍約 80-85%；真正落地執行 / runtime ingestion / GitHub primary / AwoooP production landing 仍約 35-40%。 + ## 2026-05-20 | 資安供應鏈 S2.53：AwoooP Home IwoooS Security Mirror Candidate **背景**：統帥指出資安工作在前端沒有感覺；S2.51 / S2.52 已經把 IwoooS 與 AwoooP 接手條件整理好，本輪把 IwoooS / security mirror 狀態直接放到 AwoooP 首頁，但仍維持只讀候選，避免另一個 Session 或使用者把首頁可見性誤解成 production landing enabled。 diff --git a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md index 0d3bbdb04..d7bbbf878 100644 --- a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md +++ b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md @@ -35,7 +35,7 @@ | Owner response validation | S4.13 已建立；四包 owner response 目前 received/accepted 皆為 0；4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes、6 個 parallel session recovery checks 與 7 條 parallel session recovery outcome lanes 可供 AwoooP 直接顯示；下一個建議收件為 S4.9 Gitea owner attestation；latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`，reviewer audit emitted 仍為 0，不代表 owner response 已收到或任何執行授權 | | Low-friction rollout policy | S1.3 已補 7 條 non-blocking escalation lanes；LOW / MEDIUM、缺 owner response、partial mirror、source-control drift、Kali observe finding、workflow / secret name gap 與 headline holding 初期只能 observe / warn；`owner_review_required_before_blocking=true`、`runtime_blocking_allowed=false` | | IwoooS frontend posture | S2.8 已新增 `/iwooos` read-only Information Security 入口；顯示 Security Posture / Exposure、source-control supply chain、Kali 112 Mesh、approval boundary、non-blocking lanes 與 evidence refs；不新增執行按鈕 | -| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；S2.32 已補 7 個 host owner decision record formal candidate packets；S2.33 已補 7 個 host owner decision record formal candidate review checklist items；S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes；S2.35 已補 8 個 host owner decision record formal record queue packets；S2.36 已補 8 個 host owner decision record formal record queue review checklist items；S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes；S2.38 已補 8 個 host owner decision record human handoff readiness packets；S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items；S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes；S2.41 已補 9 個 host owner decision record human record owner review candidate packets；S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items；S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes；S2.44 已補 9 個 host owner decision record human record owner review preparation packets；S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items；S2.46 已補 6 條 progress acceleration lanes，顯示 58% holding 原因與下一個高層解鎖 gate；S2.47 已補 4 個 owner response next-action focus items，顯示 S4.9 為下一個收件焦點且 S4.10-S4.12 依序排隊；S2.48 已補 6 個 S4.9 owner response preflight checks，讓下一個 P0 owner response 的可收件條件可見；S2.49 已補 5 個 S4.9 owner response request templates，讓 owner 要逐項回覆的五題可見；S2.50 已補 5 個 progress hold movement gates，解釋為什麼 58% 仍維持且五個真實 movement signal 都是 0 / false；S2.51 已補 6 個 AwoooP read-only landing readiness items，讓另一個 AwoooP Session 可照 snapshot / evidence / guard / route / forbidden outputs 接入；S2.52 已補 6 個 AwoooP cross-session handoff packets，固定 PR / branch anchor、progress semantics、guard commands、forbidden runtime actions、read-only inputs 與 next coordination gate；S2.53 已把 IwoooS / security mirror 狀態放進 AwoooP 首頁只讀候選面板，顯示 58%、80-85%、35-40%、active gates 0 與四個接入檢查；仍不新增 action button | +| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；S2.32 已補 7 個 host owner decision record formal candidate packets；S2.33 已補 7 個 host owner decision record formal candidate review checklist items；S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes；S2.35 已補 8 個 host owner decision record formal record queue packets；S2.36 已補 8 個 host owner decision record formal record queue review checklist items；S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes；S2.38 已補 8 個 host owner decision record human handoff readiness packets；S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items；S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes；S2.41 已補 9 個 host owner decision record human record owner review candidate packets；S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items；S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes；S2.44 已補 9 個 host owner decision record human record owner review preparation packets；S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items；S2.46 已補 6 條 progress acceleration lanes，顯示 58% holding 原因與下一個高層解鎖 gate；S2.47 已補 4 個 owner response next-action focus items，顯示 S4.9 為下一個收件焦點且 S4.10-S4.12 依序排隊；S2.48 已補 6 個 S4.9 owner response preflight checks，讓下一個 P0 owner response 的可收件條件可見；S2.49 已補 5 個 S4.9 owner response request templates，讓 owner 要逐項回覆的五題可見；S2.50 已補 5 個 progress hold movement gates，解釋為什麼 58% 仍維持且五個真實 movement signal 都是 0 / false；S2.51 已補 6 個 AwoooP read-only landing readiness items，讓另一個 AwoooP Session 可照 snapshot / evidence / guard / route / forbidden outputs 接入；S2.52 已補 6 個 AwoooP cross-session handoff packets，固定 PR / branch anchor、progress semantics、guard commands、forbidden runtime actions、read-only inputs 與 next coordination gate；S2.53 已把 IwoooS / security mirror 狀態放進 AwoooP 首頁只讀候選面板，顯示 58%、80-85%、35-40%、active gates 0 與四個接入檢查；S2.54 已把 IwoooS / security mirror 狀態放進 AwoooP 工作鏈路觀察項；仍不新增 action button | | Dry-run | `contract_defined_not_executed`；已納入 `CHECK_PROGRESS_GUARD` 與 `CHECK_OWNER_RESPONSE_GUARD`，latest local validation 為 `repo_snapshot_guard_pass`，仍不代表 production ingestion | | Runtime actions | `false` | | Payload ingestion | `false` | @@ -137,6 +137,7 @@ | S2.51 IwoooS AwoooP read-only landing readiness | framework detail | 0 | 只顯示 AwoooP 只讀接入前的六個條件；production_landing_enabled=false、execution_router_linked=false、progress_change_applied=false，不把 readiness 當 production consumption、guard skip、runtime gate 或 action button | | S2.52 IwoooS AwoooP cross-session handoff packets | framework detail | 0 | 只顯示另一個 Session 接手前的 PR / branch、進度語義、guard commands、runtime 禁止動作、只讀輸入與下一個協調 gate；production_landing_enabled=false、execution_router_linked=false、progress_change_applied=false，不把 handoff 當 merge、deploy、primary switch、refs mutation、guard skip 或 production consumption | | S2.53 AwoooP home IwoooS security mirror candidate | framework detail | 0 | 只把 IwoooS / security mirror 狀態放進 AwoooP 首頁只讀候選面板；production_landing_enabled=false、execution_router_linked=false、runtime_execution_authorized=false、action_buttons_allowed=false，不把候選面板當 production landing、runtime gate、execution router 或 action button | +| S2.54 AwoooP work-items IwoooS security mirror candidate | framework detail | 0 | 只把 IwoooS / security mirror 狀態放進 AwoooP 工作鏈路觀察項；production_landing_enabled=false、execution_router_linked=false、runtime_execution_authorized=false、action_buttons_allowed=false，不把觀察項當 production landing、runtime gate、execution router、scan、execute、repair、deploy、primary switch 或 refs action | headline 進度要再往上，至少需要下列任一高層 gate 有實質 evidence： diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index 3bc6dea07..a4fb900d4 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -4,7 +4,7 @@ |------|------| | 日期 | 2026-05-17 | | 狀態 | S0/S1 read-only evidence 建置中 | -| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 | +| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | ## 0. 本階段完成後整體進度 @@ -27,7 +27,7 @@ python3 scripts/security/security-mirror-progress-guard.py ### 0.2 Headline 58% 不代表停滯 -近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.53 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。 +近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.54 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。 S2.50 也把「為什麼 58% 還不動」拆成五個可見 gate：owner response accepted、redacted payload ingestion、active runtime gate、GitHub primary ready、AwoooP read-only landing。這五個 gate 目前仍全部是 0 / false，所以 headline 不應被灌水提高。 @@ -115,6 +115,7 @@ S2.50 也把「為什麼 58% 還不動」拆成五個可見 gate：owner respons | S2.51 IwoooS AwoooP read-only landing readiness | 已完成草案，將 AwoooP 只讀接入前的 rollup snapshot、evidence refs、guard checks、route groups、forbidden outputs 與 production handoff pending 顯示在 IwoooS；production_landing_enabled 仍為 false | 0 | | S2.52 IwoooS AwoooP cross-session handoff packets | 已完成草案，將另一個 Session 接手前的 PR / branch、progress semantics、guard commands、forbidden runtime actions、read-only inputs 與 next coordination gate 顯示在 IwoooS；production_landing_enabled 仍為 false | 0 | | S2.53 AwoooP home IwoooS security mirror candidate | 已完成草案，將 IwoooS / security mirror headline、framework、runtime、active gates 與四個接入檢查放入 AwoooP 首頁只讀候選面板；production_landing_enabled 仍為 false | 0 | +| S2.54 AwoooP work-items IwoooS security mirror candidate | 已完成草案，將 IwoooS / security mirror 顯示成 AwoooP 工作鏈路的觀察期只讀工作項；production_landing_enabled 仍為 false，active runtime gates 仍為 0 | 0 | headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收，或人工批准後出現 active runtime gate、redacted payload ingestion、GitHub primary readiness 這類落地 evidence。 @@ -187,6 +188,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons | S2.51 IwoooS AwoooP Read-Only Landing Readiness | 完成草案 | `/iwooos` 新增 AwoooP 只讀 landing readiness，顯示 snapshot、evidence refs、guard checks、route groups、forbidden outputs 與 production handoff pending 六個接入條件 | 使用者與另一個 AwoooP Session 能看懂主線接入要消費什麼；readiness 仍不是 production landing enabled、execution router、action button、guard skip 或 headline 加分 | | S2.52 IwoooS AwoooP Cross-Session Handoff Packets | 完成草案 | `/iwooos` 新增 AwoooP 跨 Session handoff，顯示 PR / branch anchor、progress semantics、required guard commands、forbidden runtime actions、read-only inputs 與 next coordination gate 六個接手 packets | 另一個 Session 可用同一 PR / branch / guard / rollup 口徑同步；handoff 仍不是 merge、deploy、primary switch、refs mutation、guard skip、production consumption 或 headline 加分 | | S2.53 AwoooP Home IwoooS Security Mirror Candidate | 完成草案 | `/awooop` 首頁新增 IwoooS 資安鏡像候選面板，顯示 58%、80-85%、35-40%、0 active runtime gates 與 projection / guard / owner response / production landing 四個檢查 | 使用者能在 AwoooP 首頁直接感受到資安網狀態；候選面板仍不是 production landing enabled、execution router、runtime gate、action button 或 headline 加分 | +| S2.54 AwoooP Work-Items IwoooS Security Mirror Candidate | 完成草案 | `/awooop/work-items` 新增 S2.54 IwoooS 資安鏡像只讀工作項，顯示 58%、80-85%、35-40%、active runtime gates=0、owner response waiting 與 false 邊界，並連到 `/iwooos` | 使用者能在工作鏈路追蹤資安網，而不是只看首頁摘要；觀察項仍不是 production landing enabled、execution router、runtime gate、action button 或 headline 加分 | | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate | | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item | | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 | diff --git a/docs/security/security-mirror-status-rollup.snapshot.json b/docs/security/security-mirror-status-rollup.snapshot.json index 4fbc89b2a..cd35f7ccc 100644 --- a/docs/security/security-mirror-status-rollup.snapshot.json +++ b/docs/security/security-mirror-status-rollup.snapshot.json @@ -1106,6 +1106,18 @@ "runtime_delta": false, "execution_authorized": false, "not_authorization": true + }, + { + "delta_id": "s2_54_awooop_work_items_iwooos_security_mirror_candidate", + "display_order": 83, + "completed_stage": "S2.54 AwoooP work-items IwoooS security mirror candidate", + "progress_axis": "framework_detail", + "headline_percent_delta": 0, + "framework_delta_visible": true, + "why_headline_unchanged": "AwoooP work-items IwoooS security mirror candidate 只把 IwoooS / security mirror 狀態放進 AwoooP 工作鏈路的只讀觀察項；owner response、deployment proof、read-only consumption evidence 與 production_landing_enabled 仍未完成。", + "runtime_delta": false, + "execution_authorized": false, + "not_authorization": true } ], "next_safe_actions": [ @@ -1158,6 +1170,22 @@ "從 AwoooP 首頁候選面板建立 runtime gate 或 action button" ] }, + { + "action_id": "show_awooop_work_items_iwooos_security_mirror_candidate", + "title": "AwoooP 工作鏈路顯示 IwoooS 資安鏡像候選", + "mode": "observe", + "source_contract": "security_mirror_status_rollup_v1", + "allowed_processing": [ + "在 /awooop/work-items 顯示 S2.54 只讀工作項", + "顯示 58% headline、80-85% framework、35-40% runtime landing、0 active runtime gates 與 owner response waiting", + "連到 /iwooos 只讀入口，不新增 scan、execute、repair、deploy、primary switch、refs action 或 runtime gate" + ], + "blocked_processing": [ + "把 AwoooP 工作鏈路候選項當成 production_landing_enabled", + "從 AwoooP 工作鏈路候選項建立 execution router 或 runtime gate", + "把 S2.54 觀察項轉成可點擊的 scan、execute、repair、deploy、primary switch 或 refs action" + ] + }, { "action_id": "mirror_low_friction_non_blocking_lanes", "title": "AwoooP 顯示低摩擦非阻擋升級分流", @@ -1524,7 +1552,8 @@ "S2.50 新增 IwoooS progress hold movement gates；progress_hold_movement_gate_count=5，顯示 owner_response_accepted、redacted_payload_ingested、active_runtime_gate、github_primary_ready、awooop_read_only_landing 五個真正會讓 58% 進入下一輪重估的 gate；owner response received/accepted、payloads_ingested、active_runtime_gate_count、github_primary_ready_count、production_landing_enabled 仍全部為 0/false，不把 gate 顯示當進度加分、授權或 runtime execution。", "S2.51 新增 IwoooS AwoooP read-only landing readiness；awooop_read_only_landing_readiness_item_count=6，顯示 rollup snapshot、evidence refs、guard checks、route groups、forbidden outputs 與 production handoff pending；production_landing_enabled=false、execution_router_linked=false、progress_change_applied=false，不把 readiness 當 production consumption、runtime authorization 或 action button。", "S2.52 新增 IwoooS AwoooP cross-session handoff packets；awooop_cross_session_handoff_packet_count=6，顯示 PR/branch anchor、progress semantics、required guard commands、forbidden runtime actions、read-only inputs 與 next coordination gate；production_landing_enabled=false、execution_router_linked=false、progress_change_applied=false，不把 handoff 當 merge、deploy、primary switch、refs mutation、guard skip 或 production consumption。", - "S2.53 新增 AwoooP home IwoooS security mirror candidate；AwoooP 首頁以只讀候選方式顯示 headline 58%、framework 80-85%、runtime 35-40%、active runtime gates 0 與四個接入檢查；production_landing_enabled=false、execution_router_linked=false、runtime_execution_authorized=false、action_buttons_allowed=false，不把首頁候選面板當 production landing、runtime gate、execution router 或 action button。" + "S2.53 新增 AwoooP home IwoooS security mirror candidate；AwoooP 首頁以只讀候選方式顯示 headline 58%、framework 80-85%、runtime 35-40%、active runtime gates 0 與四個接入檢查；production_landing_enabled=false、execution_router_linked=false、runtime_execution_authorized=false、action_buttons_allowed=false，不把首頁候選面板當 production landing、runtime gate、execution router 或 action button。", + "S2.54 新增 AwoooP work-items IwoooS security mirror candidate；AwoooP 工作鏈路以觀察期只讀工作項顯示 S2.54、IwoooS / security mirror、headline 58%、framework 80-85%、runtime 35-40%、active runtime gates 0 與 owner response waiting；production_landing_enabled=false、execution_router_linked=false、runtime_execution_authorized=false、action_buttons_allowed=false，不把工作項當 production landing、runtime gate、execution router 或 action button。" ], "forbidden_actions": [ "start_kali_scan", diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index 209f019c8..fb4870e1f 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -58,6 +58,9 @@ def validate(root: Path) -> None: awooop_home_page = ( root / "apps" / "web" / "src" / "app" / "[locale]" / "awooop" / "page.tsx" ).read_text(encoding="utf-8") + awooop_work_items_page = ( + root / "apps" / "web" / "src" / "app" / "[locale]" / "awooop" / "work-items" / "page.tsx" + ).read_text(encoding="utf-8") web_messages_zh = load_json(root / "apps" / "web" / "messages" / "zh-TW.json") web_messages_en = load_json(root / "apps" / "web" / "messages" / "en.json") @@ -215,6 +218,7 @@ def validate(root: Path) -> None: "s2_51_iwooos_awooop_read_only_landing_readiness", "s2_52_iwooos_awooop_cross_session_handoff_packets", "s2_53_awooop_home_iwooos_security_mirror_candidate", + "s2_54_awooop_work_items_iwooos_security_mirror_candidate", ] assert_equal( "progress_delta_ledger.delta_ids", @@ -249,6 +253,11 @@ def validate(root: Path) -> None: [item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)], "show_awooop_home_iwooos_security_mirror_candidate", ) + assert_contains( + "rollup.next_safe_actions.action_ids", + [item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)], + "show_awooop_work_items_iwooos_security_mirror_candidate", + ) assert_equal("rollout_policy.schema_version", rollout_policy["schema_version"], "security_rollout_policy_v1") assert_equal("rollout_policy.default_mode", rollout_policy["default_mode"], "observe") @@ -4798,6 +4807,48 @@ def validate(root: Path) -> None: key, ) + assert_text_contains("awooop_work_items_page.security_mirror_item", awooop_work_items_page, "iwooosSecurityMirror") + assert_text_contains( + "awooop_work_items_page.security_mirror_source", + awooop_work_items_page, + "security_mirror_status_rollup_v1 / iwooos_posture_projection_v1", + ) + assert_text_contains("awooop_work_items_page.security_mirror_href", awooop_work_items_page, 'href: "/iwooos"') + assert_text_contains("awooop_work_items_page.security_mirror_status", awooop_work_items_page, 'status: "watching"') + for key in ["iwooos"]: + assert_contains( + "web_messages.zh-TW.awooop.workItems.surfaces", + list(web_messages_zh["awooop"]["workItems"]["surfaces"].keys()), + key, + ) + assert_contains( + "web_messages.en.awooop.workItems.surfaces", + list(web_messages_en["awooop"]["workItems"]["surfaces"].keys()), + key, + ) + for section in ["items", "gates", "evidence"]: + assert_contains( + f"web_messages.zh-TW.awooop.workItems.{section}", + list(web_messages_zh["awooop"]["workItems"][section].keys()), + "iwooosSecurityMirror", + ) + assert_contains( + f"web_messages.en.awooop.workItems.{section}", + list(web_messages_en["awooop"]["workItems"][section].keys()), + "iwooosSecurityMirror", + ) + for key in ["iwooosSecurityMirrorOwner", "iwooosSecurityMirrorBoundary"]: + assert_contains( + "web_messages.zh-TW.awooop.workItems.evidence", + list(web_messages_zh["awooop"]["workItems"]["evidence"].keys()), + key, + ) + assert_contains( + "web_messages.en.awooop.workItems.evidence", + list(web_messages_en["awooop"]["workItems"]["evidence"].keys()), + key, + ) + owner_summary = owner_rollup["summary"] assert_equal("owner_rollup.total_received_response_count", owner_summary["total_received_response_count"], 0) assert_equal("owner_rollup.total_accepted_response_count", owner_summary["total_accepted_response_count"], 0)