From b194644b85ddfb6f497b62fddcf0c3b18911673c Mon Sep 17 00:00:00 2001 From: AWOOOI CD Date: Sat, 27 Jun 2026 12:21:37 +0800 Subject: [PATCH 1/5] chore(cd): deploy 51a8394 [skip ci] --- k8s/awoooi-prod/kustomization.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml index a0d1e5359..99f866d00 100644 --- a/k8s/awoooi-prod/kustomization.yaml +++ b/k8s/awoooi-prod/kustomization.yaml @@ -41,7 +41,7 @@ resources: images: - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/api - newTag: b2b51ecbf2f68bdff918f286b76ec7b7afa4d039 + newTag: 51a839489abe7456ce0923b39537ff9df886e81a - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/web - newTag: b2b51ecbf2f68bdff918f286b76ec7b7afa4d039 + newTag: 51a839489abe7456ce0923b39537ff9df886e81a From 2686909c0759aca2421603a425420a7499ca6c29 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 27 Jun 2026 12:24:54 +0800 Subject: [PATCH 2/5] fix(web): localize IwoooS runtime security status labels --- apps/web/messages/en.json | 22 ++++++++++++++----- apps/web/messages/zh-TW.json | 22 ++++++++++++++----- apps/web/src/app/[locale]/iwooos/page.tsx | 18 ++++++++++++++- ...iwooos-frontend-display-redaction-guard.py | 3 +++ 4 files changed, 54 insertions(+), 11 deletions(-) diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 3a97a2d36..93e971d3e 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -20380,7 +20380,7 @@ "runtimeSecurityReadback": { "eyebrow": "IwoooS Runtime 資安讀回", "title": "九條 P0 資安線先接到同一張讀回板", - "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全 aggregate 讀回；它不保存 raw Wazuh payload、不啟動掃描、不送訊息、不改主機。", + "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。", "statusLabel": "讀回狀態", "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。", "laneStatusLabel": "目前狀態", @@ -20391,7 +20391,19 @@ "status": { "loading": "正在讀取只讀資安總板", "failed": "只讀總板尚未部署或讀取失敗", - "readbackReady": "只讀總板已讀回，但 runtime 閘門仍關閉" + "readbackReady": "只讀總板已讀回，但執行期閘門仍關閉" + }, + "laneStatusValues": { + "wazuh_registry": "等待管理器清單交叉驗收", + "wazuh_live_route": "正式只讀路由已關閉，等待 IwoooS Wazuh 負責人閘門", + "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆", + "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作", + "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈", + "kali_intake": "部分執行期健康已整合，仍待完整驗收", + "alert_readability": "格式合約已就緒，尚未有實發收件證據", + "owner_dispatch": "負責人請求草案已就緒，尚未送出", + "intrusion_prevention": "僅為候選，尚未授權執行期圍堵", + "unknown": "待補狀態映射" }, "summary": { "controlPlane": { @@ -20407,7 +20419,7 @@ "detail": "管理器清單接受數仍為 0。" }, "wazuhLive": { - "label": "Wazuh live", + "label": "Wazuh 即時路由", "detail": "正式只讀路由若 disabled、空清單或低於預期，首屏直接顯示警示。" }, "metadataGate": { @@ -20423,13 +20435,13 @@ "detail": "active scan / execute 都維持 0。" }, "runtimeGate": { - "label": "Runtime Gate", + "label": "執行期閘門", "detail": "任何修復、封鎖、重啟或 reload 都還沒開門。" } }, "lanes": { "wazuh_registry": { - "title": "Wazuh manager registry", + "title": "Wazuh 管理器清單", "body": "必須拿到總數、在線、離線、從未連線與時間窗；transport 或儀表板可見不能代替驗收。" }, "wazuh_live_route": { diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 3a97a2d36..93e971d3e 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -20380,7 +20380,7 @@ "runtimeSecurityReadback": { "eyebrow": "IwoooS Runtime 資安讀回", "title": "九條 P0 資安線先接到同一張讀回板", - "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全 aggregate 讀回；它不保存 raw Wazuh payload、不啟動掃描、不送訊息、不改主機。", + "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。", "statusLabel": "讀回狀態", "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。", "laneStatusLabel": "目前狀態", @@ -20391,7 +20391,19 @@ "status": { "loading": "正在讀取只讀資安總板", "failed": "只讀總板尚未部署或讀取失敗", - "readbackReady": "只讀總板已讀回，但 runtime 閘門仍關閉" + "readbackReady": "只讀總板已讀回，但執行期閘門仍關閉" + }, + "laneStatusValues": { + "wazuh_registry": "等待管理器清單交叉驗收", + "wazuh_live_route": "正式只讀路由已關閉，等待 IwoooS Wazuh 負責人閘門", + "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆", + "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作", + "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈", + "kali_intake": "部分執行期健康已整合，仍待完整驗收", + "alert_readability": "格式合約已就緒，尚未有實發收件證據", + "owner_dispatch": "負責人請求草案已就緒，尚未送出", + "intrusion_prevention": "僅為候選，尚未授權執行期圍堵", + "unknown": "待補狀態映射" }, "summary": { "controlPlane": { @@ -20407,7 +20419,7 @@ "detail": "管理器清單接受數仍為 0。" }, "wazuhLive": { - "label": "Wazuh live", + "label": "Wazuh 即時路由", "detail": "正式只讀路由若 disabled、空清單或低於預期，首屏直接顯示警示。" }, "metadataGate": { @@ -20423,13 +20435,13 @@ "detail": "active scan / execute 都維持 0。" }, "runtimeGate": { - "label": "Runtime Gate", + "label": "執行期閘門", "detail": "任何修復、封鎖、重啟或 reload 都還沒開門。" } }, "lanes": { "wazuh_registry": { - "title": "Wazuh manager registry", + "title": "Wazuh 管理器清單", "body": "必須拿到總數、在線、離線、從未連線與時間窗；transport 或儀表板可見不能代替驗收。" }, "wazuh_live_route": { diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index fa8707492..1a4ab1443 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -8083,6 +8083,18 @@ function IwoooSWazuhIntrusionReadbackBoard() { ) } +const runtimeSecurityLaneStatusKeys = new Set([ + 'wazuh_registry', + 'wazuh_live_route', + 'wazuh_live_metadata_gate', + 'wazuh_owner_evidence_preflight', + 'wazuh_dashboard_api', + 'kali_intake', + 'alert_readability', + 'owner_dispatch', + 'intrusion_prevention', +]) + function IwoooSRuntimeSecurityReadbackBoard() { const t = useTranslations('iwooos.runtimeSecurityReadback') const textWrap = { overflowWrap: 'anywhere' as const, wordBreak: 'break-word' as const } @@ -8173,6 +8185,10 @@ function IwoooSRuntimeSecurityReadbackBoard() { }, ] const lanes = data?.lanes ?? [] + const laneStatusLabel = (laneId: IwoooSRuntimeSecurityReadbackResponse['lanes'][number]['lane_id']) => + runtimeSecurityLaneStatusKeys.has(laneId) + ? t(`laneStatusValues.${laneId}` as never) + : t('laneStatusValues.unknown') return (
{t('laneStatusLabel')}
-
{lane.status}
+
{laneStatusLabel(lane.lane_id)}
{t('laneNextGateLabel')}
diff --git a/scripts/security/iwooos-frontend-display-redaction-guard.py b/scripts/security/iwooos-frontend-display-redaction-guard.py index 2742ef249..32fd2d51f 100644 --- a/scripts/security/iwooos-frontend-display-redaction-guard.py +++ b/scripts/security/iwooos-frontend-display-redaction-guard.py @@ -27,6 +27,9 @@ FORBIDDEN_FRAGMENTS = [ "security_compliance_s2_110", "127.0.0.1", "192.168.", + "raw Wazuh payload", + "source_thread_id", + "批准！繼續", "P2-110", "P2-112", ] From 6dca808d71bc5f16ad6a661e30b890b0d21cbebb Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 27 Jun 2026 12:25:10 +0800 Subject: [PATCH 3/5] fix(web): prevent governance mobile overflow --- apps/web/src/app/[locale]/governance/page.tsx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/web/src/app/[locale]/governance/page.tsx b/apps/web/src/app/[locale]/governance/page.tsx index 4a07bdcd6..585d53fd7 100644 --- a/apps/web/src/app/[locale]/governance/page.tsx +++ b/apps/web/src/app/[locale]/governance/page.tsx @@ -99,12 +99,12 @@ export default function GovernancePage({ })}
-
+
{orderedSections.map((section) => { const Icon = section.Icon return ( -
-
+
+
- {orderedSections.map((section) => { + {governanceSections.map((section) => { const Icon = section.Icon return (
diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 93f275d39..95e5ae829 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,17 @@ +## 2026-06-27｜Governance 正式 hydration 修補：`?tab=` 不再改變 SSR section 順序 + +**背景**：P2-415 i18n 修補完成部署後，正式瀏覽器 console 已無 `controlled_apply_ready` 缺字串，但仍出現 React hydration 類錯誤。追查後發現 `/governance` 是 client page，卻用 `searchParams.tab` 在 SSR 階段重排 section；`?tab=automation-inventory` 會讓 server / client 初始 section 順序不穩，造成 hydration mismatch。 + +**完成內容**： +- `/zh-TW/governance` 的 section 順序固定為 SLO、治理事件、AI 待辦、Agent 市場、自動化盤點。 +- 舊 `?tab=` deep link 只在 client mount 後讀取 `window.location.search`，用於高亮與 `scrollIntoView`，不再改變 SSR 初始 DOM。 + +**驗證結果**： +- `pnpm --filter @awoooi/web typecheck`：通過。 + +**目前真相邊界**： +- 本段只修補 Governance 前端 hydration 穩定度；不改任何 API snapshot、executor、Telegram、runtime gate 或正式寫入權限。 + ## 2026-06-27｜P2-415 正式瀏覽器讀回修補：controlled apply i18n 缺字串歸零 **背景**：P2-415 已推上正式環境並可由正式 API / 前台讀回，但瀏覽器 console 顯示既有 `controlled_apply_ready` 狀態缺少繁中 message key，造成 `reportRuntimeReadiness` 與 `reportRuntimeDryRun` 兩段出現 `MISSING_MESSAGE` 雜訊。 From 04db5e6b2a178665ee7773c291d243bafec49840 Mon Sep 17 00:00:00 2001 From: AWOOOI CD Date: Sat, 27 Jun 2026 12:37:17 +0800 Subject: [PATCH 5/5] chore(cd): deploy c8016fe [skip ci] --- k8s/awoooi-prod/kustomization.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml index 99f866d00..ed3f047ca 100644 --- a/k8s/awoooi-prod/kustomization.yaml +++ b/k8s/awoooi-prod/kustomization.yaml @@ -41,7 +41,7 @@ resources: images: - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/api - newTag: 51a839489abe7456ce0923b39537ff9df886e81a + newTag: c8016fe6518cb2c3079208dddf76a939c94dbff6 - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/web - newTag: 51a839489abe7456ce0923b39537ff9df886e81a + newTag: c8016fe6518cb2c3079208dddf76a939c94dbff6