test(iwooos): 新增高價值配置集中 guard [skip ci]

2026-06-15 05:58:37 +08:00
parent bfc0e22376
commit 32415febe7
6 changed files with 645 additions and 4 deletions
--- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md
+++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md
@@ -86,6 +86,14 @@

 固定數字為 `change_evidence_candidate_count=14`、`write_capable_change_evidence_candidate_count=6`、`policy_or_exposure_candidate_count=5`、`change_evidence_field_count=32`、`required_evidence_field_count=16`、`reviewer_check_count=16`、`outcome_lane_count=8`、`blocked_action_count=24`、`change_evidence_received_count=0`、`change_evidence_accepted_count=0`、`firewall_change_authorized_count=0`、`port_close_authorized_count=0`、`port_open_authorized_count=0`、`runtime_gate_count=0`。此更新讓 `ssh_firewall_network_access` 從 `58%` 推進到 `60%`；它只補齊端口 / 防火牆變更的 actor、before / after state、service dependency、customer impact、cross-project sync、rollback 與 post-check evidence 驗收規則，不代表 SSH、live firewall read、firewall change、port close / open、route smoke、host restart、production write 或 runtime gate 已授權。

+## 1.8 2026-06-15 高價值配置集中 Guard
+
+已新增 `docs/security/IWOOOS-CONFIG-CONTROL-GUARD.md` 與 `scripts/security/iwooos-config-control-guard.py`，把 14 類高價值配置、C0 類別、evidence refs、owner response / change evidence 帳本、supply-chain contract manifest 與 `0 / false` 邊界串成集中驗證。
+
+此 guard 已由 `security-mirror-progress-guard.py` 呼叫。後續只要跑主進度 guard，就會同步檢查 Nginx、DNS / TLS、K8s / ArgoCD、Secrets / runner、Public runtime、SSH / firewall、Backup / DR、Monitoring、agent-bounty-protocol 與 supply-chain contract 的 repo snapshot 基線。
+
+此更新只讓「配置控管集中驗證」從 `0%` 推進到 `100%`；owner response 收件、live evidence、Nginx reload、firewall change、workflow / runner / secret 變更、backup / restore、active scan、agent-bounty runtime 與 production deploy 仍全部維持 `0 / false`。
+
 ## 2. 覆蓋摘要

 | 指標 | 目前值 | 說明 |
@@ -223,12 +231,19 @@ python3 scripts/security/high-value-config-control-coverage.py \
  --output docs/security/high-value-config-control-coverage.snapshot.json
 ```

+集中驗證 guard：
+
+```bash
+python3 scripts/security/iwooos-config-control-guard.py --root .
+```
+
 ## 7. 完成度

 | 工作 | 完成度 | 說明 |
 |------|--------|------|
 | 全高價值配置類別註冊 | `100%` | 14 類全部來自既有 Gate 定義 |
 | 覆蓋 snapshot / schema | `100%` | 已新增可重跑 snapshot 與 JSON schema |
+| 高價值配置集中 guard | `100%` | 已新增 `scripts/security/iwooos-config-control-guard.py`，並串接 `security-mirror-progress-guard.py`；14 類配置、主要 owner / change evidence 帳本、supply-chain manifest 與 `0 / false` 邊界可集中驗證 |
 | DNS / TLS / certbot owner response acceptance | `100%` | 已新增 `domain_tls_certbot_owner_response_acceptance_v1`，4 個 C0 candidate、13 個 owner 必填欄位、13 個 reviewer checks、7 條 outcome lanes、20 類 blocked action；成熟度 `74% -> 78%` |
 | Docker / systemd / host service owner response acceptance | `100%` | 已新增 `host_service_owner_response_acceptance_v1`，9 個 candidate、3 個 write-capable、14 個 reviewer checks、7 條 outcome lanes、20 類 blocked action；成熟度 `50% -> 54%` |
 | CD / Runner / Secret injection change evidence acceptance | `100%` | 已新增 `cd_runner_secret_injection_change_evidence_acceptance_v1`，5 個 candidate、4 個 C0、19 個 reviewer checks、8 條 outcome lanes、32 類 blocked action；secret metadata 成熟度 `66% -> 68%`，workflow / runner 成熟度 `70% -> 72%` |
--- a/docs/security/IWOOOS-CONFIG-CONTROL-GUARD.md
+++ b/docs/security/IWOOOS-CONFIG-CONTROL-GUARD.md
@@ -0,0 +1,80 @@
+# IwoooS 高價值配置控管 Guard
+
+| 項目 | 內容 |
+|------|------|
+| 日期 | 2026-06-15 |
+| 狀態 | `repo_snapshot_guard_ready` |
+| 腳本 | `scripts/security/iwooos-config-control-guard.py` |
+| 模式 | repo snapshot only，不連線主機、不讀 secret、不做 runtime 動作 |
+| runtime gate | `0` |
+
+## 1. 目的
+
+此 guard 將「所有重要配置都要被資安控管」從文件盤點推進成可重複執行的驗證基線。它讀取既有 Markdown 與 JSON snapshot，確認下列配置面都有只讀控管帳本、owner gate、拒收條件與 `0 / false` 邊界：
+
+| 類別 | 代表配置面 |
+|------|------------|
+| Public gateway | Nginx、reverse proxy、公開 route、rendered diff、`nginx -t` 證據收件規則 |
+| DNS / TLS | certbot、certificate path、ACME route、renewal owner |
+| K8s / ArgoCD | production manifest、GitOps change evidence、rollback revision |
+| Secrets / Runner | workflow、runner attestation、secret name parity、injection route |
+| Runtime config | public / admin / API route、CORS、frontend env、Sentry tunnel、webhook / callback |
+| Network | SSH、sudoers、known_hosts、防火牆、NodePort、WireGuard |
+| Backup / DR | backup、restore、offsite、escrow、retention、Velero |
+| Monitoring | Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、Telegram route |
+| Cross-product | VibeWork、agent-bounty-protocol、StockPlatform、Bitan、Tsenyang 等產品邊界 |
+
+## 2. 驗證內容
+
+`iwooos-config-control-guard.py` 目前固定檢查：
+
+1. `high-value-config-control-coverage.snapshot.json` 必須有 14 類配置，C0 類別 8 個，owner response required 14 個，owner response received / accepted 為 `0 / 0`，runtime gate 與 action button 為 `0`。
+2. 每個高價值配置類別的 evidence refs 必須能在 repo 中找到對應文件、snapshot、schema、腳本或 source path。
+3. Public gateway、DNS / TLS、Docker / systemd、SSH / firewall、Backup / restore、K8s / ArgoCD、CD / runner / secret、Public runtime、Monitoring、agent-bounty-protocol 等帳本必須符合既定 schema、status、candidate count、reviewer checks、outcome lanes 與 blocked actions。
+4. 各帳本 summary 中的 `*_authorized_count`、`*_executed_count`、`*_received_count`、`*_accepted_count`、`*_allowed_count`、`runtime_gate_count`、`action_button_count`、`request_sent_count` 必須維持 `0`。
+5. `execution_boundaries` 中所有 runtime / host / workflow / secret / scan / deploy 授權旗標必須維持 `false`；只有 `not_authorization=true` 是安全宣告。
+6. `security-supply-chain-contract-manifest.snapshot.json` 必須維持 `36` 個 contract，default enforcement 為 `mirror_only`，且每個 contract 都有 forbidden actions 與存在的 schema / snapshot / human docs ref。
+
+## 3. 指令
+
+```bash
+python3 scripts/security/iwooos-config-control-guard.py --root .
+```
+
+預期輸出：
+
+```text
+IWOOOS_CONFIG_CONTROL_GUARD_OK
+```
+
+主進度 guard 已串接此 guard：
+
+```bash
+python3 scripts/security/security-mirror-progress-guard.py --root .
+```
+
+預期仍為：
+
+```text
+SECURITY_MIRROR_PROGRESS_GUARD_OK
+```
+
+## 4. 邊界
+
+此 guard 通過只代表 repo snapshot 層的配置控管基線完整，不代表：
+
+- owner response 已收到或接受。
+- Nginx reload、`nginx -t`、DNS query、TLS probe、certbot renew 已授權。
+- ArgoCD sync、kubectl、workflow 修改、runner 啟用、secret 讀取 / 輪替已授權。
+- SSH、firewall、port open / close、WireGuard / NodePort / NetworkPolicy 變更已授權。
+- backup run、restore drill、offsite sync、retention change、escrow marker write 已授權。
+- active scan、Kali `/execute`、agent-bounty runtime、payout、withdrawal 或 production deploy 已授權。
+
+## 5. 完成度
+
+| 工作 | 完成度 | 說明 |
+|------|--------|------|
+| 高價值配置集中 guard | `100%` | 已新增腳本並可獨立執行 |
+| 主進度 guard 串接 | `100%` | `security-mirror-progress-guard.py` 已呼叫此 guard |
+| dry-run 證據同步 | `100%` | `security-mirror-dry-run.snapshot.json` 已新增 `CHECK_CONFIG_CONTROL_GUARD` |
+| runtime / host / secret / scan / deploy 授權 | `0%` | 全部維持 `0 / false` |
--- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md
+++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md
@@ -210,6 +210,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
 8. Backup / restore / offsite / escrow / retention 清冊可見只代表需被控管；不得把 runbook 命令、snapshot、AwoooP approval 或 IwoooS UI 當作 backup run、restore drill、rclone sync、remote delete、restic prune、escrow marker write 或 Velero restore 授權。
 9. DNS / TLS / certbot owner response 只能收脫敏 metadata ref、coverage basis、expiry metadata、renewal owner、ACME route owner、maintenance window、rollback owner 與 validation plan；不得因 owner 回覆而自動做 DNS query、live TLS probe、certbot renew、Nginx reload、route smoke、DNS record 變更、certificate path 變更或 ACME route 變更。
 10. Public / admin / API / frontend runtime config 變更必須先通過 affected route、auth boundary、API readback、CORS diff、frontend env diff、i18n redaction、desktop / mobile smoke、sensitive string scan、rollback owner 與 post-check evidence；前台不得顯示 raw owner namespace、repo slug、內部狀態碼、內部協作內容或未脫敏截圖。
+11. 高價值配置控管必須能由 `scripts/security/iwooos-config-control-guard.py` 集中驗證；guard 通過只代表 repo snapshot 基線完整，不代表 owner response、live evidence、reload、restart、workflow / secret / runner 變更、backup / restore、scan、runtime 或 deploy 授權。

 ## 5. 需要調整的既有規範

@@ -238,6 +239,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
 | Gate → owner response packet 草案 | `100%` | 已新增 `scripts/security/high-value-config-owner-packet.py`，可將 impacted category 轉成 canonical owner response packet 草案 |
 | canonical owner 欄位對齊 | `100%` | 高價值配置 Gate 已對齊 S4.9 `owner_role_or_team`，並保留 `owner_role_team` 等 alias 支援 |
 | 全域配置覆蓋矩陣 | `100%` | 已新增 `scripts/security/high-value-config-control-coverage.py`、snapshot 與 schema，14 類高價值配置可重跑檢查 |
+| 高價值配置集中 guard | `100%` | 已新增 `scripts/security/iwooos-config-control-guard.py`，並串接 `security-mirror-progress-guard.py`；14 類配置、主要 owner / change evidence 帳本、supply-chain manifest 與 `0 / false` 邊界可集中驗證 |
 | Backup / restore / escrow 清冊 | `100%` | 已新增 `backup_restore_escrow_inventory_v1`，納入 38 個 repo-only surface；成熟度 `52% -> 58%` |
 | Backup / restore / escrow owner response acceptance | `100%` | 已新增 `backup_restore_owner_response_acceptance_v1`，38 個 candidate、27 個 write-capable、13 個 reviewer checks、7 條 outcome lanes、22 類 blocked action；成熟度 `58% -> 62%` |
 | Monitoring / alerting / observability 清冊 | `100%` | 已新增 `monitoring_alerting_observability_inventory_v1`，納入 60 個 repo-only surface；成熟度 `56% -> 62%` |
--- a/docs/security/security-mirror-dry-run.snapshot.json
+++ b/docs/security/security-mirror-dry-run.snapshot.json
@@ -127,6 +127,26 @@
        "switch_github_primary"
      ]
    },
+    {
+      "step_id": "CHECK_CONFIG_CONTROL_GUARD",
+      "expected_observation": "AwoooP dry-run 必須確認 14 類高價值配置控管 snapshot 齊備，Nginx、DNS / TLS、K8s、Secrets、runner、public runtime、防火牆、backup、monitoring 與 agent-bounty-protocol 的 owner response / change evidence 帳本仍維持只讀，不代表 reload、restart、sync、deploy、secret、scan 或 runtime gate 授權。",
+      "evidence_refs": [
+        "docs/security/high-value-config-control-coverage.snapshot.json",
+        "docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md",
+        "scripts/security/iwooos-config-control-guard.py"
+      ],
+      "pass_condition": "`python3 scripts/security/iwooos-config-control-guard.py` 回傳 IWOOOS_CONFIG_CONTROL_GUARD_OK，且 owner_response_received_count=0、owner_response_accepted_count=0、runtime_gate_count=0、action_button_count=0。",
+      "execution_allowed": false,
+      "blocked_actions": [
+        "treat_config_coverage_as_runtime_approval",
+        "reload_nginx",
+        "modify_firewall",
+        "modify_workflow_or_secret",
+        "enable_runner",
+        "run_active_scan",
+        "production_deploy"
+      ]
+    },
    {
      "step_id": "CHECK_LOW_NOISE_CHANNEL",
      "expected_observation": "Channel Event 初期只發低噪音摘要或人工批准必要事件。",
@@ -164,15 +184,16 @@
  ],
  "latest_local_validation": {
    "status": "repo_snapshot_guard_pass",
-    "date": "2026-05-18",
+    "date": "2026-06-15",
    "scope": "repo_snapshot_only",
-    "command": "python3 scripts/security/security-mirror-progress-guard.py && python3 scripts/security/source-control-owner-response-guard.py",
-    "result": "SECURITY_MIRROR_PROGRESS_GUARD_OK; SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK",
+    "command": "python3 scripts/security/security-mirror-progress-guard.py && python3 scripts/security/source-control-owner-response-guard.py && python3 scripts/security/iwooos-config-control-guard.py",
+    "result": "SECURITY_MIRROR_PROGRESS_GUARD_OK; SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK; IWOOOS_CONFIG_CONTROL_GUARD_OK",
    "validated_steps": [
      "LOAD_CONTRACT_INDEXES",
      "CHECK_ACCEPTANCE_AND_QUARANTINE",
      "CHECK_PROGRESS_GUARD",
      "CHECK_OWNER_RESPONSE_GUARD",
+      "CHECK_CONFIG_CONTROL_GUARD",
      "CONFIRM_NO_RUNTIME_ACTION"
    ],
    "runtime_actions_executed": false,