wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(iwooos): 新增端口防火牆變更證據驗收
All checks were successful
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / tests (push) Successful in 1m30s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m59s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m41s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-15 01:40:39 +08:00
parent 9c0648acb5
commit 471054b8f4
15 changed files with 3766 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/security/high-value-config-control-coverage.py
View File

@@ -156,8 +156,8 @@ CONTROL_STATUS_BY_CATEGORY = {
"next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、maintenance / restart window、rollback owner、post-check plan 與 disable switch。",
},
"ssh_firewall_network_access": {
"coverage_status": "owner_response_acceptance_ledger_ready_needs_network_owner",
"coverage_percent": 58,
"coverage_status": "change_evidence_acceptance_ready_needs_network_owner_evidence",
"coverage_percent": 60,
"evidence_refs": [
"docs/HARD_RULES.md",
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
@@ -167,9 +167,11 @@ CONTROL_STATUS_BY_CATEGORY = {
"docs/security/ssh-network-owner-request-draft.snapshot.json",
"docs/security/SSH-NETWORK-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/ssh-network-owner-response-acceptance.snapshot.json",
"docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json",
],
"current_gap": "owner response acceptance 帳本已固定 16 個 SSH / network acceptance candidate；仍缺 owner response、live access state、allowed source CIDR、host key pinning、port impact、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 validation plan。",
"next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。",
"current_gap": "owner response acceptance 帳本已固定 16 個 SSH / network acceptance candidate，端口 / 防火牆變更證據驗收帳本已固定 14 個 change evidence candidate；仍缺 owner-provided change / incident evidence、actor、before / after state、impact、cross-project sync、maintenance window、rollback owner 與 post-check evidence。",
"next_owner_action": "補端口 / 防火牆變更的 change / incident ref、actor role / team、affected scope、before / after state、service dependency、customer impact、cross-project sync、rollback owner 與 post-check 指標。",
},
"ai_provider_model_routing": {
"coverage_status": "policy_ready_needs_dry_run_pack",
@@ -329,6 +331,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]:
"owner_response_acceptance_ledger_ready_needs_runtime_evidence",
"owner_response_acceptance_ledger_ready_needs_restore_drill_owner",
"owner_response_acceptance_ledger_ready_needs_network_owner",
"change_evidence_acceptance_ready_needs_network_owner_evidence",
"policy_ready_needs_drift_evidence",
"inventory_needed",
"repo_only_inventory_ready_needs_live_owner_evidence",

410
scripts/security/port-firewall-change-evidence-acceptance.py Normal file
View File

@@ -0,0 +1,410 @@
#!/usr/bin/env python3
"""
IwoooS 端口 / 防火牆變更證據驗收只讀帳本產生器。
本工具讀取 SSH / Firewall / Network Access owner response acceptance
snapshot，建立未來端口關閉、端口開放、防火牆規則、NodePort、
NetworkPolicy 或 WireGuard 變更的 evidence acceptance ledger。它不 SSH、
不讀 live firewall、不改端口、不套用規則、不做 route smoke、不修復主機，
也不把 incident evidence 誤判成 runtime authorization。
"""
from __future__ import annotations
import argparse
import json
import subprocess
import sys
from datetime import datetime, timedelta, timezone
from pathlib import Path
from typing import Any
TAIPEI = timezone(timedelta(hours=8))
SOURCE_CONFIG_KINDS = {
"ssh_target_inventory",
"ci_deploy_ssh",
"ssh_discovery_script",
"monitoring_ssh_deploy_script",
"ssh_backup_capture",
"sudoers_policy",
"k8s_network_policy",
"k8s_nodeport_service",
"wireguard_runbook",
"alert_ssh_action_rules",
}
CHANGE_EVIDENCE_FIELDS = [
"change_evidence_candidate_id",
"source_acceptance_candidate_id",
"surface_id",
"config_kind",
"control_tier",
"write_capable_surface",
"change_or_incident_ref",
"actor_role_or_team",
"decision",
"decision_reason",
"affected_scope",
"affected_host_or_route_aliases",
"affected_ports_or_paths_ref",
"before_state_ref",
"after_state_ref",
"firewall_rule_diff_ref",
"allowlist_or_denylist_ref",
"service_dependency_ref",
"customer_impact_ref",
"monitoring_alert_refs",
"cross_project_sync_ref",
"maintenance_window",
"rollback_owner",
"rollback_plan_ref",
"validation_plan",
"postcheck_evidence_refs",
"communication_owner",
"break_glass_owner",
"change_freeze_rule",
"reviewer_outcome",
"followup_owner",
"not_approval",
]
REQUIRED_EVIDENCE_FIELDS = [
"change_or_incident_ref",
"actor_role_or_team",
"decision",
"decision_reason",
"affected_scope",
"affected_ports_or_paths_ref",
"before_state_ref",
"after_state_ref",
"service_dependency_ref",
"customer_impact_ref",
"maintenance_window",
"rollback_owner",
"rollback_plan_ref",
"validation_plan",
"postcheck_evidence_refs",
"cross_project_sync_ref",
]
REVIEWER_CHECKS = [
{"check_id": "change_ref_present", "instruction": "必須有可追溯的 change / incident ref。"},
{"check_id": "actor_role_traceable", "instruction": "必須標示 actor role / team，不接受匿名端口變更。"},
{"check_id": "decision_reason_present", "instruction": "decision 與 decision reason 必須同時存在。"},
{"check_id": "affected_scope_matches_surface", "instruction": "affected scope 必須能對回既有 SSH / network surface。"},
{"check_id": "ports_or_paths_redacted", "instruction": "端口、路徑、host alias 只能收脫敏摘要或 owner-provided ref。"},
{"check_id": "before_after_state_refs", "instruction": "需有變更前後狀態 ref，不能只有口頭說明。"},
{"check_id": "firewall_diff_metadata_only", "instruction": "firewall diff 僅收 metadata ref，不保存 raw firewall dump。"},
{"check_id": "dependency_impact_present", "instruction": "必須列出受影響服務、agent、監控、公開入口或後台路徑。"},
{"check_id": "customer_impact_review", "instruction": "若造成服務異常，需有 customer / product impact ref。"},
{"check_id": "cross_project_sync_present", "instruction": "需標示已同步受影響產品 / Session / owner，不得單點改動。"},
{"check_id": "maintenance_window_present", "instruction": "未來變更需有維護窗口；事故回補也需標記 break-glass。"},
{"check_id": "rollback_owner_present", "instruction": "rollback owner 與 rollback plan 必須同時存在。"},
{"check_id": "postcheck_evidence_present", "instruction": "post-check evidence 必須覆蓋 API / route / agent / monitoring。"},
{"check_id": "secret_or_key_value_absent", "instruction": "不得包含 secret、SSH key、token、cookie 或私鑰內容。"},
{"check_id": "no_runtime_authorization", "instruction": "驗收證據不等於允許 firewall / port / route 變更。"},
{"check_id": "counts_transition_safe", "instruction": "只有 reviewer record 能更新 accepted count，且不得同時開 runtime gate。"},
]
OUTCOME_LANES = [
{"lane_id": "waiting_change_evidence", "meaning": "尚未收到端口 / 防火牆變更證據；所有 accepted / runtime count 維持 0。"},
{"lane_id": "quarantine_raw_firewall_dump", "meaning": "收到 raw firewall dump、secret 或 key material 時只能隔離。"},
{"lane_id": "reject_unattributed_change", "meaning": "無 actor、無 owner、無 affected scope 或無 rollback 的變更不得驗收。"},
{"lane_id": "request_impact_supplement", "meaning": "缺 before/after、impact、dependency、post-check 或 cross-project sync 時要求補件。"},
{"lane_id": "ready_for_network_review", "meaning": "metadata 合格後，只能進 network / firewall reviewer review。"},
{"lane_id": "incident_backfill_only", "meaning": "事故回補只能更新只讀 ledger，不得反向視為已批准操作。"},
{"lane_id": "owner_review_only_update", "meaning": "只允許更新 reviewer ledger，不改 firewall、port、route 或 host。"},
{"lane_id": "waiting_runtime_gate", "meaning": "即使證據 accepted，runtime gate 仍需獨立人工批准。"},
]
BLOCKED_ACTIONS = [
"ssh_read",
"ssh_write",
"live_firewall_read",
"firewall_change",
"port_change",
"port_close",
"port_open",
"network_policy_apply",
"nodeport_change",
"wireguard_change",
"sudo_action",
"deploy_ssh_action",
"route_smoke",
"public_gateway_reload",
"nginx_reload",
"host_restart",
"secret_value_collection",
"ssh_key_collection",
"raw_firewall_dump_storage",
"raw_key_material_storage",
"mark_change_evidence_accepted_without_reviewer_record",
"open_runtime_gate",
"add_action_button",
"production_write",
]
def git_short_sha(root: Path) -> str:
try:
result = subprocess.run(
["git", "rev-parse", "--short", "HEAD"],
cwd=root,
check=True,
capture_output=True,
text=True,
)
return result.stdout.strip()
except Exception:
return "unknown"
def load_json(path: Path) -> dict[str, Any]:
return json.loads(path.read_text(encoding="utf-8"))
def build_candidate(source: dict[str, Any]) -> dict[str, Any]:
surface_id = source["surface_id"]
return {
"change_evidence_candidate_id": f"port_firewall_change_evidence:{surface_id}",
"status": "waiting_change_evidence",
"source_acceptance_candidate_id": source["acceptance_candidate_id"],
"surface_id": surface_id,
"config_kind": source["config_kind"],
"control_tier": source["control_tier"],
"write_capable_surface": source["write_capable_surface"],
"expected_scope": source["expected_scope"],
"change_or_incident_ref": None,
"actor_role_or_team": "pending_change_evidence",
"decision": "pending_change_evidence",
"decision_reason": "pending_change_evidence",
"affected_scope": "pending_change_evidence",
"affected_host_or_route_aliases": [],
"affected_ports_or_paths_ref": None,
"before_state_ref": None,
"after_state_ref": None,
"firewall_rule_diff_ref": None,
"allowlist_or_denylist_ref": None,
"service_dependency_ref": None,
"customer_impact_ref": None,
"monitoring_alert_refs": [],
"cross_project_sync_ref": None,
"maintenance_window": "pending_change_evidence",
"rollback_owner": "pending_change_evidence",
"rollback_plan_ref": None,
"validation_plan": "pending_change_evidence",
"postcheck_evidence_refs": [],
"communication_owner": "pending_change_evidence",
"break_glass_owner": "pending_change_evidence",
"change_freeze_rule": "pending_change_evidence",
"reviewer_outcome": "waiting_change_evidence",
"followup_owner": "pending_change_evidence",
"change_evidence_fields": CHANGE_EVIDENCE_FIELDS,
"required_evidence_fields": REQUIRED_EVIDENCE_FIELDS,
"reviewer_checks": [item["check_id"] for item in REVIEWER_CHECKS],
"outcome_lanes": [item["lane_id"] for item in OUTCOME_LANES],
"blocked_actions": BLOCKED_ACTIONS,
"not_approval": True,
"change_evidence_received": False,
"change_evidence_accepted": False,
"change_evidence_rejected": False,
"change_evidence_quarantined": False,
"impact_supplement_requested": False,
"incident_backfill_only": True,
"actor_identified": False,
"affected_scope_accepted": False,
"before_state_accepted": False,
"after_state_accepted": False,
"firewall_rule_diff_accepted": False,
"port_policy_accepted": False,
"service_dependency_accepted": False,
"customer_impact_accepted": False,
"cross_project_sync_accepted": False,
"maintenance_window_accepted": False,
"rollback_owner_accepted": False,
"rollback_plan_accepted": False,
"validation_plan_accepted": False,
"postcheck_evidence_accepted": False,
"host_write_authorized": False,
"ssh_read_authorized": False,
"ssh_write_authorized": False,
"live_firewall_read_authorized": False,
"firewall_change_authorized": False,
"port_change_authorized": False,
"port_close_authorized": False,
"port_open_authorized": False,
"network_policy_apply_authorized": False,
"nodeport_change_authorized": False,
"wireguard_change_authorized": False,
"sudo_action_authorized": False,
"deploy_ssh_action_authorized": False,
"route_smoke_authorized": False,
"public_gateway_reload_authorized": False,
"nginx_reload_authorized": False,
"host_restart_authorized": False,
"secret_value_collection_allowed": False,
"ssh_key_collection_allowed": False,
"runtime_gate": False,
"runtime_execution_authorized": False,
"production_write_authorized": False,
"action_buttons_allowed": False,
}
def build_report(root: Path, source_report: dict[str, Any], generated_at: str | None) -> dict[str, Any]:
report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds")
source_candidates = [
item
for item in source_report.get("acceptance_candidates", [])
if item.get("config_kind") in SOURCE_CONFIG_KINDS
]
change_candidates = [build_candidate(item) for item in source_candidates]
write_capable = [item for item in change_candidates if item["write_capable_surface"]]
policy_or_exposure = [
item
for item in change_candidates
if item["config_kind"] in {"k8s_network_policy", "k8s_nodeport_service", "wireguard_runbook"}
]
return {
"schema_version": "port_firewall_change_evidence_acceptance_v1",
"generated_at": report_time,
"git_commit": git_short_sha(root),
"source_acceptance_schema_version": source_report.get("schema_version"),
"source_acceptance_status": source_report.get("status"),
"status": "change_evidence_acceptance_ready_no_runtime_action",
"summary": {
"source_acceptance_candidate_count": source_report.get("summary", {}).get("acceptance_candidate_count", 0),
"change_evidence_candidate_count": len(change_candidates),
"write_capable_change_evidence_candidate_count": len(write_capable),
"policy_or_exposure_candidate_count": len(policy_or_exposure),
"change_evidence_field_count": len(CHANGE_EVIDENCE_FIELDS),
"required_evidence_field_count": len(REQUIRED_EVIDENCE_FIELDS),
"reviewer_check_count": len(REVIEWER_CHECKS),
"outcome_lane_count": len(OUTCOME_LANES),
"blocked_action_count": len(BLOCKED_ACTIONS),
"change_evidence_received_count": 0,
"change_evidence_accepted_count": 0,
"change_evidence_rejected_count": 0,
"change_evidence_quarantined_count": 0,
"impact_supplement_requested_count": 0,
"actor_identified_count": 0,
"affected_scope_accepted_count": 0,
"before_state_accepted_count": 0,
"after_state_accepted_count": 0,
"firewall_rule_diff_accepted_count": 0,
"port_policy_accepted_count": 0,
"service_dependency_accepted_count": 0,
"customer_impact_accepted_count": 0,
"cross_project_sync_accepted_count": 0,
"maintenance_window_accepted_count": 0,
"rollback_owner_accepted_count": 0,
"rollback_plan_accepted_count": 0,
"validation_plan_accepted_count": 0,
"postcheck_evidence_accepted_count": 0,
"host_write_authorized_count": 0,
"ssh_read_authorized_count": 0,
"ssh_write_authorized_count": 0,
"live_firewall_read_authorized_count": 0,
"firewall_change_authorized_count": 0,
"port_change_authorized_count": 0,
"port_close_authorized_count": 0,
"port_open_authorized_count": 0,
"network_policy_apply_authorized_count": 0,
"nodeport_change_authorized_count": 0,
"wireguard_change_authorized_count": 0,
"sudo_action_authorized_count": 0,
"deploy_ssh_action_authorized_count": 0,
"route_smoke_authorized_count": 0,
"public_gateway_reload_authorized_count": 0,
"nginx_reload_authorized_count": 0,
"host_restart_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"ssh_key_collection_allowed_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
},
"execution_boundaries": {
"change_evidence_acceptance_authorized": False,
"runtime_execution_authorized": False,
"production_write_authorized": False,
"live_host_read_authorized": False,
"host_write_authorized": False,
"ssh_read_authorized": False,
"ssh_write_authorized": False,
"live_firewall_read_authorized": False,
"firewall_change_authorized": False,
"port_change_authorized": False,
"port_close_authorized": False,
"port_open_authorized": False,
"network_policy_apply_authorized": False,
"nodeport_change_authorized": False,
"wireguard_change_authorized": False,
"sudo_action_authorized": False,
"deploy_ssh_action_authorized": False,
"route_smoke_authorized": False,
"public_gateway_reload_authorized": False,
"nginx_reload_authorized": False,
"host_restart_authorized": False,
"secret_value_collection_allowed": False,
"ssh_key_collection_allowed": False,
"action_buttons_allowed": False,
"not_authorization": True,
},
"change_evidence_fields": CHANGE_EVIDENCE_FIELDS,
"required_evidence_fields": REQUIRED_EVIDENCE_FIELDS,
"reviewer_checks": REVIEWER_CHECKS,
"outcome_lanes": OUTCOME_LANES,
"blocked_actions": BLOCKED_ACTIONS,
"change_evidence_candidates": change_candidates,
"next_steps": [
"等待 owner-provided change / incident evidence；未收到前不得更新 accepted count。",
"收到證據後先檢查 actor、affected scope、before / after state、impact、rollback、post-check 與 cross-project sync。",
"metadata 合格也只能進 network / firewall reviewer review；端口、防火牆、NetworkPolicy、NodePort、WireGuard 與 route smoke 仍需獨立人工批准。",
],
}
def main() -> int:
parser = argparse.ArgumentParser(description="IwoooS 端口 / 防火牆變更證據驗收只讀帳本產生器")
parser.add_argument("--root", default=".", help="repo root")
parser.add_argument(
"--source-acceptance-report",
default="docs/security/ssh-network-owner-response-acceptance.snapshot.json",
help="ssh-network-owner-response-acceptance.py 輸出的 JSON",
)
parser.add_argument("--output", help="寫出 JSON 報告")
parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用")
args = parser.parse_args()
root = Path(args.root).resolve()
source_report = load_json(root / args.source_acceptance_report)
report = build_report(root, source_report, args.generated_at)
payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True)
if args.output:
output = Path(args.output)
output.parent.mkdir(parents=True, exist_ok=True)
output.write_text(payload + "\n", encoding="utf-8")
else:
print(payload)
summary = report["summary"]
print(
"PORT_FIREWALL_CHANGE_EVIDENCE_ACCEPTANCE_OK "
f"candidates={summary['change_evidence_candidate_count']} "
f"write_capable={summary['write_capable_change_evidence_candidate_count']} "
f"policy_or_exposure={summary['policy_or_exposure_candidate_count']} "
f"checks={summary['reviewer_check_count']} "
f"lanes={summary['outcome_lane_count']} "
f"accepted={summary['change_evidence_accepted_count']} "
f"runtime_gate={summary['runtime_gate_count']}",
file=sys.stderr,
)
return 0
if __name__ == "__main__":
sys.exit(main())

246
scripts/security/security-mirror-progress-guard.py
View File

@@ -111,6 +111,9 @@ def validate(root: Path) -> None:
ssh_network_owner_response_acceptance = load_json(
security_dir / "ssh-network-owner-response-acceptance.snapshot.json"
)
port_firewall_change_evidence_acceptance = load_json(
security_dir / "port-firewall-change-evidence-acceptance.snapshot.json"
)
backup_restore_escrow_inventory = load_json(security_dir / "backup-restore-escrow-inventory.snapshot.json")
backup_restore_owner_request_draft = load_json(
security_dir / "backup-restore-owner-request-draft.snapshot.json"
@@ -2855,18 +2858,20 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.coverage_categories.ssh_network.coverage_percent",
ssh_network_category["coverage_percent"],
58,
60,
)
assert_equal(
"high_value_config_coverage.coverage_categories.ssh_network.coverage_status",
ssh_network_category["coverage_status"],
"owner_response_acceptance_ledger_ready_needs_network_owner",
"change_evidence_acceptance_ready_needs_network_owner_evidence",
)
for evidence_ref in [
"docs/security/SSH-NETWORK-ACCESS-INVENTORY.md",
"docs/security/ssh-network-access-inventory.snapshot.json",
"docs/security/SSH-NETWORK-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/ssh-network-owner-response-acceptance.snapshot.json",
"docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json",
]:
assert_contains(
"high_value_config_coverage.coverage_categories.ssh_network.evidence_refs",
@@ -3785,6 +3790,207 @@ def validate(root: Path) -> None:
f"ssh_network_owner_response_acceptance.{item['acceptance_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"port_firewall_change_evidence_acceptance.schema",
port_firewall_change_evidence_acceptance["schema_version"],
"port_firewall_change_evidence_acceptance_v1",
)
assert_equal(
"port_firewall_change_evidence_acceptance.status",
port_firewall_change_evidence_acceptance["status"],
"change_evidence_acceptance_ready_no_runtime_action",
)
assert_equal(
"port_firewall_change_evidence_acceptance.source_acceptance_schema_version",
port_firewall_change_evidence_acceptance["source_acceptance_schema_version"],
"ssh_network_owner_response_acceptance_v1",
)
assert_equal(
"port_firewall_change_evidence_acceptance.source_acceptance_status",
port_firewall_change_evidence_acceptance["source_acceptance_status"],
"owner_response_acceptance_ledger_ready_no_runtime_action",
)
expected_port_firewall_change_evidence_summary = {
"source_acceptance_candidate_count": 16,
"change_evidence_candidate_count": 14,
"write_capable_change_evidence_candidate_count": 6,
"policy_or_exposure_candidate_count": 5,
"change_evidence_field_count": 32,
"required_evidence_field_count": 16,
"reviewer_check_count": 16,
"outcome_lane_count": 8,
"blocked_action_count": 24,
"change_evidence_received_count": 0,
"change_evidence_accepted_count": 0,
"change_evidence_rejected_count": 0,
"change_evidence_quarantined_count": 0,
"impact_supplement_requested_count": 0,
"actor_identified_count": 0,
"affected_scope_accepted_count": 0,
"before_state_accepted_count": 0,
"after_state_accepted_count": 0,
"firewall_rule_diff_accepted_count": 0,
"port_policy_accepted_count": 0,
"service_dependency_accepted_count": 0,
"customer_impact_accepted_count": 0,
"cross_project_sync_accepted_count": 0,
"maintenance_window_accepted_count": 0,
"rollback_owner_accepted_count": 0,
"rollback_plan_accepted_count": 0,
"validation_plan_accepted_count": 0,
"postcheck_evidence_accepted_count": 0,
"host_write_authorized_count": 0,
"ssh_read_authorized_count": 0,
"ssh_write_authorized_count": 0,
"live_firewall_read_authorized_count": 0,
"firewall_change_authorized_count": 0,
"port_change_authorized_count": 0,
"port_close_authorized_count": 0,
"port_open_authorized_count": 0,
"network_policy_apply_authorized_count": 0,
"nodeport_change_authorized_count": 0,
"wireguard_change_authorized_count": 0,
"sudo_action_authorized_count": 0,
"deploy_ssh_action_authorized_count": 0,
"route_smoke_authorized_count": 0,
"public_gateway_reload_authorized_count": 0,
"nginx_reload_authorized_count": 0,
"host_restart_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"ssh_key_collection_allowed_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
}
for key, expected in expected_port_firewall_change_evidence_summary.items():
assert_equal(
f"port_firewall_change_evidence_acceptance.summary.{key}",
port_firewall_change_evidence_acceptance["summary"][key],
expected,
)
for key, value in port_firewall_change_evidence_acceptance["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"port_firewall_change_evidence_acceptance.execution_boundaries.{key}", value)
else:
assert_false(f"port_firewall_change_evidence_acceptance.execution_boundaries.{key}", value)
assert_equal(
"port_firewall_change_evidence_acceptance.change_evidence_candidates.count",
len(port_firewall_change_evidence_acceptance["change_evidence_candidates"]),
14,
)
port_firewall_change_candidate_ids = [
item["change_evidence_candidate_id"]
for item in port_firewall_change_evidence_acceptance["change_evidence_candidates"]
]
for change_evidence_candidate_id in [
"port_firewall_change_evidence:deploy_alerts_ssh_path",
"port_firewall_change_evidence:host_ops_sudoers_wrapper",
"port_firewall_change_evidence:argocd_metrics_nodeport",
"port_firewall_change_evidence:velero_metrics_nodeport",
"port_firewall_change_evidence:wireguard_mesh_runbook",
"port_firewall_change_evidence:alert_rules_ssh_actions",
]:
assert_contains(
"port_firewall_change_evidence_acceptance.change_evidence_candidates",
port_firewall_change_candidate_ids,
change_evidence_candidate_id,
)
assert_equal(
"port_firewall_change_evidence_acceptance.reviewer_checks.count",
len(port_firewall_change_evidence_acceptance["reviewer_checks"]),
16,
)
assert_equal(
"port_firewall_change_evidence_acceptance.outcome_lanes.count",
len(port_firewall_change_evidence_acceptance["outcome_lanes"]),
8,
)
assert_equal(
"port_firewall_change_evidence_acceptance.blocked_actions.count",
len(port_firewall_change_evidence_acceptance["blocked_actions"]),
24,
)
for item in port_firewall_change_evidence_acceptance["change_evidence_candidates"]:
assert_equal(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.change_evidence_fields",
len(item["change_evidence_fields"]),
32,
)
assert_equal(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.required_evidence_fields",
len(item["required_evidence_fields"]),
16,
)
assert_equal(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.reviewer_checks",
len(item["reviewer_checks"]),
16,
)
assert_equal(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.outcome_lanes",
len(item["outcome_lanes"]),
8,
)
assert_equal(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.blocked_actions",
len(item["blocked_actions"]),
24,
)
assert_true(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.not_approval",
item["not_approval"],
)
assert_true(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.incident_backfill_only",
item["incident_backfill_only"],
)
for false_key in [
"change_evidence_received",
"change_evidence_accepted",
"change_evidence_rejected",
"change_evidence_quarantined",
"impact_supplement_requested",
"actor_identified",
"affected_scope_accepted",
"before_state_accepted",
"after_state_accepted",
"firewall_rule_diff_accepted",
"port_policy_accepted",
"service_dependency_accepted",
"customer_impact_accepted",
"cross_project_sync_accepted",
"maintenance_window_accepted",
"rollback_owner_accepted",
"rollback_plan_accepted",
"validation_plan_accepted",
"postcheck_evidence_accepted",
"host_write_authorized",
"ssh_read_authorized",
"ssh_write_authorized",
"live_firewall_read_authorized",
"firewall_change_authorized",
"port_change_authorized",
"port_close_authorized",
"port_open_authorized",
"network_policy_apply_authorized",
"nodeport_change_authorized",
"wireguard_change_authorized",
"sudo_action_authorized",
"deploy_ssh_action_authorized",
"route_smoke_authorized",
"public_gateway_reload_authorized",
"nginx_reload_authorized",
"host_restart_authorized",
"secret_value_collection_allowed",
"ssh_key_collection_allowed",
"runtime_gate",
"runtime_execution_authorized",
"production_write_authorized",
"action_buttons_allowed",
]:
assert_false(
f"port_firewall_change_evidence_acceptance.{item['change_evidence_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"backup_restore_escrow_inventory.schema",
backup_restore_escrow_inventory["schema_version"],
@@ -5480,6 +5686,8 @@ def validate(root: Path) -> None:
"docs/schemas/host_service_config_inventory_v1.schema.json",
"docs/security/ssh-network-access-inventory.snapshot.json",
"docs/security/SSH-NETWORK-ACCESS-INVENTORY.md",
"docs/security/port-firewall-change-evidence-acceptance.snapshot.json",
"docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/schemas/ssh_network_access_inventory_v1.schema.json",
"docs/security/backup-restore-escrow-inventory.snapshot.json",
"docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md",
@@ -5592,6 +5800,22 @@ def validate(root: Path) -> None:
"ssh_network_owner_response_acceptance_runtime_gate_count": 0,
"ssh_network_owner_response_acceptance_action_button_count": 0,
"ssh_network_owner_response_acceptance_coverage_percent_after_acceptance": 58,
"port_firewall_change_evidence_acceptance_first_layer": True,
"port_firewall_change_evidence_acceptance_candidate_count": 14,
"port_firewall_change_evidence_acceptance_write_capable_candidate_count": 6,
"port_firewall_change_evidence_acceptance_policy_or_exposure_candidate_count": 5,
"port_firewall_change_evidence_acceptance_required_evidence_field_count": 16,
"port_firewall_change_evidence_acceptance_reviewer_check_count": 16,
"port_firewall_change_evidence_acceptance_outcome_lane_count": 8,
"port_firewall_change_evidence_acceptance_blocked_action_count": 24,
"port_firewall_change_evidence_acceptance_received_count": 0,
"port_firewall_change_evidence_acceptance_accepted_count": 0,
"port_firewall_change_evidence_acceptance_actor_identified_count": 0,
"port_firewall_change_evidence_acceptance_cross_project_sync_accepted_count": 0,
"port_firewall_change_evidence_acceptance_postcheck_evidence_accepted_count": 0,
"port_firewall_change_evidence_acceptance_runtime_gate_count": 0,
"port_firewall_change_evidence_acceptance_action_button_count": 0,
"port_firewall_change_evidence_acceptance_coverage_percent_after_acceptance": 60,
}
for key, expected in expected_ssh_network_projection_summary.items():
assert_equal(
@@ -15132,7 +15356,7 @@ def validate(root: Path) -> None:
assert_text_contains(
"iwooos_page.high_value_config_control_coverage_ssh_network_percent",
iwooos_projection_page,
"{ key: 'sshNetwork', rank: 'P1-2', value: '58%'",
"{ key: 'sshNetwork', rank: 'P1-2', value: '60%'",
)
assert_text_contains(
"iwooos_page.high_value_config_control_coverage_backup_restore_percent",
@@ -15188,6 +15412,19 @@ def validate(root: Path) -> None:
"ssh_network_owner_response_acceptance_firewall_owner_accepted_count=0",
"ssh_network_owner_response_acceptance_port_policy_accepted_count=0",
"ssh_network_owner_response_acceptance_wireguard_cutover_accepted_count=0",
"port_firewall_change_evidence_acceptance_candidate_count=14",
"port_firewall_change_evidence_acceptance_write_capable_candidate_count=6",
"port_firewall_change_evidence_acceptance_policy_or_exposure_candidate_count=5",
"port_firewall_change_evidence_acceptance_required_evidence_field_count=16",
"port_firewall_change_evidence_acceptance_reviewer_check_count=16",
"port_firewall_change_evidence_acceptance_outcome_lane_count=8",
"port_firewall_change_evidence_acceptance_blocked_action_count=24",
"port_firewall_change_evidence_acceptance_received_count=0",
"port_firewall_change_evidence_acceptance_accepted_count=0",
"port_firewall_change_evidence_acceptance_actor_identified_count=0",
"port_firewall_change_evidence_acceptance_cross_project_sync_accepted_count=0",
"port_firewall_change_evidence_acceptance_postcheck_evidence_accepted_count=0",
"port_firewall_change_evidence_acceptance_runtime_gate_count=0",
"backup_restore_escrow_inventory_surface_count=38",
"backup_restore_escrow_inventory_write_capable_surface_count=27",
"backup_restore_escrow_inventory_runtime_gate_count=0",
@@ -15211,6 +15448,9 @@ def validate(root: Path) -> None:
"ssh_write_authorized=false",
"sudo_action_authorized=false",
"firewall_change_authorized=false",
"port_change_authorized=false",
"port_close_authorized=false",
"port_open_authorized=false",
"network_policy_apply_authorized=false",
"nodeport_change_authorized=false",
"wireguard_change_authorized=false",