wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): 新增 Nginx 事故回讀 gate
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / tests (push) Successful in 1m36s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m49s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m48s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-16 10:31:13 +08:00
parent a0f7931550
commit 5254a0c88b
16 changed files with 2410 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

359
scripts/security/security-mirror-progress-guard.py
View File

@@ -234,6 +234,9 @@ def validate(root: Path) -> None:
public_gateway_rendered_diff_acceptance = load_json(
security_dir / "public-gateway-rendered-diff-acceptance.snapshot.json"
)
public_gateway_post_incident_readback_plan = load_json(
security_dir / "public-gateway-post-incident-readback-plan.snapshot.json"
)
s49_request_draft = load_json(security_dir / "gitea-inventory-owner-attestation-request-draft.snapshot.json")
kali_status = load_json(security_dir / "kali-integration-status.snapshot.json")
iwooos_projection_page = (
@@ -3036,12 +3039,12 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.coverage_categories.nginx.coverage_percent",
nginx_gateway_category["coverage_percent"],
90,
92,
)
assert_equal(
"high_value_config_coverage.coverage_categories.nginx.coverage_status",
nginx_gateway_category["coverage_status"],
"emergency_change_backfill_ready_needs_owner_live_diff",
"post_incident_readback_plan_ready_needs_public_gateway_owner_evidence",
)
for evidence_ref in [
"docs/security/PUBLIC-GATEWAY-PREFLIGHT-INVENTORY.md",
@@ -3050,6 +3053,8 @@ def validate(root: Path) -> None:
"docs/security/public-gateway-owner-response-acceptance.snapshot.json",
"docs/security/PUBLIC-GATEWAY-RENDERED-DIFF-ACCEPTANCE.md",
"docs/security/public-gateway-rendered-diff-acceptance.snapshot.json",
"docs/security/PUBLIC-GATEWAY-POST-INCIDENT-READBACK-PLAN.md",
"docs/security/public-gateway-post-incident-readback-plan.snapshot.json",
"docs/schemas/public_gateway_preflight_inventory_v1.schema.json",
]:
assert_contains(
@@ -7120,6 +7125,288 @@ def validate(root: Path) -> None:
f"public_gateway_rendered_diff_acceptance.{item['diff_acceptance_id']}.{false_key}",
item[false_key],
)
assert_equal(
"public_gateway_post_incident_readback_plan.schema",
public_gateway_post_incident_readback_plan["schema_version"],
"public_gateway_post_incident_readback_plan_v1",
)
assert_equal(
"public_gateway_post_incident_readback_plan.source_schema_version",
public_gateway_post_incident_readback_plan["source_schema_version"],
"public_gateway_rendered_diff_acceptance_v1",
)
assert_equal(
"public_gateway_post_incident_readback_plan.status",
public_gateway_post_incident_readback_plan["status"],
"post_incident_readback_plan_ready_no_runtime_action",
)
expected_public_gateway_post_incident_readback_summary = {
"source_diff_acceptance_candidate_count": 3,
"source_c0_diff_acceptance_candidate_count": 2,
"source_c1_diff_acceptance_candidate_count": 1,
"source_required_evidence_field_count": 14,
"source_reviewer_check_count": 15,
"source_blocked_action_count": 22,
"source_rendered_diff_accepted_count": 0,
"source_nginx_test_evidence_accepted_count": 0,
"source_route_smoke_result_accepted_count": 0,
"source_runtime_gate_count": 0,
"readback_candidate_count": 3,
"c0_readback_candidate_count": 2,
"c1_readback_candidate_count": 1,
"write_capable_readback_candidate_count": 3,
"route_health_review_required_candidate_count": 3,
"upstream_websocket_tls_review_required_candidate_count": 3,
"ai_monitoring_cross_project_review_required_candidate_count": 3,
"no_false_green_required_candidate_count": 3,
"readback_field_count": 36,
"required_readback_field_count": 30,
"reviewer_check_count": 28,
"outcome_lane_count": 10,
"blocked_action_count": 41,
"post_incident_readback_received_count": 0,
"post_incident_readback_accepted_count": 0,
"actor_attribution_accepted_count": 0,
"change_time_window_accepted_count": 0,
"intent_or_break_glass_accepted_count": 0,
"before_after_route_state_accepted_count": 0,
"source_live_diff_state_accepted_count": 0,
"nginx_test_readback_accepted_count": 0,
"nginx_reload_or_no_reload_accepted_count": 0,
"route_smoke_readback_accepted_count": 0,
"tls_acme_readback_accepted_count": 0,
"websocket_readback_accepted_count": 0,
"upstream_health_accepted_count": 0,
"public_admin_api_route_impact_accepted_count": 0,
"ai_provider_impact_accepted_count": 0,
"monitoring_alert_accepted_count": 0,
"operator_notification_accepted_count": 0,
"cross_project_sync_accepted_count": 0,
"rollback_validation_accepted_count": 0,
"post_change_monitoring_accepted_count": 0,
"recovery_or_still_degraded_accepted_count": 0,
"postcheck_readback_accepted_count": 0,
"recurrence_guard_accepted_count": 0,
"no_false_green_accepted_count": 0,
"host_live_conf_read_authorized_count": 0,
"nginx_test_authorized_count": 0,
"nginx_test_executed_count": 0,
"nginx_reload_authorized_count": 0,
"nginx_reload_executed_count": 0,
"public_gateway_reload_authorized_count": 0,
"route_smoke_authorized_count": 0,
"route_smoke_executed_count": 0,
"dns_tls_probe_authorized_count": 0,
"certbot_renew_authorized_count": 0,
"public_route_change_authorized_count": 0,
"admin_route_change_authorized_count": 0,
"websocket_route_change_authorized_count": 0,
"acme_challenge_change_authorized_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
"coverage_percent_after_readback_plan": 92,
}
for key, expected in expected_public_gateway_post_incident_readback_summary.items():
assert_equal(
f"public_gateway_post_incident_readback_plan.summary.{key}",
public_gateway_post_incident_readback_plan["summary"][key],
expected,
)
for key, value in public_gateway_post_incident_readback_plan["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"public_gateway_post_incident_readback_plan.execution_boundaries.{key}", value)
else:
assert_false(f"public_gateway_post_incident_readback_plan.execution_boundaries.{key}", value)
expected_public_gateway_post_incident_readback_ids = [
"public_gateway_post_incident_readback:host188_all_sites",
"public_gateway_post_incident_readback:host188_internal_tools_https",
"public_gateway_post_incident_readback:host110_ollama_proxy",
]
assert_equal(
"public_gateway_post_incident_readback_plan.readback_candidate_ids",
[
item["post_incident_readback_candidate_id"]
for item in public_gateway_post_incident_readback_plan["readback_candidates"]
],
expected_public_gateway_post_incident_readback_ids,
)
expected_public_gateway_post_incident_reviewer_checks = [
"source_diff_acceptance_current",
"incident_or_change_ref_present",
"actor_attribution_present",
"change_time_window_present",
"intent_or_break_glass_present",
"before_after_route_state_present",
"source_live_diff_state_present",
"nginx_test_readback_is_owner_provided",
"reload_or_no_reload_called_out",
"route_smoke_readback_present",
"tls_acme_readback_present",
"websocket_readback_present",
"upstream_health_present",
"public_admin_api_route_impact_present",
"ai_provider_impact_present",
"monitoring_alert_present",
"operator_notification_present",
"cross_project_sync_present",
"rollback_validation_present",
"post_change_monitoring_present",
"recovery_or_still_degraded_present",
"postcheck_independent",
"recurrence_guard_present",
"maintenance_window_present",
"no_false_green",
"raw_payload_absent",
"runtime_stays_zero",
"counts_transition_safe",
]
assert_equal(
"public_gateway_post_incident_readback_plan.reviewer_check_ids",
[item["check_id"] for item in public_gateway_post_incident_readback_plan["reviewer_checks"]],
expected_public_gateway_post_incident_reviewer_checks,
)
expected_public_gateway_post_incident_outcome_lanes = [
"waiting_post_incident_readback",
"request_actor_or_time_supplement",
"request_route_state_supplement",
"request_diff_test_supplement",
"request_dependency_supplement",
"quarantine_raw_payload",
"reject_false_green_claim",
"ready_for_gateway_post_incident_review",
"recurrence_guard_backfill_required",
"waiting_runtime_gate",
]
assert_equal(
"public_gateway_post_incident_readback_plan.outcome_lane_ids",
[item["lane_id"] for item in public_gateway_post_incident_readback_plan["outcome_lanes"]],
expected_public_gateway_post_incident_outcome_lanes,
)
expected_public_gateway_post_incident_blocked_actions = [
"ssh_read_live_nginx_conf",
"store_raw_live_conf",
"store_full_rendered_diff_payload",
"collect_secret_value",
"collect_private_key",
"collect_certificate_body",
"collect_cookie_or_token",
"run_nginx_test",
"reload_nginx",
"restart_nginx",
"change_nginx_site_enabled",
"change_public_route",
"change_admin_route",
"change_api_route",
"change_websocket_route",
"change_acme_challenge_route",
"change_upstream",
"change_dns_record",
"tls_probe",
"dns_probe",
"certbot_renew",
"certbot_reconfigure",
"route_smoke",
"websocket_smoke",
"host_write",
"firewall_change",
"docker_restart",
"systemd_restart",
"argocd_sync",
"kubectl_apply",
"accept_route_200_as_all_green",
"accept_nginx_active_as_all_green",
"accept_dashboard_up_as_security_acceptance",
"accept_cd_success_as_security_acceptance",
"skip_cross_project_sync",
"skip_operator_notification",
"skip_rollback_validation",
"skip_post_change_monitoring",
"mark_readback_accepted_without_reviewer_record",
"open_runtime_gate",
"add_action_button",
]
assert_equal(
"public_gateway_post_incident_readback_plan.blocked_actions",
public_gateway_post_incident_readback_plan["blocked_actions"],
expected_public_gateway_post_incident_blocked_actions,
)
for item in public_gateway_post_incident_readback_plan["readback_candidates"]:
assert_equal(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.field_count",
len(item["readback_fields"]),
36,
)
assert_equal(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.required_readback_fields",
len(item["required_readback_fields"]),
30,
)
assert_equal(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.reviewer_checks",
len(item["reviewer_checks"]),
28,
)
assert_equal(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.outcome_lanes",
len(item["outcome_lanes"]),
10,
)
assert_equal(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.blocked_actions",
len(item["blocked_actions"]),
41,
)
assert_true(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.not_approval",
item["not_approval"],
)
for false_key in [
"post_incident_readback_received",
"post_incident_readback_accepted",
"actor_attribution_accepted",
"change_time_window_accepted",
"intent_or_break_glass_accepted",
"before_after_route_state_accepted",
"source_live_diff_state_accepted",
"nginx_test_readback_accepted",
"nginx_reload_or_no_reload_accepted",
"route_smoke_readback_accepted",
"tls_acme_readback_accepted",
"websocket_readback_accepted",
"upstream_health_accepted",
"public_admin_api_route_impact_accepted",
"ai_provider_impact_accepted",
"monitoring_alert_accepted",
"operator_notification_accepted",
"cross_project_sync_accepted",
"rollback_validation_accepted",
"post_change_monitoring_accepted",
"recovery_or_still_degraded_accepted",
"postcheck_readback_accepted",
"recurrence_guard_accepted",
"no_false_green_accepted",
"host_live_conf_read_authorized",
"nginx_test_authorized",
"nginx_test_executed",
"nginx_reload_authorized",
"nginx_reload_executed",
"public_gateway_reload_authorized",
"route_smoke_authorized",
"route_smoke_executed",
"dns_tls_probe_authorized",
"certbot_renew_authorized",
"public_route_change_authorized",
"admin_route_change_authorized",
"websocket_route_change_authorized",
"acme_challenge_change_authorized",
"production_write_authorized",
"runtime_gate",
"action_buttons_allowed",
]:
assert_false(
f"public_gateway_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.{false_key}",
item[false_key],
)
for source_path in [
"docs/security/public-gateway-preflight-inventory.snapshot.json",
"docs/security/PUBLIC-GATEWAY-PREFLIGHT-INVENTORY.md",
@@ -7127,6 +7414,8 @@ def validate(root: Path) -> None:
"docs/security/PUBLIC-GATEWAY-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/public-gateway-rendered-diff-acceptance.snapshot.json",
"docs/security/PUBLIC-GATEWAY-RENDERED-DIFF-ACCEPTANCE.md",
"docs/security/public-gateway-post-incident-readback-plan.snapshot.json",
"docs/security/PUBLIC-GATEWAY-POST-INCIDENT-READBACK-PLAN.md",
"docs/schemas/public_gateway_preflight_inventory_v1.schema.json",
"docs/security/k8s-argocd-owner-response-acceptance.snapshot.json",
"docs/security/K8S-ARGOCD-OWNER-RESPONSE-ACCEPTANCE.md",
@@ -7677,6 +7966,53 @@ def validate(root: Path) -> None:
iwooos_projection["summary"][key],
expected,
)
expected_public_gateway_post_incident_projection_summary = {
"nginx_public_gateway_coverage_percent": 92,
"public_gateway_post_incident_readback_plan_candidate_count": 3,
"public_gateway_post_incident_readback_plan_c0_candidate_count": 2,
"public_gateway_post_incident_readback_plan_write_capable_candidate_count": 3,
"public_gateway_post_incident_readback_plan_required_readback_field_count": 30,
"public_gateway_post_incident_readback_plan_reviewer_check_count": 28,
"public_gateway_post_incident_readback_plan_outcome_lane_count": 10,
"public_gateway_post_incident_readback_plan_blocked_action_count": 41,
"public_gateway_post_incident_readback_plan_post_incident_readback_received_count": 0,
"public_gateway_post_incident_readback_plan_post_incident_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_actor_attribution_accepted_count": 0,
"public_gateway_post_incident_readback_plan_before_after_route_state_accepted_count": 0,
"public_gateway_post_incident_readback_plan_source_live_diff_state_accepted_count": 0,
"public_gateway_post_incident_readback_plan_nginx_test_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_nginx_reload_or_no_reload_accepted_count": 0,
"public_gateway_post_incident_readback_plan_route_smoke_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_tls_acme_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_websocket_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_upstream_health_accepted_count": 0,
"public_gateway_post_incident_readback_plan_public_admin_api_route_impact_accepted_count": 0,
"public_gateway_post_incident_readback_plan_ai_provider_impact_accepted_count": 0,
"public_gateway_post_incident_readback_plan_monitoring_alert_accepted_count": 0,
"public_gateway_post_incident_readback_plan_operator_notification_accepted_count": 0,
"public_gateway_post_incident_readback_plan_cross_project_sync_accepted_count": 0,
"public_gateway_post_incident_readback_plan_rollback_validation_accepted_count": 0,
"public_gateway_post_incident_readback_plan_post_change_monitoring_accepted_count": 0,
"public_gateway_post_incident_readback_plan_postcheck_readback_accepted_count": 0,
"public_gateway_post_incident_readback_plan_recurrence_guard_accepted_count": 0,
"public_gateway_post_incident_readback_plan_no_false_green_accepted_count": 0,
"public_gateway_post_incident_readback_plan_host_live_conf_read_authorized_count": 0,
"public_gateway_post_incident_readback_plan_nginx_test_authorized_count": 0,
"public_gateway_post_incident_readback_plan_nginx_reload_authorized_count": 0,
"public_gateway_post_incident_readback_plan_public_gateway_reload_authorized_count": 0,
"public_gateway_post_incident_readback_plan_route_smoke_authorized_count": 0,
"public_gateway_post_incident_readback_plan_dns_tls_probe_authorized_count": 0,
"public_gateway_post_incident_readback_plan_certbot_renew_authorized_count": 0,
"public_gateway_post_incident_readback_plan_runtime_gate_count": 0,
"public_gateway_post_incident_readback_plan_action_button_count": 0,
"public_gateway_post_incident_readback_plan_coverage_percent_after_readback_plan": 92,
}
for key, expected in expected_public_gateway_post_incident_projection_summary.items():
assert_equal(
f"iwooos_projection.summary.{key}",
iwooos_projection["summary"][key],
expected,
)
assert_true(
"iwooos_projection.summary.high_value_config_owner_packet_first_layer",
iwooos_projection["summary"]["high_value_config_owner_packet_first_layer"],
@@ -17298,7 +17634,7 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_owner_response_accepted_count=0",
"high_value_config_control_coverage_runtime_gate_count=0",
"high_value_config_control_coverage_action_button_count=0",
"nginx_public_gateway_coverage_percent=90",
"nginx_public_gateway_coverage_percent=92",
"public_gateway_owner_response_acceptance_required_owner_response_field_count=22",
"public_gateway_owner_response_acceptance_reviewer_check_count=22",
"public_gateway_owner_response_acceptance_outcome_lane_count=8",
@@ -17411,6 +17747,18 @@ def validate(root: Path) -> None:
"public_gateway_rendered_diff_acceptance_candidate_count=3",
"public_gateway_rendered_diff_acceptance_reviewer_check_count=15",
"public_gateway_rendered_diff_acceptance_runtime_gate_count=0",
"public_gateway_post_incident_readback_plan_candidate_count=3",
"public_gateway_post_incident_readback_plan_c0_candidate_count=2",
"public_gateway_post_incident_readback_plan_required_readback_field_count=30",
"public_gateway_post_incident_readback_plan_reviewer_check_count=28",
"public_gateway_post_incident_readback_plan_outcome_lane_count=10",
"public_gateway_post_incident_readback_plan_blocked_action_count=41",
"public_gateway_post_incident_readback_plan_post_incident_readback_received_count=0",
"public_gateway_post_incident_readback_plan_post_incident_readback_accepted_count=0",
"public_gateway_post_incident_readback_plan_nginx_test_authorized_count=0",
"public_gateway_post_incident_readback_plan_nginx_reload_authorized_count=0",
"public_gateway_post_incident_readback_plan_route_smoke_authorized_count=0",
"public_gateway_post_incident_readback_plan_runtime_gate_count=0",
"public_gateway_preflight_inventory_source_config_count=3",
"public_gateway_preflight_inventory_route_impact_count=14",
"public_gateway_preflight_inventory_preflight_gate_count=12",
@@ -17654,7 +18002,7 @@ def validate(root: Path) -> None:
assert_text_contains(
"iwooos_page.critical_config_priority_nginx_percent",
iwooos_projection_page,
"{ key: 'nginxGateway', rank: 'P0-1', state: '90% / live 0'",
"{ key: 'nginxGateway', rank: 'P0-1', state: '92% / readback 0'",
)
assert_text_contains(
"iwooos_page.critical_config_priority_dns_percent",
@@ -17689,6 +18037,9 @@ def validate(root: Path) -> None:
"nginx_public_gateway_live_conf_evidence_received=false",
"nginx_public_gateway_rendered_diff_accepted=false",
"nginx_public_gateway_rendered_diff_acceptance_candidate_count=3",
"nginx_public_gateway_post_incident_readback_plan_candidate_count=3",
"nginx_public_gateway_post_incident_readback_plan_blocked_action_count=41",
"nginx_public_gateway_post_incident_readback_plan_runtime_gate_count=0",
"nginx_public_gateway_nginx_test_evidence_count=0",
"secret_metadata_coverage_percent=68",
"gitea_workflow_runner_source_control_coverage_percent=72",