feat(web): add IwoooS S4.9 preflight
This commit is contained in:
Your Name
@@ -75,6 +75,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
|
||||
43. 9 個 host owner decision record human record owner review preparation checklist items，顯示 preparation packets 進人工 record owner review 前仍需只讀核對的條件，但不標記 preparation completed、不標記 checklist passed、不開始 review、不標記 ready、不收 owner decision、不建立 decision record、不開 runtime gate。
|
||||
44. 6 條 progress acceleration lanes，直接顯示 58% 為何維持、哪些高層 gate 能解鎖下一輪進度判讀，以及後續節奏要改成 milestone batch，但不把 acceleration lane 當授權、加分、owner response、runtime gate、GitHub primary 或 production execution。
|
||||
45. 4 個 owner response next-action focus items，直接顯示 S4.9 目前是下一個收件焦點，S4.10 / S4.11 / S4.12 依序排隊，但不催收、不代填、不標記 received / accepted、不建立 approval record、不開 runtime gate。
|
||||
46. 6 個 S4.9 owner response preflight checks，直接顯示第一個 P0 owner response 在收件前要確認的已知 item、必填欄位、allowed decision、脫敏 evidence、無 execution request 與五項到齊規則，但不寄送 request、不標記 received / accepted、不建立 audit event、不寫 Gitea、不 sync refs、不開 runtime gate。
|
||||
|
||||
## 3.1 既有前端資安頁面整合
|
||||
|
||||
@@ -760,6 +761,23 @@ S2.47 將 owner response 的下一步收件焦點從 S4.13 rollup 拉到 IwoooS
|
||||
|
||||
這個 focus board 不代表 S4.9 request 已送出、owner response 已收到、owner response 已接受或下一步可自動推到 GitHub migration。它只把 P0 收件順序顯示清楚，讓後續工作從 S4.9 開始收斂，而不是再繼續新增細碎 checklist。
|
||||
|
||||
## 3.39 S4.9 Owner Response Preflight
|
||||
|
||||
S2.48 將 S4.9 owner response 的收件前 preflight 從 Gitea owner attestation response packet 拉到 IwoooS 可見面板。這一層只回答「第一個 P0 owner response 送入驗收前要檢查什麼」，不寄送 request、不催收、不代填、不標記 received、不標記 accepted、不建立 audit event、不寫 Gitea、不 sync refs、不開 runtime gate、不切 GitHub primary。
|
||||
|
||||
| 順序 | Preflight check | Failure lane | 核對條件 |
|
||||
|------|-----------------|--------------|----------|
|
||||
| 1 | Known attestation item | `request_owner_correction` | 回覆必須對應 S4.7 五個 coverage attestation items 之一 |
|
||||
| 2 | Required owner fields | `request_more_evidence` | owner role/team、decision、decision reason、受影響 scope、evidence refs、followup owner 完整 |
|
||||
| 3 | Allowed decision | `request_owner_correction` | decision 必須落在對應 response template 的 acceptable decisions |
|
||||
| 4 | Redacted evidence only | `quarantine_sensitive_payload` | evidence 只能是 repo 內文件、snapshot 或脫敏 metadata pointer |
|
||||
| 5 | No execution request | `reject_execution_request` | 不得夾帶 repo / refs / workflow / secret / runner / scan / runtime 執行要求 |
|
||||
| 6 | All five items before accepted | `keep_waiting_owner_response` | 五個 response templates 都可驗收前，不得標記 S4.9 accepted |
|
||||
|
||||
每個 S4.9 owner response preflight check 都固定 `display_mode=s4_9_owner_response_preflight_only`、`request_sent_count=0`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`owner_response_rejected_count=0`、`preflight_passed_count=0`、`audit_events_emitted_count=0`、`request_sent_allowed=false`、`owner_response_collection_allowed=false`、`mark_passed_allowed=false`、`mark_received_allowed=false`、`mark_accepted_allowed=false`、`approval_record_created=false`、`runtime_gate_opened=false`、`gitea_write_allowed=false`、`repo_or_refs_mutation_allowed=false`、`secret_value_collection_allowed=false`、`sensitive_payload_allowed=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
|
||||
|
||||
這個 preflight board 不代表 S4.9 request 已送出、owner response 已收到、owner response 已接受、audit event 已建立或 Gitea / GitHub migration 可執行。它只把第一個能真正推動 58% 的 owner response 收件條件顯示清楚。
|
||||
|
||||
## 4. 仍禁止
|
||||
|
||||
IwoooS 不得提供下列輸出：
|
||||
@@ -804,7 +822,8 @@ IwoooS 不得提供下列輸出：
|
||||
38. 把 owner decision record human record owner review preparation checklist 當成 approval、標記 preparation checklist passed 或 preparation completed、開始 human record owner review、標記 review ready、收 owner decision、由 preparation checklist 建立 decision record，或從 preparation checklist 開 runtime gate。
|
||||
39. 把 progress acceleration lane 當成授權、進度自動加分、owner response received、runtime gate、GitHub primary readiness 或 production execution。
|
||||
40. 把 owner response next-action focus 當成催收、代填、received、accepted、approval record、runtime gate、repo / refs mutation、secret value collection 或 GitHub primary switch。
|
||||
41. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
|
||||
41. 把 S4.9 owner response preflight 當成 request sent、owner response received / accepted、preflight passed、audit emitted、approval record、Gitea write、repo / refs mutation、runtime gate 或 GitHub primary switch。
|
||||
42. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
|
||||
|
||||
## 5. 驗證
|
||||
|
||||
|
||||
@@ -35,7 +35,7 @@
|
||||
| Owner response validation | S4.13 已建立；四包 owner response 目前 received/accepted 皆為 0；4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes、6 個 parallel session recovery checks 與 7 條 parallel session recovery outcome lanes 可供 AwoooP 直接顯示；下一個建議收件為 S4.9 Gitea owner attestation；latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`，reviewer audit emitted 仍為 0，不代表 owner response 已收到或任何執行授權 |
|
||||
| Low-friction rollout policy | S1.3 已補 7 條 non-blocking escalation lanes；LOW / MEDIUM、缺 owner response、partial mirror、source-control drift、Kali observe finding、workflow / secret name gap 與 headline holding 初期只能 observe / warn；`owner_review_required_before_blocking=true`、`runtime_blocking_allowed=false` |
|
||||
| IwoooS frontend posture | S2.8 已新增 `/iwooos` read-only Information Security 入口；顯示 Security Posture / Exposure、source-control supply chain、Kali 112 Mesh、approval boundary、non-blocking lanes 與 evidence refs；不新增執行按鈕 |
|
||||
| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；S2.32 已補 7 個 host owner decision record formal candidate packets；S2.33 已補 7 個 host owner decision record formal candidate review checklist items；S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes；S2.35 已補 8 個 host owner decision record formal record queue packets；S2.36 已補 8 個 host owner decision record formal record queue review checklist items；S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes；S2.38 已補 8 個 host owner decision record human handoff readiness packets；S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items；S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes；S2.41 已補 9 個 host owner decision record human record owner review candidate packets；S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items；S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes；S2.44 已補 9 個 host owner decision record human record owner review preparation packets；S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items；S2.46 已補 6 條 progress acceleration lanes，顯示 58% holding 原因與下一個高層解鎖 gate；S2.47 已補 4 個 owner response next-action focus items，顯示 S4.9 為下一個收件焦點且 S4.10-S4.12 依序排隊；仍不新增 action button |
|
||||
| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；S2.32 已補 7 個 host owner decision record formal candidate packets；S2.33 已補 7 個 host owner decision record formal candidate review checklist items；S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes；S2.35 已補 8 個 host owner decision record formal record queue packets；S2.36 已補 8 個 host owner decision record formal record queue review checklist items；S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes；S2.38 已補 8 個 host owner decision record human handoff readiness packets；S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items；S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes；S2.41 已補 9 個 host owner decision record human record owner review candidate packets；S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items；S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes；S2.44 已補 9 個 host owner decision record human record owner review preparation packets；S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items；S2.46 已補 6 條 progress acceleration lanes，顯示 58% holding 原因與下一個高層解鎖 gate；S2.47 已補 4 個 owner response next-action focus items，顯示 S4.9 為下一個收件焦點且 S4.10-S4.12 依序排隊；S2.48 已補 6 個 S4.9 owner response preflight checks，讓下一個 P0 owner response 的可收件條件可見；仍不新增 action button |
|
||||
| Dry-run | `contract_defined_not_executed`；已納入 `CHECK_PROGRESS_GUARD` 與 `CHECK_OWNER_RESPONSE_GUARD`，latest local validation 為 `repo_snapshot_guard_pass`，仍不代表 production ingestion |
|
||||
| Runtime actions | `false` |
|
||||
| Payload ingestion | `false` |
|
||||
@@ -131,6 +131,7 @@
|
||||
| S2.45 IwoooS host owner decision record human record owner review preparation checklist | framework detail | 0 | 只顯示 human record owner review preparation packets 後的九個只讀核對項；preparation completed、checklist passed、review started、review ready、handoff started、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
|
||||
| S2.46 IwoooS progress acceleration lanes | framework detail | 0 | 只顯示 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六條解鎖 lane；headline percent、owner response、payload ingestion、runtime gate、GitHub primary、production execution 與 action button 仍全部鎖住 |
|
||||
| S2.47 IwoooS owner response next-action focus | framework detail | 0 | 只顯示 S4.9 為下一個 owner response 收件焦點，S4.10 / S4.11 / S4.12 依序排隊；received、accepted、rejected、audit emitted、approval record、runtime gate、repo / refs mutation、secret value collection 與 action button 仍全部鎖住 |
|
||||
| S2.48 IwoooS S4.9 owner response preflight | framework detail | 0 | 只顯示 S4.9 六個收件前檢查與 failure lanes；request sent、received、accepted、rejected、preflight passed、audit emitted、Gitea write、repo / refs mutation、runtime gate、GitHub primary 與 action button 仍全部鎖住 |
|
||||
|
||||
headline 進度要再往上，至少需要下列任一高層 gate 有實質 evidence：
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ python3 scripts/security/security-mirror-progress-guard.py
|
||||
|
||||
### 0.2 Headline 58% 不代表停滯
|
||||
|
||||
近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.47 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
|
||||
近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.48 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
|
||||
|
||||
| 最近完成 | 目前狀態 | headline delta |
|
||||
|----------|----------|----------------|
|
||||
@@ -107,6 +107,7 @@ python3 scripts/security/security-mirror-progress-guard.py
|
||||
| S2.45 IwoooS host owner decision record human record owner review preparation checklist | 已完成草案，將 preparation identity trace readable、owner boundary readable、decision summary readable、scope / expiry current、scan limits not authorization、credential metadata-only、maintenance / rollback traceable、validation / runtime gate separate、no-execution attestation present 顯示成九個只讀核對項 | 0 |
|
||||
| S2.46 IwoooS progress acceleration lanes | 已完成草案，將 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六個真正會影響進度感的解鎖 lane 顯示在 IwoooS；headline 仍只在高層 gate 有 evidence 時 review | 0 |
|
||||
| S2.47 IwoooS owner response next-action focus | 已完成草案，將 S4.9 Gitea owner attestation 固定為下一個收件焦點，S4.10 / S4.11 / S4.12 依序排隊；received / accepted 仍為 0 | 0 |
|
||||
| S2.48 IwoooS S4.9 owner response preflight | 已完成草案，將 S4.9 六個收件前檢查顯示在 IwoooS；request sent、received / accepted / rejected、preflight passed、audit emitted 仍為 0 | 0 |
|
||||
|
||||
headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收，或人工批准後出現 active runtime gate、redacted payload ingestion、GitHub primary readiness 這類落地 evidence。
|
||||
|
||||
@@ -173,6 +174,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
|
||||
| S2.45 IwoooS Host Owner Decision Record Human Record Owner Review Preparation Checklist | 完成草案 | `/iwooos` 新增主機 owner decision record human record owner review preparation checklist，顯示 preparation identity trace readable、owner boundary readable、decision summary readable、scope / expiry current、scan limits not authorization、credential metadata-only、maintenance / rollback traceable、validation / runtime gate separate、no-execution attestation present 九個只讀核對項 | 使用者能理解 human record owner review preparation checklist 仍不是 preparation completed、checklist passed、review started、review ready、owner decision 或正式紀錄；仍不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
|
||||
| S2.46 IwoooS Progress Acceleration Lanes | 完成草案 | `/iwooos` 新增進度加速與 58% 解鎖面板，顯示 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六條 acceleration lanes | 使用者能理解前面看起來慢是因為 S2.38-S2.45 都是防止誤讀的 framework detail；後續改採 milestone batch，但 acceleration lane 仍不是 owner response、進度加分、runtime gate、GitHub primary 或 production execution |
|
||||
| S2.47 IwoooS Owner Response Next-Action Focus | 完成草案 | `/iwooos` 新增 owner response 下一步收件焦點，顯示 S4.9 Gitea owner attestation 先收、S4.10 GitHub target、S4.11 refs truth、S4.12 workflow / secret name 依序排隊 | 使用者能理解下一個有感工作是收斂 P0 owner response；focus 仍不是催收、代填、received、accepted、approval record、runtime gate、repo / refs mutation、secret value collection 或 GitHub primary |
|
||||
| S2.48 IwoooS S4.9 Owner Response Preflight | 完成草案 | `/iwooos` 新增 S4.9 owner response 收件前 preflight，顯示 known attestation item、required owner fields、allowed decision、redacted evidence only、no execution request、all five items before accepted 六個檢查 | 使用者能理解下一步不是再拆 checklist，而是把第一個 P0 owner response 的可收件條件說清楚；preflight 仍不是 request sent、received、accepted、audit emitted、Gitea write、refs sync、runtime gate 或 GitHub primary |
|
||||
| S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate |
|
||||
| S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item |
|
||||
| S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 |
|
||||
|
||||
@@ -73,7 +73,8 @@
|
||||
"host_owner_decision_record_human_record_owner_review_preparation_packet_count": 9,
|
||||
"host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count": 9,
|
||||
"progress_acceleration_lane_count": 6,
|
||||
"owner_response_next_action_focus_item_count": 4
|
||||
"owner_response_next_action_focus_item_count": 4,
|
||||
"s4_9_owner_response_preflight_check_count": 6
|
||||
},
|
||||
"progress": {
|
||||
"overall_percent": 58,
|
||||
@@ -183,7 +184,8 @@
|
||||
"display_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes",
|
||||
"display_host_owner_decision_record_human_record_owner_review_preparation_packets",
|
||||
"display_host_owner_decision_record_human_record_owner_review_preparation_checklist",
|
||||
"display_owner_response_next_action_focus"
|
||||
"display_owner_response_next_action_focus",
|
||||
"display_s4_9_owner_response_preflight_checks"
|
||||
],
|
||||
"forbidden_frontend_outputs": [
|
||||
"add_scan_button",
|
||||
@@ -354,7 +356,16 @@
|
||||
"skip_s4_9_from_owner_response_focus",
|
||||
"open_runtime_gate_from_owner_response_focus",
|
||||
"switch_github_primary_from_owner_response_focus",
|
||||
"create_repo_from_owner_response_focus"
|
||||
"create_repo_from_owner_response_focus",
|
||||
"treat_s4_9_preflight_as_request_sent",
|
||||
"treat_s4_9_preflight_as_received",
|
||||
"mark_s4_9_preflight_passed_from_frontend",
|
||||
"accept_s4_9_owner_response_from_preflight",
|
||||
"emit_s4_9_audit_event_from_preflight",
|
||||
"open_runtime_gate_from_s4_9_preflight",
|
||||
"write_gitea_from_s4_9_preflight",
|
||||
"sync_refs_from_s4_9_preflight",
|
||||
"switch_primary_from_s4_9_preflight"
|
||||
],
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
@@ -6060,5 +6071,187 @@
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
}
|
||||
],
|
||||
"s4_9_owner_response_preflight_checks": [
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_known_attestation_item",
|
||||
"display_order": 1,
|
||||
"source_check_id": "preflight-known-attestation-item",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "回覆必須對應 S4.7 五個 coverage attestation items 之一。",
|
||||
"failure_lane": "request_owner_correction",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_required_owner_fields",
|
||||
"display_order": 2,
|
||||
"source_check_id": "preflight-required-owner-fields",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "每筆 response 必須有 owner role/team、decision、decision_reason、受影響 scope、evidence_refs 與 followup_owner。",
|
||||
"failure_lane": "request_more_evidence",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_allowed_decision",
|
||||
"display_order": 3,
|
||||
"source_check_id": "preflight-allowed-decision",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "decision 必須落在對應 response template 的 acceptable_decisions。",
|
||||
"failure_lane": "request_owner_correction",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_redacted_evidence_only",
|
||||
"display_order": 4,
|
||||
"source_check_id": "preflight-redacted-evidence-only",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "evidence_refs 只能指向 repo 內文件、snapshot 或 owner 提供的脫敏 metadata。",
|
||||
"failure_lane": "quarantine_sensitive_payload",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_no_execution_request",
|
||||
"display_order": 5,
|
||||
"source_check_id": "preflight-no-execution-request",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "response 不得要求 repo 寫入、repo 建立、visibility 修改、refs sync/delete/force-push、workflow/secret/runner 變更、scan 或 runtime action。",
|
||||
"failure_lane": "reject_execution_request",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"preflight_id": "s4_9_preflight_all_five_items_before_accepted",
|
||||
"display_order": 6,
|
||||
"source_check_id": "preflight-all-five-items-before-accepted",
|
||||
"source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
|
||||
"pass_condition_summary": "S4.9 要被標示 accepted 前，五個 response templates 都必須收到可驗收 owner response。",
|
||||
"failure_lane": "keep_waiting_owner_response",
|
||||
"display_mode": "s4_9_owner_response_preflight_only",
|
||||
"required": true,
|
||||
"request_sent_count": 0,
|
||||
"owner_response_received_count": 0,
|
||||
"owner_response_accepted_count": 0,
|
||||
"owner_response_rejected_count": 0,
|
||||
"preflight_passed_count": 0,
|
||||
"audit_events_emitted_count": 0,
|
||||
"request_sent_allowed": false,
|
||||
"owner_response_collection_allowed": false,
|
||||
"mark_passed_allowed": false,
|
||||
"mark_received_allowed": false,
|
||||
"mark_accepted_allowed": false,
|
||||
"approval_record_created": false,
|
||||
"runtime_gate_opened": false,
|
||||
"gitea_write_allowed": false,
|
||||
"repo_or_refs_mutation_allowed": false,
|
||||
"secret_value_collection_allowed": false,
|
||||
"sensitive_payload_allowed": false,
|
||||
"runtime_execution_authorized": false,
|
||||
"action_buttons_allowed": false,
|
||||
"not_authorization": true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -1034,6 +1034,18 @@
|
||||
"runtime_delta": false,
|
||||
"execution_authorized": false,
|
||||
"not_authorization": true
|
||||
},
|
||||
{
|
||||
"delta_id": "s2_48_iwooos_s4_9_owner_response_preflight",
|
||||
"display_order": 77,
|
||||
"completed_stage": "S2.48 IwoooS S4.9 owner response preflight",
|
||||
"progress_axis": "framework_detail",
|
||||
"headline_percent_delta": 0,
|
||||
"framework_delta_visible": true,
|
||||
"why_headline_unchanged": "S4.9 owner response preflight 只顯示六個收件前檢查；request sent、owner response received/accepted/rejected、audit emitted、runtime gate、Gitea write、refs mutation、GitHub primary readiness 與 production landing 仍未改變。",
|
||||
"runtime_delta": false,
|
||||
"execution_authorized": false,
|
||||
"not_authorization": true
|
||||
}
|
||||
],
|
||||
"next_safe_actions": [
|
||||
@@ -1430,7 +1442,8 @@
|
||||
"S2.44 只新增 IwoooS host owner decision record human record owner review preparation packets；host_owner_decision_record_human_record_owner_review_preparation_packet_count=9、human_record_owner_review_prepared_count=0、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 review preparation packet 當 preparation completed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。",
|
||||
"S2.45 只新增 IwoooS host owner decision record human record owner review preparation checklist；host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count=9、human_record_owner_review_prepared_count=0、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 review preparation checklist 當 preparation completed、checklist passed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。",
|
||||
"S2.46 新增 IwoooS progress acceleration lanes；progress_acceleration_lane_count=6、headline_percent_after_this_stage=58、owner_response_received_count=0、owner_response_accepted_count=0、payloads_ingested=false、active_runtime_gate_count=0、github_primary_ready_count=0、production_landing_enabled=false，不把 acceleration lane 當授權、進度加分、runtime gate、owner response received、GitHub primary 或 production execution。",
|
||||
"S2.47 新增 IwoooS owner response next-action focus；owner_response_next_action_focus_item_count=4，顯示 S4.9 Gitea owner attestation 為下一個收件焦點，S4.10/S4.11/S4.12 依序排隊；owner response received/accepted/rejected 與 audit events emitted 仍為 0，不自動催收、代填、標記 received/accepted、建立 approval record、開 runtime gate 或切 GitHub primary。"
|
||||
"S2.47 新增 IwoooS owner response next-action focus；owner_response_next_action_focus_item_count=4，顯示 S4.9 Gitea owner attestation 為下一個收件焦點，S4.10/S4.11/S4.12 依序排隊；owner response received/accepted/rejected 與 audit events emitted 仍為 0，不自動催收、代填、標記 received/accepted、建立 approval record、開 runtime gate 或切 GitHub primary。",
|
||||
"S2.48 新增 IwoooS S4.9 owner response preflight；s4_9_owner_response_preflight_check_count=6，顯示 known item、required owner fields、allowed decision、redacted evidence only、no execution request、all five items before accepted 六個收件前檢查；request sent、owner response received/accepted/rejected、preflight passed 與 audit events emitted 仍為 0，不標記 sent/received/accepted、不建立 approval record、不寫 Gitea、不 sync refs、不開 runtime gate 或切 GitHub primary。"
|
||||
],
|
||||
"forbidden_actions": [
|
||||
"start_kali_scan",
|
||||
|
||||
Reference in New Issue
Block a user