wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(web): add IwoooS S4.9 preflight

Browse Source
This commit is contained in:
Your Name
2026-05-20 13:19:11 +08:00
parent 5979e3d22d
commit 52e3137f48
11 changed files with 685 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
scripts/security/security-mirror-progress-guard.py
View File

@@ -199,6 +199,7 @@ def validate(root: Path) -> None:
"s2_45_iwooos_host_owner_decision_record_human_record_owner_review_preparation_checklist",
"s2_46_iwooos_progress_acceleration_lanes",
"s2_47_iwooos_owner_response_next_action_focus",
"s2_48_iwooos_s4_9_owner_response_preflight",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -1059,6 +1060,119 @@ def validate(root: Path) -> None:
f"iwooos_projection.owner_response_next_action_focus_items.{item['focus_id']}.not_authorization",
item["not_authorization"],
)
expected_s4_9_owner_response_preflight_ids = [
"s4_9_preflight_known_attestation_item",
"s4_9_preflight_required_owner_fields",
"s4_9_preflight_allowed_decision",
"s4_9_preflight_redacted_evidence_only",
"s4_9_preflight_no_execution_request",
"s4_9_preflight_all_five_items_before_accepted",
]
assert_equal(
"iwooos_projection.summary.s4_9_owner_response_preflight_check_count",
iwooos_projection["summary"]["s4_9_owner_response_preflight_check_count"],
len(expected_s4_9_owner_response_preflight_ids),
)
s4_9_owner_response_preflight_checks = iwooos_projection["s4_9_owner_response_preflight_checks"]
assert_equal(
"iwooos_projection.s4_9_owner_response_preflight_checks.ids",
[item["preflight_id"] for item in s4_9_owner_response_preflight_checks],
expected_s4_9_owner_response_preflight_ids,
)
assert_equal(
"iwooos_projection.s4_9_owner_response_preflight_checks.display_order",
[item["display_order"] for item in s4_9_owner_response_preflight_checks],
list(range(1, len(expected_s4_9_owner_response_preflight_ids) + 1)),
)
assert_equal(
"iwooos_projection.s4_9_owner_response_preflight_checks.source_check_ids",
[item["source_check_id"] for item in s4_9_owner_response_preflight_checks],
[
"preflight-known-attestation-item",
"preflight-required-owner-fields",
"preflight-allowed-decision",
"preflight-redacted-evidence-only",
"preflight-no-execution-request",
"preflight-all-five-items-before-accepted",
],
)
assert_equal(
"iwooos_projection.s4_9_owner_response_preflight_checks.failure_lanes",
[item["failure_lane"] for item in s4_9_owner_response_preflight_checks],
[
"request_owner_correction",
"request_more_evidence",
"request_owner_correction",
"quarantine_sensitive_payload",
"reject_execution_request",
"keep_waiting_owner_response",
],
)
for item in s4_9_owner_response_preflight_checks:
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.source_packet",
item["source_packet"],
"docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.display_mode",
item["display_mode"],
"s4_9_owner_response_preflight_only",
)
assert_true(f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.required", item["required"])
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.request_sent_count",
item["request_sent_count"],
0,
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.owner_response_received_count",
item["owner_response_received_count"],
0,
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.owner_response_accepted_count",
item["owner_response_accepted_count"],
0,
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.owner_response_rejected_count",
item["owner_response_rejected_count"],
0,
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.preflight_passed_count",
item["preflight_passed_count"],
0,
)
assert_equal(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.audit_events_emitted_count",
item["audit_events_emitted_count"],
0,
)
for flag in [
"request_sent_allowed",
"owner_response_collection_allowed",
"mark_passed_allowed",
"mark_received_allowed",
"mark_accepted_allowed",
"approval_record_created",
"runtime_gate_opened",
"gitea_write_allowed",
"repo_or_refs_mutation_allowed",
"secret_value_collection_allowed",
"sensitive_payload_allowed",
"runtime_execution_authorized",
"action_buttons_allowed",
]:
assert_false(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.{flag}",
item[flag],
)
assert_true(
f"iwooos_projection.s4_9_owner_response_preflight_checks.{item['preflight_id']}.not_authorization",
item["not_authorization"],
)
assert_equal(
"iwooos_projection.posture_pillars.ids",
[item["pillar_id"] for item in iwooos_projection["posture_pillars"]],
@@ -4010,6 +4124,7 @@ def validate(root: Path) -> None:
"display_progress_estimate",
"display_progress_acceleration_lanes",
"display_owner_response_next_action_focus",
"display_s4_9_owner_response_preflight_checks",
"display_non_blocking_lanes",
"display_existing_frontend_security_surfaces",
"display_frontend_surface_coverage_matrix",
@@ -4217,6 +4332,15 @@ def validate(root: Path) -> None:
"open_runtime_gate_from_owner_response_focus",
"switch_github_primary_from_owner_response_focus",
"create_repo_from_owner_response_focus",
"treat_s4_9_preflight_as_request_sent",
"treat_s4_9_preflight_as_received",
"mark_s4_9_preflight_passed_from_frontend",
"accept_s4_9_owner_response_from_preflight",
"emit_s4_9_audit_event_from_preflight",
"open_runtime_gate_from_s4_9_preflight",
"write_gitea_from_s4_9_preflight",
"sync_refs_from_s4_9_preflight",
"switch_primary_from_s4_9_preflight",
"apply_runtime_blocking_control",
"switch_github_primary",
"production_deploy",