wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): add GitHub private backup evidence gate

Browse Source
This commit is contained in:
ogt
2026-06-26 17:45:00 +08:00
parent 59485d519c
commit 5d6b128854
10 changed files with 1621 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
docs/LOGBOOK.md
View File

@@ -1,3 +1,78 @@
## 2026-06-26｜GitHub 私有備援 evidence gate / API client 收斂
**整體完成度**：依 `~/.codex/CODEX-START-HERE.md` 與 `product-runtime-governance-completion-scorecard`，全產品治理總工程仍為 `42.2%`、`not_complete`。本段只把 GitHub 備援鏡像的「私有性證據與安全 credential 前置 gate」補成 source-side snapshot、API service、API route、前端 client 與測試；不調高 GitHub mirror 實際完成度，也不宣稱任何專案已推上 GitHub。
**受控工作區**：
- path：`/Users/ogt/codex-workspaces/awoooi-dev`
- branch：`codex/awoooi-current-main-dev-base-20260624`
- base HEAD：`59485d51`
- commit / push：本段尚未 commit、尚未 push。
**本段完成度**：
- GitHub private backup evidence gate source / snapshot / markdown：`100%`
- FastAPI loader / read-only endpoint / 前端 API client：`100%`
- focused tests / JSON parse / doc secret / diff check：`已通過`
- 實際 GitHub private repo verification：`0/9`
- GitHub refs sync / repo creation / visibility change：`0 / false`
- 全產品 GitHub mirror ready：仍為 `0/11`
**新增與修改範圍**：
- `scripts/security/github-target-private-backup-evidence-gate.py`
- `docs/security/github-target-private-backup-evidence-gate.snapshot.json`
- `docs/security/GITHUB-TARGET-PRIVATE-BACKUP-EVIDENCE-GATE.md`
- `docs/schemas/github_target_private_backup_evidence_gate_v1.schema.json`
- `apps/api/src/services/github_target_private_backup_evidence_gate.py`
- `apps/api/tests/test_github_target_private_backup_evidence_gate.py`
- `apps/api/tests/test_github_target_private_backup_evidence_gate_api.py`
- `apps/api/src/api/v1/agents.py`
- `apps/web/src/lib/api-client.ts`
**目前事實**：
- approval-required GitHub targets：`9`
- unauthenticated probe publicly visible：`4`，分別是 `owenhytsai/awoooi`、`owenhytsai/clawbot-v5`、`owenhytsai/wooo-aiops`、`owenhytsai/wooo-infra-config`；全部維持 `blocked_public_probe_visible_private_evidence_required`，不得標綠。
- `not_found_or_private`：`5`，分別是 `owenhytsai/ewoooc`、`owenhytsai/bitan-pharmacy`、`owenhytsai/tsenyang-website`、`owenhytsai/VibeWork`、`owenhytsai/agent-bounty-protocol`；這只代表未授權公開 probe 看不到，不得視為已 private，也不得視為 repo 不存在。
- private backup verified：`0`
- private visibility owner evidence：`0/9`
- safe credential metadata accepted：`0/9`
- owner response received / accepted：`0 / 0`
- execution ready：`0`
**驗證**：
- `python3 scripts/security/github-target-private-backup-evidence-gate.py --root .` → `GITHUB_TARGET_PRIVATE_BACKUP_EVIDENCE_GATE_BLOCKED targets=9 public_visible=4 private_verified=0 credential=0/9 refs_sync=False`
- `python3 -m py_compile scripts/security/github-target-private-backup-evidence-gate.py apps/api/src/services/github_target_private_backup_evidence_gate.py apps/api/src/api/v1/agents.py` → OK
- `python3 -m json.tool docs/security/github-target-private-backup-evidence-gate.snapshot.json` → OK
- `python3 -m json.tool docs/schemas/github_target_private_backup_evidence_gate_v1.schema.json` → OK
- `DATABASE_URL=postgresql://test:test@localhost:5432/test REDIS_URL=redis://localhost:6379/15 SECRET_KEY=test-secret ENVIRONMENT=dev pytest apps/api/tests/test_github_target_private_backup_evidence_gate.py apps/api/tests/test_github_target_private_backup_evidence_gate_api.py -q` → `6 passed`
- `python3 scripts/ops/doc-secrets-sanity-check.py docs/security/GITHUB-TARGET-PRIVATE-BACKUP-EVIDENCE-GATE.md docs/security/github-target-private-backup-evidence-gate.snapshot.json docs/schemas/github_target_private_backup_evidence_gate_v1.schema.json` → `DOC_SECRET_SANITY_OK scanned_files=3`
- `git diff --check -- ...` → OK
- `pnpm --filter @awoooi/web typecheck` → blocked：此 worktree 未安裝 `node_modules`，`tsc: command not found`；需在依賴恢復後補跑，不能把前端 typecheck 視為已通過。
**安全旗標**：
- `runtime_execution_authorized=false`
- `active_scan_authorized=false`
- `credentialed_scan_authorized=false`
- `host_update_authorized=false`
- `wazuh_api_live_query_authorized=false`
- `wazuh_active_response_authorized=false`
- `repo_creation_authorized=false`
- `visibility_change_authorized=false`
- `refs_sync_authorized=false`
- `workflow_modification_authorized=false`
- `workflow_trigger_authorized=false`
- `github_primary_switch_authorized=false`
- `secret_values_collected=false`
- `backup_execution_authorized=false`
- `restore_execution_authorized=false`
- `migration_authorized=false`
**邊界與修正**：
- 本段沒有 SSH、沒有改 110/111/112/120/121/168、沒有改 Nginx / Docker / K8s / firewall、沒有觸發 Gitea / GitHub workflow、沒有建立 repo、沒有修改 visibility、沒有同步 refs、沒有讀取或保存 secret value。
- Wazuh / SOC / Kali runtime 仍由 IwoooS 主控線處理；本段沒有新增 Wazuh UI / API，也沒有把 GitHub mirror governance 接到 Wazuh runtime。
- 先前曾因工具預設工作目錄短暫在 `/Users/ogt/awoooi` 誤新增同名 script，已立即移除並驗證 `WRONG_WORKTREE_CLEAN_OK`；實際有效工作僅保留在受控 worktree `/Users/ogt/codex-workspaces/awoooi-dev`。
**下一個 P0 gate**：
- 需要 owner 提供每個 GitHub target 的 private visibility evidence ref 與 safe credential metadata evidence ref；在 `private_backup_verified=0`、`safe_credential_accepted_evidence=0/9`、`owner_response_accepted=0` 之前，不得進入 repo creation、visibility change、refs sync、workflow trigger 或 GitHub primary switch。
## 2026-06-25｜14:41 post-start quick check live wrapper 分級讀回
**背景**：第一版 `post-start-quick-check.sh` live run 將預期中的 `escrow_missing=5` 與 MOMO 非服務面 warning 一併算成 `DEGRADED`，容易讓重啟 SOP 看起來永遠差一點。這不符合本輪目標：服務恢復、資料新鮮、備份健康、DR escrow、Wazuh registry 必須分層判定。

160
docs/schemas/github_target_private_backup_evidence_gate_v1.schema.json Normal file
View File

@@ -0,0 +1,160 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "github_target_private_backup_evidence_gate_v1.schema.json",
"title": "GitHub Target Private Backup Evidence Gate",
"type": "object",
"required": [
"schema_version",
"generated_at",
"status",
"mode",
"source_reviews",
"summary",
"targets",
"acceptance_requirements",
"rejection_rules",
"operation_boundaries",
"authorization_flags"
],
"properties": {
"schema_version": {
"const": "github_target_private_backup_evidence_gate_v1"
},
"generated_at": {
"type": "string"
},
"status": {
"type": "string",
"pattern": "^blocked_"
},
"mode": {
"const": "read_only_private_backup_evidence_gate"
},
"source_reviews": {
"type": "object"
},
"summary": {
"type": "object",
"required": [
"approval_required_target_count",
"public_probe_visible_target_count",
"not_found_or_private_target_count",
"private_backup_verified_count",
"safe_credential_required_count",
"safe_credential_accepted_evidence_count",
"execution_ready_count",
"repo_creation_authorized",
"visibility_change_authorized",
"refs_sync_authorized",
"github_primary_switch_authorized",
"workflow_modification_authorized",
"workflow_trigger_authorized",
"secret_value_collection_allowed",
"private_clone_url_collection_allowed",
"not_found_or_private_as_absent_allowed",
"public_repo_allowed"
],
"properties": {
"repo_creation_authorized": { "const": false },
"visibility_change_authorized": { "const": false },
"refs_sync_authorized": { "const": false },
"github_primary_switch_authorized": { "const": false },
"workflow_modification_authorized": { "const": false },
"workflow_trigger_authorized": { "const": false },
"secret_value_collection_allowed": { "const": false },
"private_clone_url_collection_allowed": { "const": false },
"not_found_or_private_as_absent_allowed": { "const": false },
"public_repo_allowed": { "const": false }
}
},
"targets": {
"type": "array",
"items": {
"type": "object",
"required": [
"github_repo",
"approval_required",
"probe_status",
"visibility_evidence_status",
"private_backup_verified",
"owner_response_accepted",
"refs_sync_ready",
"execution_ready",
"blockers",
"repo_creation_authorized",
"visibility_change_authorized",
"refs_sync_authorized",
"github_primary_switch_authorized",
"secret_values_collected"
],
"properties": {
"private_backup_verified": { "const": false },
"owner_response_accepted": { "const": false },
"refs_sync_ready": { "const": false },
"execution_ready": { "const": false },
"repo_creation_authorized": { "const": false },
"visibility_change_authorized": { "const": false },
"refs_sync_authorized": { "const": false },
"github_primary_switch_authorized": { "const": false },
"secret_values_collected": { "const": false },
"blockers": {
"type": "array",
"minItems": 1
}
}
}
},
"acceptance_requirements": {
"type": "array",
"minItems": 1,
"items": { "type": "string" }
},
"rejection_rules": {
"type": "array",
"minItems": 1,
"items": { "type": "string" }
},
"operation_boundaries": {
"type": "object",
"required": [
"read_only_api_allowed",
"github_api_write_allowed",
"gitea_api_write_allowed",
"repo_creation_allowed",
"visibility_change_allowed",
"refs_sync_allowed",
"workflow_modification_allowed",
"workflow_trigger_allowed",
"github_primary_switch_allowed",
"secret_value_collection_allowed",
"private_clone_url_collection_allowed"
],
"properties": {
"read_only_api_allowed": { "const": true },
"github_api_write_allowed": { "const": false },
"gitea_api_write_allowed": { "const": false },
"repo_creation_allowed": { "const": false },
"visibility_change_allowed": { "const": false },
"refs_sync_allowed": { "const": false },
"workflow_modification_allowed": { "const": false },
"workflow_trigger_allowed": { "const": false },
"github_primary_switch_allowed": { "const": false },
"secret_value_collection_allowed": { "const": false },
"private_clone_url_collection_allowed": { "const": false }
}
},
"authorization_flags": {
"type": "object",
"properties": {
"runtime_execution_authorized": { "const": false },
"repo_creation_authorized": { "const": false },
"visibility_change_authorized": { "const": false },
"refs_sync_authorized": { "const": false },
"workflow_modification_authorized": { "const": false },
"workflow_trigger_authorized": { "const": false },
"github_primary_switch_authorized": { "const": false },
"secret_values_collected": { "const": false }
}
}
}
}

32
docs/security/GITHUB-TARGET-PRIVATE-BACKUP-EVIDENCE-GATE.md Normal file
View File

@@ -0,0 +1,32 @@
# GitHub Target Private Backup Evidence Gate
| 項目 | 值 |
|------|----|
| 狀態 | `blocked_public_visibility_and_safe_credential_evidence_required` |
| approval-required targets | `9` |
| public probe visible | `4` |
| not_found_or_private | `5` |
| private backup verified | `0` |
| safe credential evidence | `0/9` |
| execution ready | `0` |
## Target Gate
| GitHub target | probe | visibility evidence | private verified | blockers |
|---------------|-------|---------------------|------------------|----------|
| `owenhytsai/awoooi` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/clawbot-v5` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/wooo-aiops` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/wooo-infra-config` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/ewoooc` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/bitan-pharmacy` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/tsenyang-website` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/VibeWork` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/agent-bounty-protocol` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
## 不可誤讀
- 本 gate 不是 GitHub repo creation / visibility change / refs sync 授權。
- 公開 probe 可讀的 target 需要 private visibility owner evidence，不能標綠。
- `not_found_or_private` 不能當成已 private，也不能當成 repo 不存在。
- safe credential evidence 只收 metadata，不收 secret value。

533
docs/security/github-target-private-backup-evidence-gate.snapshot.json Normal file
View File

@@ -0,0 +1,533 @@
{
"schema_version": "github_target_private_backup_evidence_gate_v1",
"generated_at": "2026-06-26T09:43:15.948000+00:00",
"status": "blocked_public_visibility_and_safe_credential_evidence_required",
"mode": "read_only_private_backup_evidence_gate",
"source_reviews": {
"github_target_decision": "docs/security/github-target-decision.snapshot.json",
"github_target_owner_decision_response": "docs/security/github-target-owner-decision-response.snapshot.json",
"github_target_repo_approval_package": "docs/security/github-target-repo-approval-package.snapshot.json"
},
"summary": {
"target_decision_count": 10,
"approval_required_target_count": 9,
"approval_package_item_count": 9,
"public_probe_visible_target_count": 4,
"not_found_or_private_target_count": 5,
"private_backup_verified_count": 0,
"private_visibility_evidence_missing_count": 9,
"safe_credential_required_count": 9,
"safe_credential_accepted_evidence_count": 0,
"owner_response_received_count": 0,
"owner_response_accepted_count": 0,
"execution_ready_count": 0,
"blocked_target_count": 9,
"external_scope_target_count": 1,
"forbidden_action_count": 12,
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"workflow_modification_authorized": false,
"workflow_trigger_authorized": false,
"secret_value_collection_allowed": false,
"private_clone_url_collection_allowed": false,
"not_found_or_private_as_absent_allowed": false,
"public_repo_allowed": false
},
"targets": [
{
"github_repo": "owenhytsai/awoooi",
"source_key": "wooo/awoooi",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "HIGH",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/clawbot-v5",
"source_key": "wooo/clawbot-v5",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/wooo-aiops",
"source_key": "wooo/wooo-aiops",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/wooo-infra-config",
"source_key": "wooo/wooo-infra-config",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_aligned",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-WOOO-INFRA-CONFIG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/ewoooc",
"source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GITEA-PUBLIC-REPO-SEARCH-SNAPSHOT.md",
"docs/security/LOCAL-REPO-CANONICAL-EWOOOC-MOMO-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/bitan-pharmacy",
"source_key": "bitan-pharmacy",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/tsenyang-website",
"source_key": "tsenyang-website",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "nexu-io/open-design",
"source_key": "open-design",
"approval_required": false,
"probe_status": "exists",
"target_state": "external_scope",
"risk": "LOW",
"visibility_evidence_status": "external_scope_not_backup_target",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "not_required_external_scope",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"external_scope_review_only"
],
"evidence_refs": [
"docs/security/github-target-probe.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/VibeWork",
"source_key": "vibework",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
"docs/security/source-control-primary-readiness-gate.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/agent-bounty-protocol",
"source_key": "agent-bounty-protocol",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
"docs/security/source-control-primary-readiness-gate.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
}
],
"acceptance_requirements": [
"每個 approval-required GitHub target 必須有 private visibility owner evidence ref。",
"公開 probe 可讀的 target 不得被視為符合私有備援要求。",
"`not_found_or_private` 只代表未授權只讀 probe 看不到，不得當成 private verified 或 repo absent。",
"safe credential evidence 只允許 credential storage / owner / scope / rotation metadata，不得收 token value。",
"owner response accepted count 在 reviewer acceptance 前必須維持 0。",
"private evidence 與 safe credential evidence 完整前不得建立 repo、改 visibility、push refs 或切 GitHub primary。"
],
"rejection_rules": [
"任何 public repo 或 unauthenticated readable target 均不得標示 private_backup_verified=true。",
"任何 token、PAT、private key、cookie、session、private clone credential 或 partial secret 必須拒收。",
"任何 repo creation、visibility change、refs sync、force push、tag rewrite、workflow trigger 或 primary switch request 必須拒收。",
"任何把 `not_found_or_private` 解讀為 repo 不存在或可建立新 repo 的 response 必須拒收。"
],
"operation_boundaries": {
"read_only_api_allowed": true,
"github_api_write_allowed": false,
"gitea_api_write_allowed": false,
"repo_creation_allowed": false,
"visibility_change_allowed": false,
"refs_sync_allowed": false,
"workflow_modification_allowed": false,
"workflow_trigger_allowed": false,
"github_primary_switch_allowed": false,
"secret_value_collection_allowed": false,
"private_clone_url_collection_allowed": false
},
"authorization_flags": {
"runtime_execution_authorized": false,
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"workflow_modification_authorized": false,
"workflow_trigger_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
}
}