wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): add GitHub private backup evidence gate

Browse Source
This commit is contained in:
ogt
2026-06-26 17:45:00 +08:00
parent 59485d519c
commit 5d6b128854
10 changed files with 1621 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docs/security/GITHUB-TARGET-PRIVATE-BACKUP-EVIDENCE-GATE.md Normal file
View File

@@ -0,0 +1,32 @@
# GitHub Target Private Backup Evidence Gate
| 項目 | 值 |
|------|----|
| 狀態 | `blocked_public_visibility_and_safe_credential_evidence_required` |
| approval-required targets | `9` |
| public probe visible | `4` |
| not_found_or_private | `5` |
| private backup verified | `0` |
| safe credential evidence | `0/9` |
| execution ready | `0` |
## Target Gate
| GitHub target | probe | visibility evidence | private verified | blockers |
|---------------|-------|---------------------|------------------|----------|
| `owenhytsai/awoooi` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/clawbot-v5` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/wooo-aiops` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/wooo-infra-config` | `exists` | `blocked_public_probe_visible_private_evidence_required` | `false` | `4` |
| `owenhytsai/ewoooc` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/bitan-pharmacy` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/tsenyang-website` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/VibeWork` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
| `owenhytsai/agent-bounty-protocol` | `not_found_or_private` | `blocked_private_or_absent_not_verified` | `false` | `4` |
## 不可誤讀
- 本 gate 不是 GitHub repo creation / visibility change / refs sync 授權。
- 公開 probe 可讀的 target 需要 private visibility owner evidence，不能標綠。
- `not_found_or_private` 不能當成已 private，也不能當成 repo 不存在。
- safe credential evidence 只收 metadata，不收 secret value。

533
docs/security/github-target-private-backup-evidence-gate.snapshot.json Normal file
View File

@@ -0,0 +1,533 @@
{
"schema_version": "github_target_private_backup_evidence_gate_v1",
"generated_at": "2026-06-26T09:43:15.948000+00:00",
"status": "blocked_public_visibility_and_safe_credential_evidence_required",
"mode": "read_only_private_backup_evidence_gate",
"source_reviews": {
"github_target_decision": "docs/security/github-target-decision.snapshot.json",
"github_target_owner_decision_response": "docs/security/github-target-owner-decision-response.snapshot.json",
"github_target_repo_approval_package": "docs/security/github-target-repo-approval-package.snapshot.json"
},
"summary": {
"target_decision_count": 10,
"approval_required_target_count": 9,
"approval_package_item_count": 9,
"public_probe_visible_target_count": 4,
"not_found_or_private_target_count": 5,
"private_backup_verified_count": 0,
"private_visibility_evidence_missing_count": 9,
"safe_credential_required_count": 9,
"safe_credential_accepted_evidence_count": 0,
"owner_response_received_count": 0,
"owner_response_accepted_count": 0,
"execution_ready_count": 0,
"blocked_target_count": 9,
"external_scope_target_count": 1,
"forbidden_action_count": 12,
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"workflow_modification_authorized": false,
"workflow_trigger_authorized": false,
"secret_value_collection_allowed": false,
"private_clone_url_collection_allowed": false,
"not_found_or_private_as_absent_allowed": false,
"public_repo_allowed": false
},
"targets": [
{
"github_repo": "owenhytsai/awoooi",
"source_key": "wooo/awoooi",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "HIGH",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/clawbot-v5",
"source_key": "wooo/clawbot-v5",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/wooo-aiops",
"source_key": "wooo/wooo-aiops",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_refs_blocked",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/wooo-infra-config",
"source_key": "wooo/wooo-infra-config",
"approval_required": true,
"probe_status": "exists",
"target_state": "exists_aligned",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_public_probe_visible_private_evidence_required",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"github_target_publicly_readable_by_unauthenticated_probe",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-WOOO-INFRA-CONFIG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/ewoooc",
"source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GITEA-PUBLIC-REPO-SEARCH-SNAPSHOT.md",
"docs/security/LOCAL-REPO-CANONICAL-EWOOOC-MOMO-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/bitan-pharmacy",
"source_key": "bitan-pharmacy",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/tsenyang-website",
"source_key": "tsenyang-website",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "MEDIUM",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
"docs/security/github-target-probe.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "nexu-io/open-design",
"source_key": "open-design",
"approval_required": false,
"probe_status": "exists",
"target_state": "external_scope",
"risk": "LOW",
"visibility_evidence_status": "external_scope_not_backup_target",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "not_required_external_scope",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"external_scope_review_only"
],
"evidence_refs": [
"docs/security/github-target-probe.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/VibeWork",
"source_key": "vibework",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
"docs/security/source-control-primary-readiness-gate.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
},
{
"github_repo": "owenhytsai/agent-bounty-protocol",
"source_key": "agent-bounty-protocol",
"approval_required": true,
"probe_status": "not_found_or_private",
"target_state": "not_found_or_private",
"risk": "HIGH",
"visibility_evidence_status": "blocked_private_or_absent_not_verified",
"private_backup_verified": false,
"private_visibility_owner_evidence_ref": null,
"safe_credential_evidence_status": "missing_safe_credential_metadata",
"safe_credential_evidence_ref": null,
"owner_response_accepted": false,
"refs_sync_ready": false,
"execution_ready": false,
"blockers": [
"not_found_or_private_is_not_private_verification",
"private_visibility_owner_evidence_missing",
"safe_credential_metadata_missing",
"refs_sync_not_authorized"
],
"evidence_refs": [
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
"docs/security/source-control-primary-readiness-gate.snapshot.json",
"docs/security/github-target-owner-decision-response.snapshot.json"
],
"forbidden_actions": [
"create_github_repo",
"change_repo_visibility",
"push_refs",
"delete_refs",
"force_push",
"mirror_sync",
"switch_github_primary",
"disable_gitea",
"workflow_modification",
"workflow_trigger",
"secret_value_collection",
"private_clone_url_collection"
],
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
}
],
"acceptance_requirements": [
"每個 approval-required GitHub target 必須有 private visibility owner evidence ref。",
"公開 probe 可讀的 target 不得被視為符合私有備援要求。",
"`not_found_or_private` 只代表未授權只讀 probe 看不到，不得當成 private verified 或 repo absent。",
"safe credential evidence 只允許 credential storage / owner / scope / rotation metadata，不得收 token value。",
"owner response accepted count 在 reviewer acceptance 前必須維持 0。",
"private evidence 與 safe credential evidence 完整前不得建立 repo、改 visibility、push refs 或切 GitHub primary。"
],
"rejection_rules": [
"任何 public repo 或 unauthenticated readable target 均不得標示 private_backup_verified=true。",
"任何 token、PAT、private key、cookie、session、private clone credential 或 partial secret 必須拒收。",
"任何 repo creation、visibility change、refs sync、force push、tag rewrite、workflow trigger 或 primary switch request 必須拒收。",
"任何把 `not_found_or_private` 解讀為 repo 不存在或可建立新 repo 的 response 必須拒收。"
],
"operation_boundaries": {
"read_only_api_allowed": true,
"github_api_write_allowed": false,
"gitea_api_write_allowed": false,
"repo_creation_allowed": false,
"visibility_change_allowed": false,
"refs_sync_allowed": false,
"workflow_modification_allowed": false,
"workflow_trigger_allowed": false,
"github_primary_switch_allowed": false,
"secret_value_collection_allowed": false,
"private_clone_url_collection_allowed": false
},
"authorization_flags": {
"runtime_execution_authorized": false,
"repo_creation_authorized": false,
"visibility_change_authorized": false,
"refs_sync_authorized": false,
"workflow_modification_authorized": false,
"workflow_trigger_authorized": false,
"github_primary_switch_authorized": false,
"secret_values_collected": false
}
}