wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(iwooos): 新增 public runtime config 驗收與 tenants 防洩漏
All checks were successful
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / tests (push) Successful in 1m29s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m22s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m40s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-15 04:29:54 +08:00
parent 77a76d1a10
commit 5f9a11e6b2
16 changed files with 2853 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

416
scripts/security/security-mirror-progress-guard.py
View File

@@ -149,6 +149,9 @@ def validate(root: Path) -> None:
cd_runner_secret_injection_change_evidence_acceptance = load_json(
security_dir / "cd-runner-secret-injection-change-evidence-acceptance.snapshot.json"
)
public_runtime_config_change_evidence_acceptance = load_json(
security_dir / "public-runtime-config-change-evidence-acceptance.snapshot.json"
)
public_gateway_preflight_inventory = load_json(
security_dir / "public-gateway-preflight-inventory.snapshot.json"
)
@@ -2506,7 +2509,7 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.summary.needs_live_evidence_count",
high_value_config_coverage["summary"]["needs_live_evidence_count"],
8,
9,
)
for key in [
"owner_response_received_count",
@@ -2883,6 +2886,32 @@ def validate(root: Path) -> None:
workflow_runner_category["evidence_refs"],
evidence_ref,
)
public_runtime_config_category = next(
item
for item in high_value_config_coverage["coverage_categories"]
if item["category_id"] == "public_admin_api_runtime_config"
)
assert_equal(
"high_value_config_coverage.coverage_categories.public_runtime_config.coverage_percent",
public_runtime_config_category["coverage_percent"],
64,
)
assert_equal(
"high_value_config_coverage.coverage_categories.public_runtime_config.coverage_status",
public_runtime_config_category["coverage_status"],
"change_evidence_acceptance_ready_needs_runtime_config_owner_evidence",
)
for evidence_ref in [
"docs/HARD_RULES.md",
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
"docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json",
]:
assert_contains(
"high_value_config_coverage.coverage_categories.public_runtime_config.evidence_refs",
public_runtime_config_category["evidence_refs"],
evidence_ref,
)
assert_contains(
"high_value_config_coverage.lowest_coverage_categories.docker",
[item["category_id"] for item in high_value_config_coverage["lowest_coverage_categories"]],
@@ -5765,6 +5794,8 @@ def validate(root: Path) -> None:
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
"docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json",
"docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md",
]:
assert_contains(
"iwooos_projection.source_paths.config_inventory",
@@ -5790,7 +5821,7 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_c0_category_count": 8,
"high_value_config_control_coverage_c1_category_count": 4,
"high_value_config_control_coverage_average_percent": 68,
"high_value_config_control_coverage_needs_live_evidence_count": 8,
"high_value_config_control_coverage_needs_live_evidence_count": 9,
"high_value_config_control_coverage_owner_response_required_count": 14,
"high_value_config_control_coverage_owner_response_received_count": 0,
"high_value_config_control_coverage_owner_response_accepted_count": 0,
@@ -5943,6 +5974,32 @@ def validate(root: Path) -> None:
"cd_runner_secret_injection_change_evidence_acceptance_secret_metadata_coverage_percent_after_acceptance": 68,
"cd_runner_secret_injection_change_evidence_acceptance_gitea_workflow_runner_coverage_percent_before_acceptance": 70,
"cd_runner_secret_injection_change_evidence_acceptance_gitea_workflow_runner_coverage_percent_after_acceptance": 72,
"public_runtime_config_change_evidence_acceptance_first_layer": True,
"public_runtime_config_change_evidence_acceptance_candidate_count": 6,
"public_runtime_config_change_evidence_acceptance_c0_candidate_count": 5,
"public_runtime_config_change_evidence_acceptance_c1_candidate_count": 1,
"public_runtime_config_change_evidence_acceptance_write_capable_candidate_count": 6,
"public_runtime_config_change_evidence_acceptance_source_ref_count": 20,
"public_runtime_config_change_evidence_acceptance_required_evidence_field_count": 21,
"public_runtime_config_change_evidence_acceptance_reviewer_check_count": 21,
"public_runtime_config_change_evidence_acceptance_outcome_lane_count": 8,
"public_runtime_config_change_evidence_acceptance_blocked_action_count": 32,
"public_runtime_config_change_evidence_acceptance_received_count": 0,
"public_runtime_config_change_evidence_acceptance_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_route_scope_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_admin_auth_boundary_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_api_contract_readback_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_cors_origin_diff_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_frontend_env_diff_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_i18n_redaction_review_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_desktop_mobile_smoke_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_sensitive_string_scan_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_postcheck_evidence_accepted_count": 0,
"public_runtime_config_change_evidence_acceptance_runtime_approval_package_ready_count": 0,
"public_runtime_config_change_evidence_acceptance_runtime_gate_count": 0,
"public_runtime_config_change_evidence_acceptance_action_button_count": 0,
"public_runtime_config_change_evidence_acceptance_coverage_percent_before_acceptance": 62,
"public_runtime_config_change_evidence_acceptance_coverage_percent_after_acceptance": 64,
}
for key, expected in expected_ssh_network_projection_summary.items():
assert_equal(
@@ -11762,8 +11819,8 @@ def validate(root: Path) -> None:
)
for text in [
"source_scope_id",
"source_namespace_redacted",
"sourcePublicScopeCode(index)",
"sourceRepos.map((repo, index)",
"sourceRiskLabel(repo.risk, t)",
"sourceReadinessLabel(repo.readiness_state, t)",
"sourceActionLabel(repo.readiness_state, t)",
@@ -11772,9 +11829,17 @@ def validate(root: Path) -> None:
]:
assert_text_contains("awooop_tenants_page.source_namespace_redaction", awooop_tenants_page, text)
for text in [
"{repo.github_repo}",
"{repo.source_key}",
"{repo.source_scope_id}",
"key={`${repo.source_scope_id}",
"{repo.risk}",
"{repo.readiness_state}",
"{repo.scope_status}",
"namespace_redacted={String(repo.source_namespace_redacted)}",
"blocked_waiting_",
"observe_scope_review",
"blockers=",
"repo_owner_namespace_redacted=true",
"raw_repository_namespace_visible=false",
"public_api_raw_repo_namespace_allowed=false",
@@ -15533,7 +15598,7 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_c0_category_count=8",
"high_value_config_control_coverage_c1_category_count=4",
"high_value_config_control_coverage_average_percent=68",
"high_value_config_control_coverage_needs_live_evidence_count=8",
"high_value_config_control_coverage_needs_live_evidence_count=9",
"high_value_config_control_coverage_owner_response_required_count=14",
"high_value_config_control_coverage_owner_response_received_count=0",
"high_value_config_control_coverage_owner_response_accepted_count=0",
@@ -15543,6 +15608,29 @@ def validate(root: Path) -> None:
"k8s_production_gitops_coverage_percent=64",
"secret_metadata_coverage_percent=68",
"gitea_workflow_runner_source_control_coverage_percent=72",
"public_admin_api_runtime_config_coverage_percent=64",
"public_runtime_config_change_evidence_acceptance_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_c0_candidate_count=5",
"public_runtime_config_change_evidence_acceptance_c1_candidate_count=1",
"public_runtime_config_change_evidence_acceptance_write_capable_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_source_ref_count=20",
"public_runtime_config_change_evidence_acceptance_required_evidence_field_count=21",
"public_runtime_config_change_evidence_acceptance_reviewer_check_count=21",
"public_runtime_config_change_evidence_acceptance_outcome_lane_count=8",
"public_runtime_config_change_evidence_acceptance_blocked_action_count=32",
"public_runtime_config_change_evidence_acceptance_received_count=0",
"public_runtime_config_change_evidence_acceptance_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_route_scope_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_admin_auth_boundary_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_api_contract_readback_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_cors_origin_diff_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_frontend_env_diff_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_i18n_redaction_review_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_desktop_mobile_smoke_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_sensitive_string_scan_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_postcheck_evidence_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_runtime_approval_package_ready_count=0",
"public_runtime_config_change_evidence_acceptance_runtime_gate_count=0",
"cd_runner_secret_injection_change_evidence_acceptance_candidate_count=5",
"cd_runner_secret_injection_change_evidence_acceptance_c0_candidate_count=4",
"cd_runner_secret_injection_change_evidence_acceptance_c1_candidate_count=1",
@@ -15701,6 +15789,27 @@ def validate(root: Path) -> None:
"secret_rotation_authorized=false",
"secret_store_read_authorized=false",
"secret_injection_change_authorized=false",
"runtime_config_change_authorized=false",
"api_route_change_authorized=false",
"cors_change_authorized=false",
"frontend_env_change_authorized=false",
"middleware_auth_change_authorized=false",
"callback_url_change_authorized=false",
"webhook_secret_change_authorized=false",
"security_header_change_authorized=false",
"cookie_policy_change_authorized=false",
"csrf_disable_authorized=false",
"rate_limit_disable_authorized=false",
"api_contract_change_authorized=false",
"i18n_public_text_internal_identity_allowed=false",
"internal_ip_exposure_allowed=false",
"repo_namespace_exposure_allowed=false",
"owner_namespace_exposure_allowed=false",
"internal_status_code_exposure_allowed=false",
"internal_transcript_exposure_allowed=false",
"raw_payload_storage_allowed=false",
"desktop_mobile_smoke_authorized=false",
"database_migration_authorized=false",
"github_hosted_runner_enable_authorized=false",
"gitea_action_dispatch_authorized=false",
"cd_pipeline_run_authorized=false",
@@ -15744,6 +15853,11 @@ def validate(root: Path) -> None:
iwooos_projection_page,
"{ key: 'workflowSecret', rank: 'P0-4', state: '68% / 72%'",
)
assert_text_contains(
"iwooos_page.critical_config_priority_public_runtime_percent",
iwooos_projection_page,
"{ key: 'publicRuntime', rank: 'P0-5', state: '64% / route 0'",
)
for text in [
"critical_config_priority_frontstage_summary_count=4",
"critical_config_priority_item_count=6",
@@ -15760,6 +15874,26 @@ def validate(root: Path) -> None:
"nginx_public_gateway_nginx_test_evidence_count=0",
"secret_metadata_coverage_percent=68",
"gitea_workflow_runner_source_control_coverage_percent=72",
"public_admin_api_runtime_config_coverage_percent=64",
"public_runtime_config_change_evidence_acceptance_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_c0_candidate_count=5",
"public_runtime_config_change_evidence_acceptance_write_capable_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_required_evidence_field_count=21",
"public_runtime_config_change_evidence_acceptance_reviewer_check_count=21",
"public_runtime_config_change_evidence_acceptance_outcome_lane_count=8",
"public_runtime_config_change_evidence_acceptance_blocked_action_count=32",
"public_runtime_config_change_evidence_acceptance_received_count=0",
"public_runtime_config_change_evidence_acceptance_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_route_scope_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_admin_auth_boundary_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_api_contract_readback_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_cors_origin_diff_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_frontend_env_diff_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_i18n_redaction_review_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_desktop_mobile_smoke_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_sensitive_string_scan_accepted_count=0",
"public_runtime_config_change_evidence_acceptance_runtime_approval_package_ready_count=0",
"public_runtime_config_change_evidence_acceptance_runtime_gate_count=0",
"cd_runner_secret_injection_change_evidence_acceptance_candidate_count=5",
"cd_runner_secret_injection_change_evidence_acceptance_c0_candidate_count=4",
"cd_runner_secret_injection_change_evidence_acceptance_write_capable_candidate_count=5",
@@ -15796,6 +15930,25 @@ def validate(root: Path) -> None:
"runner_change_authorized=false",
"repo_secret_change_authorized=false",
"secret_injection_change_authorized=false",
"runtime_config_change_authorized=false",
"api_route_change_authorized=false",
"cors_change_authorized=false",
"frontend_env_change_authorized=false",
"middleware_auth_change_authorized=false",
"callback_url_change_authorized=false",
"webhook_secret_change_authorized=false",
"security_header_change_authorized=false",
"cookie_policy_change_authorized=false",
"csrf_disable_authorized=false",
"rate_limit_disable_authorized=false",
"api_contract_change_authorized=false",
"i18n_public_text_internal_identity_allowed=false",
"internal_ip_exposure_allowed=false",
"repo_namespace_exposure_allowed=false",
"owner_namespace_exposure_allowed=false",
"internal_status_code_exposure_allowed=false",
"internal_transcript_exposure_allowed=false",
"raw_payload_storage_allowed=false",
"gitea_action_dispatch_authorized=false",
"cd_pipeline_run_authorized=false",
"production_deploy_authorized=false",
@@ -15831,6 +15984,21 @@ def validate(root: Path) -> None:
web_messages_en["iwooos"]["criticalConfigPriority"]["items"]["k8sArgocd"]["body"],
"GitOps 變更證據驗收",
)
for locale, messages in [
("zh-TW", web_messages_zh),
("en", web_messages_en),
]:
public_runtime_body = messages["iwooos"]["criticalConfigPriority"]["items"]["publicRuntime"]["body"]
assert_text_contains(
f"web_messages.{locale}.iwooos.criticalConfigPriority.items.publicRuntime.body.acceptance",
public_runtime_body,
"變更證據驗收",
)
assert_text_contains(
f"web_messages.{locale}.iwooos.criticalConfigPriority.items.publicRuntime.body.redaction",
public_runtime_body,
"不得暴露 raw namespace",
)
assert_contains(
"web_messages.zh-TW.iwooos.highValueConfigControlCoverage",
list(web_messages_zh["iwooos"].keys()),
@@ -17341,6 +17509,244 @@ def validate(root: Path) -> None:
f"cd_runner_secret_injection_change_evidence_acceptance.{item['change_evidence_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"public_runtime_config_change_evidence_acceptance.schema",
public_runtime_config_change_evidence_acceptance["schema_version"],
"public_runtime_config_change_evidence_acceptance_v1",
)
assert_equal(
"public_runtime_config_change_evidence_acceptance.status",
public_runtime_config_change_evidence_acceptance["status"],
"change_evidence_acceptance_ledger_ready_no_runtime_action",
)
assert_equal(
"public_runtime_config_change_evidence_acceptance.mode",
public_runtime_config_change_evidence_acceptance["mode"],
"metadata_only_no_secret_no_route_change_no_deploy",
)
expected_public_runtime_config_summary = {
"change_evidence_candidate_count": 6,
"c0_change_evidence_candidate_count": 5,
"c1_change_evidence_candidate_count": 1,
"write_capable_candidate_count": 6,
"source_ref_count": 20,
"existing_source_ref_count": 20,
"required_evidence_field_count": 21,
"reviewer_check_count": 21,
"outcome_lane_count": 8,
"blocked_action_count": 32,
"change_evidence_received_count": 0,
"change_evidence_accepted_count": 0,
"route_scope_accepted_count": 0,
"admin_auth_boundary_accepted_count": 0,
"api_contract_readback_accepted_count": 0,
"cors_origin_diff_accepted_count": 0,
"frontend_env_diff_accepted_count": 0,
"i18n_redaction_review_accepted_count": 0,
"webhook_callback_owner_accepted_count": 0,
"desktop_mobile_smoke_accepted_count": 0,
"sensitive_string_scan_accepted_count": 0,
"postcheck_evidence_accepted_count": 0,
"runtime_approval_package_ready_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
"public_admin_api_runtime_config_coverage_percent_before_acceptance": 62,
"public_admin_api_runtime_config_coverage_percent_after_acceptance": 64,
}
for key, expected in expected_public_runtime_config_summary.items():
assert_equal(
f"public_runtime_config_change_evidence_acceptance.summary.{key}",
public_runtime_config_change_evidence_acceptance["summary"][key],
expected,
)
for key, value in public_runtime_config_change_evidence_acceptance["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"public_runtime_config_change_evidence_acceptance.execution_boundaries.{key}", value)
else:
assert_false(f"public_runtime_config_change_evidence_acceptance.execution_boundaries.{key}", value)
expected_public_runtime_config_ids = [
"public_runtime_config_change_evidence:public_product_route_and_i18n_redaction",
"public_runtime_config_change_evidence:admin_auth_and_operator_console_boundary",
"public_runtime_config_change_evidence:api_cors_and_public_url_runtime_config",
"public_runtime_config_change_evidence:frontend_env_and_sentry_tunnel_runtime_config",
"public_runtime_config_change_evidence:webhook_callback_and_notification_runtime_config",
"public_runtime_config_change_evidence:cross_product_runtime_route_scope",
]
assert_equal(
"public_runtime_config_change_evidence_acceptance.candidate_ids",
[
item["change_evidence_candidate_id"]
for item in public_runtime_config_change_evidence_acceptance["change_evidence_candidates"]
],
expected_public_runtime_config_ids,
)
expected_public_runtime_config_check_ids = [
"change_ref_present",
"affected_route_refs_present",
"public_url_not_internal_ip",
"admin_auth_boundary_called_out",
"api_contract_readback_present",
"cors_origin_diff_ref_only",
"frontend_env_diff_ref_present",
"i18n_redaction_review_present",
"webhook_callback_owner_present",
"desktop_mobile_smoke_present",
"api_health_readback_present",
"sensitive_string_scan_present",
"console_error_scan_present",
"no_secret_value_or_cookie",
"security_header_or_cookie_impact_called_out",
"blast_radius_present",
"maintenance_window_present",
"rollback_owner_present",
"postcheck_evidence_present",
"no_runtime_action_claim",
"cross_project_sync_noted",
]
assert_equal(
"public_runtime_config_change_evidence_acceptance.reviewer_check_ids",
[item["check_id"] for item in public_runtime_config_change_evidence_acceptance["reviewer_checks"]],
expected_public_runtime_config_check_ids,
)
expected_public_runtime_config_outcome_ids = [
"waiting_change_evidence",
"quarantine_sensitive_payload",
"reject_unredacted_or_runtime_claim",
"request_supplement",
"ready_for_reviewer_acceptance",
"ready_for_runtime_approval_package",
"waiting_maintenance_window",
"waiting_runtime_gate",
]
assert_equal(
"public_runtime_config_change_evidence_acceptance.outcome_lane_ids",
[item["lane_id"] for item in public_runtime_config_change_evidence_acceptance["outcome_lanes"]],
expected_public_runtime_config_outcome_ids,
)
expected_public_runtime_config_blocked_actions = [
"change_public_route",
"change_admin_route",
"change_api_route",
"change_cors_origin",
"modify_next_public_env",
"expose_internal_ip",
"expose_repo_slug",
"expose_owner_namespace",
"expose_secret_value",
"bypass_auth",
"change_callback_url",
"change_webhook_secret",
"modify_middleware_auth",
"disable_csrf",
"disable_rate_limit",
"change_cookie_policy",
"change_security_headers",
"publish_internal_transcript",
"publish_internal_status_code",
"deploy_frontend",
"deploy_api",
"rewrite_nginx_route",
"change_public_url",
"change_openapi_contract",
"mutate_database",
"run_migration",
"send_webhook",
"active_scan",
"enable_action_button",
"production_deploy",
"force_push",
"switch_github_primary",
]
assert_equal(
"public_runtime_config_change_evidence_acceptance.blocked_actions",
public_runtime_config_change_evidence_acceptance["blocked_actions"],
expected_public_runtime_config_blocked_actions,
)
for item in public_runtime_config_change_evidence_acceptance["change_evidence_candidates"]:
assert_equal(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.change_evidence_fields",
len(item["change_evidence_fields"]),
24,
)
assert_equal(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.required_evidence_fields",
len(item["required_evidence_fields"]),
21,
)
assert_equal(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.reviewer_checks",
len(item["reviewer_checks"]),
21,
)
assert_equal(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.outcome_lanes",
len(item["outcome_lanes"]),
8,
)
assert_equal(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.blocked_actions",
len(item["blocked_actions"]),
32,
)
assert_true(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.not_approval",
item["not_approval"],
)
for false_key in [
"change_evidence_received",
"change_evidence_accepted",
"change_evidence_rejected",
"change_evidence_quarantined",
"route_scope_accepted",
"admin_auth_boundary_accepted",
"api_contract_readback_accepted",
"cors_origin_diff_accepted",
"frontend_env_diff_accepted",
"i18n_redaction_review_accepted",
"webhook_callback_owner_accepted",
"desktop_mobile_smoke_accepted",
"sensitive_string_scan_accepted",
"postcheck_evidence_accepted",
"runtime_approval_package_ready",
"runtime_execution_authorized",
"runtime_config_change_authorized",
"public_route_change_authorized",
"admin_route_change_authorized",
"api_route_change_authorized",
"cors_change_authorized",
"frontend_env_change_authorized",
"middleware_auth_change_authorized",
"callback_url_change_authorized",
"webhook_receiver_change_authorized",
"webhook_secret_change_authorized",
"security_header_change_authorized",
"cookie_policy_change_authorized",
"csrf_disable_authorized",
"rate_limit_disable_authorized",
"api_contract_change_authorized",
"i18n_public_text_internal_identity_allowed",
"internal_ip_exposure_allowed",
"repo_namespace_exposure_allowed",
"owner_namespace_exposure_allowed",
"internal_status_code_exposure_allowed",
"internal_transcript_exposure_allowed",
"secret_value_collection_allowed",
"secret_hash_collection_allowed",
"partial_token_collection_allowed",
"raw_payload_storage_allowed",
"desktop_mobile_smoke_authorized",
"route_smoke_authorized",
"production_deploy_authorized",
"database_migration_authorized",
"force_push_authorized",
"github_primary_switch_authorized",
"runtime_gate",
"action_buttons_allowed",
]:
assert_false(
f"public_runtime_config_change_evidence_acceptance.{item['change_evidence_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"iwooos_projection.summary.domain_tls_certbot_inventory_managed_domain_count",
iwooos_projection["summary"]["domain_tls_certbot_inventory_managed_domain_count"],