feat(security): 新增 public gateway preflight 只讀清冊

scripts/security/high-value-config-control-coverage.py

@@ -24,15 +24,18 @@ TAIPEI = timezone(timedelta(hours=8))
 
 CONTROL_STATUS_BY_CATEGORY = {
     "nginx_public_gateway": {
-        "coverage_status": "repo_only_drift_detector_ready",
-        "coverage_percent": 78,
+        "coverage_status": "repo_only_preflight_contract_ready_needs_owner_live_diff",
+        "coverage_percent": 84,
         "evidence_refs": [
             "docs/security/NGINX-CONFIG-DRIFT-DETECTOR.md",
             "docs/security/nginx-config-drift-repo.snapshot.json",
             "docs/security/DOMAIN-TLS-CERTBOT-INVENTORY.md",
+            "docs/security/PUBLIC-GATEWAY-PREFLIGHT-INVENTORY.md",
+            "docs/security/public-gateway-preflight-inventory.snapshot.json",
+            "docs/schemas/public_gateway_preflight_inventory_v1.schema.json",
         ],
-        "current_gap": "缺 owner-provided live conf 匯出與 approved maintenance window；不得 SSH 擷取或 reload。",
-        "next_owner_action": "提供脫敏 live conf 匯出檔或確認維護窗口、rollback owner 與 route smoke plan。",
+        "current_gap": "已固定 12 個 public gateway preflight gate；owner response、live conf、rendered diff、nginx -t、route smoke、maintenance window 與 rollback owner 仍全部為 0。",
+        "next_owner_action": "補 public gateway owner、owner-provided live conf、source-to-live rendered diff、nginx -t evidence、route smoke、maintenance window 與 rollback owner。",
     },
     "dns_tls_certbot": {
         "coverage_status": "repo_only_inventory_ready",
@@ -184,6 +187,15 @@ CONTROL_STATUS_BY_CATEGORY = {
 FALSE_BOUNDARIES = {
     "runtime_execution_authorized": False,
     "host_write_authorized": False,
+    "host_live_conf_read_authorized": False,
+    "nginx_test_authorized": False,
+    "public_gateway_reload_authorized": False,
+    "public_route_change_authorized": False,
+    "admin_route_change_authorized": False,
+    "websocket_route_change_authorized": False,
+    "acme_challenge_change_authorized": False,
+    "route_smoke_authorized": False,
+    "rollback_executed": False,
     "nginx_reload_authorized": False,
     "dns_tls_change_authorized": False,
     "certbot_renew_authorized": False,
@@ -288,6 +300,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]:
             "policy_defined_needs_restore_drill_owner",
             "repo_only_inventory_ready_needs_restore_drill_owner",
             "repo_only_inventory_ready_needs_live_route_evidence",
+            "repo_only_preflight_contract_ready_needs_owner_live_diff",
             "policy_ready_needs_drift_evidence",
             "inventory_needed",
             "repo_only_inventory_ready_needs_live_owner_evidence",