diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json
index 0d019bcf5..7fad94e13 100644
--- a/apps/web/messages/en.json
+++ b/apps/web/messages/en.json
@@ -2708,6 +2708,51 @@
"guard": "not_authorization=true; approval record=false"
}
}
+ },
+ "progressAcceleration": {
+ "title": "Progress Acceleration And Real Unlock Points",
+ "subtitle": "Progress is moving, but the 58% headline only gets reassessed when owner responses, runtime gates, GitHub primary readiness, or AwoooP production landing produce real evidence. This board makes the next visible unlock points explicit.",
+ "laneLabel": "Acceleration lane",
+ "unlockLabel": "Unlock signal",
+ "guardLabel": "Low-friction boundary remains",
+ "items": {
+ "ownerResponses": {
+ "title": "Converge owner responses first",
+ "body": "S4.9-S4.12 owner responses for Gitea, GitHub targets, refs truth, and workflow / secret names are the main reason the headline is holding at 58%.",
+ "unlock": "The headline can be reassessed only after the first accepted redacted owner responses arrive.",
+ "guard": "Redacted evidence only; no repo creation, refs sync, workflow mutation, or secret value collection."
+ },
+ "redactedIngestion": {
+ "title": "Connect redacted evidence ingestion",
+ "body": "Security findings, Kali observe signals, and owner evidence need to enter the read-only intake plane as redacted metadata before runtime work.",
+ "unlock": "Runtime landing gets a real signal only after the redacted payload ingestion adapter is approved and passes preflight.",
+ "guard": "No raw payload, no credential plaintext, and no active scan."
+ },
+ "runtimeGate": {
+ "title": "Runtime gates stay separately approved",
+ "body": "Future scanning, repair, host update, or blocking controls must not auto-advance from frontend status.",
+ "unlock": "Runtime landing can be reassessed only after S3 / S3.4 has human approval, rollback, post-check metrics, and an active runtime gate.",
+ "guard": "active runtime gate=0; action button=false; Kali /execute remains a block candidate."
+ },
+ "githubReadiness": {
+ "title": "Split GitHub primary readiness blockers",
+ "body": "The long-term GitHub direction is agreed, but targets, refs, workflow / secret names, and rollback ADR still need full verification.",
+ "unlock": "primary_ready_count can move only after owner responses, refs truth, workflow parity, and rollback ADR are verifiable.",
+ "guard": "No primary switch, no force push, no refs deletion, and no unapproved target repo creation."
+ },
+ "awooopLanding": {
+ "title": "Make AwoooP / IwoooS visible in the main flow",
+ "body": "One reason progress feels slow is that security work still looks like backend contracts; the next steps, blockers, prohibitions, and unlock signals need to be visible in-product.",
+ "unlock": "Once AwoooP consumes the rollup and IwoooS board read-only, users can see the real blockers directly.",
+ "guard": "Read-only landing only; visible status is not authorization and does not add execution buttons."
+ },
+ "cadenceCompression": {
+ "title": "Move future cadence in batches",
+ "body": "S2.38-S2.45 split many checklist layers, making progress feel fragmented. Next work should favor P0 owner responses and AwoooP landing over endlessly adding small checklist layers.",
+ "unlock": "Similar framework details should be batched in future reports; only high-level gate changes move the headline.",
+ "guard": "Faster cadence does not loosen safety; runtime and source-control cutover still need human gates."
+ }
+ }
}
},
"tickets": {
diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json
index cfea5bb7c..a07023d71 100644
--- a/apps/web/messages/zh-TW.json
+++ b/apps/web/messages/zh-TW.json
@@ -2709,6 +2709,51 @@
"guard": "not_authorization=true;approval record=false"
}
}
+ },
+ "progressAcceleration": {
+ "title": "進度加速與真正解鎖點",
+ "subtitle": "目前不是沒有推進,而是 58% headline 只在 owner response、runtime gate、GitHub primary readiness 或 AwoooP production landing 有實質 evidence 時才會重估。這裡把下一批有感推進點集中顯示。",
+ "laneLabel": "加速路線",
+ "unlockLabel": "解鎖訊號",
+ "guardLabel": "仍維持低摩擦邊界",
+ "items": {
+ "ownerResponses": {
+ "title": "Owner responses 先收斂",
+ "body": "S4.9-S4.12 的 Gitea、GitHub target、refs truth、workflow / secret name owner response 是目前 58% 最主要的卡點。",
+ "unlock": "收到並驗收第一批脫敏 owner response 後,headline 才有重估依據。",
+ "guard": "只收脫敏 evidence;不建立 repo、不同步 refs、不修改 workflow、不收 secret value。"
+ },
+ "redactedIngestion": {
+ "title": "Redacted ingestion 接上可見證據",
+ "body": "資安 finding、Kali observe 訊號與 owner evidence 需要先以 redacted metadata 進入只讀收件面,再談 runtime。",
+ "unlock": "redacted payload ingestion adapter 經人工批准並通過 preflight 後,runtime landing 會有實質訊號。",
+ "guard": "不收 raw payload、不收 credential plaintext、不啟動 active scan。"
+ },
+ "runtimeGate": {
+ "title": "Runtime gate 必須獨立批准",
+ "body": "後續真正掃描、修復、主機更新或 blocking control 都不能從前端狀態自動推進。",
+ "unlock": "S3 / S3.4 有人工批准、rollback、post-check metrics 與 active runtime gate 後,才進入落地重估。",
+ "guard": "active runtime gate=0;action button=false;Kali /execute 仍是 block candidate。"
+ },
+ "githubReadiness": {
+ "title": "GitHub primary readiness 要拆關鍵缺口",
+ "body": "Gitea 轉 GitHub 的大方向已確認,但 target、refs、workflow / secret name、rollback ADR 還沒全量驗證。",
+ "unlock": "owner response、refs truth、workflow parity 與 rollback ADR 都可驗證後,primary_ready_count 才能往上。",
+ "guard": "不切 primary、不 force push、不刪 refs、不建立未批准 target repo。"
+ },
+ "awooopLanding": {
+ "title": "AwoooP / IwoooS 主線可見",
+ "body": "使用者感覺慢的原因之一,是資安工作還太像後台契約;需要把下一步、卡點、禁令與解鎖訊號放到產品入口。",
+ "unlock": "AwoooP 主線只讀消費 rollup 與 IwoooS 面板後,使用者能直接看到真正卡點。",
+ "guard": "只讀 landing;不把可見狀態當授權,不新增執行按鈕。"
+ },
+ "cadenceCompression": {
+ "title": "後續節奏改成批次推進",
+ "body": "S2.38-S2.45 太多細層 checklist 讓進度看起來碎。後續應優先收斂 P0 owner response 與 AwoooP landing,而不是無限拆小核對項。",
+ "unlock": "相同類型的 framework detail 之後合併成一批回報,只有高層 gate 變動才調整 headline。",
+ "guard": "節奏加快不等於放寬安全;runtime 與 source-control cutover 仍需人工 gate。"
+ }
+ }
}
},
"tickets": {
diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx
index e8bc73eb8..579d301ac 100644
--- a/apps/web/src/app/[locale]/iwooos/page.tsx
+++ b/apps/web/src/app/[locale]/iwooos/page.tsx
@@ -31,6 +31,13 @@ type PostureMetric = {
tone: 'steady' | 'warn' | 'locked'
}
+type ProgressAccelerationLane = {
+ key: string
+ lane: string
+ icon: typeof ShieldCheck
+ tone: 'steady' | 'warn' | 'locked'
+}
+
type Pillar = {
key: string
icon: typeof ShieldCheck
@@ -307,6 +314,15 @@ const postureMetrics: PostureMetric[] = [
{ key: 'activeGates', value: '0', tone: 'locked' },
]
+const progressAccelerationLanes: ProgressAccelerationLane[] = [
+ { key: 'ownerResponses', lane: 'PAL1', icon: ClipboardCheck, tone: 'warn' },
+ { key: 'redactedIngestion', lane: 'PAL2', icon: FileText, tone: 'warn' },
+ { key: 'runtimeGate', lane: 'PAL3', icon: Lock, tone: 'locked' },
+ { key: 'githubReadiness', lane: 'PAL4', icon: GitBranch, tone: 'warn' },
+ { key: 'awooopLanding', lane: 'PAL5', icon: Radar, tone: 'steady' },
+ { key: 'cadenceCompression', lane: 'PAL6', icon: CheckCircle2, tone: 'steady' },
+]
+
const posturePillars: Pillar[] = [
{ key: 'exposure', icon: Radar, tone: 'warn' },
{ key: 'sourceControl', icon: GitBranch, tone: 'warn' },
@@ -784,6 +800,38 @@ function MetricCard({ item }: { item: PostureMetric }) {
)
}
+function ProgressAccelerationLaneCard({ item }: { item: ProgressAccelerationLane }) {
+ const t = useTranslations('iwooos.progressAcceleration')
+ const Icon = item.icon
+ return (
+
{t('journey.title')}
diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 06d3dc4f6..34996745c 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,3 +1,17 @@
+## 2026-05-20 | 資安供應鏈 S2.46:IwoooS Progress Acceleration Lanes
+
+**背景**:S2.38-S2.45 連續補了 host owner decision record human handoff / human record owner review 的 packets、checklists、outcomes 與 preparation guard,實際上有推進框架安全性,但 headline 58% 不會因 framework detail 自動上升,使用者會感覺進度很慢。本輪把慢的原因直接呈現在 IwoooS 首屏,並將後續同類框架細節改採 milestone batch 節奏。
+
+**完成**:
+- `/iwooos` 新增「進度加速與 58% 解鎖面板」,顯示 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing、cadence compression 六條 acceleration lanes。
+- `iwooos_posture_projection_v1` schema / snapshot 新增 `progress_acceleration_lanes` 與 `progress_acceleration_lane_count=6`,每條 lane 固定 `display_mode=progress_acceleration_only`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`payloads_ingested=false`、`active_runtime_gate_count=0`、`github_primary_ready_count=0`、`production_landing_enabled=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
+- `security_mirror_status_rollup_v1` 新增 `progress_acceleration_policy` 與 micro progress ledger `s2_46_iwooos_progress_acceleration_lanes`,明確記錄 S2.38-S2.45 看起來慢是因為多數是防誤讀的 framework detail,headline 仍只在 owner response、runtime gate、GitHub primary readiness 或 production landing 有 evidence 時 review。
+- `security-mirror-progress-guard.py` 開始驗證六條 progress acceleration lanes、順序、0 counters、false runtime flags、allowed frontend output 與 forbidden output。
+
+**仍禁止**:
+- progress acceleration lanes 不代表進度已加分、owner response received / accepted、payload ingestion、runtime gate opened、GitHub primary ready、AwoooP production execution、approval record、action button、Kali `/execute`、SSH 登入、主機變更、Kali 更新或 blocking control。
+- 後續節奏會改成更大的 milestone batch,但仍不能跳過 owner response、脫敏驗收、人工批准與獨立 runtime gate。
+
## 2026-05-20 | 資安供應鏈 S2.45:IwoooS Host Owner Decision Record Human Record Owner Review Preparation Checklist
**背景**:S2.44 已把 human record owner review preparation candidate 後的只讀 preparation packets 顯示出來;本輪補上 preparation packets 後的只讀 checklist,避免使用者把 preparation checklist 誤讀成 preparation completed、checklist passed、review started、review ready、owner decision received、正式 decision record 已建立或已批准。
diff --git a/docs/schemas/iwooos_posture_projection_v1.schema.json b/docs/schemas/iwooos_posture_projection_v1.schema.json
index fb385b364..bde84ec5e 100644
--- a/docs/schemas/iwooos_posture_projection_v1.schema.json
+++ b/docs/schemas/iwooos_posture_projection_v1.schema.json
@@ -14,6 +14,7 @@
"source_paths",
"summary",
"progress",
+ "progress_acceleration_lanes",
"posture_pillars",
"non_blocking_lane_ids",
"existing_frontend_surfaces",
@@ -143,6 +144,7 @@
"host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_count",
"host_owner_decision_record_human_record_owner_review_preparation_packet_count",
"host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count",
+ "progress_acceleration_lane_count",
"action_buttons_allowed"
],
"properties": {
@@ -340,6 +342,10 @@
"host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count": {
"type": "integer",
"const": 9
+ },
+ "progress_acceleration_lane_count": {
+ "type": "integer",
+ "const": 6
}
},
"additionalProperties": false
@@ -3807,6 +3813,93 @@
},
"additionalProperties": false
}
+ },
+ "progress_acceleration_lanes": {
+ "type": "array",
+ "minItems": 6,
+ "maxItems": 6,
+ "items": {
+ "type": "object",
+ "required": [
+ "lane_id",
+ "display_order",
+ "acceleration_axis",
+ "current_state",
+ "unlock_condition",
+ "expected_progress_effect",
+ "display_mode",
+ "owner_response_received_count",
+ "owner_response_accepted_count",
+ "payloads_ingested",
+ "active_runtime_gate_count",
+ "github_primary_ready_count",
+ "production_landing_enabled",
+ "runtime_execution_authorized",
+ "action_buttons_allowed",
+ "not_authorization"
+ ],
+ "properties": {
+ "lane_id": {
+ "type": "string"
+ },
+ "display_order": {
+ "type": "integer",
+ "minimum": 1
+ },
+ "acceleration_axis": {
+ "type": "string"
+ },
+ "current_state": {
+ "type": "string"
+ },
+ "unlock_condition": {
+ "type": "string"
+ },
+ "expected_progress_effect": {
+ "type": "string"
+ },
+ "display_mode": {
+ "const": "progress_acceleration_only"
+ },
+ "owner_response_received_count": {
+ "type": "integer",
+ "const": 0
+ },
+ "owner_response_accepted_count": {
+ "type": "integer",
+ "const": 0
+ },
+ "payloads_ingested": {
+ "type": "boolean",
+ "const": false
+ },
+ "active_runtime_gate_count": {
+ "type": "integer",
+ "const": 0
+ },
+ "github_primary_ready_count": {
+ "type": "integer",
+ "const": 0
+ },
+ "production_landing_enabled": {
+ "type": "boolean",
+ "const": false
+ },
+ "runtime_execution_authorized": {
+ "type": "boolean",
+ "const": false
+ },
+ "action_buttons_allowed": {
+ "type": "boolean",
+ "const": false
+ },
+ "not_authorization": {
+ "type": "boolean",
+ "const": true
+ }
+ },
+ "additionalProperties": false
+ }
}
},
"additionalProperties": false
diff --git a/docs/security/IWOOOS-POSTURE-PROJECTION.md b/docs/security/IWOOOS-POSTURE-PROJECTION.md
index 1d3135b44..0cc47b7de 100644
--- a/docs/security/IWOOOS-POSTURE-PROJECTION.md
+++ b/docs/security/IWOOOS-POSTURE-PROJECTION.md
@@ -73,6 +73,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence:
41. 9 個 host owner decision record human record owner review candidate outcome lanes,顯示 candidate checklist 後的只讀結果分流與下一步,但不標記 outcome passed、不開始 review、不標記 ready、不收 owner decision、不建立 decision record、不開 runtime gate。
42. 9 個 host owner decision record human record owner review preparation packets,顯示未來人工 record owner review 畫面準備需要看的 metadata,但不標記 preparation completed、不開始 review、不標記 ready、不收 owner decision、不建立 decision record、不開 runtime gate。
43. 9 個 host owner decision record human record owner review preparation checklist items,顯示 preparation packets 進人工 record owner review 前仍需只讀核對的條件,但不標記 preparation completed、不標記 checklist passed、不開始 review、不標記 ready、不收 owner decision、不建立 decision record、不開 runtime gate。
+44. 6 條 progress acceleration lanes,直接顯示 58% 為何維持、哪些高層 gate 能解鎖下一輪進度判讀,以及後續節奏要改成 milestone batch,但不把 acceleration lane 當授權、加分、owner response、runtime gate、GitHub primary 或 production execution。
## 3.1 既有前端資安頁面整合
@@ -726,6 +727,23 @@ S2.45 將 human record owner review preparation packets 後的只讀核對條件
這個 preparation checklist board 不代表 human record owner review preparation 已完成、checklist 已通過、review 已開始、review 已 ready、handoff 已開始、owner decision 已收到或接受、decision record 已建立、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把 preparation packets 進人工 record owner review 前仍需核對的 read-only 條件顯示清楚。
+## 3.37 Progress Acceleration Lanes
+
+S2.46 將「為什麼進度看起來慢」改成 IwoooS 首屏可見的六條解鎖 lane。這一層只回答「哪些高層 gate 才會讓 headline 58% 進入下一輪 progress review」,不自動調整進度、不收 owner response、不啟用 payload ingestion、不開 runtime gate、不切 GitHub primary、不啟用 production execution。
+
+| 順序 | Acceleration lane | 目前狀態 | 解鎖條件 |
+|------|-------------------|----------|----------|
+| 1 | Owner response | waiting owner response | S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收 |
+| 2 | Redacted ingestion | waiting preflight and human review | 脫敏 payload 通過 preflight、quarantine 與人工 review |
+| 3 | Runtime gate | intentionally closed | 人工批准、scope、rollback、validation evidence 完整後另開 follow-up runtime gate |
+| 4 | GitHub readiness | waiting parity evidence | refs truth、workflow / secret 名稱、rollback ADR 與逐 repo owner decision 通過後 primary_ready_count 大於 0 |
+| 5 | AwoooP landing | read-only landing pending | AwoooP 主線只讀消費 rollup、evidence refs 與 guard result,且不接 execution router |
+| 6 | Cadence compression | approved for next framework work | 後續同類 packet / checklist / outcome 合併成 milestone batch,除非 guard 需要獨立驗證 |
+
+每條 progress acceleration lane 都固定 `display_mode=progress_acceleration_only`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`payloads_ingested=false`、`active_runtime_gate_count=0`、`github_primary_ready_count=0`、`production_landing_enabled=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
+
+這個 acceleration board 不代表進度已加分、owner response 已收到、payload ingestion 已啟用、runtime gate 已開啟、GitHub primary 已 ready、AwoooP production execution 已啟用或任何資安批准已完成。它只把下一個真正能推動 headline 的槓桿顯示清楚,並把後續框架工作改成更有感的 milestone batch 節奏。
+
## 4. 仍禁止
IwoooS 不得提供下列輸出:
@@ -768,7 +786,8 @@ IwoooS 不得提供下列輸出:
36. 把 owner decision record human record owner review candidate outcome 當成 approval、標記 outcome passed、開始 human record owner review、標記 review ready、收 owner decision、由 candidate outcome 建立 decision record,或從 candidate outcome 開 runtime gate。
37. 把 owner decision record human record owner review preparation packet 當成 approval、標記 preparation completed、開始 human record owner review、標記 review ready、收 owner decision、由 preparation packet 建立 decision record,或從 preparation packet 開 runtime gate。
38. 把 owner decision record human record owner review preparation checklist 當成 approval、標記 preparation checklist passed 或 preparation completed、開始 human record owner review、標記 review ready、收 owner decision、由 preparation checklist 建立 decision record,或從 preparation checklist 開 runtime gate。
-39. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
+39. 把 progress acceleration lane 當成授權、進度自動加分、owner response received、runtime gate、GitHub primary readiness 或 production execution。
+40. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
## 5. 驗證
diff --git a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
index b4ef548d0..0b0ee7f4c 100644
--- a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
+++ b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
@@ -35,7 +35,7 @@
| Owner response validation | S4.13 已建立;四包 owner response 目前 received/accepted 皆為 0;4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes、6 個 parallel session recovery checks 與 7 條 parallel session recovery outcome lanes 可供 AwoooP 直接顯示;下一個建議收件為 S4.9 Gitea owner attestation;latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`,reviewer audit emitted 仍為 0,不代表 owner response 已收到或任何執行授權 |
| Low-friction rollout policy | S1.3 已補 7 條 non-blocking escalation lanes;LOW / MEDIUM、缺 owner response、partial mirror、source-control drift、Kali observe finding、workflow / secret name gap 與 headline holding 初期只能 observe / warn;`owner_review_required_before_blocking=true`、`runtime_blocking_allowed=false` |
| IwoooS frontend posture | S2.8 已新增 `/iwooos` read-only Information Security 入口;顯示 Security Posture / Exposure、source-control supply chain、Kali 112 Mesh、approval boundary、non-blocking lanes 與 evidence refs;不新增執行按鈕 |
-| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`;S2.10 已把 10 個既有前端資安相關頁面納入 projection;S2.11 已補 4 個 coverage groups 與 5 個 conflict controls;S2.12 已補 6 個只讀 operator journey steps;S2.13 已補 7 個 owner evidence readiness items;S2.14 已補 3 個 host coverage items:Kali 112、開發主機 168、開發主機 111;S2.15 已補 6 個 host action gate items;S2.16 已補 7 個 host evidence readiness items;S2.17 已補 7 個 host evidence collection order steps;S2.18 已補 7 個 host evidence intake preflight checks;S2.19 已補 7 個 host evidence review outcome lanes;S2.20 已補 7 個 host evidence review handoff packets;S2.21 已補 7 個 host evidence reviewer checklist items;S2.22 已補 7 個 host evidence reviewer outcome lanes;S2.23 已補 7 個 host owner decision candidate packets;S2.24 已補 7 個 host owner decision review checklist items;S2.25 已補 7 個 host owner decision review outcome lanes;S2.26 已補 7 個 host owner decision record draft packets;S2.27 已補 7 個 host owner decision record draft review checklist items;S2.28 已補 7 個 host owner decision record draft review outcome lanes;S2.29 已補 7 個 host owner decision record write-up packets;S2.30 已補 7 個 host owner decision record write-up review checklist items;S2.31 已補 7 個 host owner decision record write-up review outcome lanes;S2.32 已補 7 個 host owner decision record formal candidate packets;S2.33 已補 7 個 host owner decision record formal candidate review checklist items;S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes;S2.35 已補 8 個 host owner decision record formal record queue packets;S2.36 已補 8 個 host owner decision record formal record queue review checklist items;S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes;S2.38 已補 8 個 host owner decision record human handoff readiness packets;S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items;S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes;S2.41 已補 9 個 host owner decision record human record owner review candidate packets;S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items;S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes;S2.44 已補 9 個 host owner decision record human record owner review preparation packets;S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items;仍不新增 action button |
+| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`;S2.10 已把 10 個既有前端資安相關頁面納入 projection;S2.11 已補 4 個 coverage groups 與 5 個 conflict controls;S2.12 已補 6 個只讀 operator journey steps;S2.13 已補 7 個 owner evidence readiness items;S2.14 已補 3 個 host coverage items:Kali 112、開發主機 168、開發主機 111;S2.15 已補 6 個 host action gate items;S2.16 已補 7 個 host evidence readiness items;S2.17 已補 7 個 host evidence collection order steps;S2.18 已補 7 個 host evidence intake preflight checks;S2.19 已補 7 個 host evidence review outcome lanes;S2.20 已補 7 個 host evidence review handoff packets;S2.21 已補 7 個 host evidence reviewer checklist items;S2.22 已補 7 個 host evidence reviewer outcome lanes;S2.23 已補 7 個 host owner decision candidate packets;S2.24 已補 7 個 host owner decision review checklist items;S2.25 已補 7 個 host owner decision review outcome lanes;S2.26 已補 7 個 host owner decision record draft packets;S2.27 已補 7 個 host owner decision record draft review checklist items;S2.28 已補 7 個 host owner decision record draft review outcome lanes;S2.29 已補 7 個 host owner decision record write-up packets;S2.30 已補 7 個 host owner decision record write-up review checklist items;S2.31 已補 7 個 host owner decision record write-up review outcome lanes;S2.32 已補 7 個 host owner decision record formal candidate packets;S2.33 已補 7 個 host owner decision record formal candidate review checklist items;S2.34 已補 8 個 host owner decision record formal candidate review outcome lanes;S2.35 已補 8 個 host owner decision record formal record queue packets;S2.36 已補 8 個 host owner decision record formal record queue review checklist items;S2.37 已補 8 個 host owner decision record formal record queue review outcome lanes;S2.38 已補 8 個 host owner decision record human handoff readiness packets;S2.39 已補 8 個 host owner decision record human handoff readiness review checklist items;S2.40 已補 9 個 host owner decision record human handoff readiness review outcome lanes;S2.41 已補 9 個 host owner decision record human record owner review candidate packets;S2.42 已補 9 個 host owner decision record human record owner review candidate checklist items;S2.43 已補 9 個 host owner decision record human record owner review candidate outcome lanes;S2.44 已補 9 個 host owner decision record human record owner review preparation packets;S2.45 已補 9 個 host owner decision record human record owner review preparation checklist items;S2.46 已補 6 條 progress acceleration lanes,顯示 58% holding 原因與下一個高層解鎖 gate;仍不新增 action button |
| Dry-run | `contract_defined_not_executed`;已納入 `CHECK_PROGRESS_GUARD` 與 `CHECK_OWNER_RESPONSE_GUARD`,latest local validation 為 `repo_snapshot_guard_pass`,仍不代表 production ingestion |
| Runtime actions | `false` |
| Payload ingestion | `false` |
@@ -129,6 +129,7 @@
| S2.43 IwoooS host owner decision record human record owner review candidate outcome lanes | framework detail | 0 | 只顯示 human record owner review candidate checklist 後的九個只讀結果分流;outcome passed、review started、review ready、handoff started、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
| S2.44 IwoooS host owner decision record human record owner review preparation packets | framework detail | 0 | 只顯示 human record owner review preparation candidate 後的九個只讀 metadata packets;preparation completed、review started、review ready、handoff started、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
| S2.45 IwoooS host owner decision record human record owner review preparation checklist | framework detail | 0 | 只顯示 human record owner review preparation packets 後的九個只讀核對項;preparation completed、checklist passed、review started、review ready、handoff started、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
+| S2.46 IwoooS progress acceleration lanes | framework detail | 0 | 只顯示 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六條解鎖 lane;headline percent、owner response、payload ingestion、runtime gate、GitHub primary、production execution 與 action button 仍全部鎖住 |
headline 進度要再往上,至少需要下列任一高層 gate 有實質 evidence:
diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
index f89886506..a4acd6423 100644
--- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
+++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
@@ -4,7 +4,7 @@
|------|------|
| 日期 | 2026-05-17 |
| 狀態 | S0/S1 read-only evidence 建置中 |
-| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist |
+| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes |
| 原則 | 低摩擦分階段;文件、schema、read-only evidence 優先;不做 runtime enforcement、不切 primary |
## 0. 本階段完成後整體進度
@@ -27,7 +27,7 @@ python3 scripts/security/security-mirror-progress-guard.py
### 0.2 Headline 58% 不代表停滯
-近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry,以及 S2.9-S2.45 IwoooS posture projection contract 都是有效進展,但它們是 framework detail,不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%,避免把只讀框架誤算成已落地執行。
+近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry,以及 S2.9-S2.46 IwoooS posture projection contract 都是有效進展,但它們是 framework detail,不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%,避免把只讀框架誤算成已落地執行。
| 最近完成 | 目前狀態 | headline delta |
|----------|----------|----------------|
@@ -105,6 +105,7 @@ python3 scripts/security/security-mirror-progress-guard.py
| S2.43 IwoooS host owner decision record human record owner review candidate outcome lanes | 已完成草案,將 ready for human record owner review preparation candidate、identity trace refresh、owner boundary clarification、decision summary clarification、scope / expiry refresh、scan limits ambiguous、credential boundary failed、maintenance / rollback incomplete、runtime gate required 顯示成九個只讀結果分流 | 0 |
| S2.44 IwoooS host owner decision record human record owner review preparation packets | 已完成草案,將 preparation identity trace、owner boundary、decision summary、scope / expiry、scan limits、credential boundary、maintenance / rollback、validation / runtime gate、no-execution attestation 顯示成九個只讀 preparation packets | 0 |
| S2.45 IwoooS host owner decision record human record owner review preparation checklist | 已完成草案,將 preparation identity trace readable、owner boundary readable、decision summary readable、scope / expiry current、scan limits not authorization、credential metadata-only、maintenance / rollback traceable、validation / runtime gate separate、no-execution attestation present 顯示成九個只讀核對項 | 0 |
+| S2.46 IwoooS progress acceleration lanes | 已完成草案,將 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六個真正會影響進度感的解鎖 lane 顯示在 IwoooS;headline 仍只在高層 gate 有 evidence 時 review | 0 |
headline 要再往上,需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收,或人工批准後出現 active runtime gate、redacted payload ingestion、GitHub primary readiness 這類落地 evidence。
@@ -169,6 +170,7 @@ headline 要再往上,需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
| S2.43 IwoooS Host Owner Decision Record Human Record Owner Review Candidate Outcome Lanes | 完成草案 | `/iwooos` 新增主機 owner decision record human record owner review candidate outcome lanes,顯示 ready for human record owner review preparation candidate、identity trace refresh、owner boundary clarification、decision summary clarification、scope / expiry refresh、scan limits ambiguous、credential boundary failed、maintenance / rollback incomplete、runtime gate still required 九個分流 | 使用者能理解 human record owner review candidate outcome 仍不是 checklist passed、review started、review ready、owner decision 或正式紀錄;仍不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
| S2.44 IwoooS Host Owner Decision Record Human Record Owner Review Preparation Packets | 完成草案 | `/iwooos` 新增主機 owner decision record human record owner review preparation packets,顯示 preparation identity trace、owner boundary、decision summary、scope / expiry、scan limits、credential boundary、maintenance / rollback、validation / runtime gate、no-execution attestation 九個準備資料包 | 使用者能理解 human record owner review preparation packet 仍不是 preparation completed、review started、review ready、owner decision 或正式紀錄;仍不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
| S2.45 IwoooS Host Owner Decision Record Human Record Owner Review Preparation Checklist | 完成草案 | `/iwooos` 新增主機 owner decision record human record owner review preparation checklist,顯示 preparation identity trace readable、owner boundary readable、decision summary readable、scope / expiry current、scan limits not authorization、credential metadata-only、maintenance / rollback traceable、validation / runtime gate separate、no-execution attestation present 九個只讀核對項 | 使用者能理解 human record owner review preparation checklist 仍不是 preparation completed、checklist passed、review started、review ready、owner decision 或正式紀錄;仍不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
+| S2.46 IwoooS Progress Acceleration Lanes | 完成草案 | `/iwooos` 新增進度加速與 58% 解鎖面板,顯示 owner response、redacted ingestion、runtime gate、GitHub readiness、AwoooP landing 與 cadence compression 六條 acceleration lanes | 使用者能理解前面看起來慢是因為 S2.38-S2.45 都是防止誤讀的 framework detail;後續改採 milestone batch,但 acceleration lane 仍不是 owner response、進度加分、runtime gate、GitHub primary 或 production execution |
| S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items:7 pending、1 block candidate、0 approved | 不得繞過人工批准;批准後仍需 follow-up runtime gate |
| S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策,不可執行 gate item |
| S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立;目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策,不可把決策當執行 |
diff --git a/docs/security/iwooos-posture-projection.snapshot.json b/docs/security/iwooos-posture-projection.snapshot.json
index 8b2a34f37..926787342 100644
--- a/docs/security/iwooos-posture-projection.snapshot.json
+++ b/docs/security/iwooos-posture-projection.snapshot.json
@@ -71,7 +71,8 @@
"host_owner_decision_record_human_record_owner_review_candidate_checklist_item_count": 9,
"host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_count": 9,
"host_owner_decision_record_human_record_owner_review_preparation_packet_count": 9,
- "host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count": 9
+ "host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count": 9,
+ "progress_acceleration_lane_count": 6
},
"progress": {
"overall_percent": 58,
@@ -139,6 +140,7 @@
"allowed_frontend_outputs": [
"display_security_posture",
"display_progress_estimate",
+ "display_progress_acceleration_lanes",
"display_non_blocking_lanes",
"display_existing_frontend_security_surfaces",
"display_frontend_surface_coverage_matrix",
@@ -336,7 +338,13 @@
"mark_human_record_owner_review_ready_from_preparation_checklist",
"collect_owner_decision_from_human_record_owner_review_preparation_checklist",
"create_host_owner_decision_record_from_human_record_owner_review_preparation_checklist",
- "open_runtime_gate_from_human_record_owner_review_preparation_checklist"
+ "open_runtime_gate_from_human_record_owner_review_preparation_checklist",
+ "treat_progress_acceleration_as_authorization",
+ "increase_headline_from_progress_acceleration_lane",
+ "open_runtime_gate_from_progress_acceleration_lane",
+ "mark_owner_response_received_from_progress_acceleration_lane",
+ "enable_github_primary_from_progress_acceleration_lane",
+ "enable_production_execution_from_progress_acceleration_lane"
],
"runtime_execution_authorized": false,
"action_buttons_allowed": false,
@@ -5822,5 +5830,115 @@
"action_buttons_allowed": false,
"not_authorization": true
}
+ ],
+ "progress_acceleration_lanes": [
+ {
+ "lane_id": "progress_acceleration_owner_responses",
+ "display_order": 1,
+ "acceleration_axis": "owner_response",
+ "current_state": "waiting_owner_response",
+ "unlock_condition": "S4.9、S4.10、S4.11 或 S4.12 任一 owner response 收到並通過脫敏驗收。",
+ "expected_progress_effect": "觸發 headline progress review;不自動加分。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_redacted_ingestion",
+ "display_order": 2,
+ "acceleration_axis": "redacted_payload_ingestion",
+ "current_state": "waiting_preflight_and_human_review",
+ "unlock_condition": "脫敏 payload 通過 preflight、quarantine 與人工 review。",
+ "expected_progress_effect": "推進 runtime landing 判讀;不代表 raw payload ingestion。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_runtime_gate",
+ "display_order": 3,
+ "acceleration_axis": "runtime_gate",
+ "current_state": "intentionally_closed",
+ "unlock_condition": "人工批准、scope、rollback、validation evidence 完整後,另開 follow-up runtime gate。",
+ "expected_progress_effect": "推進 runtime landing;不得由 IwoooS 前端或 checklist 直接開 gate。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_github_readiness",
+ "display_order": 4,
+ "acceleration_axis": "github_primary_readiness",
+ "current_state": "waiting_parity_evidence",
+ "unlock_condition": "refs truth、workflow / secret 名稱、rollback ADR 與逐 repo owner decision 通過後,primary_ready_count 大於 0。",
+ "expected_progress_effect": "觸發 GitHub primary readiness progress review;不自動切 primary。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_awooop_landing",
+ "display_order": 5,
+ "acceleration_axis": "awooop_production_landing",
+ "current_state": "read_only_landing_pending",
+ "unlock_condition": "AwoooP 主線只讀消費 rollup、evidence refs 與 guard result,且不接 execution router。",
+ "expected_progress_effect": "讓使用者更有感看到資安網;仍不是 production execution。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_cadence_compression",
+ "display_order": 6,
+ "acceleration_axis": "cadence_compression",
+ "current_state": "approved_for_next_framework_work",
+ "unlock_condition": "後續同類 packet、checklist、outcome 合併成 milestone batch,除非 guard 需要獨立驗證。",
+ "expected_progress_effect": "降低 S2.x 微小增量碎片感;不改變 headline percent。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ }
]
}
diff --git a/docs/security/security-mirror-status-rollup.snapshot.json b/docs/security/security-mirror-status-rollup.snapshot.json
index b0c8db030..87b89228d 100644
--- a/docs/security/security-mirror-status-rollup.snapshot.json
+++ b/docs/security/security-mirror-status-rollup.snapshot.json
@@ -1010,6 +1010,18 @@
"runtime_delta": false,
"execution_authorized": false,
"not_authorization": true
+ },
+ {
+ "delta_id": "s2_46_iwooos_progress_acceleration_lanes",
+ "display_order": 75,
+ "completed_stage": "S2.46 IwoooS progress acceleration lanes",
+ "progress_axis": "framework_detail",
+ "headline_percent_delta": 0,
+ "framework_delta_visible": true,
+ "why_headline_unchanged": "progress acceleration lanes 只顯示 58% 為何維持與哪些高層 gate 能解鎖下一輪 progress review;owner response、runtime gate、GitHub primary readiness 與 production landing 仍未改變。",
+ "runtime_delta": false,
+ "execution_authorized": false,
+ "not_authorization": true
}
],
"next_safe_actions": [
@@ -1404,7 +1416,8 @@
"S2.37 只新增 IwoooS host owner decision record formal record queue review outcome lanes;host_owner_decision_record_formal_record_queue_review_outcome_lane_count=8、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false,不把 formal record queue review outcome 當 review passed、enqueue、正式決策紀錄、接受、批准或 runtime gate。",
"S2.43 只新增 IwoooS host owner decision record human record owner review candidate outcome lanes;host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_count=9、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false,不把 review candidate outcome 當 checklist passed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。",
"S2.44 只新增 IwoooS host owner decision record human record owner review preparation packets;host_owner_decision_record_human_record_owner_review_preparation_packet_count=9、human_record_owner_review_prepared_count=0、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false,不把 review preparation packet 當 preparation completed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。",
- "S2.45 只新增 IwoooS host owner decision record human record owner review preparation checklist;host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count=9、human_record_owner_review_prepared_count=0、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false,不把 review preparation checklist 當 preparation completed、checklist passed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。"
+ "S2.45 只新增 IwoooS host owner decision record human record owner review preparation checklist;host_owner_decision_record_human_record_owner_review_preparation_checklist_item_count=9、human_record_owner_review_prepared_count=0、human_record_owner_review_check_passed_count=0、human_record_owner_review_started_count=0、human_record_owner_review_ready_count=0、human_record_owner_handoff_review_passed_count=0、human_record_owner_handoff_started_count=0、human_record_owner_handoff_ready_count=0、formal_record_queue_review_passed_count=0、formal_record_queue_enqueued_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false,不把 review preparation checklist 當 preparation completed、checklist passed、review started、review ready、owner decision、正式 decision record、批准或 runtime gate。",
+ "S2.46 新增 IwoooS progress acceleration lanes;progress_acceleration_lane_count=6、headline_percent_after_this_stage=58、owner_response_received_count=0、owner_response_accepted_count=0、payloads_ingested=false、active_runtime_gate_count=0、github_primary_ready_count=0、production_landing_enabled=false,不把 acceleration lane 當授權、進度加分、runtime gate、owner response received、GitHub primary 或 production execution。"
],
"forbidden_actions": [
"start_kali_scan",
@@ -1418,5 +1431,125 @@
"production_deploy",
"store_secret_token_cookie_private_key_or_exploit_payload",
"turn_low_medium_observations_into_blocking_gates"
- ]
+ ],
+ "progress_acceleration_policy": {
+ "display_mode": "progress_acceleration_only",
+ "lane_count": 6,
+ "headline_percent_after_this_stage": 58,
+ "why_previous_progress_felt_slow": "S2.38-S2.45 多數是防止前端誤讀的 framework detail;headline percent 只在 owner response、runtime gate、GitHub primary readiness 或 production landing 變動時調整。",
+ "next_cadence": "後續同類 framework detail 合併成 milestone batch,優先推 owner response、AwoooP read-only landing 與 GitHub readiness。",
+ "lanes": [
+ {
+ "lane_id": "progress_acceleration_owner_responses",
+ "display_order": 1,
+ "acceleration_axis": "owner_response",
+ "current_state": "waiting_owner_response",
+ "unlock_condition": "S4.9、S4.10、S4.11 或 S4.12 任一 owner response 收到並通過脫敏驗收。",
+ "expected_progress_effect": "觸發 headline progress review;不自動加分。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_redacted_ingestion",
+ "display_order": 2,
+ "acceleration_axis": "redacted_payload_ingestion",
+ "current_state": "waiting_preflight_and_human_review",
+ "unlock_condition": "脫敏 payload 通過 preflight、quarantine 與人工 review。",
+ "expected_progress_effect": "推進 runtime landing 判讀;不代表 raw payload ingestion。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_runtime_gate",
+ "display_order": 3,
+ "acceleration_axis": "runtime_gate",
+ "current_state": "intentionally_closed",
+ "unlock_condition": "人工批准、scope、rollback、validation evidence 完整後,另開 follow-up runtime gate。",
+ "expected_progress_effect": "推進 runtime landing;不得由 IwoooS 前端或 checklist 直接開 gate。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_github_readiness",
+ "display_order": 4,
+ "acceleration_axis": "github_primary_readiness",
+ "current_state": "waiting_parity_evidence",
+ "unlock_condition": "refs truth、workflow / secret 名稱、rollback ADR 與逐 repo owner decision 通過後,primary_ready_count 大於 0。",
+ "expected_progress_effect": "觸發 GitHub primary readiness progress review;不自動切 primary。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_awooop_landing",
+ "display_order": 5,
+ "acceleration_axis": "awooop_production_landing",
+ "current_state": "read_only_landing_pending",
+ "unlock_condition": "AwoooP 主線只讀消費 rollup、evidence refs 與 guard result,且不接 execution router。",
+ "expected_progress_effect": "讓使用者更有感看到資安網;仍不是 production execution。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ },
+ {
+ "lane_id": "progress_acceleration_cadence_compression",
+ "display_order": 6,
+ "acceleration_axis": "cadence_compression",
+ "current_state": "approved_for_next_framework_work",
+ "unlock_condition": "後續同類 packet、checklist、outcome 合併成 milestone batch,除非 guard 需要獨立驗證。",
+ "expected_progress_effect": "降低 S2.x 微小增量碎片感;不改變 headline percent。",
+ "display_mode": "progress_acceleration_only",
+ "owner_response_received_count": 0,
+ "owner_response_accepted_count": 0,
+ "payloads_ingested": false,
+ "active_runtime_gate_count": 0,
+ "github_primary_ready_count": 0,
+ "production_landing_enabled": false,
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ }
+ ],
+ "runtime_execution_authorized": false,
+ "action_buttons_allowed": false,
+ "not_authorization": true
+ }
}
diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py
index fb32f634a..db3927e4b 100755
--- a/scripts/security/security-mirror-progress-guard.py
+++ b/scripts/security/security-mirror-progress-guard.py
@@ -197,6 +197,7 @@ def validate(root: Path) -> None:
"s2_43_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes",
"s2_44_iwooos_host_owner_decision_record_human_record_owner_review_preparation_packets",
"s2_45_iwooos_host_owner_decision_record_human_record_owner_review_preparation_checklist",
+ "s2_46_iwooos_progress_acceleration_lanes",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -880,6 +881,76 @@ def validate(root: Path) -> None:
progress_display_policy["headline_status"],
)
assert_true("iwooos_projection.progress.not_authorization", iwooos_progress["not_authorization"])
+ assert_equal(
+ "iwooos_projection.summary.progress_acceleration_lane_count",
+ iwooos_projection["summary"]["progress_acceleration_lane_count"],
+ 6,
+ )
+ progress_acceleration_lanes = iwooos_projection["progress_acceleration_lanes"]
+ expected_progress_acceleration_lane_ids = [
+ "progress_acceleration_owner_responses",
+ "progress_acceleration_redacted_ingestion",
+ "progress_acceleration_runtime_gate",
+ "progress_acceleration_github_readiness",
+ "progress_acceleration_awooop_landing",
+ "progress_acceleration_cadence_compression",
+ ]
+ assert_equal(
+ "iwooos_projection.progress_acceleration_lanes.lane_ids",
+ [item["lane_id"] for item in progress_acceleration_lanes],
+ expected_progress_acceleration_lane_ids,
+ )
+ assert_equal(
+ "iwooos_projection.progress_acceleration_lanes.display_order",
+ [item["display_order"] for item in progress_acceleration_lanes],
+ list(range(1, len(expected_progress_acceleration_lane_ids) + 1)),
+ )
+ for item in progress_acceleration_lanes:
+ assert_equal(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.display_mode",
+ item["display_mode"],
+ "progress_acceleration_only",
+ )
+ assert_equal(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.owner_response_received_count",
+ item["owner_response_received_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.owner_response_accepted_count",
+ item["owner_response_accepted_count"],
+ 0,
+ )
+ assert_false(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.payloads_ingested",
+ item["payloads_ingested"],
+ )
+ assert_equal(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.active_runtime_gate_count",
+ item["active_runtime_gate_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.github_primary_ready_count",
+ item["github_primary_ready_count"],
+ 0,
+ )
+ assert_false(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.production_landing_enabled",
+ item["production_landing_enabled"],
+ )
+ assert_false(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.runtime_execution_authorized",
+ item["runtime_execution_authorized"],
+ )
+ assert_false(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.action_buttons_allowed",
+ item["action_buttons_allowed"],
+ )
+ assert_true(
+ f"iwooos_projection.progress_acceleration_lanes.{item['lane_id']}.not_authorization",
+ item["not_authorization"],
+ )
assert_equal(
"iwooos_projection.posture_pillars.ids",
[item["pillar_id"] for item in iwooos_projection["posture_pillars"]],
@@ -3829,6 +3900,7 @@ def validate(root: Path) -> None:
for output in [
"display_security_posture",
"display_progress_estimate",
+ "display_progress_acceleration_lanes",
"display_non_blocking_lanes",
"display_existing_frontend_security_surfaces",
"display_frontend_surface_coverage_matrix",
@@ -4022,6 +4094,12 @@ def validate(root: Path) -> None:
"collect_owner_decision_from_human_record_owner_review_preparation_checklist",
"create_host_owner_decision_record_from_human_record_owner_review_preparation_checklist",
"open_runtime_gate_from_human_record_owner_review_preparation_checklist",
+ "treat_progress_acceleration_as_authorization",
+ "increase_headline_from_progress_acceleration_lane",
+ "open_runtime_gate_from_progress_acceleration_lane",
+ "mark_owner_response_received_from_progress_acceleration_lane",
+ "enable_github_primary_from_progress_acceleration_lane",
+ "enable_production_execution_from_progress_acceleration_lane",
"apply_runtime_blocking_control",
"switch_github_primary",
"production_deploy",