From 6a85619b994ddb9042aafb76e21155b4a578594d Mon Sep 17 00:00:00 2001 From: Your Name Date: Thu, 4 Jun 2026 19:08:10 +0800 Subject: [PATCH] docs(security): add IwoooS S4.9 dispatch preflight [skip ci] --- docs/LOGBOOK.md | 36 +++++ ...VENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md | 51 ++++++- ...er-attestation-request-draft.snapshot.json | 124 ++++++++++++++++-- ...026-06-04-iwooos-security-governance-p0.md | 14 +- 4 files changed, 209 insertions(+), 16 deletions(-) diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 152e619fa..dcb440480 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,39 @@ +## 2026-06-04｜IwoooS S4.9 Request Dispatch Preflight 交接包 + +**背景**：S4.9 current intake readiness 已整理成 AwoooP / reviewer 可照表收件與預檢，但尚缺「送件前交接包」：誰送、送哪些 template、附哪些脫敏 evidence refs、哪些 payload 禁止、何時可以增加 request_sent_count，以及送件後哪些 Gate 仍不得變動。本段只補送件前治理封套，不送件、不收 response、不開 runtime。 + +**本輪完成**： +- 先同步 `gitea/main` 到 `b61ee9b0 feat(web): align AwoooP controls with WOOO radius tokens`，保留另一個 Session 的 AwoooP controls radius token 調整。 +- 更新 `GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md`：日期改為 2026-06-04，新增 7 項送件前檢查、11 欄交接封套欄位與送件後不變條件。 +- 更新 `gitea-inventory-owner-attestation-request-draft.snapshot.json`：新增 `dispatch_preflight_package_ready=true`、`dispatch_preflight_completion_percent=100`、`dispatch_preflight_check_count=7`、`dispatch_packet_field_count=11`，並維持 `dispatch_authorized=false`、`request_sent=false`。 +- 更新 IwoooS P0/P1 主控總帳：新增 `P0-2b S4.9 request dispatch preflight 交接包`，完成度 `100%`，但 owner response gate 仍 `0%`。 + +**完成度更新**： +- S4.9 request dispatch preflight 交接包：`100%`。 +- S4.9 request draft package：`100%`。 +- S4.9 owner response gate：`0%`，`request_sent=false`、`request_sent_count=0`、`recipients_confirmed_count=0`、`received=0`、`accepted=0`、`rejected=0`。 +- IwoooS headline 仍 `64%`；framework / read-only evidence 仍 `92%`；runtime landing 仍 `40-45%`。 + +**驗證**： +- `python3 -m json.tool docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json`：通過。 +- `python3 -m json.tool docs/security/gitea-inventory-owner-attestation-response.snapshot.json`：通過。 +- `python3 -m json.tool docs/security/source-control-owner-response-validation-rollup.snapshot.json`：通過。 +- `git diff --check`：通過。 +- `python3 scripts/security/source-control-owner-response-guard.py --root .`：`SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。 +- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。 +- URL credential pattern 檢查：本段異動檔案無命中。 +- Production 頁面檢查：本段只改 docs / snapshot / LOGBOOK，未改前端、未部署、未宣稱新的 production 狀態；沿用 P0 `/zh-TW/iwooos` desktop / mobile live sanity 作為基準。 + +**推版狀態**： +- 本段 commit：本段所在提交，預期使用 `[skip ci]`。 +- Gitea run：docs / snapshot / LOGBOOK only，使用 `[skip ci]` 時不應產生新的 CD / code-review run。 +- AwoooP Session 同步：需同步 `b61ee9b0` 基準、S4.9 dispatch preflight `100%`、owner response gate `0%` 與所有 0 / false 邊界。 + +**目前邊界**： +- `owner_response_received_count=0`、`owner_response_accepted_count=0`、`owner_response_rejected_count=0`、`active_runtime_gate_count=0`、`github_primary_ready_count=0`。 +- `runtime_execution_authorized=false`、`dispatch_authorized=false`、`request_dispatch_allowed_without_human_operator=false`、`github_primary_switch_authorized=false`、`refs_sync_authorized=false`、`repo_creation_authorized=false`、`workflow_modification_authorized=false`、`action_buttons_allowed=false`、`host_update_authorized=false`、`active_scan_authorized=false`。 +- 交接包就算後續實際送出，也只能依可稽核 metadata 調整 request_sent_count；不得同步把 received / accepted / rejected 或 runtime gate 拉高。 + ## 2026-06-04｜IwoooS S4.9 Owner Response Current Intake Readiness **背景**：接續 P1-1 refs truth current queue 重產後，本段回到 IwoooS 64% 真正能前進的第一優先 gate：S4.9 Gitea owner attestation response。目標是把收件準備度整理到 AwoooP / reviewer 可直接照表收件與預檢，但不把任何準備度誤讀成 request 已送出、owner response 已收到、response 已接受或 runtime / GitHub primary 授權。 diff --git a/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md b/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md index 02f6e6005..bd61aeae5 100644 --- a/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md +++ b/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md @@ -2,8 +2,8 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-01 | -| 狀態 | 草稿已整理，尚未送出 | +| 日期 | 2026-06-04 | +| 狀態 | 草稿與送件前交接包已整理，尚未送出 | | 對應階段 | S4.9 | | 對應收件包 | `docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md` | | 快照 | `docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json` | @@ -60,3 +60,50 @@ | runtime gate opened | false | | action buttons allowed | false | +## 6. 2026-06-04 送件前交接包 + +本段把五題補件草稿提升成可交接的人工送件封套。它只代表 reviewer / AwoooP operator 可以照表核對送件內容，不代表已送出請求、不代表收件對象已確認、不代表收到 owner response，也不代表任何 repo、refs、workflow、secret、GitHub primary、Kali、主機維護或 runtime execution 授權。 + +| 指標 | 值 | +|------|----| +| dispatch preflight package | ready | +| dispatch preflight completion | 100% | +| dispatch authorized | false | +| request sent | false | +| request sent count | 0 | +| recipients confirmed count | 0 | +| owner response received count | 0 | +| owner response accepted count | 0 | +| runtime gate opened | false | + +### 6.1 送件前檢查 + +| 順序 | 檢查項 | 完成條件 | 目前狀態 | +|------|--------|----------|----------| +| 1 | 同步基線 | 送件前先確認 `gitea/main` 與另一個 AwoooP Session 最新 commit，不使用舊 refs / 舊 deploy marker | 已定義，未送件 | +| 2 | 題目版本 | 五題 template id、必填欄位與收件包版本需一致 | 已定義，未送件 | +| 3 | 收件角色 | 收件對象只記錄 role / team，不收個人敏感資料或憑證 | 已定義，未送件 | +| 4 | 證據參照 | 僅附 repo 內文件、snapshot、ticket id、hash 或脫敏 metadata ref | 已定義，未送件 | +| 5 | 禁止條款 | 明確標示此包不是 approval、不是 execution、不是 source-control mutation | 已定義，未送件 | +| 6 | 稽核紀錄 | 只有實際送件後才可記錄 request shown metadata；不得預填已送出 | 已定義，未送件 | +| 7 | 計數不變 | 無實際送件證據前，`request_sent_count`、received、accepted、rejected 全部維持 0 | 已定義，未送件 | + +### 6.2 交接封套欄位 + +| 欄位 | 內容規則 | +|------|----------| +| `request_id` | 固定對應 S4.9 Gitea owner attestation request，不建立新的 runtime action id | +| `stage_id` | 固定 `S4.9` | +| `requested_templates` | 只能引用本文件第 2 節五個 template id | +| `recipient_role_or_team` | 只填 role / team；不得填 token、PAT、cookie、session 或私人聯絡資訊 | +| `sender_role_or_team` | 只填送件操作角色；不得把 AwoooP approval 視為資安批准 | +| `requested_response_deadline_or_window` | 可填人工約定窗口；空值不得阻擋 0 / false gate | +| `allowed_response_format` | 只接受本文件第 3 節欄位與脫敏 evidence refs | +| `redacted_evidence_refs` | 僅指向既有文件、snapshot、ticket id、hash 或 quarantine pointer | +| `forbidden_payloads` | secrets、repo archive、DB dump、runner token、deploy key private key、git object pack 全部拒收 | +| `followup_owner` | 只記後續補證 role / team | +| `not_approval` | 必須為 `true` | + +### 6.3 送件後不變條件 + +即使後續有人實際送出此請求，也只能在有可稽核的人工送件 metadata 後，把 `request_sent_count` 從 `0` 調整為真實數字；不得同時把 owner response received / accepted / rejected 拉高。收到回覆後仍需經過 S4.9 response preflight、敏感材料隔離、跨包一致性檢查與 reviewer 驗收，才能更新對應 read-only matrix。任何 GitHub primary、repo / refs / workflow / secret、Kali、SSH、主機維護或 runtime gate 都必須另走人工批准與 rollback / post-check。 diff --git a/docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json b/docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json index 878ad92c8..bd0dba139 100644 --- a/docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json +++ b/docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json @@ -1,24 +1,31 @@ { "schema_version": "gitea_inventory_owner_attestation_request_draft_v1", "status": "request_draft_ready_not_sent", - "date": "2026-06-01", + "date": "2026-06-04", "stage_id": "S4.9", "mode": "owner_request_draft_only", "runtime_execution_authorized": false, "source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md", "source_snapshot": "docs/security/gitea-inventory-owner-attestation-response.snapshot.json", - "summary": { - "request_draft_package_ready": true, - "request_draft_template_count": 5, - "request_draft_template_ready_count": 5, - "frontstage_package_visible": true, - "frontstage_card_count": 5, - "frontstage_detail_visible": true, - "frontstage_detail_row_count": 5, - "frontstage_required_field_total": 30, - "frontstage_forbidden_action_count": 10, - "request_sent": false, - "request_sent_count": 0, + "summary": { + "request_draft_package_ready": true, + "request_draft_template_count": 5, + "request_draft_template_ready_count": 5, + "frontstage_package_visible": true, + "frontstage_card_count": 5, + "frontstage_detail_visible": true, + "frontstage_detail_row_count": 5, + "frontstage_required_field_total": 30, + "frontstage_forbidden_action_count": 10, + "dispatch_preflight_package_ready": true, + "dispatch_preflight_completion_percent": 100, + "dispatch_preflight_check_count": 7, + "dispatch_packet_field_count": 11, + "dispatch_authorized": false, + "request_dispatch_allowed_without_human_operator": false, + "post_dispatch_count_increment_allowed_without_evidence": false, + "request_sent": false, + "request_sent_count": 0, "recipients_confirmed_count": 0, "owner_response_received_count": 0, "owner_response_accepted_count": 0, @@ -70,6 +77,97 @@ "required_fields": ["owner_role_or_team", "decision", "decision_reason", "affected_repos", "evidence_refs", "followup_owner"] } ], + "dispatch_preflight_checks": [ + { + "check_id": "dispatch-baseline-sync", + "display_order": 1, + "check": "送件前確認 gitea/main 與另一個 AwoooP Session 最新 commit，不使用舊 refs 或舊 deploy marker。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-template-version", + "display_order": 2, + "check": "五題 template id、必填欄位與收件包版本需一致。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-recipient-role-only", + "display_order": 3, + "check": "收件對象只記錄 role / team，不收個人敏感資料或憑證。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-redacted-evidence-refs", + "display_order": 4, + "check": "僅附 repo 內文件、snapshot、ticket id、hash 或脫敏 metadata ref。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-forbidden-action-banner", + "display_order": 5, + "check": "明確標示此包不是 approval、不是 execution、不是 source-control mutation。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-audit-metadata-only-after-send", + "display_order": 6, + "check": "只有實際送件後才可記錄 request shown metadata；不得預填已送出。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + }, + { + "check_id": "dispatch-counts-remain-zero", + "display_order": 7, + "check": "無實際送件證據前，request_sent_count、received、accepted、rejected 全部維持 0。", + "current_status": "defined_not_dispatched", + "execution_authorized": false + } + ], + "dispatch_packet_template": { + "request_id": "s4_9_gitea_owner_attestation_response_request", + "stage_id": "S4.9", + "requested_templates": [ + "response-public-only-vs-local-gitea-gap", + "response-org-user-endpoint-identity", + "response-internal-110-adjacent-scope", + "response-repo-owner-canonical-scope", + "response-legacy-or-inaccessible-disposition" + ], + "recipient_role_or_team_required": true, + "sender_role_or_team_required": true, + "requested_response_deadline_or_window_optional": true, + "allowed_response_format": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "followup_owner" + ], + "redacted_evidence_refs_only": true, + "forbidden_payloads": [ + "secret_plaintext", + "repo_archive", + "database_dump", + "runner_registration_token", + "deploy_key_private_key", + "git_object_pack" + ], + "followup_owner_required": true, + "not_approval": true, + "runtime_execution_authorized": false + }, + "post_dispatch_invariants": [ + "request_sent_count 只能在有可稽核人工送件 metadata 後調整。", + "送件後不得同步提高 owner_response_received_count、owner_response_accepted_count 或 owner_response_rejected_count。", + "收到回覆後仍需經過 S4.9 response preflight、敏感材料隔離、跨包一致性檢查與 reviewer 驗收。", + "任何 GitHub primary、repo / refs / workflow / secret、Kali、SSH、主機維護或 runtime gate 都必須另走人工批准與 rollback / post-check。" + ], "allowed_outputs": [ "owner role/team metadata", "decision and decision reason", diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index 46118f484..6828625b4 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -9,7 +9,7 @@ | 工作視窗 | IwoooS / AWOOOI 資安治理 P0 | | 本次乾淨 worktree | `/private/tmp/awoooi-iwooos-governance-p0-20260604` | | 本次分支 | `codex/iwooos-governance-p0-20260604` | -| 最新觀察到的 `gitea/main` | `64490d32 docs(logbook): record WOOO design rollout smoke [skip ci]` | +| 最新觀察到的 `gitea/main` | `b61ee9b0 feat(web): align AwoooP controls with WOOO radius tokens` | | 前一個正式 IwoooS 候選基準 | code `7b8fc093`、deploy marker `45c63488`、LOGBOOK `02cadee6` | | 最新導航 IA 基準 | code `973fc7a4`、LOGBOOK `2555c811`、deploy marker `0260ec89` | | 禁止事項 | 不 force push、不 destructive git、不 SSH 修改主機、不 active scan、不收 secrets 明文、不把 AwoooP approval 當資安批准、不把 UI 可見當 runtime 授權 | @@ -36,6 +36,7 @@ | P0-1 | IwoooS 狀態總帳 | 100% | 本文件已落地；後續每階段只更新同一總帳與 LOGBOOK | Markdown 檢查、guard、不調高 0 / false gate | | P0-2 | S4.9 owner response gate | 100% | 欄位、預檢、收件、驗收、拒收與補件條件已固定成人類可讀規範 | `source-control-owner-response-guard.py --root .` 通過 | | P0-2a | S4.9 current intake readiness | 100% | 五題缺口、合格封套、結果分流與只讀更新邊界已補進收件包與 S4.13 rollup；owner response gate 仍 0% | JSON parse、owner response guard、progress guard | +| P0-2b | S4.9 request dispatch preflight 交接包 | 100% | 送件前檢查、交接封套欄位與送後不變條件已固定；dispatch authorized 仍 false | JSON parse、owner response guard、progress guard | | P0-3 | AwoooP 同步封包 | 90% | 同步內容已固定；缺後續實際 AwoooP Session readback | 本文件與 mirror checklist readback | | P0-4 | production live sanity 節點 | 100% | desktop / mobile / 展開區塊 / overflow / action href 檢查已完成 | Playwright production sanity 通過 | | P0-5 | LOGBOOK 與完成度更新 | 90% | LOGBOOK 本輪將同步記錄；Gitea run 需等實際 push 後回填 | `docs/LOGBOOK.md` readback | @@ -78,6 +79,17 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count | S4.9 owner response gate | 0% | request_sent=false、received=0、accepted=0、rejected=0 | 合格回覆前不得調高 | | 可更新範圍 | 只讀 | 只允許 coverage / migration matrix / decision table / readiness wording | 不寫 Gitea、不建 repo、不同步 refs、不切 primary | +### 3.4 2026-06-04 Request Dispatch Preflight 交接包 + +本輪把 S4.9 從「AwoooP / reviewer 可照表收件與預檢」再推到「送件前交接包可照表核對」。這是送件準備度，不是送件結果；`dispatch_authorized=false`、`request_sent=false`、`request_sent_count=0`、received / accepted / rejected 全部仍為 `0`。 + +| 項目 | 完成度 | 目前狀態 | 不可誤讀 | +|------|--------|----------|----------| +| 送件前檢查 | 100% | 已固定 7 項：同步基線、題目版本、收件角色、證據參照、禁止條款、稽核紀錄、計數不變 | 不代表 request 已送出 | +| 交接封套欄位 | 100% | 已固定 11 欄：request id、stage、template、recipient / sender role、回覆窗口、格式、脫敏 evidence refs、禁止 payload、followup owner、not approval | 不代表收件人已確認 | +| 送後不變條件 | 100% | 實際送件後也只能依可稽核 metadata 調整 request_sent_count，不得同步拉高 received / accepted / rejected | 不代表 owner response gate 解鎖 | +| runtime / source-control 邊界 | 100% | GitHub primary、repo / refs / workflow / secret、Kali、SSH、主機維護、runtime gate 全部另走人工批准 | 不代表任何執行面授權 | + ## 4. 驗證節點規則 | 階段類型 | 必跑驗證 | 是否需要實際開頁 |