wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): 更新 P0 主控板同步基線 [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-14 18:51:01 +08:00
parent 762f73a6c6
commit 757f6a5359
2 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/LOGBOOK.md
View File

@@ -1,3 +1,25 @@
## 2026-06-14｜P0 主控板同步基線回填
**背景**：P0 主控板頂部仍保留 2026-06-11 的舊 worktree、舊分支、舊 `gitea/main` 與舊平行 Session 說明，容易讓下一個 IwoooS / AwoooP Session 誤用舊基線或重複修改 Public Gateway / Nginx 配置控管檔案。
**完成項目**：
- `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` 已更新本次乾淨 worktree、分支與最新 `gitea/main=762f73a6`。
- 新增「最新 P0 Public Gateway 配置控管基準」列，固定 P0-15 `5068654d`、P0-16 `f856df1c`、P0-17 `762f73a6` 的三段成果與 `0 / false` 邊界。
- 更新平行 Session 文字為 AwoooP thread `019e9168-3e85-7053-a63f-471eb77b1457`，並標示已同步 P0-15 / P0-16 / P0-17。
- P0 工作拆解新增 P0-18 row，標示本輪基線回填完成度 `100%`。
**本地驗證**：
- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。
- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=818`。
- `git diff --check` 通過。
- diff-only 工作溝通片語掃描通過；未加入工作溝通原文、委派 XML 或內部抱怨內容。
**完成度與邊界**：
- P0-18 P0 主控板同步基線回填：`100%`。
- Production browser verification：不適用；本輪只改 P0 總帳與 LOGBOOK，不變更前端 bundle 或 runtime。
- redacted export accepted、rendered diff ready、live evidence、runtime gate、action buttons、Nginx live config、`nginx -t`、reload、DNS / TLS live probe、certbot renew、route smoke、maintenance window accepted、rollback owner accepted、ArgoCD sync、kubectl action、workflow / secret 修改、public route change、agent-bounty runtime、host write、active scan、production write 全部維持 `0 / false`。
## 2026-06-14｜Public Gateway rendered diff / nginx gate 草稿本地完成
**背景**：P0-16 已建立 redacted export 收件預檢，但即使未來收到並接受脫敏 ref，也不能直接進 `nginx -t`、reload 或 route smoke。下一步需先把 rendered diff、owner review、`nginx -t` approval package、reload、route smoke、DNS / TLS probe、certbot renew、maintenance window、rollback owner 與 post-check 拆成分階段 gate 草稿。

10
docs/workplans/2026-06-04-iwooos-security-governance-p0.md
View File

@@ -7,9 +7,9 @@
| 項目 | 目前值 |
|------|--------|
| 工作視窗 | IwoooS / AWOOOI 資安治理 P0 |
| 本次乾淨 worktree | `/private/tmp/awoooi-repair-playbook-coverage-20260611` |
| 本次分支 | `codex/repair-playbook-coverage-20260611` |
| 最新觀察到的 `gitea/main` | `27ffb928 chore(cd): deploy 58e760f [skip ci]` |
| 本次乾淨 worktree | `/tmp/awoooi-iwooos-p2-138-release-decision-hold-20260614-1038` |
| 本次分支 | `codex/iwooos-p2-145-owner-response-acceptance-20260614` |
| 最新觀察到的 `gitea/main` | `762f73a6 docs(security): 新增 public gateway rendered diff gate 草稿 [skip ci]` |
| 最新 P0 Telegram 告警 / 批准執行真相鏈基準 | code `32e4beca`、deploy marker `717b5870`、code-review `2658`、CD `2657`；no-action approval 不再觸發 executor，可執行修復 approval 會寫入 `auto_repair_executions`、KM 與 verifier |
| 最新 P0 Telegram no-action 人工處置包基準 | code `cd928852`、deploy marker `9181cc0e`、code-review `2666`；正式部署 tree 已包含 no-action 人工處置包、`處置包 / 重診 / 歷史 / 靜默 / 真相鏈 / Runs` 鍵盤、production pod render / keyboard smoke |
| 最新 P0 MCP evidence / PlayBook 修復候選基準 | code `cc614023`、D1 blocker clarity `47d677ac`、D2 manual draft package `febe9ecf`、D3 draft work item `e8d5eafb`、D4 work item detail panel `e8a5bac5`、D5 coverage gap contract 本地完成；目前 production deploy marker 仍為 `985a2cfe` 的 D4 Work Items detail panel，D5 尚待推送 / 部署驗證。正式部署 tree 經 production pod smoke 與 Work Items browser smoke 確認可由 MCP evidence + approved PlayBook trust 產生 medium approval candidate、綁定預配置 approval id、不外露 preallocated metadata，且通用兜底 / 診斷型 PlayBook 不會被誤當修復命令；若缺安全修復候選，Telegram 人工處置包會顯示阻擋原因、下一步、PlayBook 草案欄位與 AwoooP 修復候選草案工作項，工作項頁會顯示 PlayBook 草案處置板、必填欄位、阻擋原因、下一步與 Runs / 審批連結；D5 讓 blocked result 進一步輸出服務 coverage gap、blocking stage、必收 MCP evidence refs 與 PlayBook template fields |
@@ -21,6 +21,7 @@
| 最新 P2-D2 Code Review 候選分類基準 | code `292cfec9`、deploy marker `4cfe5ff7`、CD `2586`、code-review `2587`；Code Review route 可見文案已搬到 `codeReview` i18n namespace，四類候選分類與人工批准流程已正式驗證 |
| 最新 P2-D2 AwoooP Runs fallback 文案基準 | code `7f6028c3`、deploy marker `bf016e91`、CD `2590`、code-review `2591`；Runs / Callback / Source Flow fallback 文案已正式驗證 |
| 最新 AwoooP Tenants 全域產品資產台帳 D1 基準 | code `fef94df8`、deploy marker `180a6543`、code-review `2967`、CD `2966`；正式 API 顯示產品 / 專案 `16`、網站 / 服務入口 `31`、source-control candidate repo `10`，已納入 `2026fifa.wooo.work`、WOOO Open Design、n8n、Grist、Vault、Ollama、Monitor 與 AWOOOI API / AIOps 服務入口；owner response / runtime gate / action button 仍 `0` |
| 最新 P0 Public Gateway 配置控管基準 | P0-15 `5068654d` live conf 匯出請求包、P0-16 `f856df1c` redacted export 收件預檢、P0-17 `762f73a6` rendered diff / nginx gate 草稿；三段皆已推上 `gitea/main`，固定 requests / candidates `3`、C0 `2`，request sent、redacted export received / accepted、raw conf stored、rendered diff ready、`nginx -t`、reload、route smoke、runtime gate、action button 全部 `0` |
| 最新 AI Agent automation P1-305 / P1-306 基準 | code `4f0787f8`、deploy marker `af3a9d48`、CD `2592`、code-review `2593`；任務批准邊界與進度彙總已正式驗證；backlog `70%`、done `16/23`、下一步 `P1-001` |
| 最新 AI Agent automation P1-001 基準 | code `de3007b7`、stability fix `fd33591c`、deploy marker `8caba233`、LOGBOOK / marker 對齊 `37c0e171`；runtime surface `22`、Secret surface `4`、live gaps `6`、backlog `74%`、done `17/23`、下一步 `P1-002` |
| 最新 AI Agent automation P1-002 基準 | code `943faaee`、stability fix `ff266926`、deploy marker `01b8712d`、LOGBOOK / marker 對齊 `70c01003`；Gitea workflows `9`、runner contracts `4`、需 runner attestation workflows `8`、backlog `78%`、done `18/23`、下一步 `P1-003` |
@@ -29,7 +30,7 @@
| 最新 S4.9 owner response intake form 基準 | `docs/security/S4-9-OWNER-RESPONSE-INTAKE-FORM.md`；五題可填表、六欄填寫規則、reviewer 收件欄與 outcome lanes 已固定；owner response gate 仍 `0%` |
| 最新 S4.9 reviewer validation checklist 基準 | `docs/security/S4-9-REVIEWER-VALIDATION-CHECKLIST.md`；Reviewer 分工、V0-V8 gates、outcome 決策表、count transition 與 cross-packet consistency 已固定；owner response gate 仍 `0%` |
| 最新 S4.9 security acceptance record template 基準 | `docs/security/S4-9-SECURITY-ACCEPTANCE-RECORD-TEMPLATE.md`；acceptance record 前置條件、欄位、count transition、decision outcome、evidence redaction 與不可授權聲明已固定；owner response gate 仍 `0%` |
| 目前平行 Session | AwoooP thread `019e9154-7d5e-7b72-85be-c9d97e43ecc9` 已補 P1-002 正式驗證紀錄；後續進 `P1-003` 前仍需重新 fetch / fast-forward，避免 LOGBOOK / workplan 衝突 |
| 目前平行 Session | AwoooP thread `019e9168-3e85-7053-a63f-471eb77b1457` 已同步 P0-15 `5068654d`、P0-16 `f856df1c`、P0-17 `762f73a6`；後續進下一個 P0 / P1 前仍需重新 fetch / fast-forward，避免 LOGBOOK / workplan 衝突 |
| 前一個正式 IwoooS 候選基準 | code `7b8fc093`、deploy marker `45c63488`、LOGBOOK `02cadee6` |
| 最新導航 IA 基準 | code `973fc7a4`、LOGBOOK `2555c811`、deploy marker `0260ec89` |
| 禁止事項 | 不 force push、不 destructive git、不 SSH 修改主機、不 active scan、不收 secrets 明文、不把 AwoooP approval 當資安批准、不把 UI 可見當 runtime 授權 |
@@ -82,6 +83,7 @@
| P0-15 | Public Gateway live conf 匯出請求包 | 100% | 已新增 `public-gateway-live-conf-export-request.py`、snapshot 與文件，把 3 份 public gateway source config 轉成 owner-provided live conf 脫敏匯出請求；redacted export received、raw live conf stored、rendered diff、`nginx -t`、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_LIVE_CONF_EXPORT_REQUEST_OK requests=3 c0=2 redaction_rules=8 received=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、export request ids、redaction rules 與每份請求 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-16 | Public Gateway redacted export 收件預檢 | 100% | 已新增 `public-gateway-redacted-export-intake-preflight.py`、snapshot 與文件，把 3 份 live conf export request 轉成 redacted export 收件候選；validation checks `10`、rejection guards `12`、reviewer lanes `5`；request sent、recipient confirmed、redacted export received、accepted、quarantine、rejected、rendered diff、`nginx -t`、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_REDACTED_EXPORT_INTAKE_PREFLIGHT_OK candidates=3 c0=2 checks=10 rejected=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、intake ids、validation checks、rejection guards 與 reviewer lanes；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-17 | Public Gateway rendered diff / nginx gate 草稿 | 100% | 已新增 `public-gateway-rendered-diff-gate-draft.py`、snapshot 與文件，把 3 份 redacted export intake candidate 轉成 rendered diff、`nginx -t`、reload、route smoke、DNS / TLS、certbot、rollback / post-check 分階段 gate 草稿；redacted export accepted、rendered diff ready、`nginx -t` executed、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_RENDERED_DIFF_GATE_DRAFT_OK candidates=3 c0=2 stages=7 blocked=14 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、diff gate ids、preflight stages、blocked actions 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-18 | P0 主控板同步基線回填 | 100% | 已將本次 worktree、分支、最新 `gitea/main`、Public Gateway P0-15~P0-17 基準與平行 AwoooP Session 同步狀態回填，避免下一個 Session 用舊 2026-06-11 worktree / 舊 commit 判讀 | 只改 P0 總帳與 LOGBOOK；需跑 progress guard、owner response guard、doc secret sanity、diff check 與工作視窗片語掃描；不需要 production browser smoke |
## 3. S4.9 Owner Response Gate 規範