wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): 新增 public gateway rendered diff gate 草稿 [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-14 18:48:38 +08:00
parent f856df1c60
commit 762f73a6c6
10 changed files with 927 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/workplans/2026-06-04-iwooos-security-governance-p0.md
View File

@@ -81,6 +81,7 @@
| P0-14 | 高價值配置 Owner Request 草稿包 / dispatch handoff | 100% | 已新增 `high-value-config-owner-request-draft.py`、snapshot 與文件，把三包預檢轉成 3 份 request draft、11 欄 handoff envelope、27 個 required owner fields、12 類 forbidden payload 與 16 類 blocked request；request sent、recipient confirmed、audit event、received、accepted、runtime gate 仍全部為 `0` | `HIGH_VALUE_CONFIG_OWNER_REQUEST_DRAFT_OK drafts=3 c0=2 fields=27 sent=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、request ids、handoff fields 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-15 | Public Gateway live conf 匯出請求包 | 100% | 已新增 `public-gateway-live-conf-export-request.py`、snapshot 與文件，把 3 份 public gateway source config 轉成 owner-provided live conf 脫敏匯出請求；redacted export received、raw live conf stored、rendered diff、`nginx -t`、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_LIVE_CONF_EXPORT_REQUEST_OK requests=3 c0=2 redaction_rules=8 received=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、export request ids、redaction rules 與每份請求 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-16 | Public Gateway redacted export 收件預檢 | 100% | 已新增 `public-gateway-redacted-export-intake-preflight.py`、snapshot 與文件，把 3 份 live conf export request 轉成 redacted export 收件候選；validation checks `10`、rejection guards `12`、reviewer lanes `5`；request sent、recipient confirmed、redacted export received、accepted、quarantine、rejected、rendered diff、`nginx -t`、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_REDACTED_EXPORT_INTAKE_PREFLIGHT_OK candidates=3 c0=2 checks=10 rejected=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、intake ids、validation checks、rejection guards 與 reviewer lanes；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
| P0-17 | Public Gateway rendered diff / nginx gate 草稿 | 100% | 已新增 `public-gateway-rendered-diff-gate-draft.py`、snapshot 與文件，把 3 份 redacted export intake candidate 轉成 rendered diff、`nginx -t`、reload、route smoke、DNS / TLS、certbot、rollback / post-check 分階段 gate 草稿；redacted export accepted、rendered diff ready、`nginx -t` executed、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_RENDERED_DIFF_GATE_DRAFT_OK candidates=3 c0=2 stages=7 blocked=14 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、diff gate ids、preflight stages、blocked actions 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke |
## 3. S4.9 Owner Response Gate 規範