wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

docs(security): add owner response audit retention rules

Browse Source
This commit is contained in:
Your Name
2026-05-19 12:36:13 +08:00
parent ba034582bf
commit 7f00490c58
19 changed files with 266 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/security/SECURITY-MIRROR-READINESS.md
View File

@@ -72,7 +72,7 @@ AwoooP 可以將 ready / partial contracts mirror 到：
4. 再 mirror `security_mirror_acceptance_v1`，驗收 contract count、event envelope、route coverage 與 redaction。
5. 再 mirror `security_mirror_quarantine_v1`，定義驗收失敗時的隔離與 retry gate。
6. 再 mirror `security_mirror_dry_run_v1`，定義接入演練回報格式。
7. 再 mirror `security_mirror_status_rollup_v1` 與 S4.13 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md`，顯示跨 Session 狀態、四個 owner response packets、22 個 templates、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples 與下一個 gate。
7. 再 mirror `security_mirror_status_rollup_v1` 與 S4.13 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md`，顯示跨 Session 狀態、四個 owner response packets、22 個 templates、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules 與下一個 gate。
8. 再 mirror `security_mirror_intake_plan_v1`，照 wave 執行 read-only intake。
9. 再 mirror `security_approval_queue_v1`，只顯示 review order。
10. 再 mirror `security_approval_gate_v1`，只記錄人工決策與 follow-up runtime gate。
@@ -93,6 +93,6 @@ Ref truth 決策面需同時 mirror S4.11 `SOURCE-CONTROL-REF-TRUTH-OWNER-RESPON
Workflow / secret 名稱決策面需同時 mirror S4.12 `SOURCE-CONTROL-WORKFLOW-SECRET-NAME-OWNER-RESPONSE.md` 與 `source-control-workflow-secret-name-owner-response.snapshot.json`，只顯示 1 個 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks、5 個 owner response templates、received / accepted response 皆為 0、audit events emitted 仍為 0、8 個 acceptance checks 與 10 個 rejection rules；不得把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當成 secret value 收集、workflow 修改、GitHub hosted runner 啟用或 GitHub primary approval。
Owner response validation 決策面需同時 mirror S4.13 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md` 與 `source-control-owner-response-validation-rollup.snapshot.json`，只顯示 S4.9 / S4.10 / S4.11 / S4.12 四個 response packets 的驗收總覽：22 個 templates、received / accepted / rejected 皆為 0、cross-packet checks 10 個、evidence routing rules 6 條、display sections 8 個、state transition rules 7 條、reviewer checklist 9 個、reviewer outcome lanes 7 條、reviewer audit event templates 4 個、reviewer audit display sections 5 個、reviewer audit collection checks 6 個、reviewer audit redaction examples 5 個且 emitted 仍為 0；不得把 rollup、routing、sections、transition rules、reviewer checklist、reviewer outcome lanes、reviewer audit templates、reviewer audit display sections、reviewer audit collection checks 或 reviewer audit redaction examples 當成 approval、runtime gate、production ingestion 或 execution authorization。
Owner response validation 決策面需同時 mirror S4.13 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md` 與 `source-control-owner-response-validation-rollup.snapshot.json`，只顯示 S4.9 / S4.10 / S4.11 / S4.12 四個 response packets 的驗收總覽：22 個 templates、received / accepted / rejected 皆為 0、cross-packet checks 10 個、evidence routing rules 6 條、display sections 8 個、state transition rules 7 條、reviewer checklist 9 個、reviewer outcome lanes 7 條、reviewer audit event templates 4 個、reviewer audit display sections 5 個、reviewer audit collection checks 6 個、reviewer audit redaction examples 5 個、reviewer audit retention rules 5 條且 emitted 仍為 0；不得把 rollup、routing、sections、transition rules、reviewer checklist、reviewer outcome lanes、reviewer audit templates、reviewer audit display sections、reviewer audit collection checks、reviewer audit redaction examples 或 reviewer audit retention rules 當成 approval、runtime gate、production ingestion 或 execution authorization。
整個 S2 不新增 execution router、不新增執行按鈕、不新增 runtime blocker。