From 8294a0545692befddad4a501919324d5c6742218 Mon Sep 17 00:00:00 2001 From: Your Name Date: Mon, 15 Jun 2026 18:16:34 +0800 Subject: [PATCH] =?UTF-8?q?feat(iwooos):=20=E6=96=B0=E5=A2=9E=E4=B8=BB?= =?UTF-8?q?=E6=A9=9F=E6=9C=8D=E5=8B=99=E8=AE=8A=E6=9B=B4=E8=AD=89=E6=93=9A?= =?UTF-8?q?=E9=A9=97=E6=94=B6=20gate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/web/messages/en.json | 18 +- apps/web/messages/zh-TW.json | 18 +- apps/web/src/app/[locale]/iwooos/page.tsx | 23 +- .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 6 +- ...HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md | 146 + .../IWOOOS-CONFIG-CONTROL-INVENTORY.md | 7 + docs/security/IWOOOS-POSTURE-PROJECTION.md | 1 + .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 10 +- ...alue-config-control-coverage.snapshot.json | 28 +- ...e-change-evidence-acceptance.snapshot.json | 2593 +++++++++++++++++ .../iwooos-posture-projection.snapshot.json | 19 + .../high-value-config-control-coverage.py | 11 +- ...host-service-change-evidence-acceptance.py | 449 +++ .../security/iwooos-config-control-guard.py | 36 +- .../security-mirror-progress-guard.py | 223 +- 15 files changed, 3541 insertions(+), 47 deletions(-) create mode 100644 docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md create mode 100644 docs/security/host-service-change-evidence-acceptance.snapshot.json create mode 100644 scripts/security/host-service-change-evidence-acceptance.py diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index e1486ab44..842cd71d9 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -17934,16 +17934,24 @@ }, "dockerSystemd": { "title": "Docker / systemd 主機服務", - "body": "repo-only 清冊、owner request draft 與 owner response acceptance 只讀帳本已納入 9 個 surface，並加入事故恢復、服務依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補；下一步仍需 live hash metadata、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。" + "body": "只讀清冊、負責人回覆驗收與主機服務變更證據驗收已納入 9 個範圍；目前只讀成熟度 62%，26 個審查檢查項、10 條結果分流、39 類禁止動作，Docker daemon、compose、systemd、失敗單元、port binding、路由恢復與操作通知驗收仍全部為 0。" + }, + "aiProvider": { + "title": "AI 供應商 / 模型路由", + "body": "供應商、Ollama 代理、回退順序、成本與隱私邊界已納入高價值配置矩陣；目前成熟度 60%，下一步需要供應商負責人、乾跑、基準測試、成本審查、隱私審查與回復負責人，不直接切正式環境。" }, "sshNetwork": { "title": "SSH / network / firewall", "body": "repo-only 清冊已納入 16 個 SSH / network access surface，且 owner response acceptance 與事故型端口 / 防火牆變更證據驗收只讀帳本已固定；下一步仍需 change / incident ref、actor、before / after state、service health impact、operator notification、restoration time、cross-project sync、maintenance window、rollback owner 與 post-check evidence。" }, - "backupRestore": { - "title": "備份 / 還原 / 金庫", - "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" - }, + "k8sGitops": { + "title": "K8s / ArgoCD GitOps", + "body": "manifest 清冊、負責人回覆驗收與 GitOps 變更證據驗收已固定；目前成熟度 64%，仍缺 proposed commit、rendered manifest diff、ArgoCD app / sync revision、健康前後狀態、rollout、route smoke、metrics / alert、回復與後檢負責人。" + }, + "backupRestore": { + "title": "備份 / 還原 / 金庫", + "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" + }, "monitoring": { "title": "監控與告警設定", "body": "已新增 60 個 monitoring / alerting / observability repo-only surface，並補上告警鏈路 no-false-green 回補 Gate；目前只讀成熟度 68%，23 個 reviewer checks、12 條 outcome lanes、34 類 blocked action，receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green accepted 仍全部為 0。" diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index e1486ab44..842cd71d9 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -17934,16 +17934,24 @@ }, "dockerSystemd": { "title": "Docker / systemd 主機服務", - "body": "repo-only 清冊、owner request draft 與 owner response acceptance 只讀帳本已納入 9 個 surface，並加入事故恢復、服務依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補；下一步仍需 live hash metadata、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。" + "body": "只讀清冊、負責人回覆驗收與主機服務變更證據驗收已納入 9 個範圍；目前只讀成熟度 62%，26 個審查檢查項、10 條結果分流、39 類禁止動作，Docker daemon、compose、systemd、失敗單元、port binding、路由恢復與操作通知驗收仍全部為 0。" + }, + "aiProvider": { + "title": "AI 供應商 / 模型路由", + "body": "供應商、Ollama 代理、回退順序、成本與隱私邊界已納入高價值配置矩陣；目前成熟度 60%，下一步需要供應商負責人、乾跑、基準測試、成本審查、隱私審查與回復負責人，不直接切正式環境。" }, "sshNetwork": { "title": "SSH / network / firewall", "body": "repo-only 清冊已納入 16 個 SSH / network access surface，且 owner response acceptance 與事故型端口 / 防火牆變更證據驗收只讀帳本已固定；下一步仍需 change / incident ref、actor、before / after state、service health impact、operator notification、restoration time、cross-project sync、maintenance window、rollback owner 與 post-check evidence。" }, - "backupRestore": { - "title": "備份 / 還原 / 金庫", - "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" - }, + "k8sGitops": { + "title": "K8s / ArgoCD GitOps", + "body": "manifest 清冊、負責人回覆驗收與 GitOps 變更證據驗收已固定；目前成熟度 64%，仍缺 proposed commit、rendered manifest diff、ArgoCD app / sync revision、健康前後狀態、rollout、route smoke、metrics / alert、回復與後檢負責人。" + }, + "backupRestore": { + "title": "備份 / 還原 / 金庫", + "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" + }, "monitoring": { "title": "監控與告警設定", "body": "已新增 60 個 monitoring / alerting / observability repo-only surface，並補上告警鏈路 no-false-green 回補 Gate；目前只讀成熟度 68%，23 個 reviewer checks、12 條 outcome lanes、34 類 blocked action，receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green accepted 仍全部為 0。" diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 7206bbb50..62d849a18 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -2092,10 +2092,10 @@ const highValueConfigControlCoverageSummary = [ ] as const const highValueConfigControlCoverageItems: HighValueConfigControlCoverageItem[] = [ - { key: 'dockerSystemd', rank: 'P1-1', value: '58%', icon: Server, tone: 'warn' }, - { key: 'sshNetwork', rank: 'P1-2', value: '62%', icon: Network, tone: 'warn' }, - { key: 'backupRestore', rank: 'P1-3', value: '64%', icon: Database, tone: 'warn' }, - { key: 'monitoring', rank: 'P1-4', value: '68%', icon: Radar, tone: 'warn' }, + { key: 'dockerSystemd', rank: 'P1-1', value: '62%', icon: Server, tone: 'warn' }, + { key: 'aiProvider', rank: 'P1-2', value: '60%', icon: Cloud, tone: 'warn' }, + { key: 'sshNetwork', rank: 'P1-3', value: '62%', icon: Network, tone: 'warn' }, + { key: 'k8sGitops', rank: 'P1-4', value: '64%', icon: Workflow, tone: 'warn' }, ] const highValueConfigControlCoverageBoundaries = [ @@ -2198,6 +2198,21 @@ const highValueConfigControlCoverageBoundaries = [ 'host_service_owner_response_acceptance_outcome_lane_count=8', 'host_service_owner_response_acceptance_blocked_action_count=27', 'host_service_owner_response_acceptance_runtime_gate_count=0', + 'host_service_change_evidence_acceptance_candidate_count=9', + 'host_service_change_evidence_acceptance_required_evidence_field_count=25', + 'host_service_change_evidence_acceptance_reviewer_check_count=26', + 'host_service_change_evidence_acceptance_outcome_lane_count=10', + 'host_service_change_evidence_acceptance_blocked_action_count=39', + 'host_service_change_evidence_acceptance_received_count=0', + 'host_service_change_evidence_acceptance_accepted_count=0', + 'host_service_change_evidence_acceptance_docker_daemon_state_accepted_count=0', + 'host_service_change_evidence_acceptance_compose_stack_state_accepted_count=0', + 'host_service_change_evidence_acceptance_systemd_unit_state_accepted_count=0', + 'host_service_change_evidence_acceptance_failed_unit_review_accepted_count=0', + 'host_service_change_evidence_acceptance_port_binding_state_accepted_count=0', + 'host_service_change_evidence_acceptance_public_route_recovery_accepted_count=0', + 'host_service_change_evidence_acceptance_operator_notification_accepted_count=0', + 'host_service_change_evidence_acceptance_runtime_gate_count=0', 'ssh_network_access_inventory_surface_count=16', 'ssh_network_access_inventory_write_capable_surface_count=6', 'ssh_network_access_inventory_runtime_gate_count=0', diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index effc9f531..0b8251d97 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -82,6 +82,8 @@ 固定數字為 `acceptance_candidate_count=9`、`write_capable_acceptance_candidate_count=3`、`live_evidence_required_candidate_count=8`、`acceptance_field_count=34`、`required_owner_field_count=18`、`reviewer_check_count=21`、`outcome_lane_count=8`、`blocked_action_count=27`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`live_host_read_authorized_count=0`、`docker_compose_action_authorized_count=0`、`systemctl_action_authorized_count=0`、`repair_bot_execution_authorized_count=0`、`ansible_apply_authorized_count=0`、`runtime_gate_count=0`。此更新讓 `docker_compose_systemd_host_config` 從 `54%` 推進到 `58%`；它不代表 live host read、restart、repair-bot、Ansible、sudo、host write 或 runtime gate 已授權。 +2026-06-15 再新增 `docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md` 與 `docs/security/host-service-change-evidence-acceptance.snapshot.json`，將 9 個 Docker / systemd / host service surface 轉成變更 / 事故證據驗收只讀帳本。固定 `change_evidence_candidate_count=9`、`write_capable_change_evidence_candidate_count=3`、`live_evidence_required_candidate_count=8`、`change_evidence_field_count=45`、`required_evidence_field_count=25`、`reviewer_check_count=26`、`outcome_lane_count=10`、`blocked_action_count=39`，讓 `docker_compose_systemd_host_config` 從 `58%` 推進到 `62%`。此帳本補齊重啟 actor、before / after service state、Docker daemon state、compose / systemd state、failed unit review、port binding、dependency、cold-start、route recovery、operator notification、cross-project sync 與 no-false-green service health；change evidence、owner response、live host read、Docker / systemd、repair-bot、Ansible、route smoke、host write、runtime gate 與 action button 仍全部為 `0 / false`。 + ## 1.7 2026-06-15 端口 / 防火牆變更證據驗收只讀帳本 已新增 `docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md` 與 `docs/security/port-firewall-change-evidence-acceptance.snapshot.json`，將 SSH / Firewall / Network Access owner response acceptance 裡的端口、防火牆、NodePort、NetworkPolicy、WireGuard、deploy SSH、sudo 與 alert action surface 轉成 change evidence acceptance 只讀帳本。 @@ -115,8 +117,8 @@ | 優先 | 類別 | 目前成熟度 | 下一步 | |------|------|------------|--------| -| P1-1 | Docker Compose / systemd / host service config | `58%` | repo-only 清冊已納入 9 個 surface，owner request draft 與 owner response acceptance ledger 已完成；事故恢復、依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補已納入；仍缺 owner response、110 / 188 live hash、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence | -| P1-2 | AI provider / model routing / Ollama proxy / cost and privacy | `60%` | provider、model routing、Ollama proxy 與 fallback order 已納入高價值配置分類；仍缺 provider owner、fallback order、cost review、privacy review、benchmark、dry-run 結果與 rollback owner，不切 production | +| P1-1 | AI provider / model routing / Ollama proxy / cost and privacy | `60%` | provider、model routing、Ollama proxy 與 fallback order 已納入高價值配置分類；仍缺 provider owner、fallback order、cost review、privacy review、benchmark、dry-run 結果與 rollback owner，不切 production | +| P1-2 | Docker Compose / systemd / host service config | `62%` | repo-only 清冊、owner response acceptance 與 host service change evidence acceptance 已納入 9 個 surface；重啟 actor、before / after、Docker daemon、compose / systemd、failed unit、port binding、dependency、cold-start、route recovery、operator notification、cross-project sync 與 no-false-green 已納入；仍缺 owner response、live hash、change evidence、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence | | P1-3 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `62%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner request draft、owner response acceptance 與事故型端口 / 防火牆變更證據驗收 ledger 已完成；仍缺 owner-provided change / incident ref、actor、before / after state、health impact、notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence | | P1-4 | K8s / ArgoCD / production manifests | `64%` | manifest inventory、owner response acceptance 與 GitOps change evidence acceptance 已完成；仍缺 proposed commit ref、rendered manifest diff、ArgoCD app / sync revision、health before / after、rollout、route smoke、metrics / alert、blast radius、rollback revision、maintenance window 與 post-check owner | | P1-5 | Backup / restore / escrow / retention | `64%` | repo-only 清冊已納入 38 個 surface，owner request draft 與 owner response acceptance ledger 已完成，並補 restore recovery、freshness SLO、隔離還原目標、remote delete guard、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；仍缺 owner response、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence | diff --git a/docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md b/docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md new file mode 100644 index 000000000..b22f5439a --- /dev/null +++ b/docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md @@ -0,0 +1,146 @@ +# IwoooS Docker / systemd / 主機服務變更證據驗收 + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-15 | +| 狀態 | `change_evidence_acceptance_ready_no_runtime_action` | +| 工具 | `scripts/security/host-service-change-evidence-acceptance.py` | +| 輸入 | `docs/security/host-service-owner-response-acceptance.snapshot.json` | +| Snapshot | `docs/security/host-service-change-evidence-acceptance.snapshot.json` | +| runtime gate | `0` | + +## 1. 目的 + +Docker / systemd / host service 事故不能只看「服務又起來了」。主機重啟、Docker daemon starting、compose stack 退出、systemd failed unit、repair-bot / runner 競爭、cold-start recovery 或 port binding 漂移，都可能讓公開 route 短暫恢復但根因仍未驗收。 + +本文件只定義變更 / 事故證據如何收件、補證、隔離、拒收與進 reviewer review。它不是 live host read、不是 SSH、不是 Docker / systemd 操作、不是 repair-bot、不是 Ansible、不是 route smoke，也不是 production write 或 runtime gate 授權。 + +## 2. 摘要 + +| 指標 | 值 | 說明 | +|------|----|------| +| change evidence candidate count | `9` | 對應 9 個 host service surface | +| write-capable candidate count | `3` | Ansible role、110 repair-bot、188 repair-bot | +| live evidence required candidate count | `8` | local dev compose 之外都需 owner-provided live metadata | +| change evidence field count | `45` | 每份 candidate 的 metadata-only 欄位 | +| required evidence field count | `25` | actor、before / after、daemon、compose、systemd、port、dependency、route、post-check 等 | +| reviewer check count | `26` | actor、service state、daemon、compose、systemd、dependency、route recovery、no-false-green 等 | +| outcome lane count | `10` | waiting、quarantine、reject、supplement、incident backfill、no-false-green supplement、review、maintenance、runtime gate | +| blocked action count | `39` | SSH、Docker、systemctl、repair-bot、Ansible、route smoke、raw log storage、runtime gate 等 | +| change evidence received / accepted | `0 / 0` | 尚未收到，尚未驗收 | +| runtime gate / action button | `0 / 0` | 未開啟 | + +## 3. 驗收候選 + +| Candidate | Host scope | 類型 | 變更證據焦點 | +|-----------|------------|------|--------------| +| `host_service_change_evidence:local_dev_compose` | `local_dev_only` | Docker Compose | dev-only disposition、不得誤用 production、secret placeholder policy | +| `host_service_change_evidence:monitoring_110_compose` | `host_110` | Docker Compose | Docker daemon、compose stack、route recovery、Alertmanager / Prometheus 影響 | +| `host_service_change_evidence:monitoring_exporters_188_compose` | `host_188` | Docker Compose | exporter state、DB / Redis dependency、compose recovery 與 post-check | +| `host_service_change_evidence:sentry_110_reference_compose` | `host_110` | reference compose | source-of-truth、official revision、backup / rollback path | +| `host_service_change_evidence:langfuse_110_compose` | `host_110` | Docker Compose | compose state、secret placeholder disposition、route recovery | +| `host_service_change_evidence:ansible_docker_compose_service_role` | `multi_host` | Ansible executor role | check-mode、allowed service_dir、人工 gate、rollback owner | +| `host_service_change_evidence:repair_bot_110_whitelist` | `host_110` | repair whitelist | actor、disable switch、audit log ref、post-check、runner contention | +| `host_service_change_evidence:repair_bot_188_whitelist` | `host_188` | repair whitelist | systemd restart approval gate、sudoers boundary、route smoke plan | +| `host_service_change_evidence:config_backup_host_capture` | `host_cluster` | config backup capture | latest backup status、restore drill owner、secret handling proof | + +> 上表使用 host alias，不把內網位址放進前台產品文案。Snapshot 內若保留既有 repo-only scope，仍不得把它當成可公開文案或 live host 授權。 + +## 4. 必填證據欄位 + +| 欄位 | 規則 | +|------|------| +| `change_or_incident_ref` | 可追溯 change / incident / ticket ref | +| `actor_role_or_team` | 只填角色或團隊，不填私人聯絡資料或 credential | +| `decision` / `decision_reason` | 說明 confirm、defer、reject 或 request_more_evidence 的理由 | +| `affected_scope` | 明確列出 host alias、service scope、route / agent / monitoring 影響 | +| `boot_or_restart_window_ref` | boot、restart、kill、cold-start 或 recovery 時間 ref | +| `before_service_state_ref` / `after_service_state_ref` | 變更前後服務狀態 ref，不能只寫「已恢復」 | +| `docker_daemon_state_ref` | Docker daemon active / starting / failed / socket / contention metadata ref | +| `compose_stack_state_ref` | compose stack / container state 摘要 ref，不保存 raw `docker ps` dump | +| `systemd_unit_state_ref` | systemd unit、failed unit 或 degraded state 摘要 ref | +| `failed_unit_review_ref` | failed unit 是否與事故或恢復相關的 review ref | +| `port_binding_state_ref` | host port、container port、proxy、gateway / firewall exposure 摘要 ref | +| `dependency_impact_ref` | 上游、下游、資料庫、queue、registry、AI provider 與 public route 依賴 ref | +| `cold_start_sequence_ref` | Docker daemon、compose stack、systemd unit、runner 與 post-check 順序 ref | +| `runner_or_repair_bot_contention_ref` | runner、repair-bot、backup job、iptables / xtables 或 compose action 競爭 ref | +| `public_route_recovery_refs` / `admin_route_recovery_refs` | route 恢復 ref；無影響需說明不適用 | +| `agent_provider_health_refs` | AI provider、agent、webhook 或 proxy 健康 ref | +| `monitoring_alert_refs` | alert / incident / monitoring ref，避免人工觀察 false green | +| `operator_notification_refs` / `cross_project_sync_ref` | 跨產品 / Session / owner 同步 ref | +| `restoration_time_ref` | 已恢復事故的恢復時間；未恢復則提供 still-degraded ref | +| `rollback_owner` / `rollback_plan_ref` | 回復責任與 plan | +| `postcheck_evidence_refs` | service、route、agent、queue、monitoring 與 rollback stop condition | + +## 5. Reviewer checks + +| Check | 說明 | +|-------|------| +| `change_ref_present` | 必須有可追溯 change / incident ref | +| `actor_role_traceable` | 不接受匿名 restart、kill、compose action 或 daemon 操作 | +| `decision_reason_present` | decision 與 reason 必須同時存在 | +| `affected_scope_matches_surface` | affected scope 必須能對回 host service surface | +| `boot_or_restart_window_present` | 重啟、cold-start 或恢復需有時間 ref | +| `before_after_service_state_present` | 需有 before / after service state ref | +| `docker_daemon_state_present` | Docker daemon state 必須有脫敏 metadata ref | +| `compose_stack_state_present` | compose / container state 不保存 raw dump | +| `systemd_unit_state_present` | systemd unit / failed unit / degraded state 必須可追溯 | +| `failed_unit_review_present` | failed unit 是否相關必須 review | +| `port_binding_state_present` | port / proxy / gateway / firewall exposure 必須一致性 review | +| `dependency_impact_present` | 必須列上游、下游、queue、registry、AI provider、public route 與 monitoring 影響 | +| `cold_start_sequence_present` | 必須提供 cold-start / recovery sequence ref | +| `runner_repair_bot_contention_present` | 必須確認 runner、repair-bot、backup job 或 xtables 競爭 | +| `route_recovery_evidence_present` | route 受影響時需有恢復 ref | +| `agent_provider_health_present` | AI provider、agent 或 webhook 受影響時需有健康 ref | +| `monitoring_alert_ref_present` | 需列 monitoring / alert / incident ref | +| `operator_notification_present` | 需提供已通知受影響 owner / Session 的脫敏 ref | +| `cross_project_sync_present` | 跨專案影響需有同步 ref | +| `restoration_time_present` | 已恢復事故需提供恢復時間或 still-degraded ref | +| `rollback_owner_present` | rollback owner 與 rollback plan 必須存在 | +| `postcheck_evidence_present` | post-check 必須覆蓋 service、route、agent、queue、monitoring 與 stop condition | +| `secret_or_raw_payload_absent` | 不得包含 secret、env dump、raw docker logs、raw journal、private key 或 cookie | +| `no_false_green_service_health` | 不得把 healthy、route 200、container up 或 dashboard up 當成驗收完成 | +| `no_runtime_authorization` | 證據驗收不授權 SSH、Docker、systemctl、repair-bot、Ansible 或 host write | +| `counts_transition_safe` | 只有 reviewer record 可更新 accepted count，且不得開 runtime gate | + +## 6. 禁止事項 + +1. 不 SSH read / write。 +2. 不讀 live host、live Docker、live systemd 或 live journal。 +3. 不執行 `docker compose up/down/pull`、`docker restart`、`docker kill`。 +4. 不執行 `systemctl restart/reload/kill`。 +5. 不呼叫 repair-bot，不跑 Ansible apply。 +6. 不做 sudo action、host file write、firewall / port change 或 route smoke。 +7. 不保存 raw live config、raw docker log、raw journal、raw env dump、secret value 或 private key。 +8. 不把服務 healthy、route `200`、container up 或 dashboard up 當成 recovery / config 已驗收。 +9. 不跳過 source-of-truth、依賴圖、port binding、cold-start sequence 或 daemon / runner contention review。 +10. 不開 runtime gate，不建立 action button。 + +## 7. 指令 + +產生 committed snapshot： + +```bash +python3 scripts/security/host-service-change-evidence-acceptance.py \ + --root . \ + --owner-response-report docs/security/host-service-owner-response-acceptance.snapshot.json \ + --output docs/security/host-service-change-evidence-acceptance.snapshot.json \ + --generated-at 2026-06-15T18:50:00+08:00 +``` + +驗證 guard： + +```bash +python3 scripts/security/security-mirror-progress-guard.py --root . +``` + +## 8. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| host service change evidence acceptance artifact | `100%` | 產生器、snapshot 與文件已固定 | +| Docker / systemd / host service 只讀治理成熟度 | `58% -> 62%` | 事故 / 變更證據、重啟 actor、before / after、daemon、compose、systemd、port、dependency、route recovery、operator notice 與 no-false-green 已納入 | +| change evidence received / accepted | `0%` | 尚未收到，尚未驗收 | +| live host read / SSH | `0%` | 尚未批准且未執行 | +| Docker / systemd / repair-bot / Ansible | `0%` | 尚未批准且未執行 | +| runtime gate / host write | `0%` | 未授權且未執行 | diff --git a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md index 1d31d9839..e7de25ccf 100644 --- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md +++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md @@ -127,6 +127,12 @@ 此更新只表示 live config hash ref、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence 已有收件驗收規則；owner response received / accepted、live host read、SSH、Docker Compose、systemctl、repair-bot、Ansible、sudo、host write、runtime gate 仍全部為 `0 / false`。 +### 0.8a 2026-06-15 Docker / systemd / host service change evidence acceptance 只讀帳本 + +`host_service_change_evidence_acceptance_v1` 已把 9 個 Docker / systemd / host service surface 轉成事故 / 變更證據驗收只讀帳本。固定 `candidates=9`、`write_capable=3`、`live_evidence_required=8`、`evidence_fields=45`、`required_evidence_fields=25`、`reviewer_checks=26`、`outcome_lanes=10`、`blocked_actions=39`，並納入重啟 actor、before / after service state、Docker daemon state、compose / systemd state、failed unit review、port binding、dependency impact、cold-start sequence、route recovery、operator notification、cross-project sync 與 no-false-green service health，讓 Docker / systemd / host service 類別成熟度從 `58%` 推進到 `62%`。 + +此更新只表示未來 host service 事故或變更證據已有收件驗收規則；change evidence received / accepted、Docker daemon state accepted、compose stack state accepted、systemd unit state accepted、failed unit review accepted、port binding accepted、route recovery accepted、operator notification accepted、live host read、SSH、Docker / systemd、repair-bot、Ansible、route smoke、host write、runtime gate 仍全部為 `0 / false`。 + ## 1. 目前已不符合新要求的項目 | 優先 | 項目 | 現況 | 風險 | 本階段處置 | @@ -259,6 +265,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | agent-bounty-protocol owner request draft | `100%` | 已將 repo / refs、deployment、data classification、external agent / treasury 與 7 個 product surface 轉成 11 份 owner request draft；claim / submit、payout、cron / daemon、runtime gate 仍為 0 | | Docker / systemd owner request draft | `100%` | 已將 9 個 host service surface 轉成 owner request draft；request sent / received / accepted 仍為 0 | | Docker / systemd owner response acceptance | `100%` | 已新增 `host_service_owner_response_acceptance_v1`，9 個 candidate、3 個 write-capable、8 個需 live evidence、21 個 reviewer checks、8 條 outcome lanes、27 類 blocked action；成熟度 `54% -> 58%` | +| Docker / systemd change evidence acceptance | `100%` | 已新增 `host_service_change_evidence_acceptance_v1`，9 個 candidate、3 個 write-capable、26 個 reviewer checks、10 條 outcome lanes、39 類 blocked action；成熟度 `58% -> 62%` | | SSH / firewall / network owner request draft | `100%` | 已將 16 個 SSH / network access surface 轉成 owner request draft；request sent / received / accepted、port change、firewall change、NetworkPolicy apply、NodePort change、WireGuard change 仍為 0 | | SSH / firewall / network owner response acceptance | `100%` | 已新增 `ssh_network_owner_response_acceptance_v1`，16 個 candidate、6 個 write-capable、15 個 reviewer checks、7 條 outcome lanes、22 類 blocked action；成熟度 `54% -> 58%` | | 端口 / 防火牆變更證據驗收 | `100%` | 已新增並強化 `port_firewall_change_evidence_acceptance_v1`，14 個 candidate、6 個 write-capable、21 個 reviewer checks、9 條 outcome lanes、28 類 blocked action；成熟度 `58% -> 62%` | diff --git a/docs/security/IWOOOS-POSTURE-PROJECTION.md b/docs/security/IWOOOS-POSTURE-PROJECTION.md index a9ea2036b..f3fa3923d 100644 --- a/docs/security/IWOOOS-POSTURE-PROJECTION.md +++ b/docs/security/IWOOOS-POSTURE-PROJECTION.md @@ -98,6 +98,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence： 54. 14 類 high-value config control coverage statuses，顯示 Nginx、DNS / TLS、K8s、機密、工作流程、執行器、backup、agent-bounty runtime、monitoring、Docker / systemd、SSH / network、AI provider、產品 route 與 security evidence 的全域配置控管覆蓋矩陣；平均只讀成熟度 `70%`、C0 類別 `8`、需 live / owner evidence 類別 `10`、owner response received / accepted 與 runtime gate 仍為 `0`，不代表 reload、sync、scan、secret rotation、payout 或主機操作授權。 54a. 前台 source / messages 敏感資訊防洩漏 guard 已固定 `public_surface_file_count=225`、`forbidden_pattern_count=12`、`allowlisted_match_count=2`、`violation_count=0`、`runtime_gate_count=0`，讓 `public_admin_api_runtime_config` 從 `64%` 推進到 `66%`；這只代表 source-control 防洩漏 gate，仍不是 production bundle scan accepted、desktop / mobile production smoke accepted、owner response accepted 或 runtime gate。 55. 9 個 host-service config repo-only inventory surfaces，顯示 Docker Compose、systemd / repair-bot、Ansible service role 與 host config backup capture 的第一層清冊；write-capable surface `3`、repair-bot whitelist `2`、systemd restart surface `1`，owner response、live evidence、restart window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 `docker compose`、`systemctl`、repair-bot 或 Ansible apply 已授權。 +55a. 9 個 Docker / systemd / host service change evidence acceptance 候選，顯示重啟 actor、before / after service state、Docker daemon state、compose / systemd state、failed unit review、port binding、dependency impact、cold-start sequence、route recovery、operator notification、cross-project sync 與 no-false-green service health 收件規則；write-capable candidate `3`、required evidence field `25`、reviewer check `26`、outcome lane `10`、blocked action `39`，讓 Docker / systemd / host service 類別成熟度從 `58%` 推進到 `62%`；change evidence、Docker daemon state accepted、compose stack accepted、systemd unit accepted、failed unit review accepted、port binding accepted、route recovery accepted、operator notification accepted、live host read、Docker / systemd、repair-bot、Ansible、route smoke、runtime gate 與 action button 仍全部為 `0`。 56. 16 個 SSH / network access repo-only inventory surfaces、owner response acceptance 與端口 / 防火牆變更證據驗收只讀帳本，顯示 SSH target、known_hosts workflow、CI deploy SSH、monitoring SSH、backup SSH capture、sudoers wrapper、NetworkPolicy、NodePort、WireGuard runbook 與 alert SSH action catalog 的第一層清冊；write-capable surface `6`、NetworkPolicy `2`、NodePort `2`、sudoers `1`、WireGuard `1`，acceptance candidate `16`、change evidence candidate `14`、reviewer check `21`、outcome lane `9`、blocked action `28`，讓 SSH / network 類別成熟度從 `58%` 推進到 `62%`；owner response、change evidence、actor、before / after state、service health impact、operator notification、cross-project sync、post-check evidence、maintenance window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 SSH、sudo、firewall、port close / open、NetworkPolicy、NodePort、WireGuard、route smoke 或 known_hosts patch 已授權。 56a. 4 個 K8s / ArgoCD GitOps 變更證據驗收候選，顯示 production manifests、ArgoCD app、Velero、monitoring manifests 的 proposed commit、rendered manifest diff、ArgoCD app / sync revision、health before / after、rollout、route smoke、metrics / alert、secret metadata parity、blast radius、maintenance window、rollback revision 與 postcheck owner 收件規則；C0 candidate `3`、write-capable candidate `4`、reviewer check `18`、outcome lane `8`、blocked action `28`，讓 K8s / ArgoCD 類別成熟度從 `62%` 推進到 `64%`；change evidence、runtime approval package、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、NetworkPolicy / NodePort / RBAC change、production write、runtime gate 與 action button 仍全部為 `0`。 56b. 5 個 CD / Runner / Secret 注入變更證據驗收候選，顯示 CD pipeline、程式碼審查、部署通知、執行器證明與 repository secret name parity / injection owner 的 metadata-only 收件規則；C0 candidate `4`、write-capable candidate `5`、local workflow file `33`、referenced secret name `42`、runner label `5`、reviewer check `19`、outcome lane `8`、blocked action `32`，讓 secret metadata 類別成熟度從 `66%` 推進到 `68%`，讓 Gitea workflow / runner 類別成熟度從 `70%` 推進到 `72%`；workflow diff、runner attestation、secret name parity、secret injection route、deploy marker readback、guard result、postcheck evidence、runtime approval package、workflow modification、runner change、repo secret change、secret rotation、Gitea action dispatch、production deploy、runtime gate 與 action button 仍全部為 `0`。 diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index 3dc093a62..e0021f793 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -3,17 +3,23 @@ | 項目 | 內容 | |------|------| | 日期 | 2026-06-15 | -| 狀態 | IwoooS 64% 只讀治理推進中；高價值配置集中 guard、Package / Docker 供應鏈 repo-only baseline 與 Package / Docker 供應鏈 owner policy gate 已完成；Frontend public sensitive surface guard、Backup / Restore / Escrow owner response acceptance backfill、Monitoring / Alerting / Observability no-false-green owner response acceptance、CD / Runner / Secret 注入變更證據驗收與 Public / Admin / API runtime config 變更證據驗收只讀帳本已本地完成；端口 / 防火牆變更證據驗收、主機服務事故回補與 K8s / ArgoCD GitOps 變更證據驗收已正式部署驗證；S4.9 owner response gate 仍是第一優先 | +| 狀態 | IwoooS 64% 只讀治理推進中；高價值配置集中 guard、Package / Docker 供應鏈 repo-only baseline 與 Package / Docker 供應鏈 owner policy gate 已完成；Frontend public sensitive surface guard、Backup / Restore / Escrow owner response acceptance backfill、Monitoring / Alerting / Observability no-false-green owner response acceptance、Host Service change evidence acceptance、CD / Runner / Secret 注入變更證據驗收與 Public / Admin / API runtime config 變更證據驗收只讀帳本已本地完成；端口 / 防火牆變更證據驗收、主機服務事故回補與 K8s / ArgoCD GitOps 變更證據驗收已正式部署驗證；S4.9 owner response gate 仍是第一優先 | | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 | | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | | P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；Public Gateway live conf 匯出請求包已新增 `requests=3 / c0=2 / redaction_rules=8 / received=0`；Public Gateway redacted export 收件預檢已新增 `candidates=3 / c0=2 / checks=10 / rejection_guards=12 / received=0 / accepted=0`；Public Gateway rendered diff / nginx gate 草稿已新增 `candidates=3 / c0=2 / stages=7 / blocked=14 / rendered_diff=0 / runtime=0`；Public Gateway owner response acceptance 只讀帳本已新增 `candidates=3 / c0=2 / fields=33 / checks=22 / lanes=8 / blocked=28 / accepted=0 / runtime=0`，並補上手動 / 緊急 gateway 變更的 intent、approval / break-glass、route health、rollback validation 與 post-change monitoring 必填 ref；DNS / TLS / certbot Owner Confirmation Request 已新增 `requests=4 / c0=4 / fields=9 / questions=5 / guards=12 / received=0 / accepted=0`；K8s / ArgoCD manifest repo-only 清冊已新增 `files=49 / c0=36 / yaml=45 / kinds=20 / blocked=13 / runtime=0`；K8s / ArgoCD Owner Request Draft 已新增 `drafts=4 / c0=3 / fields=11 / sent=0 / runtime=0`；K8s / ArgoCD owner response acceptance 只讀帳本已新增 `candidates=4 / c0=3 / fields=11 / checks=12 / lanes=7 / blocked=18 / accepted=0 / runtime=0`；K8s / ArgoCD GitOps 變更證據驗收已新增 `candidates=4 / c0=3 / write_capable=4 / evidence_fields=18 / checks=18 / lanes=8 / blocked=28 / accepted=0 / runtime=0`；CD / Runner / Secret 注入變更證據驗收已新增 `candidates=5 / c0=4 / write_capable=5 / workflow_files=33 / secret_names=42 / runner_labels=5 / evidence_fields=19 / checks=19 / lanes=8 / blocked=32 / accepted=0 / runtime=0`；Public / Admin / API runtime config 變更證據驗收已新增 `candidates=6 / c0=5 / write_capable=6 / source_refs=20 / evidence_fields=21 / checks=21 / lanes=8 / blocked=32 / accepted=0 / runtime=0`，並把 raw namespace、repo slug、內部狀態碼與內部協作內容外洩列為拒收 / 隔離；Frontend public sensitive surface guard 已新增 `files=225 / patterns=12 / allowlisted=2 / violations=0 / runtime=0`，讓 public runtime config 成熟度 `64% -> 66%`、高價值配置平均 `69% -> 70%`；Backup / Restore / Escrow owner response acceptance 只讀帳本已更新為 `candidates=38 / write_capable=27 / fields=33 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；SSH / Firewall / Network Access owner response acceptance 只讀帳本已新增 `candidates=16 / write_capable=6 / fields=13 / checks=15 / lanes=7 / blocked=22 / accepted=0 / runtime=0`；端口 / 防火牆變更證據驗收只讀帳本已新增 `candidates=14 / write_capable=6 / policy_or_exposure=5 / evidence_fields=16 / checks=16 / lanes=8 / blocked=24 / accepted=0 / runtime=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | | P0 agent-bounty 追加 | agent-bounty-protocol Owner Request Draft 已新增 `drafts=11 / control=4 / surface=7 / write_capable=8 / treasury=4 / mcp_a2a=5 / fields=22 / forbidden_inputs=25 / blocked=28 / sent=0 / runtime=0`；這是 repo / refs、deployment、data classification、MCP / A2A、cron / daemon、admin / treasury、webhook / traffic 的人工送件前草稿，不是 owner response、repo push、refs sync、workflow 修改、secret 收集、deploy、compose restart、DB migration、claim / submit、payout / withdrawal、cron / daemon、external send、host write 或 runtime gate | -| P1 追加 | Docker / systemd / Host Service Owner Request Draft 已新增 `drafts=9 / write_capable=3 / fields=12 / blocked=14 / sent=0 / runtime=0`；Docker / systemd / Host Service Owner Response Acceptance 已更新為 `candidates=9 / write_capable=3 / live_evidence_required=8 / fields=34 / owner_fields=18 / reviewer_checks=21 / lanes=8 / blocked=27 / accepted=0 / runtime=0`；SSH / Firewall / Network Access Owner Request Draft 已新增 `drafts=16 / write_capable=6 / fields=13 / blocked=16 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Request Draft 已新增 `drafts=38 / write_capable=27 / fields=14 / blocked=18 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Response Acceptance 已更新為 `candidates=38 / write_capable=27 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；Monitoring / Alerting / Observability Owner Request Draft 已新增 `drafts=60 / write_capable=11 / fields=14 / blocked=24 / sent=0 / runtime=0`；Monitoring / Alerting / Observability Owner Response Acceptance 已更新為 `candidates=60 / write_capable=11 / live_evidence_required=60 / fields=38 / owner_fields=14 / reviewer_checks=23 / lanes=12 / blocked=34 / accepted=0 / runtime=0`，並補 incident context、receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green risk review；上述全部仍是人工送件前草稿或只讀 acceptance 帳本，不是 owner response、live evidence、reload、restart、backup、restore、Telegram send、alert smoke、host write 或 runtime gate | +| P1 追加 | Docker / systemd / Host Service Owner Request Draft 已新增 `drafts=9 / write_capable=3 / fields=12 / blocked=14 / sent=0 / runtime=0`；Docker / systemd / Host Service Owner Response Acceptance 已更新為 `candidates=9 / write_capable=3 / live_evidence_required=8 / fields=34 / owner_fields=18 / reviewer_checks=21 / lanes=8 / blocked=27 / accepted=0 / runtime=0`；Docker / systemd / Host Service Change Evidence Acceptance 已新增 `candidates=9 / write_capable=3 / live_evidence_required=8 / evidence_fields=45 / required_fields=25 / reviewer_checks=26 / lanes=10 / blocked=39 / accepted=0 / runtime=0`；SSH / Firewall / Network Access Owner Request Draft 已新增 `drafts=16 / write_capable=6 / fields=13 / blocked=16 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Request Draft 已新增 `drafts=38 / write_capable=27 / fields=14 / blocked=18 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Response Acceptance 已更新為 `candidates=38 / write_capable=27 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；Monitoring / Alerting / Observability Owner Request Draft 已新增 `drafts=60 / write_capable=11 / fields=14 / blocked=24 / sent=0 / runtime=0`；Monitoring / Alerting / Observability Owner Response Acceptance 已更新為 `candidates=60 / write_capable=11 / live_evidence_required=60 / fields=38 / owner_fields=14 / reviewer_checks=23 / lanes=12 / blocked=34 / accepted=0 / runtime=0`，並補 incident context、receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green risk review；上述全部仍是人工送件前草稿或只讀 acceptance 帳本，不是 owner response、change evidence accepted、live evidence、reload、restart、backup、restore、Telegram send、alert smoke、host write 或 runtime gate | | P2 供應鏈追加 | Package / Docker 供應鏈 repo-only baseline 已新增 `package_json=6 / pyproject=4 / requirements=2 / dockerfiles=2 / compose=6 / gaps=5 / runtime=0`；Package / Docker 供應鏈 owner policy gate 已新增 `requests=6 / c0=2 / fields=8 / checks=12 / blocked=20 / sent=0 / accepted=0 / runtime=0`；缺口為 Python lockfile 缺席、requirements 未 pin、Docker base image 未全數 digest pinning、Docker `COPY --from` 外部 image 未 digest pinning、compose image 未 digest pinning，以及 CVE / license / SBOM window 未定；目前尚未列入 36 個正式 AwoooP 消費 contract，後續若要前台消費需同步 manifest / readiness / route / rollup / dry-run / posture projection / guard count；本輪不 install、不 upgrade、不跑 CVE、不 pull / build / push image、不改 tag、不登入 registry、不部署 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | +## 0.00aaaaaaa 2026-06-15 Docker / systemd / Host Service change evidence acceptance + +本輪把 Docker / systemd / host service 從 owner response acceptance 再補一層事故 / 變更證據驗收只讀帳本：`host_service_change_evidence_acceptance_v1` 固定 `candidates=9`、`write_capable=3`、`live_evidence_required=8`、`change_evidence_fields=45`、`required_evidence_fields=25`、`reviewer_checks=26`、`outcome_lanes=10`、`blocked_actions=39`，並讓 `docker_compose_systemd_host_config` 只讀治理成熟度 `58% -> 62%`。新增要求包含重啟 actor、before / after service state、Docker daemon state、compose / systemd state、failed unit review、port binding、dependency impact、cold-start sequence、route recovery、operator notification、cross-project sync 與 no-false-green service health。 + +同步邊界：IwoooS headline 維持 `64%`，active runtime gate 維持 `0`；change evidence、Docker daemon state、compose stack state、systemd unit state、failed unit review、port binding、route recovery、operator notification、postcheck evidence、runtime gate 與 action buttons 全部仍為 `0 / false`。本段只更新文件、snapshot、guard、覆蓋矩陣與前端 marker，不 SSH、不讀 live host、不碰 Docker daemon、systemd、repair-bot、Ansible、route smoke、Nginx、firewall、iptables 或主機。 + ## 0.00aaaaaa 2026-06-15 Monitoring / Alerting / Observability owner response acceptance 本輪把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、receiver route、silence policy、Telegram Bot 與 alert chain smoke 從 owner request draft 推進到 owner response acceptance 只讀帳本：`monitoring_owner_response_acceptance_v1` 固定 `candidates=60`、`write_capable=11`、`live_evidence_required=60`、`acceptance_fields=38`、`owner_fields=14`、`reviewer_checks=23`、`outcome_lanes=12`、`blocked_actions=34`，並讓 `monitoring_alerting_observability` 只讀治理成熟度 `62% -> 68%`。這是 owner response 收件驗收與 no-false-green 回補帳本，不是 owner response received / accepted / rejected、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、runtime approval package 或 runtime gate。 diff --git a/docs/security/high-value-config-control-coverage.snapshot.json b/docs/security/high-value-config-control-coverage.snapshot.json index 1b6b602a9..176d7bbc8 100644 --- a/docs/security/high-value-config-control-coverage.snapshot.json +++ b/docs/security/high-value-config-control-coverage.snapshot.json @@ -368,9 +368,9 @@ "action_buttons_allowed": false, "category_id": "docker_compose_systemd_host_config", "control_tier": "C1", - "coverage_percent": 58, - "coverage_status": "incident_recovery_backfill_ready_needs_live_owner_evidence", - "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並加入事故恢復、依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補欄位；仍缺 owner response、110 / 188 live hash、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", + "coverage_percent": 62, + "coverage_status": "change_evidence_acceptance_ready_needs_host_service_owner_evidence", + "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並新增 host service change evidence acceptance；重啟 actor、before / after state、Docker daemon、compose / systemd state、failed unit、port binding、dependency、cold-start、route recovery、operator notice、cross-project sync 與 no-false-green 皆已納入只讀帳本；仍缺 owner response、live hash、change evidence、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md", @@ -379,10 +379,12 @@ "docs/security/host-service-owner-request-draft.snapshot.json", "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/host-service-owner-response-acceptance.snapshot.json", + "docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md", + "docs/security/host-service-change-evidence-acceptance.snapshot.json", "docs/security/DEV-HOSTS-112-111-168-OBSERVE-ONLY-MAPPING.md" ], "label": "Docker Compose / systemd / host service config", - "next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、maintenance / restart window、rollback owner、post-check plan、disable switch、source-of-truth、服務依賴圖、port binding、cold-start sequence、incident recovery evidence 與 daemon / runner contention review。", + "next_owner_action": "補 owner-provided live hash / disposition、change / incident ref、actor role / team、before / after state、Docker daemon state、compose / systemd state、failed unit review、port binding、服務依賴圖、cold-start sequence、route recovery、operator notification、cross-project sync、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", "owner_response_accepted": false, "owner_response_received": false, "owner_response_required": true, @@ -635,16 +637,9 @@ "websocket_route_change_authorized": false, "workflow_modification_authorized": false }, - "generated_at": "2026-06-15T18:20:00+08:00", - "git_commit": "0def6daf", + "generated_at": "2026-06-15T18:55:00+08:00", + "git_commit": "a9060b49", "lowest_coverage_categories": [ - { - "category_id": "docker_compose_systemd_host_config", - "coverage_percent": 58, - "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並加入事故恢復、依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補欄位；仍缺 owner response、110 / 188 live hash、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", - "label": "Docker Compose / systemd / host service config", - "next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、maintenance / restart window、rollback owner、post-check plan、disable switch、source-of-truth、服務依賴圖、port binding、cold-start sequence、incident recovery evidence 與 daemon / runner contention review。" - }, { "category_id": "ai_provider_model_routing", "coverage_percent": 60, @@ -652,6 +647,13 @@ "label": "AI provider / model routing / Ollama proxy / cost and privacy", "next_owner_action": "補 provider owner、fallback order、cost review、privacy review、benchmark 與 rollback owner。" }, + { + "category_id": "docker_compose_systemd_host_config", + "coverage_percent": 62, + "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並新增 host service change evidence acceptance；重啟 actor、before / after state、Docker daemon、compose / systemd state、failed unit、port binding、dependency、cold-start、route recovery、operator notice、cross-project sync 與 no-false-green 皆已納入只讀帳本；仍缺 owner response、live hash、change evidence、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", + "label": "Docker Compose / systemd / host service config", + "next_owner_action": "補 owner-provided live hash / disposition、change / incident ref、actor role / team、before / after state、Docker daemon state、compose / systemd state、failed unit review、port binding、服務依賴圖、cold-start sequence、route recovery、operator notification、cross-project sync、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。" + }, { "category_id": "ssh_firewall_network_access", "coverage_percent": 62, diff --git a/docs/security/host-service-change-evidence-acceptance.snapshot.json b/docs/security/host-service-change-evidence-acceptance.snapshot.json new file mode 100644 index 000000000..aada51ceb --- /dev/null +++ b/docs/security/host-service-change-evidence-acceptance.snapshot.json @@ -0,0 +1,2593 @@ +{ + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "change_evidence_candidates": [ + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:local_dev_compose", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "docker_compose_source", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "local_dev_only", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "AWOOOI local development compose", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": false, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "web", + "api", + "postgres", + "redis" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:local_dev_compose", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "local_dev_compose", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:monitoring_110_compose", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "docker_compose_source", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.110", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "110 monitoring docker compose", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "cadvisor", + "prometheus", + "grafana", + "blackbox-exporter", + "alertmanager", + "github-exporter" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:monitoring_110_compose", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "monitoring_110_compose", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:monitoring_exporters_188_compose", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "docker_compose_source", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.188", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "188 database exporters compose", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "postgres-exporter", + "redis-exporter" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:monitoring_exporters_188_compose", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "monitoring_exporters_188_compose", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:sentry_110_reference_compose", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "docker_compose_reference", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.110", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "110 Sentry self-hosted reference compose", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "sentry-placeholder-reference" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:sentry_110_reference_compose", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "sentry_110_reference_compose", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:langfuse_110_compose", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "docker_compose_source", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.110", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "110 Langfuse compose", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "langfuse", + "langfuse-db" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:langfuse_110_compose", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "langfuse_110_compose", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:ansible_docker_compose_service_role", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "ansible_service_executor", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "multi_host", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "Ansible docker-compose-service role", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "docker compose up -d" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:ansible_docker_compose_service_role", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "ansible_docker_compose_service_role", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:repair_bot_110_whitelist", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "host_repair_whitelist", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.110", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "110 repair-bot compose whitelist", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "sentry", + "harbor", + "gitea", + "gitea-runner", + "langfuse", + "alertmanager", + "signoz" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:repair_bot_110_whitelist", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "repair_bot_110_whitelist", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:repair_bot_188_whitelist", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "host_repair_whitelist", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "192.168.0.188", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "188 repair-bot compose/systemd whitelist", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "openclaw", + "minio", + "signoz", + "redis", + "nginx", + "ollama" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:repair_bot_188_whitelist", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "repair_bot_188_whitelist", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_identified": false, + "actor_role_or_team": "pending_change_evidence", + "admin_route_recovery_accepted": false, + "admin_route_recovery_refs": [], + "affected_scope": "pending_change_evidence", + "after_service_state_accepted": false, + "after_service_state_ref": null, + "agent_provider_health_accepted": false, + "agent_provider_health_refs": [], + "ansible_apply_authorized": false, + "backup_job_overlap_ref": null, + "before_service_state_accepted": false, + "before_service_state_ref": null, + "blocked_actions": [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button" + ], + "boot_or_restart_window_accepted": false, + "boot_or_restart_window_ref": null, + "change_evidence_accepted": false, + "change_evidence_candidate_id": "host_service_change_evidence:config_backup_host_capture", + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "change_evidence_quarantined": false, + "change_evidence_received": false, + "change_evidence_rejected": false, + "change_freeze_rule": "pending_change_evidence", + "change_or_incident_ref": null, + "cold_start_sequence_accepted": false, + "cold_start_sequence_ref": null, + "compose_stack_state_accepted": false, + "compose_stack_state_ref": null, + "config_kind": "backup_capture_contract", + "control_tier": "C1", + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "customer_impact_ref": null, + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "dependency_impact_accepted": false, + "dependency_impact_ref": null, + "docker_compose_action_authorized": false, + "docker_daemon_state_accepted": false, + "docker_daemon_state_ref": null, + "docker_restart_authorized": false, + "expected_host_scope": "110_188_120_121_cluster", + "failed_unit_review_accepted": false, + "failed_unit_review_ref": null, + "followup_owner": "pending_change_evidence", + "host_write_authorized": false, + "incident_severity": "pending_change_evidence", + "label": "host config backup capture contract", + "live_host_read_authorized": false, + "maintenance_window": "pending_change_evidence", + "monitoring_alert_accepted": false, + "monitoring_alert_refs": [], + "network_gateway_impact_ref": null, + "not_approval": true, + "operator_notification_accepted": false, + "operator_notification_refs": [], + "outcome_lanes": [ + "waiting_change_evidence", + "quarantine_secret_or_raw_payload", + "reject_unattributed_restart", + "request_recovery_supplement", + "incident_backfill_required", + "no_false_green_supplement_required", + "ready_for_host_service_review", + "owner_review_only_update", + "waiting_maintenance_window", + "waiting_runtime_gate" + ], + "port_binding_state_accepted": false, + "port_binding_state_ref": null, + "postcheck_evidence_accepted": false, + "postcheck_evidence_refs": [], + "public_route_recovery_accepted": false, + "public_route_recovery_refs": [], + "recovery_supplement_requested": false, + "repair_bot_execution_authorized": false, + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "requires_live_evidence": true, + "restoration_time_accepted": false, + "restoration_time_ref": null, + "reviewer_checks": [ + "change_ref_present", + "actor_role_traceable", + "decision_reason_present", + "affected_scope_matches_surface", + "boot_or_restart_window_present", + "before_after_service_state_present", + "docker_daemon_state_present", + "compose_stack_state_present", + "systemd_unit_state_present", + "failed_unit_review_present", + "port_binding_state_present", + "dependency_impact_present", + "cold_start_sequence_present", + "runner_repair_bot_contention_present", + "route_recovery_evidence_present", + "agent_provider_health_present", + "monitoring_alert_ref_present", + "operator_notification_present", + "cross_project_sync_present", + "restoration_time_present", + "rollback_owner_present", + "postcheck_evidence_present", + "secret_or_raw_payload_absent", + "no_false_green_service_health", + "no_runtime_authorization", + "counts_transition_safe" + ], + "reviewer_outcome": "waiting_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_owner_accepted": false, + "rollback_plan_ref": null, + "route_smoke_authorized": false, + "runner_or_repair_bot_contention_accepted": false, + "runner_or_repair_bot_contention_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "service_scope": [ + "systemd", + "docker", + "nginx", + "cron", + "k8s", + "host-configs" + ], + "source_acceptance_candidate_id": "host_service_owner_response_acceptance:config_backup_host_capture", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_change_evidence", + "sudo_action_authorized": false, + "surface_id": "config_backup_host_capture", + "systemctl_action_authorized": false, + "systemd_unit_state_accepted": false, + "systemd_unit_state_ref": null, + "write_capable_surface": false + } + ], + "change_evidence_fields": [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval" + ], + "execution_boundaries": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "ansible_apply_authorized": false, + "change_evidence_accepted": false, + "change_evidence_received": false, + "docker_compose_action_authorized": false, + "docker_restart_authorized": false, + "host_write_authorized": false, + "live_host_read_authorized": false, + "not_authorization": true, + "repair_bot_execution_authorized": false, + "request_dispatch_authorized": false, + "route_smoke_authorized": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "sudo_action_authorized": false, + "systemctl_action_authorized": false + }, + "generated_at": "2026-06-15T18:50:00+08:00", + "git_commit": "a9060b49", + "next_steps": [ + "等待 owner 以脫敏 metadata ref 補 change / incident ref、actor、before / after state、Docker daemon、compose / systemd、failed unit、port binding、dependency、cold-start、route recovery、operator notification、rollback 與 post-check evidence。", + "收到證據後先做欄位完整性、敏感 payload 隔離與 execution request 拒收；不得直接 SSH、docker、systemctl、repair-bot、Ansible 或 route smoke。", + "即使 reviewer 接受 change evidence，也只能形成 runtime approval package；維護窗口、rollback、post-check、stop condition 與人工 runtime gate 需另行批准。" + ], + "outcome_lanes": [ + { + "lane_id": "waiting_change_evidence", + "meaning": "尚未收到 host service 變更 / 事故證據；所有 accepted / runtime count 維持 0。" + }, + { + "lane_id": "quarantine_secret_or_raw_payload", + "meaning": "收到 secret、env dump、raw docker logs、raw journal、raw compose 或未脫敏 host config 時只能隔離。" + }, + { + "lane_id": "reject_unattributed_restart", + "meaning": "無 actor、無 owner、無 affected scope、無 rollback 或無 post-check 的 restart / reload / kill 不得驗收。" + }, + { + "lane_id": "request_recovery_supplement", + "meaning": "缺 before / after、daemon state、compose state、systemd state、dependency、route recovery 或 cross-project sync 時要求補件。" + }, + { + "lane_id": "incident_backfill_required", + "meaning": "涉及服務異常、靜默重啟、端口事故、cold-start recovery 或 daemon contention 時必須回補。" + }, + { + "lane_id": "no_false_green_supplement_required", + "meaning": "只用 route 200、container up、dashboard up 或服務 healthy 代表恢復時，要求補 no-false-green 證據。" + }, + { + "lane_id": "ready_for_host_service_review", + "meaning": "metadata 合格後，只能進 host service reviewer review。" + }, + { + "lane_id": "owner_review_only_update", + "meaning": "只允許更新 reviewer ledger，不改 compose、systemd、repair-bot、Ansible 或 host。" + }, + { + "lane_id": "waiting_maintenance_window", + "meaning": "若未來要 restart / repair / apply，仍需獨立維護窗口。" + }, + { + "lane_id": "waiting_runtime_gate", + "meaning": "即使 change evidence accepted，runtime gate 仍需獨立人工批准。" + } + ], + "required_evidence_fields": [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs" + ], + "reviewer_checks": [ + { + "check_id": "change_ref_present", + "instruction": "必須有可追溯的 change / incident ref。" + }, + { + "check_id": "actor_role_traceable", + "instruction": "必須標示 actor role / team，不接受匿名 restart、kill、compose action 或 daemon 操作。" + }, + { + "check_id": "decision_reason_present", + "instruction": "decision 與 decision reason 必須同時存在。" + }, + { + "check_id": "affected_scope_matches_surface", + "instruction": "affected scope 必須能對回既有 host service surface。" + }, + { + "check_id": "boot_or_restart_window_present", + "instruction": "涉及重啟、cold-start 或服務恢復時，必須有 boot / restart / recovery 時間 ref。" + }, + { + "check_id": "before_after_service_state_present", + "instruction": "需有 before / after service state ref，不能只寫服務已恢復。" + }, + { + "check_id": "docker_daemon_state_present", + "instruction": "Docker daemon active、starting、failed、contention 或 socket state 必須有脫敏 metadata ref。" + }, + { + "check_id": "compose_stack_state_present", + "instruction": "Compose stack / container state 只能收狀態摘要 ref，不保存 raw docker ps dump。" + }, + { + "check_id": "systemd_unit_state_present", + "instruction": "systemd failed unit、restart policy 或 service degraded 需有摘要 ref。" + }, + { + "check_id": "failed_unit_review_present", + "instruction": "必須確認 failed unit 是否與事故、restart 或服務恢復相關。" + }, + { + "check_id": "port_binding_state_present", + "instruction": "必須確認 host port、container port、proxy、firewall / gateway 狀態是否一致。" + }, + { + "check_id": "dependency_impact_present", + "instruction": "必須列出上游、下游、資料庫、queue、registry、AI provider、public route 與 monitoring 影響。" + }, + { + "check_id": "cold_start_sequence_present", + "instruction": "必須提供 cold-start / recovery sequence ref，不接受憑印象重啟。" + }, + { + "check_id": "runner_repair_bot_contention_present", + "instruction": "必須確認 runner、repair-bot、backup job、iptables / xtables 或 compose action 是否競爭。" + }, + { + "check_id": "route_recovery_evidence_present", + "instruction": "public / admin route 受影響時需有恢復 ref；無影響也需說明不適用。" + }, + { + "check_id": "agent_provider_health_present", + "instruction": "AI provider、Ollama proxy、agent 或 webhook 受影響時需有健康 ref。" + }, + { + "check_id": "monitoring_alert_ref_present", + "instruction": "需列 monitoring / alert / incident ref，不能只靠人工觀察。" + }, + { + "check_id": "operator_notification_present", + "instruction": "需提供已通知受影響產品、owner 或 Session 的脫敏 ref。" + }, + { + "check_id": "cross_project_sync_present", + "instruction": "若影響 AwoooP、IwoooS、agent-bounty、StockPlatform、公開網站或監控，需有跨專案同步 ref。" + }, + { + "check_id": "restoration_time_present", + "instruction": "已恢復事故需提供恢復時間；未恢復需提供 still-degraded ref。" + }, + { + "check_id": "rollback_owner_present", + "instruction": "rollback owner 與 rollback plan 必須存在。" + }, + { + "check_id": "postcheck_evidence_present", + "instruction": "post-check evidence 必須覆蓋 service、route、agent、queue、monitoring 與 rollback stop condition。" + }, + { + "check_id": "secret_or_raw_payload_absent", + "instruction": "不得包含 secret、env dump、raw docker logs、raw systemd journal、private key 或 cookie。" + }, + { + "check_id": "no_false_green_service_health", + "instruction": "不得把服務 healthy、route 200、container up 或 dashboard up 當成 config / recovery 已驗收。" + }, + { + "check_id": "no_runtime_authorization", + "instruction": "驗收證據不等於允許 SSH、Docker、systemctl、repair-bot、Ansible、host write 或 route smoke。" + }, + { + "check_id": "counts_transition_safe", + "instruction": "只有 reviewer record 能更新 accepted count，且不得同時開 runtime gate。" + } + ], + "schema_version": "host_service_change_evidence_acceptance_v1", + "source_owner_response_acceptance_schema_version": "host_service_owner_response_acceptance_v1", + "source_owner_response_acceptance_status": "owner_response_acceptance_ledger_ready_no_runtime_action", + "status": "change_evidence_acceptance_ready_no_runtime_action", + "summary": { + "action_button_count": 0, + "active_scan_authorized_count": 0, + "actor_identified_count": 0, + "admin_route_recovery_accepted_count": 0, + "after_service_state_accepted_count": 0, + "agent_provider_health_accepted_count": 0, + "ansible_apply_authorized_count": 0, + "before_service_state_accepted_count": 0, + "blocked_action_count": 39, + "boot_or_restart_window_accepted_count": 0, + "change_evidence_accepted_count": 0, + "change_evidence_candidate_count": 9, + "change_evidence_field_count": 45, + "change_evidence_quarantined_count": 0, + "change_evidence_received_count": 0, + "change_evidence_rejected_count": 0, + "cold_start_sequence_accepted_count": 0, + "compose_stack_state_accepted_count": 0, + "coverage_percent_after_acceptance": 62, + "coverage_percent_before_acceptance": 58, + "cross_project_sync_accepted_count": 0, + "dependency_impact_accepted_count": 0, + "docker_compose_action_authorized_count": 0, + "docker_daemon_state_accepted_count": 0, + "docker_restart_authorized_count": 0, + "failed_unit_review_accepted_count": 0, + "host_write_authorized_count": 0, + "live_evidence_required_candidate_count": 8, + "live_host_read_authorized_count": 0, + "monitoring_alert_accepted_count": 0, + "operator_notification_accepted_count": 0, + "outcome_lane_count": 10, + "port_binding_state_accepted_count": 0, + "postcheck_evidence_accepted_count": 0, + "public_route_recovery_accepted_count": 0, + "recovery_supplement_requested_count": 0, + "repair_bot_execution_authorized_count": 0, + "required_evidence_field_count": 25, + "restoration_time_accepted_count": 0, + "reviewer_check_count": 26, + "rollback_owner_accepted_count": 0, + "route_smoke_authorized_count": 0, + "runner_or_repair_bot_contention_accepted_count": 0, + "runtime_gate_count": 0, + "secret_value_collection_allowed_count": 0, + "source_acceptance_candidate_count": 9, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "sudo_action_authorized_count": 0, + "systemctl_action_authorized_count": 0, + "systemd_unit_state_accepted_count": 0, + "write_capable_change_evidence_candidate_count": 3 + } +} diff --git a/docs/security/iwooos-posture-projection.snapshot.json b/docs/security/iwooos-posture-projection.snapshot.json index c1fc2c19c..c6e5b0ed5 100644 --- a/docs/security/iwooos-posture-projection.snapshot.json +++ b/docs/security/iwooos-posture-projection.snapshot.json @@ -8382,6 +8382,8 @@ "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md", "docs/security/host-service-owner-response-acceptance.snapshot.json", "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/host-service-change-evidence-acceptance.snapshot.json", + "docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md", "docs/schemas/host_service_config_inventory_v1.schema.json", "docs/security/ssh-network-access-inventory.snapshot.json", "docs/security/SSH-NETWORK-ACCESS-INVENTORY.md", @@ -8688,6 +8690,23 @@ "host_service_config_inventory_surface_count": 9, "host_service_config_inventory_systemd_restart_surface_count": 1, "host_service_config_inventory_write_capable_surface_count": 3, + "host_service_change_evidence_acceptance_candidate_count": 9, + "host_service_change_evidence_acceptance_change_evidence_field_count": 45, + "host_service_change_evidence_acceptance_required_evidence_field_count": 25, + "host_service_change_evidence_acceptance_reviewer_check_count": 26, + "host_service_change_evidence_acceptance_outcome_lane_count": 10, + "host_service_change_evidence_acceptance_blocked_action_count": 39, + "host_service_change_evidence_acceptance_received_count": 0, + "host_service_change_evidence_acceptance_accepted_count": 0, + "host_service_change_evidence_acceptance_docker_daemon_state_accepted_count": 0, + "host_service_change_evidence_acceptance_compose_stack_state_accepted_count": 0, + "host_service_change_evidence_acceptance_systemd_unit_state_accepted_count": 0, + "host_service_change_evidence_acceptance_failed_unit_review_accepted_count": 0, + "host_service_change_evidence_acceptance_port_binding_state_accepted_count": 0, + "host_service_change_evidence_acceptance_public_route_recovery_accepted_count": 0, + "host_service_change_evidence_acceptance_operator_notification_accepted_count": 0, + "host_service_change_evidence_acceptance_runtime_gate_count": 0, + "host_service_change_evidence_acceptance_coverage_percent_after_acceptance": 62, "host_tool_evidence_chain_default_visible": false, "host_tool_evidence_chain_first_layer": true, "host_tool_evidence_chain_host_count": 3, diff --git a/scripts/security/high-value-config-control-coverage.py b/scripts/security/high-value-config-control-coverage.py index 5c79bddfc..11ce54f80 100644 --- a/scripts/security/high-value-config-control-coverage.py +++ b/scripts/security/high-value-config-control-coverage.py @@ -157,8 +157,8 @@ CONTROL_STATUS_BY_CATEGORY = { "next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、receipt proof、stale alert review、silence / dedup review、route smoke plan、noise budget、rollback owner 與 no-secret-value evidence。", }, "docker_compose_systemd_host_config": { - "coverage_status": "incident_recovery_backfill_ready_needs_live_owner_evidence", - "coverage_percent": 58, + "coverage_status": "change_evidence_acceptance_ready_needs_host_service_owner_evidence", + "coverage_percent": 62, "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md", @@ -167,10 +167,12 @@ CONTROL_STATUS_BY_CATEGORY = { "docs/security/host-service-owner-request-draft.snapshot.json", "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/host-service-owner-response-acceptance.snapshot.json", + "docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md", + "docs/security/host-service-change-evidence-acceptance.snapshot.json", "docs/security/DEV-HOSTS-112-111-168-OBSERVE-ONLY-MAPPING.md", ], - "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並加入事故恢復、依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補欄位；仍缺 owner response、110 / 188 live hash、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", - "next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、maintenance / restart window、rollback owner、post-check plan、disable switch、source-of-truth、服務依賴圖、port binding、cold-start sequence、incident recovery evidence 與 daemon / runner contention review。", + "current_gap": "已固定 9 份 Docker / systemd / host service owner response acceptance candidate，並新增 host service change evidence acceptance；重啟 actor、before / after state、Docker daemon、compose / systemd state、failed unit、port binding、dependency、cold-start、route recovery、operator notice、cross-project sync 與 no-false-green 皆已納入只讀帳本；仍缺 owner response、live hash、change evidence、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", + "next_owner_action": "補 owner-provided live hash / disposition、change / incident ref、actor role / team、before / after state、Docker daemon state、compose / systemd state、failed unit review、port binding、服務依賴圖、cold-start sequence、route recovery、operator notification、cross-project sync、rollback owner、post-check plan、disable switch 與 no-secret-value evidence。", }, "ssh_firewall_network_access": { "coverage_status": "incident_change_evidence_acceptance_ready_needs_network_owner_evidence", @@ -389,6 +391,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: "inventory_needed", "repo_only_inventory_ready_needs_live_owner_evidence", "incident_recovery_backfill_ready_needs_live_owner_evidence", + "change_evidence_acceptance_ready_needs_host_service_owner_evidence", "policy_ready_needs_network_matrix", "policy_ready_needs_dry_run_pack", } diff --git a/scripts/security/host-service-change-evidence-acceptance.py b/scripts/security/host-service-change-evidence-acceptance.py new file mode 100644 index 000000000..225c33c32 --- /dev/null +++ b/scripts/security/host-service-change-evidence-acceptance.py @@ -0,0 +1,449 @@ +#!/usr/bin/env python3 +""" +IwoooS Docker / systemd / host service 變更證據驗收只讀帳本產生器。 + +本工具讀取 host service owner response acceptance snapshot，建立未來 +主機重啟、Docker daemon 競爭、compose stack 變動、systemd failed unit、 +repair-bot / runner 互斥、cold-start recovery 與服務恢復證據如何收件、 +補件、拒收或進 reviewer review 的 metadata-only ledger。它不 SSH、 +不讀 live host、不執行 docker / systemctl、不呼叫 repair-bot、不跑 +Ansible、不做 route smoke、不保存 raw log / raw config。 +""" + +from __future__ import annotations + +import argparse +import json +import subprocess +import sys +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + +CHANGE_EVIDENCE_FIELDS = [ + "change_evidence_candidate_id", + "source_acceptance_candidate_id", + "surface_id", + "label", + "expected_host_scope", + "config_kind", + "service_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "network_gateway_impact_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "backup_job_overlap_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "customer_impact_ref", + "incident_severity", + "restoration_time_ref", + "maintenance_window", + "rollback_owner", + "rollback_plan_ref", + "postcheck_evidence_refs", + "change_freeze_rule", + "reviewer_outcome", + "followup_owner", + "not_approval", +] + +REQUIRED_EVIDENCE_FIELDS = [ + "change_or_incident_ref", + "actor_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "boot_or_restart_window_ref", + "before_service_state_ref", + "after_service_state_ref", + "docker_daemon_state_ref", + "compose_stack_state_ref", + "systemd_unit_state_ref", + "failed_unit_review_ref", + "port_binding_state_ref", + "dependency_impact_ref", + "cold_start_sequence_ref", + "runner_or_repair_bot_contention_ref", + "public_route_recovery_refs", + "admin_route_recovery_refs", + "agent_provider_health_refs", + "monitoring_alert_refs", + "operator_notification_refs", + "cross_project_sync_ref", + "restoration_time_ref", + "rollback_owner", + "postcheck_evidence_refs", +] + +REVIEWER_CHECKS = [ + {"check_id": "change_ref_present", "instruction": "必須有可追溯的 change / incident ref。"}, + {"check_id": "actor_role_traceable", "instruction": "必須標示 actor role / team，不接受匿名 restart、kill、compose action 或 daemon 操作。"}, + {"check_id": "decision_reason_present", "instruction": "decision 與 decision reason 必須同時存在。"}, + {"check_id": "affected_scope_matches_surface", "instruction": "affected scope 必須能對回既有 host service surface。"}, + {"check_id": "boot_or_restart_window_present", "instruction": "涉及重啟、cold-start 或服務恢復時，必須有 boot / restart / recovery 時間 ref。"}, + {"check_id": "before_after_service_state_present", "instruction": "需有 before / after service state ref，不能只寫服務已恢復。"}, + {"check_id": "docker_daemon_state_present", "instruction": "Docker daemon active、starting、failed、contention 或 socket state 必須有脫敏 metadata ref。"}, + {"check_id": "compose_stack_state_present", "instruction": "Compose stack / container state 只能收狀態摘要 ref，不保存 raw docker ps dump。"}, + {"check_id": "systemd_unit_state_present", "instruction": "systemd failed unit、restart policy 或 service degraded 需有摘要 ref。"}, + {"check_id": "failed_unit_review_present", "instruction": "必須確認 failed unit 是否與事故、restart 或服務恢復相關。"}, + {"check_id": "port_binding_state_present", "instruction": "必須確認 host port、container port、proxy、firewall / gateway 狀態是否一致。"}, + {"check_id": "dependency_impact_present", "instruction": "必須列出上游、下游、資料庫、queue、registry、AI provider、public route 與 monitoring 影響。"}, + {"check_id": "cold_start_sequence_present", "instruction": "必須提供 cold-start / recovery sequence ref，不接受憑印象重啟。"}, + {"check_id": "runner_repair_bot_contention_present", "instruction": "必須確認 runner、repair-bot、backup job、iptables / xtables 或 compose action 是否競爭。"}, + {"check_id": "route_recovery_evidence_present", "instruction": "public / admin route 受影響時需有恢復 ref；無影響也需說明不適用。"}, + {"check_id": "agent_provider_health_present", "instruction": "AI provider、Ollama proxy、agent 或 webhook 受影響時需有健康 ref。"}, + {"check_id": "monitoring_alert_ref_present", "instruction": "需列 monitoring / alert / incident ref，不能只靠人工觀察。"}, + {"check_id": "operator_notification_present", "instruction": "需提供已通知受影響產品、owner 或 Session 的脫敏 ref。"}, + {"check_id": "cross_project_sync_present", "instruction": "若影響 AwoooP、IwoooS、agent-bounty、StockPlatform、公開網站或監控，需有跨專案同步 ref。"}, + {"check_id": "restoration_time_present", "instruction": "已恢復事故需提供恢復時間；未恢復需提供 still-degraded ref。"}, + {"check_id": "rollback_owner_present", "instruction": "rollback owner 與 rollback plan 必須存在。"}, + {"check_id": "postcheck_evidence_present", "instruction": "post-check evidence 必須覆蓋 service、route、agent、queue、monitoring 與 rollback stop condition。"}, + {"check_id": "secret_or_raw_payload_absent", "instruction": "不得包含 secret、env dump、raw docker logs、raw systemd journal、private key 或 cookie。"}, + {"check_id": "no_false_green_service_health", "instruction": "不得把服務 healthy、route 200、container up 或 dashboard up 當成 config / recovery 已驗收。"}, + {"check_id": "no_runtime_authorization", "instruction": "驗收證據不等於允許 SSH、Docker、systemctl、repair-bot、Ansible、host write 或 route smoke。"}, + {"check_id": "counts_transition_safe", "instruction": "只有 reviewer record 能更新 accepted count，且不得同時開 runtime gate。"}, +] + +OUTCOME_LANES = [ + {"lane_id": "waiting_change_evidence", "meaning": "尚未收到 host service 變更 / 事故證據；所有 accepted / runtime count 維持 0。"}, + {"lane_id": "quarantine_secret_or_raw_payload", "meaning": "收到 secret、env dump、raw docker logs、raw journal、raw compose 或未脫敏 host config 時只能隔離。"}, + {"lane_id": "reject_unattributed_restart", "meaning": "無 actor、無 owner、無 affected scope、無 rollback 或無 post-check 的 restart / reload / kill 不得驗收。"}, + {"lane_id": "request_recovery_supplement", "meaning": "缺 before / after、daemon state、compose state、systemd state、dependency、route recovery 或 cross-project sync 時要求補件。"}, + {"lane_id": "incident_backfill_required", "meaning": "涉及服務異常、靜默重啟、端口事故、cold-start recovery 或 daemon contention 時必須回補。"}, + {"lane_id": "no_false_green_supplement_required", "meaning": "只用 route 200、container up、dashboard up 或服務 healthy 代表恢復時，要求補 no-false-green 證據。"}, + {"lane_id": "ready_for_host_service_review", "meaning": "metadata 合格後，只能進 host service reviewer review。"}, + {"lane_id": "owner_review_only_update", "meaning": "只允許更新 reviewer ledger，不改 compose、systemd、repair-bot、Ansible 或 host。"}, + {"lane_id": "waiting_maintenance_window", "meaning": "若未來要 restart / repair / apply，仍需獨立維護窗口。"}, + {"lane_id": "waiting_runtime_gate", "meaning": "即使 change evidence accepted，runtime gate 仍需獨立人工批准。"}, +] + +BLOCKED_ACTIONS = [ + "ssh_read", + "ssh_write", + "live_host_read", + "docker_ps_live_read", + "docker_compose_up", + "docker_compose_down", + "docker_compose_pull", + "docker_restart", + "docker_kill", + "systemctl_restart", + "systemctl_reload", + "systemctl_kill", + "repair_bot_execute", + "ansible_apply", + "sudo_action", + "host_file_write", + "firewall_change", + "port_change", + "route_smoke", + "public_gateway_reload", + "nginx_reload", + "active_scan", + "secret_value_collection", + "raw_live_config_storage", + "raw_docker_log_storage", + "raw_journal_storage", + "raw_env_dump_storage", + "accept_restart_without_actor", + "accept_restart_without_window", + "accept_restart_without_rollback", + "accept_recovery_without_postcheck", + "accept_service_healthy_as_config_accepted", + "skip_dependency_map_review", + "skip_port_binding_review", + "skip_cold_start_sequence", + "hide_daemon_runner_contention", + "mark_change_evidence_accepted_without_reviewer_record", + "open_runtime_gate", + "add_action_button", +] + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def load_json(path: Path) -> dict[str, Any]: + return json.loads(path.read_text(encoding="utf-8")) + + +def build_candidate(source: dict[str, Any]) -> dict[str, Any]: + surface_id = source["surface_id"] + return { + "change_evidence_candidate_id": f"host_service_change_evidence:{surface_id}", + "status": "waiting_change_evidence", + "source_acceptance_candidate_id": source["acceptance_candidate_id"], + "surface_id": surface_id, + "label": source["label"], + "expected_host_scope": source["expected_host_scope"], + "config_kind": source["config_kind"], + "service_scope": source["service_scope"], + "control_tier": source["control_tier"], + "write_capable_surface": source["write_capable_surface"], + "requires_live_evidence": source["requires_live_evidence"], + "change_or_incident_ref": None, + "actor_role_or_team": "pending_change_evidence", + "decision": "pending_change_evidence", + "decision_reason": "pending_change_evidence", + "affected_scope": "pending_change_evidence", + "boot_or_restart_window_ref": None, + "before_service_state_ref": None, + "after_service_state_ref": None, + "docker_daemon_state_ref": None, + "compose_stack_state_ref": None, + "systemd_unit_state_ref": None, + "failed_unit_review_ref": None, + "port_binding_state_ref": None, + "network_gateway_impact_ref": None, + "dependency_impact_ref": None, + "cold_start_sequence_ref": None, + "runner_or_repair_bot_contention_ref": None, + "backup_job_overlap_ref": None, + "public_route_recovery_refs": [], + "admin_route_recovery_refs": [], + "agent_provider_health_refs": [], + "monitoring_alert_refs": [], + "operator_notification_refs": [], + "cross_project_sync_ref": None, + "customer_impact_ref": None, + "incident_severity": "pending_change_evidence", + "restoration_time_ref": None, + "maintenance_window": "pending_change_evidence", + "rollback_owner": "pending_change_evidence", + "rollback_plan_ref": None, + "postcheck_evidence_refs": [], + "change_freeze_rule": "pending_change_evidence", + "reviewer_outcome": "waiting_change_evidence", + "followup_owner": "pending_change_evidence", + "change_evidence_fields": CHANGE_EVIDENCE_FIELDS, + "required_evidence_fields": REQUIRED_EVIDENCE_FIELDS, + "reviewer_checks": [item["check_id"] for item in REVIEWER_CHECKS], + "outcome_lanes": [item["lane_id"] for item in OUTCOME_LANES], + "blocked_actions": BLOCKED_ACTIONS, + "not_approval": True, + "change_evidence_received": False, + "change_evidence_accepted": False, + "change_evidence_rejected": False, + "change_evidence_quarantined": False, + "recovery_supplement_requested": False, + "actor_identified": False, + "boot_or_restart_window_accepted": False, + "before_service_state_accepted": False, + "after_service_state_accepted": False, + "docker_daemon_state_accepted": False, + "compose_stack_state_accepted": False, + "systemd_unit_state_accepted": False, + "failed_unit_review_accepted": False, + "port_binding_state_accepted": False, + "dependency_impact_accepted": False, + "cold_start_sequence_accepted": False, + "runner_or_repair_bot_contention_accepted": False, + "public_route_recovery_accepted": False, + "admin_route_recovery_accepted": False, + "agent_provider_health_accepted": False, + "monitoring_alert_accepted": False, + "operator_notification_accepted": False, + "cross_project_sync_accepted": False, + "restoration_time_accepted": False, + "rollback_owner_accepted": False, + "postcheck_evidence_accepted": False, + "host_write_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "live_host_read_authorized": False, + "docker_compose_action_authorized": False, + "docker_restart_authorized": False, + "systemctl_action_authorized": False, + "repair_bot_execution_authorized": False, + "ansible_apply_authorized": False, + "sudo_action_authorized": False, + "route_smoke_authorized": False, + "secret_value_collection_allowed": False, + "active_scan_authorized": False, + "runtime_gate": False, + "action_buttons_allowed": False, + } + + +def build_report( + root: Path, + owner_response_acceptance: dict[str, Any], + generated_at: str | None, +) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + sources = owner_response_acceptance.get("acceptance_candidates", []) + candidates = [build_candidate(item) for item in sources] + write_capable = [item for item in candidates if item["write_capable_surface"]] + live_evidence = [item for item in candidates if item["requires_live_evidence"]] + + return { + "schema_version": "host_service_change_evidence_acceptance_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "source_owner_response_acceptance_schema_version": owner_response_acceptance.get("schema_version"), + "source_owner_response_acceptance_status": owner_response_acceptance.get("status"), + "status": "change_evidence_acceptance_ready_no_runtime_action", + "summary": { + "source_acceptance_candidate_count": len(sources), + "change_evidence_candidate_count": len(candidates), + "write_capable_change_evidence_candidate_count": len(write_capable), + "live_evidence_required_candidate_count": len(live_evidence), + "change_evidence_field_count": len(CHANGE_EVIDENCE_FIELDS), + "required_evidence_field_count": len(REQUIRED_EVIDENCE_FIELDS), + "reviewer_check_count": len(REVIEWER_CHECKS), + "outcome_lane_count": len(OUTCOME_LANES), + "blocked_action_count": len(BLOCKED_ACTIONS), + "change_evidence_received_count": 0, + "change_evidence_accepted_count": 0, + "change_evidence_rejected_count": 0, + "change_evidence_quarantined_count": 0, + "recovery_supplement_requested_count": 0, + "actor_identified_count": 0, + "boot_or_restart_window_accepted_count": 0, + "before_service_state_accepted_count": 0, + "after_service_state_accepted_count": 0, + "docker_daemon_state_accepted_count": 0, + "compose_stack_state_accepted_count": 0, + "systemd_unit_state_accepted_count": 0, + "failed_unit_review_accepted_count": 0, + "port_binding_state_accepted_count": 0, + "dependency_impact_accepted_count": 0, + "cold_start_sequence_accepted_count": 0, + "runner_or_repair_bot_contention_accepted_count": 0, + "public_route_recovery_accepted_count": 0, + "admin_route_recovery_accepted_count": 0, + "agent_provider_health_accepted_count": 0, + "monitoring_alert_accepted_count": 0, + "operator_notification_accepted_count": 0, + "cross_project_sync_accepted_count": 0, + "restoration_time_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "postcheck_evidence_accepted_count": 0, + "host_write_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "live_host_read_authorized_count": 0, + "docker_compose_action_authorized_count": 0, + "docker_restart_authorized_count": 0, + "systemctl_action_authorized_count": 0, + "repair_bot_execution_authorized_count": 0, + "ansible_apply_authorized_count": 0, + "sudo_action_authorized_count": 0, + "route_smoke_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "active_scan_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_before_acceptance": 58, + "coverage_percent_after_acceptance": 62, + }, + "execution_boundaries": { + "request_dispatch_authorized": False, + "change_evidence_received": False, + "change_evidence_accepted": False, + "live_host_read_authorized": False, + "host_write_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "docker_compose_action_authorized": False, + "docker_restart_authorized": False, + "systemctl_action_authorized": False, + "repair_bot_execution_authorized": False, + "ansible_apply_authorized": False, + "sudo_action_authorized": False, + "route_smoke_authorized": False, + "secret_value_collection_allowed": False, + "active_scan_authorized": False, + "runtime_execution_authorized": False, + "action_buttons_allowed": False, + "not_authorization": True, + }, + "change_evidence_fields": CHANGE_EVIDENCE_FIELDS, + "required_evidence_fields": REQUIRED_EVIDENCE_FIELDS, + "reviewer_checks": REVIEWER_CHECKS, + "outcome_lanes": OUTCOME_LANES, + "blocked_actions": BLOCKED_ACTIONS, + "change_evidence_candidates": candidates, + "next_steps": [ + "等待 owner 以脫敏 metadata ref 補 change / incident ref、actor、before / after state、Docker daemon、compose / systemd、failed unit、port binding、dependency、cold-start、route recovery、operator notification、rollback 與 post-check evidence。", + "收到證據後先做欄位完整性、敏感 payload 隔離與 execution request 拒收；不得直接 SSH、docker、systemctl、repair-bot、Ansible 或 route smoke。", + "即使 reviewer 接受 change evidence，也只能形成 runtime approval package；維護窗口、rollback、post-check、stop condition 與人工 runtime gate 需另行批准。", + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser(description="IwoooS host service change evidence acceptance 產生器") + parser.add_argument("--root", default=".", help="repo root") + parser.add_argument( + "--owner-response-report", + default="docs/security/host-service-owner-response-acceptance.snapshot.json", + help="host-service-owner-response-acceptance.py 輸出的 JSON", + ) + parser.add_argument("--output", help="寫出 JSON 報告") + parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") + args = parser.parse_args() + + root = Path(args.root).resolve() + owner_response_acceptance = load_json(root / args.owner_response_report) + report = build_report(root, owner_response_acceptance, args.generated_at) + payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + + if args.output: + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(payload + "\n", encoding="utf-8") + else: + print(payload) + + summary = report["summary"] + print( + "HOST_SERVICE_CHANGE_EVIDENCE_ACCEPTANCE_OK " + f"candidates={summary['change_evidence_candidate_count']} " + f"write_capable={summary['write_capable_change_evidence_candidate_count']} " + f"checks={summary['reviewer_check_count']} " + f"lanes={summary['outcome_lane_count']} " + f"accepted={summary['change_evidence_accepted_count']} " + f"runtime_gate={summary['runtime_gate_count']}", + file=sys.stderr, + ) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/security/iwooos-config-control-guard.py b/scripts/security/iwooos-config-control-guard.py index 7f2c1e95e..3c93ad91f 100644 --- a/scripts/security/iwooos-config-control-guard.py +++ b/scripts/security/iwooos-config-control-guard.py @@ -26,7 +26,7 @@ EXPECTED_CATEGORIES = { "backup_restore_credential": 64, "agent_bounty_protocol_runtime": 68, "monitoring_alerting_observability": 68, - "docker_compose_systemd_host_config": 58, + "docker_compose_systemd_host_config": 62, "ssh_firewall_network_access": 62, "ai_provider_model_routing": 60, "product_surface_runtime_routes": 72, @@ -52,6 +52,7 @@ REQUIRED_CONTROL_DOCS = [ "docs/security/PUBLIC-GATEWAY-RENDERED-DIFF-ACCEPTANCE.md", "docs/security/DOMAIN-TLS-CERTBOT-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md", "docs/security/SSH-NETWORK-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", @@ -187,6 +188,39 @@ ARTIFACT_SPECS = [ "runtime_gate_count": 0, }, }, + { + "label": "host service change evidence acceptance", + "path": "docs/security/host-service-change-evidence-acceptance.snapshot.json", + "schema": "host_service_change_evidence_acceptance_v1", + "status": "change_evidence_acceptance_ready_no_runtime_action", + "list_counts": { + "change_evidence_candidates": 9, + "blocked_actions": 39, + "reviewer_checks": 26, + "outcome_lanes": 10, + "required_evidence_fields": 25, + }, + "summary_counts": { + "change_evidence_candidate_count": 9, + "write_capable_change_evidence_candidate_count": 3, + "live_evidence_required_candidate_count": 8, + "change_evidence_field_count": 45, + "required_evidence_field_count": 25, + "reviewer_check_count": 26, + "outcome_lane_count": 10, + "blocked_action_count": 39, + "change_evidence_received_count": 0, + "change_evidence_accepted_count": 0, + "docker_daemon_state_accepted_count": 0, + "compose_stack_state_accepted_count": 0, + "systemd_unit_state_accepted_count": 0, + "failed_unit_review_accepted_count": 0, + "port_binding_state_accepted_count": 0, + "public_route_recovery_accepted_count": 0, + "operator_notification_accepted_count": 0, + "runtime_gate_count": 0, + }, + }, { "label": "ssh network owner response acceptance", "path": "docs/security/ssh-network-owner-response-acceptance.snapshot.json", diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index cf45752ff..b15d8edab 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -150,6 +150,9 @@ def validate(root: Path) -> None: host_service_owner_response_acceptance = load_json( security_dir / "host-service-owner-response-acceptance.snapshot.json" ) + host_service_change_evidence_acceptance = load_json( + security_dir / "host-service-change-evidence-acceptance.snapshot.json" + ) ssh_network_access_inventory = load_json(security_dir / "ssh-network-access-inventory.snapshot.json") ssh_network_owner_request_draft = load_json( security_dir / "ssh-network-owner-request-draft.snapshot.json" @@ -3169,12 +3172,12 @@ def validate(root: Path) -> None: assert_equal( "high_value_config_coverage.coverage_categories.docker.coverage_percent", docker_systemd_category["coverage_percent"], - 58, + 62, ) assert_equal( "high_value_config_coverage.coverage_categories.docker.coverage_status", docker_systemd_category["coverage_status"], - "incident_recovery_backfill_ready_needs_live_owner_evidence", + "change_evidence_acceptance_ready_needs_host_service_owner_evidence", ) for evidence_ref in [ "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md", @@ -3183,6 +3186,8 @@ def validate(root: Path) -> None: "docs/security/host-service-owner-request-draft.snapshot.json", "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/host-service-owner-response-acceptance.snapshot.json", + "docs/security/HOST-SERVICE-CHANGE-EVIDENCE-ACCEPTANCE.md", + "docs/security/host-service-change-evidence-acceptance.snapshot.json", ]: assert_contains( "high_value_config_coverage.coverage_categories.docker.evidence_refs", @@ -3725,6 +3730,170 @@ def validate(root: Path) -> None: f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.{false_key}", item[false_key], ) + assert_equal( + "host_service_change_evidence_acceptance.schema", + host_service_change_evidence_acceptance["schema_version"], + "host_service_change_evidence_acceptance_v1", + ) + assert_equal( + "host_service_change_evidence_acceptance.status", + host_service_change_evidence_acceptance["status"], + "change_evidence_acceptance_ready_no_runtime_action", + ) + assert_equal( + "host_service_change_evidence_acceptance.source_owner_response_acceptance_schema_version", + host_service_change_evidence_acceptance["source_owner_response_acceptance_schema_version"], + "host_service_owner_response_acceptance_v1", + ) + expected_host_service_change_evidence_summary = { + "source_acceptance_candidate_count": 9, + "change_evidence_candidate_count": 9, + "write_capable_change_evidence_candidate_count": 3, + "live_evidence_required_candidate_count": 8, + "change_evidence_field_count": 45, + "required_evidence_field_count": 25, + "reviewer_check_count": 26, + "outcome_lane_count": 10, + "blocked_action_count": 39, + "change_evidence_received_count": 0, + "change_evidence_accepted_count": 0, + "actor_identified_count": 0, + "docker_daemon_state_accepted_count": 0, + "compose_stack_state_accepted_count": 0, + "systemd_unit_state_accepted_count": 0, + "failed_unit_review_accepted_count": 0, + "port_binding_state_accepted_count": 0, + "dependency_impact_accepted_count": 0, + "cold_start_sequence_accepted_count": 0, + "runner_or_repair_bot_contention_accepted_count": 0, + "public_route_recovery_accepted_count": 0, + "admin_route_recovery_accepted_count": 0, + "agent_provider_health_accepted_count": 0, + "monitoring_alert_accepted_count": 0, + "operator_notification_accepted_count": 0, + "cross_project_sync_accepted_count": 0, + "restoration_time_accepted_count": 0, + "rollback_owner_accepted_count": 0, + "postcheck_evidence_accepted_count": 0, + "host_write_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "live_host_read_authorized_count": 0, + "docker_compose_action_authorized_count": 0, + "docker_restart_authorized_count": 0, + "systemctl_action_authorized_count": 0, + "repair_bot_execution_authorized_count": 0, + "ansible_apply_authorized_count": 0, + "sudo_action_authorized_count": 0, + "route_smoke_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "active_scan_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_before_acceptance": 58, + "coverage_percent_after_acceptance": 62, + } + for key, expected in expected_host_service_change_evidence_summary.items(): + assert_equal( + f"host_service_change_evidence_acceptance.summary.{key}", + host_service_change_evidence_acceptance["summary"][key], + expected, + ) + for key, value in host_service_change_evidence_acceptance["execution_boundaries"].items(): + if key == "not_authorization": + assert_true(f"host_service_change_evidence_acceptance.execution_boundaries.{key}", value) + else: + assert_false(f"host_service_change_evidence_acceptance.execution_boundaries.{key}", value) + assert_equal( + "host_service_change_evidence_acceptance.change_evidence_candidates.count", + len(host_service_change_evidence_acceptance["change_evidence_candidates"]), + 9, + ) + expected_host_service_change_ids = [ + "host_service_change_evidence:local_dev_compose", + "host_service_change_evidence:monitoring_110_compose", + "host_service_change_evidence:monitoring_exporters_188_compose", + "host_service_change_evidence:sentry_110_reference_compose", + "host_service_change_evidence:langfuse_110_compose", + "host_service_change_evidence:ansible_docker_compose_service_role", + "host_service_change_evidence:repair_bot_110_whitelist", + "host_service_change_evidence:repair_bot_188_whitelist", + "host_service_change_evidence:config_backup_host_capture", + ] + assert_equal( + "host_service_change_evidence_acceptance.change_evidence_candidates", + [item["change_evidence_candidate_id"] for item in host_service_change_evidence_acceptance["change_evidence_candidates"]], + expected_host_service_change_ids, + ) + for item in host_service_change_evidence_acceptance["change_evidence_candidates"]: + assert_equal( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.required_evidence_fields", + len(item["required_evidence_fields"]), + 25, + ) + assert_equal( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.reviewer_checks", + len(item["reviewer_checks"]), + 26, + ) + assert_equal( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.outcome_lanes", + len(item["outcome_lanes"]), + 10, + ) + assert_equal( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.blocked_actions", + len(item["blocked_actions"]), + 39, + ) + assert_true( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.not_approval", + item["not_approval"], + ) + for false_key in [ + "change_evidence_received", + "change_evidence_accepted", + "change_evidence_rejected", + "change_evidence_quarantined", + "recovery_supplement_requested", + "actor_identified", + "docker_daemon_state_accepted", + "compose_stack_state_accepted", + "systemd_unit_state_accepted", + "failed_unit_review_accepted", + "port_binding_state_accepted", + "dependency_impact_accepted", + "cold_start_sequence_accepted", + "runner_or_repair_bot_contention_accepted", + "public_route_recovery_accepted", + "admin_route_recovery_accepted", + "agent_provider_health_accepted", + "monitoring_alert_accepted", + "operator_notification_accepted", + "cross_project_sync_accepted", + "restoration_time_accepted", + "rollback_owner_accepted", + "postcheck_evidence_accepted", + "host_write_authorized", + "ssh_read_authorized", + "ssh_write_authorized", + "live_host_read_authorized", + "docker_compose_action_authorized", + "docker_restart_authorized", + "systemctl_action_authorized", + "repair_bot_execution_authorized", + "ansible_apply_authorized", + "sudo_action_authorized", + "route_smoke_authorized", + "secret_value_collection_allowed", + "active_scan_authorized", + "runtime_gate", + "action_buttons_allowed", + ]: + assert_false( + f"host_service_change_evidence_acceptance.{item['change_evidence_candidate_id']}.{false_key}", + item[false_key], + ) assert_equal( "ssh_network_access_inventory.schema", ssh_network_access_inventory["schema_version"], @@ -6454,6 +6623,23 @@ def validate(root: Path) -> None: "host_service_config_inventory_action_button_count": 0, "host_service_config_inventory_coverage_percent_before_inventory": 42, "host_service_config_inventory_coverage_percent_after_inventory": 50, + "host_service_change_evidence_acceptance_candidate_count": 9, + "host_service_change_evidence_acceptance_change_evidence_field_count": 45, + "host_service_change_evidence_acceptance_required_evidence_field_count": 25, + "host_service_change_evidence_acceptance_reviewer_check_count": 26, + "host_service_change_evidence_acceptance_outcome_lane_count": 10, + "host_service_change_evidence_acceptance_blocked_action_count": 39, + "host_service_change_evidence_acceptance_received_count": 0, + "host_service_change_evidence_acceptance_accepted_count": 0, + "host_service_change_evidence_acceptance_docker_daemon_state_accepted_count": 0, + "host_service_change_evidence_acceptance_compose_stack_state_accepted_count": 0, + "host_service_change_evidence_acceptance_systemd_unit_state_accepted_count": 0, + "host_service_change_evidence_acceptance_failed_unit_review_accepted_count": 0, + "host_service_change_evidence_acceptance_port_binding_state_accepted_count": 0, + "host_service_change_evidence_acceptance_public_route_recovery_accepted_count": 0, + "host_service_change_evidence_acceptance_operator_notification_accepted_count": 0, + "host_service_change_evidence_acceptance_runtime_gate_count": 0, + "host_service_change_evidence_acceptance_coverage_percent_after_acceptance": 62, } for key, expected in expected_host_service_projection_summary.items(): assert_equal( @@ -16319,22 +16505,22 @@ def validate(root: Path) -> None: assert_text_contains( "iwooos_page.high_value_config_control_coverage_docker_systemd_percent", iwooos_projection_page, - "{ key: 'dockerSystemd', rank: 'P1-1', value: '58%'", + "{ key: 'dockerSystemd', rank: 'P1-1', value: '62%'", + ) + assert_text_contains( + "iwooos_page.high_value_config_control_coverage_ai_provider_percent", + iwooos_projection_page, + "{ key: 'aiProvider', rank: 'P1-2', value: '60%'", ) assert_text_contains( "iwooos_page.high_value_config_control_coverage_ssh_network_percent", iwooos_projection_page, - "{ key: 'sshNetwork', rank: 'P1-2', value: '62%'", + "{ key: 'sshNetwork', rank: 'P1-3', value: '62%'", ) assert_text_contains( - "iwooos_page.high_value_config_control_coverage_backup_restore_percent", + "iwooos_page.high_value_config_control_coverage_k8s_gitops_percent", iwooos_projection_page, - "{ key: 'backupRestore', rank: 'P1-3', value: '64%'", - ) - assert_text_contains( - "iwooos_page.high_value_config_control_coverage_monitoring_percent", - iwooos_projection_page, - "{ key: 'monitoring', rank: 'P1-4', value: '68%'", + "{ key: 'k8sGitops', rank: 'P1-4', value: '64%'", ) assert_text_before( "iwooos_page.high_value_config_control_coverage_before_owner_packet", @@ -16442,6 +16628,21 @@ def validate(root: Path) -> None: "host_service_owner_response_acceptance_outcome_lane_count=8", "host_service_owner_response_acceptance_blocked_action_count=27", "host_service_owner_response_acceptance_runtime_gate_count=0", + "host_service_change_evidence_acceptance_candidate_count=9", + "host_service_change_evidence_acceptance_required_evidence_field_count=25", + "host_service_change_evidence_acceptance_reviewer_check_count=26", + "host_service_change_evidence_acceptance_outcome_lane_count=10", + "host_service_change_evidence_acceptance_blocked_action_count=39", + "host_service_change_evidence_acceptance_received_count=0", + "host_service_change_evidence_acceptance_accepted_count=0", + "host_service_change_evidence_acceptance_docker_daemon_state_accepted_count=0", + "host_service_change_evidence_acceptance_compose_stack_state_accepted_count=0", + "host_service_change_evidence_acceptance_systemd_unit_state_accepted_count=0", + "host_service_change_evidence_acceptance_failed_unit_review_accepted_count=0", + "host_service_change_evidence_acceptance_port_binding_state_accepted_count=0", + "host_service_change_evidence_acceptance_public_route_recovery_accepted_count=0", + "host_service_change_evidence_acceptance_operator_notification_accepted_count=0", + "host_service_change_evidence_acceptance_runtime_gate_count=0", "ssh_network_access_inventory_surface_count=16", "ssh_network_access_inventory_write_capable_surface_count=6", "ssh_network_access_inventory_runtime_gate_count=0",