wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(github): validate redacted evidence refs

Browse Source
This commit is contained in:
Your Name
2026-06-27 22:59:31 +08:00
parent 0040a595a4
commit 82e9d780bb
5 changed files with 665 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
docs/LOGBOOK.md
View File

@@ -47939,3 +47939,40 @@ production browser smoke:
- `P0-01` GitHub private backup evidence acceptance：逐 target 收 owner-provided redacted evidence refs，讓 `safe_credential_accepted_evidence_count` 從 `0/9` 往上推；仍不得收 private clone URL、secret value、repo archive 或 git object pack。
- `P0-02` missing target canonical source owner decision：釐清 `ewoooc`、`bitan-pharmacy`、`tsenyang-website`、`VibeWork`、`agent-bounty-protocol` 的 canonical source before repo creation。
- `P0-03` refs sync readiness：canonical source 與 owner decision 未成立前，`refs_sync_ready_count` 必須維持 `0`。
## 2026-06-27 — 22:56 GitHub safe credential evidence refs reviewer validation 本地完成
**時間與來源**：
- 2026-06-27 22:56 Asia/Taipei。
- 來源：feature branch `codex/github-redacted-evidence-validator-20260627`、`gitea/main=0040a595a`。
**完成內容**：
- `apps/api/src/services/github_target_private_backup_evidence_gate.py` 新增 `validate_github_target_safe_credential_evidence_refs()`，針對 owner-provided redacted safe credential evidence refs 做 no-persist reviewer validation。
- `GET /api/v1/agents/github-target-private-backup-evidence-gate` 新增 reviewer validation readback 欄位：`safe_credential_reviewer_validation_ready=true`、required fields `7`、committed gate `safe_credential_reviewer_validation_passed_count=0`、`safe_credential_reviewer_validation_quarantined_count=0`。
- 新增 `POST /api/v1/agents/github-target-safe-credential-evidence-reviewer-validation/validate-redacted-refs`，只回傳 accepted / supplement / quarantine / runtime request rejected 分流；不 persist payload、不呼叫 GitHub live API、不建立 repo、不改 visibility、不同步 refs、不觸發 workflow、不收 private clone URL 或 secret value、不更新 accepted 總帳。
- unsafe evidence ref hit 不再 echo 原始不安全 ref，避免 private clone URL / token 被錯誤回顯。
**本地驗證結果**：
- `python3.11 -m ruff format ...`：通過，`4 files reformatted`。
- `python3.11 -m ruff check apps/api/src/services/github_target_private_backup_evidence_gate.py apps/api/src/api/v1/agents.py apps/api/tests/test_github_target_private_backup_evidence_gate.py apps/api/tests/test_github_target_private_backup_evidence_gate_api.py`：通過。
- `python3 -m py_compile apps/api/src/services/github_target_private_backup_evidence_gate.py apps/api/src/api/v1/agents.py`：通過。
- `DATABASE_URL=sqlite:///test.db PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_github_target_private_backup_evidence_gate.py apps/api/tests/test_github_target_private_backup_evidence_gate_api.py apps/api/tests/test_delivery_closure_workbench_api.py -q`：`16 passed`。
- `git diff --check`：通過。
- 本地 readback snippet：gate reviewer validation ready `True`、required fields `7`、gate reviewer validation passed `0`、`safe_credential_accepted_evidence_count=0`、create/private ready `0`、refs sync ready `0`；單次 validator request status `accepted_for_readonly_safe_credential_evidence_review_only`、request passed `1`、request `safe_credential_accepted_evidence_count=0`、`payload_persisted=False`、`runtime_execution_authorized=False`。
**完成度與同步狀態**：
- 本段「GitHub safe credential evidence refs reviewer validation source/API」本地：`0% -> 85%`。
- 尚未 push feature、尚未 merge/push main、尚未 CD、尚未 production API readback；production 仍以前一版為準直到 Gitea CD 成功與 readback 完成。
**仍維持 0 / false**：
- committed gate：`safe_credential_accepted_evidence_count=0`、`safe_credential_reviewer_validation_passed_count=0`、`safe_credential_reviewer_validation_quarantined_count=0`。
- `owner_response_received_count=0`、`owner_response_accepted_count=0`、`github_missing_target_create_private_repo_ready_count=0`、`github_missing_target_refs_sync_ready_count=0`、`execution_ready_count=0`、`blocked_target_count=9`、`private_backup_verified_count=4`。
- `repo_creation_authorized=false`、`visibility_change_authorized=false`、`refs_sync_authorized=false`、`workflow_trigger_authorized=false`、`secret_value_collection_allowed=false`、`private_clone_url_collection_allowed=false`、`stored_raw_payload_allowed=false`。
**做過的命令類型**：
- 寫入：repo service / API route / test / LOGBOOK。
- 只讀：git fetch、治理入口與 HARD_RULES / LOGBOOK 精準段落、本地 readback snippet、本地 focused tests。
- 未做：沒有 GitHub repo creation、visibility change、refs sync、workflow trigger、private clone URL collection、secret value collection；沒有 host / Docker / systemd / Nginx / firewall / K8s / DB / Wazuh runtime 寫操作；沒有 force push。
**下一個 P0**：
- commit feature，正常 push 到 Gitea；確認 main CD idle/success 後 normal push `HEAD:main`，再做 production readback，目標為 `safe_credential_reviewer_validation_ready=true`、required fields `7`、committed gate reviewer validation passed `0`、`safe_credential_accepted_evidence_count=0`，同時 create/private ready `0`、refs sync ready `0`、execution ready `0` 維持不變。