wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): 新增 monitoring alerting 只讀清冊
All checks were successful
CD Pipeline / tests (push) Successful in 1m26s
Details
Code Review / ai-code-review (push) Successful in 23s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m52s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m59s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-12 00:45:08 +08:00
parent 7a7daa333e
commit 8a424f0c56
15 changed files with 4086 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md
View File

@@ -24,7 +24,7 @@
| C1 類別 | `4` | 監控、Docker / systemd、SSH / network、AI provider |
| C2 類別 | `1` | 產品 runtime route 與跨產品邊界 |
| C3 類別 | `1` | security evidence / snapshot / guard tooling |
| 平均只讀控管成熟度 | `65%` | 僅代表框架 / evidence / owner packet 準備度，不代表 runtime 可執行 |
| 平均只讀控管成熟度 | `66%` | 僅代表框架 / evidence / owner packet 準備度，不代表 runtime 可執行 |
| 需要 live evidence 的類別 | `6` | 只能等 owner-provided redacted evidence 或維護窗口，不主動修改主機 |
| owner response required | `14` | 每類都需要 owner response 才能往 accepted 前進 |
| owner response received / accepted | `0 / 0` | 不得假性提高 |
@@ -37,7 +37,7 @@
| P1-1 | Docker Compose / systemd / host service config | `50%` | repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標 |
| P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `54%` | repo-only 清冊已納入 16 個 SSH / network access surface；仍缺 live evidence、owner 與 rollback |
| P1-3 | Backup / restore / escrow / retention | `58%` | repo-only 清冊已納入 38 個 surface；仍缺 restore drill approval package、offsite / escrow owner、retention owner、rollback owner 與 no-secret-value evidence |
| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `56%` | 補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke |
| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof |
## 4. 固定 0 / false 邊界
@@ -70,6 +70,22 @@ active_scan_authorized=false
agent_bounty_runtime_authorized=false
payout_or_withdrawal_authorized=false
action_buttons_allowed=false
prometheus_reload_authorized=false
alertmanager_reload_authorized=false
grafana_dashboard_apply_authorized=false
signoz_rule_apply_authorized=false
sentry_deploy_authorized=false
langfuse_config_change_authorized=false
otel_collector_reload_authorized=false
receiver_route_change_authorized=false
silence_policy_change_authorized=false
telegram_send_authorized=false
notification_route_change_authorized=false
webhook_receiver_change_authorized=false
remote_write_change_authorized=false
exporter_deploy_authorized=false
live_alert_fire_authorized=false
alert_chain_smoke_authorized=false
```
## 5. 判讀規則
@@ -118,3 +134,7 @@ python3 scripts/security/high-value-config-control-coverage.py \
## 10. P1-3 Backup / restore / escrow / retention 清冊更新
`backup_restore_escrow_inventory_v1` 已把 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 納入 repo-only 清冊，共 `38` 個 surface、`15` 個 backup script surface、`8` 個 offsite / escrow surface、`5` 個 Velero surface 與 `27` 個 write-capable surface。此更新只讓 `backup_restore_credential` 從 `52%` 推進到 `58%`；owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、runtime gate 與 action button 仍全部為 `0`。
## 11. P1-4 Monitoring / alerting / observability 清冊更新
`monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入 repo-only 清冊，共 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface。此更新只讓 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`。

15
docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md
View File

@@ -32,7 +32,7 @@
| 註冊配置類別 | `14` | 代表已進 Gate 分類，不代表已批准 |
| C0 類別 | `8` | Nginx、DNS / TLS、K8s、secret、workflow / runner、runtime config、backup、agent-bounty runtime |
| C1 類別 | `4` | 監控、Docker / systemd、SSH / network、AI provider |
| 平均只讀控管成熟度 | `65%` | 只代表框架 / evidence / owner packet 準備度 |
| 平均只讀控管成熟度 | `66%` | 只代表框架 / evidence / owner packet 準備度 |
| 需要 live evidence 類別 | `6` | 只能等 owner-provided redacted evidence 或維護窗口，不主動 SSH |
| owner response required | `14` | owner response received / accepted 仍 `0 / 0` |
| runtime gate | `0` | 不提供執行按鈕 |
@@ -57,6 +57,12 @@
此更新仍不是 live backup truth：owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config、Velero restore、kubectl 或 SSH。
### 0.5 2026-06-12 Monitoring / alerting / observability repo-only 清冊
`monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入只讀 snapshot。清冊目前共有 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface，讓 monitoring / alerting / observability 類別成熟度從 `56%` 推進到 `62%`。
此更新仍不是 live alert chain truth：owner response、live evidence、reload owner、receiver owner、route smoke、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 Prometheus reload、Alertmanager reload、Grafana import、SigNoz rule apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH 或 kubectl。
## 1. 目前已不符合新要求的項目
| 優先 | 項目 | 現況 | 風險 | 本階段處置 |
@@ -119,8 +125,8 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
| P0 | Public admin / API route config | Nginx templates、`apps/web/src/lib/config.ts`、`apps/api/src/core/config.py` | Product owner + runtime owner | auth boundary、CORS、public URL、admin path smoke、frontend internal IP ban |
| P0 | Backup / restore credential | `scripts/backup/*`、`k8s/velero/*`、DR runbooks、`docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md` | MinIO / restic / offsite escrow | credential value absent、restore drill gate、offsite owner、escrow owner、retention policy、rollback owner |
| P0 | agent-bounty-protocol treasury / MCP / A2A | `docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md` | agent-bounty owner response | no payout / claim / submit / daemon / webhook until explicit runtime approval |
| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*` | 110 monitoring stack | rule diff、receiver diff、reload gate、failure-only notification policy |
| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window |
| P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 monitoring stack | repo-only 清冊、rule diff、receiver diff、reload gate、failure-only notification policy |
| P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window |
| P1 | Harbor / registry | Nginx templates、backup scripts、CD workflows | 110 Harbor / registry domains | robot account owner、image tag immutability、scan policy、TLS |
| P1 | PostgreSQL / Redis / MinIO | app config、backup scripts、monitoring config | 188 / 110 / K3s | no plaintext DSN, access boundary, backup, restore, metrics auth |
| P1 | Docker Compose / systemd | `docker-compose.yml`、`ops/*/docker-compose.yml`、`scripts/reboot-recovery/*.service` | 110 / 188 / agent-bounty hosts | port / volume / env diff、restart window、rollback owner |
@@ -171,6 +177,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
| canonical owner 欄位對齊 | `100%` | 高價值配置 Gate 已對齊 S4.9 `owner_role_or_team`，並保留 `owner_role_team` 等 alias 支援 |
| 全域配置覆蓋矩陣 | `100%` | 已新增 `scripts/security/high-value-config-control-coverage.py`、snapshot 與 schema，14 類高價值配置可重跑檢查 |
| Backup / restore / escrow 清冊 | `100%` | 已新增 `backup_restore_escrow_inventory_v1`，納入 38 個 repo-only surface；成熟度 `52% -> 58%` |
| Monitoring / alerting / observability 清冊 | `100%` | 已新增 `monitoring_alerting_observability_inventory_v1`，納入 60 個 repo-only surface；成熟度 `56% -> 62%` |
| owner packet 前台只讀接入 | `100%` | `/zh-TW/iwooos` 已顯示高價值配置 owner packet 草案、C0/C1 packet 數、request / received / accepted 仍為 0 與禁止執行邊界 |
| owner response request / received / accepted | `0%` | Packet 只是草案；尚未送件、尚未收件、尚未 reviewer accepted |
| CI blocking / workflow gate | `0%` | 本階段刻意不修改 `.gitea/workflows`，避免初期資安流程摩擦過大 |
@@ -189,7 +196,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
5. P0：把 agent-bounty-protocol compose / MCP / A2A / treasury 高價值配置欄位接入同一個 owner packet queue；不啟用 runtime。
6. P1：盤點 110 / 188 Docker Compose 與 systemd live config，標記 Harbor、Sentry、Langfuse、Gitea、agent-bounty-protocol 影響面。
7. P1：把 backup / restore / offsite / escrow owner response packet 接入 AwoooP 只讀狀態；驗收前 backup run、restore drill、offsite sync、remote delete、escrow marker write、retention change 全部維持 `0 / false`。
8. P1：盤點 Prometheus / Alertmanager / Grafana / SigNoz / Sentry 設定 drift 與 secret externalization。
8. P1：把 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse owner response packet 接入 AwoooP 只讀狀態；驗收前 reload、receiver route change、silence change、Telegram send 與 alert chain smoke 全部維持 `0 / false`。
9. P1：補 Kali 112、111、168 維護窗口 owner 欄位，仍不做 upgrade / restart / scan。
10. P2：持續精簡 `/zh-TW/iwooos` 配置控管摘要，但不得顯示內部工作對話、token、secret 或可執行按鈕。

6
docs/security/IWOOOS-POSTURE-PROJECTION.md
View File

@@ -2,7 +2,7 @@
| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-04 |
| 日期 | 2026-06-12 |
| 狀態 | 草案；P0 governance 總帳已建立 |
| Schema | `docs/schemas/iwooos_posture_projection_v1.schema.json` |
| Snapshot | `docs/security/iwooos-posture-projection.snapshot.json` |
@@ -89,9 +89,11 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
51. 10 個 frontend surface reverse bridge statuses，顯示既有資安入口目前是 embedded bridge、direct bridge 或 AwoooP read-only candidate；這只是連接狀態，不代表 owner response、runtime authorization、Code Review blocker、Gitea/GitHub action 或任何執行控制。
52. 6 個 source control primary readiness items，顯示 GitHub primary 前置缺口：candidate repo inventory、primary ready counter、owner response validation、refs truth、workflow / secret name inventory、rollback ADR；這只是 readiness，不代表 repo 建立、visibility 變更、refs mutation、secret value collection、primary switch 或 Gitea 停用。
53. 4 個 rollout risk read-only items，顯示風險來源部署 marker、`AWOOOI_ROLLOUT_RISK=1`、ArgoCD `Degraded` / `OutOfSync`、API health / smoke 已通過與執行期閘門仍為 0；這只是部署風險可見性，不代表 ArgoCD sync、kubectl、主機重啟、修復、部署或 runtime gate 已授權。
54. 14 類 high-value config control coverage statuses，顯示 Nginx、DNS / TLS、K8s、secret、workflow、backup、agent-bounty runtime、monitoring、Docker / systemd、SSH / network、AI provider、產品 route 與 security evidence 的全域配置控管覆蓋矩陣；平均只讀成熟度 `65%`、C0 類別 `8`、需 live evidence 類別 `6`、owner response received / accepted 與 runtime gate 仍為 `0`，不代表 reload、sync、scan、secret rotation、payout 或主機操作授權。
54. 14 類 high-value config control coverage statuses，顯示 Nginx、DNS / TLS、K8s、secret、workflow、backup、agent-bounty runtime、monitoring、Docker / systemd、SSH / network、AI provider、產品 route 與 security evidence 的全域配置控管覆蓋矩陣；平均只讀成熟度 `66%`、C0 類別 `8`、需 live evidence 類別 `6`、owner response received / accepted 與 runtime gate 仍為 `0`，不代表 reload、sync、scan、secret rotation、payout 或主機操作授權。
55. 9 個 host-service config repo-only inventory surfaces，顯示 Docker Compose、systemd / repair-bot、Ansible service role 與 host config backup capture 的第一層清冊；write-capable surface `3`、repair-bot whitelist `2`、systemd restart surface `1`，owner response、live evidence、restart window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 `docker compose`、`systemctl`、repair-bot 或 Ansible apply 已授權。
56. 16 個 SSH / network access repo-only inventory surfaces，顯示 SSH target、known_hosts workflow、CI deploy SSH、monitoring SSH、backup SSH capture、sudoers wrapper、NetworkPolicy、NodePort、WireGuard runbook 與 alert SSH action catalog 的第一層清冊；write-capable surface `6`、NetworkPolicy `2`、NodePort `2`、sudoers `1`、WireGuard `1`，owner response、live evidence、maintenance window、rollback owner、runtime gate 與 action button 仍全部為 `0`，不代表 SSH、sudo、firewall、NetworkPolicy、NodePort、WireGuard 或 known_hosts patch 已授權。
57. 38 個 Backup / restore / escrow / retention repo-only inventory surfaces，顯示 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 的第一層清冊；write-capable surface `27`、restore drill surface `4`、offsite / escrow surface `8`，owner response、live evidence、restore drill、offsite sync、credential escrow、retention change、runtime gate 與 action button 仍全部為 `0`，不代表 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config 或 Velero restore 已授權。
58. 60 個 Monitoring / alerting / observability repo-only inventory surfaces，顯示 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 的第一層清冊；write-capable surface `11`、alert rule surface `13`、deploy / reload surface `6`，owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`，不代表 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Telegram send、live alert fire 或 alert chain smoke 已授權。
## 3.1 既有前端資安頁面整合

113
docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md Normal file
View File

@@ -0,0 +1,113 @@
# IwoooS Monitoring / Alerting / Observability repo-only 清冊
| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-12 |
| 狀態 | `repo_only_inventory_ready` |
| 工具 | `scripts/security/monitoring-alerting-observability-inventory.py` |
| Snapshot | `docs/security/monitoring-alerting-observability-inventory.snapshot.json` |
| Schema | `docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json` |
| runtime gate | `0` |
## 1. 目的
這份清冊把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 集中納入 IwoooS 高價值配置控管。
本階段仍是 repo-only source inventory：只讀已提交檔案、計算 SHA256、整理 owner gate 與 live evidence 缺口。不連 live Prometheus、不 reload Alertmanager、不改 Grafana、不套用 SigNoz rule、不部署 Sentry、不發 Telegram、不建立 silence、不 SSH、不 kubectl、不讀 secret value。
## 2. 覆蓋摘要
| 指標 | 目前值 | 說明 |
|------|--------|------|
| surface | `60` | 全部為 committed repo source |
| source exists | `60` | 每個 source path 都存在並有 SHA256 |
| Prometheus config surface | `8` | 基礎設定、remote write、generated target、service registry、exporter query |
| alert rule surface | `13` | Prometheus、K8s、SLO、Ollama、app alert rule 與 Grafana alert rule |
| Alertmanager receiver surface | `1` | route / receiver / grouping source |
| Grafana surface | `6` | alert rule 與 dashboard JSON |
| SigNoz surface | `3` | alert rule、log rule、API client |
| Sentry surface | `4` | compose、deploy、webhook receiver、API client |
| Langfuse surface | `3` | compose、runbook、API client |
| notification policy surface | `4` | failure-only policy、backup policy、observability contract、notification matrix |
| Telegram surface | `3` | digest policy、receipt package、gateway service |
| OTEL surface | `1` | SigNoz OTEL collector |
| deploy / reload surface | `6` | Alertmanager / Prometheus / Sentry / exporter deploy 或 reload-capable script |
| drift guard surface | `1` | Prometheus rule drift guard |
| smoke surface | `4` | live / test alert 與 alert chain smoke script |
| write-capable surface | `11` | 可能 reload、deploy、send notification、fire alert 或 restart exporter |
| owner response received / accepted | `0 / 0` | 不得假性拉高 |
| live evidence received | `0` | 尚未驗證 live monitoring truth |
| reload owner / receiver owner / route smoke accepted | `0 / 0 / 0` | 尚未授權 reload、route change 或 live smoke |
| runtime gate / action button | `0 / 0` | 不得建立前端執行入口 |
| P1-4 成熟度 | `56% -> 62%` | 只代表 repo-only 清冊完成，不代表 live alert chain 通過 |
## 3. Write-capable surface
| surface | 風險 | 必要 gate |
|---------|------|-----------|
| `deploy_alertmanager_config_script` | 可影響 receiver / route / reload | owner response、維護窗口、rollback owner、receiver smoke |
| `deploy_prometheus_alerts_script` | 可影響 alert rules / reload | rule test、receiver mapping、reload owner、rollback owner |
| `k8s_deploy_prometheus_config_script` | 可觸發 K8s apply / reload | K8s owner、ArgoCD / kubectl 邊界、rollback owner |
| `api_apply_prometheus_config_script` | 可由 API side 套用 Prometheus config | API deploy owner、config source owner、reload proof |
| `monitoring_exporter_deploy_script` | 可透過 host deploy 影響 exporter / restart | host owner、SSH boundary、restart window |
| `sentry_self_hosted_deploy` | 可部署 Sentry self-hosted stack | deploy owner、backup owner、migration rollback |
| `telegram_gateway_service` | 可送 Telegram / 寫 delivery path | token injection owner、receipt owner、send approval gate |
| `notification_manager_service` | 可改通知通道與路由 | channel owner、receipt owner、failure-only policy |
| `converged_alert_recurrence_notifier` | 可造成 recurrence escalation 或噪音 | noise budget owner、silence boundary、receipt proof |
| `fire_live_alert_script` | 可向 live alert chain 打告警 | allowed receiver、test window、cleanup owner |
| `fire_test_alert_script` | 可觸發測試告警與通知 | dedup proof、receiver owner、noise guard |
## 4. 固定 0 / false 邊界
```text
runtime_execution_authorized=false
host_write_authorized=false
prometheus_reload_authorized=false
alertmanager_reload_authorized=false
grafana_dashboard_apply_authorized=false
signoz_rule_apply_authorized=false
sentry_deploy_authorized=false
langfuse_config_change_authorized=false
otel_collector_reload_authorized=false
receiver_route_change_authorized=false
silence_policy_change_authorized=false
telegram_send_authorized=false
notification_route_change_authorized=false
webhook_receiver_change_authorized=false
remote_write_change_authorized=false
exporter_deploy_authorized=false
live_alert_fire_authorized=false
alert_chain_smoke_authorized=false
ssh_read_authorized=false
ssh_write_authorized=false
kubectl_action_authorized=false
secret_value_collection_allowed=false
active_scan_authorized=false
action_buttons_allowed=false
```
## 5. 下一步 owner response
1. Prometheus owner：提供 live config hash、rule diff、reload owner、rollback owner 與 false-green guard。
2. Alertmanager owner：提供 receiver diff、route owner、silence policy owner、reload owner 與 failure-only notification proof。
3. Grafana owner：提供 dashboard UID / folder owner、import owner、rollback ref 與 smoke plan。
4. SigNoz / OTEL owner：提供 pipeline diff、rule apply owner、data export boundary 與 rollback owner。
5. Sentry / Langfuse owner：提供 compose live hash、secret injection owner、upgrade / restart window、backup owner 與 rollback owner。
6. Telegram / notification owner：提供 receiver owner、receipt owner、redaction proof、retry boundary 與 no-secret-value evidence。
7. Alert chain smoke owner：提供 allowed receiver、execution window、expected receipt、noise budget 與 cleanup owner。
## 6. 完成度
| 工作 | 完成度 | 說明 |
|------|--------|------|
| P1-4 repo-only surface 註冊 | `100%` | `60` 個 surface 已納入 snapshot |
| source existence / SHA256 | `100%` | `60 / 60` source path 存在 |
| monitoring / alerting 高價值配置成熟度 | `56% -> 62%` | 只代表清冊與 guard 準備度 |
| owner response 收件 / 接受 | `0%` | 尚未收到或接受任何 owner response |
| live evidence collection | `0%` | 未讀 live monitoring stack |
| reload / receiver / route smoke gate | `0%` | 未授權、未執行 |
| runtime gate | `0%` | 無前端執行按鈕 |
## 7. 邊界
本清冊完成不代表 live Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 已一致，也不代表 alert route 已送達或告警必到。不得把 repo source 可見、snapshot、IwoooS UI、AwoooP approval 或 LOGBOOK 當成 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、remote write change、silence change、Telegram send、live alert fire、alert chain smoke、SSH、kubectl、active scan 或 secret collection 授權。

48
docs/security/high-value-config-control-coverage.snapshot.json
View File

@@ -293,15 +293,17 @@
"action_buttons_allowed": false,
"category_id": "monitoring_alerting_observability",
"control_tier": "C1",
"coverage_percent": 56,
"coverage_status": "policy_ready_needs_drift_evidence",
"current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。",
"coverage_percent": 62,
"coverage_status": "repo_only_inventory_ready_needs_live_route_evidence",
"current_gap": "repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live config hash、rule diff、receiver diff、reload owner、route smoke、receipt proof 與 owner response。",
"evidence_refs": [
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
"docs/security/SERVICE-HEALTH-FAILURE-NOTIFICATION-POLICY.md"
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json"
],
"label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse",
"next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。",
"next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、rollback owner 與 no-secret-value evidence。",
"owner_response_accepted": false,
"owner_response_received": false,
"owner_response_required": true,
@@ -510,20 +512,31 @@
"action_buttons_allowed": false,
"active_scan_authorized": false,
"agent_bounty_runtime_authorized": false,
"alert_chain_smoke_authorized": false,
"alertmanager_reload_authorized": false,
"argocd_sync_authorized": false,
"backup_run_authorized": false,
"certbot_renew_authorized": false,
"credential_escrow_marker_write_authorized": false,
"dns_tls_change_authorized": false,
"exporter_deploy_authorized": false,
"force_push_authorized": false,
"grafana_dashboard_apply_authorized": false,
"host_write_authorized": false,
"kubectl_action_authorized": false,
"langfuse_config_change_authorized": false,
"live_alert_fire_authorized": false,
"nginx_reload_authorized": false,
"notification_route_change_authorized": false,
"offsite_remote_delete_authorized": false,
"offsite_sync_authorized": false,
"otel_collector_reload_authorized": false,
"payout_or_withdrawal_authorized": false,
"prometheus_reload_authorized": false,
"rclone_config_authorized": false,
"receiver_route_change_authorized": false,
"refs_sync_authorized": false,
"remote_write_change_authorized": false,
"restic_prune_authorized": false,
"restore_drill_authorized": false,
"restore_run_authorized": false,
@@ -531,11 +544,16 @@
"runner_change_authorized": false,
"runtime_execution_authorized": false,
"secret_value_collection_allowed": false,
"sentry_deploy_authorized": false,
"signoz_rule_apply_authorized": false,
"silence_policy_change_authorized": false,
"telegram_send_authorized": false,
"velero_restore_authorized": false,
"webhook_receiver_change_authorized": false,
"workflow_modification_authorized": false
},
"generated_at": "2026-06-11T22:25:00+08:00",
"git_commit": "dba91f3c",
"generated_at": "2026-06-12T09:05:00+08:00",
"git_commit": "7a7daa33",
"lowest_coverage_categories": [
{
"category_id": "docker_compose_systemd_host_config",
@@ -551,19 +569,19 @@
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
"next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。"
},
{
"category_id": "monitoring_alerting_observability",
"coverage_percent": 56,
"current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。",
"label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse",
"next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。"
},
{
"category_id": "k8s_production_gitops",
"coverage_percent": 58,
"current_gap": "尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet。",
"label": "K8s / ArgoCD / production manifests",
"next_owner_action": "補 GitOps owner、rollback revision、health readback 與 post-deploy validation plan。"
},
{
"category_id": "backup_restore_credential",
"coverage_percent": 58,
"current_gap": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。",
"label": "Backup / restore / escrow / retention",
"next_owner_action": "補 restore drill approval package、offsite owner、escrow owner、retention owner、rollback owner 與 no-secret-value evidence。"
}
],
"next_collection_order": [
@@ -588,7 +606,7 @@
"status": "coverage_matrix_ready",
"summary": {
"action_button_count": 0,
"average_coverage_percent": 65,
"average_coverage_percent": 66,
"c0_category_count": 8,
"c1_category_count": 4,
"c2_category_count": 1,

41
docs/security/iwooos-posture-projection.snapshot.json
View File

@@ -1,7 +1,7 @@
{
"schema_version": "iwooos_posture_projection_v1",
"status": "draft",
"date": "2026-06-11",
"date": "2026-06-12",
"product_id": "iwooos",
"display_name": "IwoooS",
"mode": "mirror_only",
@@ -34,6 +34,9 @@
"docs/security/backup-restore-escrow-inventory.snapshot.json",
"docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md",
"docs/schemas/backup_restore_escrow_inventory_v1.schema.json",
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
"docs/LOGBOOK.md",
"docs/workplans/2026-06-04-iwooos-security-governance-p0.md",
"apps/web/src/app/[locale]/iwooos/page.tsx",
@@ -242,7 +245,7 @@
"high_value_config_control_coverage_category_count": 14,
"high_value_config_control_coverage_c0_category_count": 8,
"high_value_config_control_coverage_c1_category_count": 4,
"high_value_config_control_coverage_average_percent": 65,
"high_value_config_control_coverage_average_percent": 66,
"high_value_config_control_coverage_needs_live_evidence_count": 6,
"high_value_config_control_coverage_owner_response_required_count": 14,
"high_value_config_control_coverage_owner_response_received_count": 0,
@@ -432,7 +435,39 @@
"decision_runway_interactive_step_allowed": true,
"decision_runway_runtime_gate_count": 0,
"decision_runway_owner_response_received_count": 0,
"decision_runway_owner_response_accepted_count": 0
"decision_runway_owner_response_accepted_count": 0,
"monitoring_alerting_observability_inventory_first_layer": true,
"monitoring_alerting_observability_inventory_surface_count": 60,
"monitoring_alerting_observability_inventory_source_exists_count": 60,
"monitoring_alerting_observability_inventory_expected_scope_count": 60,
"monitoring_alerting_observability_inventory_prometheus_config_surface_count": 8,
"monitoring_alerting_observability_inventory_alert_rule_surface_count": 13,
"monitoring_alerting_observability_inventory_alertmanager_receiver_surface_count": 1,
"monitoring_alerting_observability_inventory_grafana_surface_count": 6,
"monitoring_alerting_observability_inventory_signoz_surface_count": 3,
"monitoring_alerting_observability_inventory_sentry_surface_count": 4,
"monitoring_alerting_observability_inventory_langfuse_surface_count": 3,
"monitoring_alerting_observability_inventory_notification_policy_surface_count": 4,
"monitoring_alerting_observability_inventory_telegram_surface_count": 3,
"monitoring_alerting_observability_inventory_otel_surface_count": 1,
"monitoring_alerting_observability_inventory_deploy_or_reload_surface_count": 6,
"monitoring_alerting_observability_inventory_drift_guard_surface_count": 1,
"monitoring_alerting_observability_inventory_smoke_surface_count": 4,
"monitoring_alerting_observability_inventory_write_capable_surface_count": 11,
"monitoring_alerting_observability_inventory_surfaces_requiring_owner_response_count": 60,
"monitoring_alerting_observability_inventory_surfaces_requiring_live_evidence_count": 60,
"monitoring_alerting_observability_inventory_owner_response_received_count": 0,
"monitoring_alerting_observability_inventory_owner_response_accepted_count": 0,
"monitoring_alerting_observability_inventory_live_evidence_received_count": 0,
"monitoring_alerting_observability_inventory_reload_owner_accepted_count": 0,
"monitoring_alerting_observability_inventory_receiver_owner_accepted_count": 0,
"monitoring_alerting_observability_inventory_route_smoke_accepted_count": 0,
"monitoring_alerting_observability_inventory_maintenance_window_accepted_count": 0,
"monitoring_alerting_observability_inventory_rollback_owner_accepted_count": 0,
"monitoring_alerting_observability_inventory_runtime_gate_count": 0,
"monitoring_alerting_observability_inventory_action_button_count": 0,
"monitoring_alerting_observability_inventory_coverage_percent_before_inventory": 56,
"monitoring_alerting_observability_inventory_coverage_percent_after_inventory": 62
},
"progress": {
"overall_percent": 64,

1990
docs/security/monitoring-alerting-observability-inventory.snapshot.json Normal file
View File

File diff suppressed because it is too large Load Diff