wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): 新增 monitoring alerting 只讀清冊
All checks were successful
CD Pipeline / tests (push) Successful in 1m26s
Details
Code Review / ai-code-review (push) Successful in 23s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m52s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m59s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-12 00:45:08 +08:00
parent 7a7daa333e
commit 8a424f0c56
15 changed files with 4086 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
scripts/security/high-value-config-control-coverage.py
View File

@@ -111,14 +111,16 @@ CONTROL_STATUS_BY_CATEGORY = {
"next_owner_action": "補 repo owner、external agent owner、treasury owner、runtime gate owner 與 validation plan。",
},
"monitoring_alerting_observability": {
"coverage_status": "policy_ready_needs_drift_evidence",
"coverage_percent": 56,
"coverage_status": "repo_only_inventory_ready_needs_live_route_evidence",
"coverage_percent": 62,
"evidence_refs": [
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
"docs/security/SERVICE-HEALTH-FAILURE-NOTIFICATION-POLICY.md",
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
],
"current_gap": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse 設定 drift 尚未集中收證。",
"next_owner_action": "補 rule diff、receiver diff、reload owner、failure-only notification policy 與 route smoke。",
"current_gap": "repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live config hash、rule diff、receiver diff、reload owner、route smoke、receipt proof 與 owner response。",
"next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、rollback owner 與 no-secret-value evidence。",
},
"docker_compose_systemd_host_config": {
"coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence",
@@ -201,6 +203,22 @@ FALSE_BOUNDARIES = {
"runner_change_authorized": False,
"refs_sync_authorized": False,
"force_push_authorized": False,
"prometheus_reload_authorized": False,
"alertmanager_reload_authorized": False,
"grafana_dashboard_apply_authorized": False,
"signoz_rule_apply_authorized": False,
"sentry_deploy_authorized": False,
"langfuse_config_change_authorized": False,
"otel_collector_reload_authorized": False,
"receiver_route_change_authorized": False,
"silence_policy_change_authorized": False,
"telegram_send_authorized": False,
"notification_route_change_authorized": False,
"webhook_receiver_change_authorized": False,
"remote_write_change_authorized": False,
"exporter_deploy_authorized": False,
"live_alert_fire_authorized": False,
"alert_chain_smoke_authorized": False,
"secret_value_collection_allowed": False,
"active_scan_authorized": False,
"agent_bounty_runtime_authorized": False,
@@ -269,6 +287,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]:
"gate_defined_needs_runtime_evidence",
"policy_defined_needs_restore_drill_owner",
"repo_only_inventory_ready_needs_restore_drill_owner",
"repo_only_inventory_ready_needs_live_route_evidence",
"policy_ready_needs_drift_evidence",
"inventory_needed",
"repo_only_inventory_ready_needs_live_owner_evidence",