fix(iwooos): 脫敏 tenants public identity

scripts/security/security-mirror-progress-guard.py

@@ -101,6 +101,9 @@ def validate(root: Path) -> None:
     host_service_owner_request_draft = load_json(
         security_dir / "host-service-owner-request-draft.snapshot.json"
     )
+    host_service_owner_response_acceptance = load_json(
+        security_dir / "host-service-owner-response-acceptance.snapshot.json"
+    )
     ssh_network_access_inventory = load_json(security_dir / "ssh-network-access-inventory.snapshot.json")
     ssh_network_owner_request_draft = load_json(
         security_dir / "ssh-network-owner-request-draft.snapshot.json"
@@ -2486,12 +2489,12 @@ def validate(root: Path) -> None:
     assert_equal(
         "high_value_config_coverage.summary.average_coverage_percent",
         high_value_config_coverage["summary"]["average_coverage_percent"],
-        67,
+        68,
     )
     assert_equal(
         "high_value_config_coverage.summary.needs_live_evidence_count",
         high_value_config_coverage["summary"]["needs_live_evidence_count"],
-        7,
+        6,
     )
     for key in [
         "owner_response_received_count",
@@ -2819,16 +2822,20 @@ def validate(root: Path) -> None:
     assert_equal(
         "high_value_config_coverage.coverage_categories.docker.coverage_percent",
         docker_systemd_category["coverage_percent"],
-        50,
+        54,
     )
     assert_equal(
         "high_value_config_coverage.coverage_categories.docker.coverage_status",
         docker_systemd_category["coverage_status"],
-        "repo_only_inventory_ready_needs_live_owner_evidence",
+        "owner_response_acceptance_ledger_ready_needs_live_owner_evidence",
     )
     for evidence_ref in [
         "docs/security/HOST-SERVICE-CONFIG-INVENTORY.md",
         "docs/security/host-service-config-inventory.snapshot.json",
+        "docs/security/HOST-SERVICE-OWNER-REQUEST-DRAFT.md",
+        "docs/security/host-service-owner-request-draft.snapshot.json",
+        "docs/security/HOST-SERVICE-OWNER-RESPONSE-ACCEPTANCE.md",
+        "docs/security/host-service-owner-response-acceptance.snapshot.json",
     ]:
         assert_contains(
             "high_value_config_coverage.coverage_categories.docker.evidence_refs",
@@ -3123,6 +3130,221 @@ def validate(root: Path) -> None:
                 f"host_service_owner_request_draft.{draft['request_id']}.{false_key}",
                 draft[false_key],
             )
+    assert_equal(
+        "host_service_owner_response_acceptance.schema",
+        host_service_owner_response_acceptance["schema_version"],
+        "host_service_owner_response_acceptance_v1",
+    )
+    assert_equal(
+        "host_service_owner_response_acceptance.status",
+        host_service_owner_response_acceptance["status"],
+        "owner_response_acceptance_ledger_ready_no_runtime_action",
+    )
+    assert_equal(
+        "host_service_owner_response_acceptance.source_inventory_schema_version",
+        host_service_owner_response_acceptance["source_inventory_schema_version"],
+        "host_service_config_inventory_v1",
+    )
+    assert_equal(
+        "host_service_owner_response_acceptance.source_owner_request_schema_version",
+        host_service_owner_response_acceptance["source_owner_request_schema_version"],
+        "host_service_owner_request_draft_v1",
+    )
+    expected_host_service_owner_response_acceptance_summary = {
+        "source_owner_request_count": 9,
+        "acceptance_candidate_count": 9,
+        "write_capable_acceptance_candidate_count": 3,
+        "live_evidence_required_candidate_count": 8,
+        "acceptance_field_count": 28,
+        "required_owner_field_count": 12,
+        "reviewer_check_count": 14,
+        "outcome_lane_count": 7,
+        "blocked_action_count": 20,
+        "request_sent_count": 0,
+        "recipient_confirmed_count": 0,
+        "owner_response_received_count": 0,
+        "owner_response_accepted_count": 0,
+        "owner_response_rejected_count": 0,
+        "owner_response_quarantined_count": 0,
+        "supplement_requested_count": 0,
+        "live_evidence_received_count": 0,
+        "live_config_hash_accepted_count": 0,
+        "maintenance_window_accepted_count": 0,
+        "restart_window_accepted_count": 0,
+        "rollback_owner_accepted_count": 0,
+        "post_check_plan_accepted_count": 0,
+        "disable_switch_accepted_count": 0,
+        "host_write_authorized_count": 0,
+        "ssh_read_authorized_count": 0,
+        "ssh_write_authorized_count": 0,
+        "docker_compose_action_authorized_count": 0,
+        "systemctl_action_authorized_count": 0,
+        "repair_bot_execution_authorized_count": 0,
+        "ansible_apply_authorized_count": 0,
+        "sudo_action_authorized_count": 0,
+        "secret_value_collection_allowed_count": 0,
+        "active_scan_authorized_count": 0,
+        "live_host_read_authorized_count": 0,
+        "runtime_gate_count": 0,
+        "action_button_count": 0,
+    }
+    for key, expected in expected_host_service_owner_response_acceptance_summary.items():
+        assert_equal(
+            f"host_service_owner_response_acceptance.summary.{key}",
+            host_service_owner_response_acceptance["summary"][key],
+            expected,
+        )
+    for key, value in host_service_owner_response_acceptance["execution_boundaries"].items():
+        if key == "not_authorization":
+            assert_true(f"host_service_owner_response_acceptance.execution_boundaries.{key}", value)
+        else:
+            assert_false(f"host_service_owner_response_acceptance.execution_boundaries.{key}", value)
+    assert_equal(
+        "host_service_owner_response_acceptance.acceptance_candidates.count",
+        len(host_service_owner_response_acceptance["acceptance_candidates"]),
+        9,
+    )
+    expected_host_service_acceptance_ids = [
+        "host_service_owner_response_acceptance:local_dev_compose",
+        "host_service_owner_response_acceptance:monitoring_110_compose",
+        "host_service_owner_response_acceptance:monitoring_exporters_188_compose",
+        "host_service_owner_response_acceptance:sentry_110_reference_compose",
+        "host_service_owner_response_acceptance:langfuse_110_compose",
+        "host_service_owner_response_acceptance:ansible_docker_compose_service_role",
+        "host_service_owner_response_acceptance:repair_bot_110_whitelist",
+        "host_service_owner_response_acceptance:repair_bot_188_whitelist",
+        "host_service_owner_response_acceptance:config_backup_host_capture",
+    ]
+    assert_equal(
+        "host_service_owner_response_acceptance.acceptance_candidates",
+        [item["acceptance_candidate_id"] for item in host_service_owner_response_acceptance["acceptance_candidates"]],
+        expected_host_service_acceptance_ids,
+    )
+    expected_host_service_checks = [
+        "owner_identity_present",
+        "decision_reason_present",
+        "affected_scope_matches_surface",
+        "redacted_refs_only",
+        "secret_value_absent",
+        "live_config_hash_metadata_only",
+        "maintenance_window_present",
+        "restart_window_separate_from_action",
+        "rollback_owner_present",
+        "post_check_plan_present",
+        "disable_switch_present",
+        "write_capable_requires_extra_review",
+        "no_runtime_request",
+        "counts_transition_safe",
+    ]
+    assert_equal(
+        "host_service_owner_response_acceptance.reviewer_checks",
+        [item["check_id"] for item in host_service_owner_response_acceptance["reviewer_checks"]],
+        expected_host_service_checks,
+    )
+    expected_host_service_lanes = [
+        "waiting_owner_response",
+        "quarantine_secret_or_raw_payload",
+        "reject_execution_request",
+        "request_supplement",
+        "ready_for_host_service_review",
+        "owner_review_only_update",
+        "waiting_runtime_gate",
+    ]
+    assert_equal(
+        "host_service_owner_response_acceptance.outcome_lanes",
+        [item["lane_id"] for item in host_service_owner_response_acceptance["outcome_lanes"]],
+        expected_host_service_lanes,
+    )
+    expected_host_service_blocked_actions = [
+        "ssh_read",
+        "ssh_write",
+        "docker_compose_up",
+        "docker_compose_down",
+        "docker_compose_pull",
+        "systemctl_restart",
+        "systemctl_reload",
+        "repair_bot_execute",
+        "ansible_apply",
+        "sudo_action",
+        "host_file_write",
+        "firewall_change",
+        "secret_value_collection",
+        "active_scan",
+        "live_host_read",
+        "raw_live_config_storage",
+        "restart_without_window",
+        "rollback_without_owner",
+        "runtime_gate_open",
+        "add_action_button",
+    ]
+    assert_equal(
+        "host_service_owner_response_acceptance.blocked_actions",
+        host_service_owner_response_acceptance["blocked_actions"],
+        expected_host_service_blocked_actions,
+    )
+    for item in host_service_owner_response_acceptance["acceptance_candidates"]:
+        assert_equal(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.acceptance_fields",
+            len(item["acceptance_fields"]),
+            28,
+        )
+        assert_equal(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.required_owner_fields",
+            len(item["required_owner_fields"]),
+            12,
+        )
+        assert_equal(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.reviewer_checks",
+            len(item["reviewer_checks"]),
+            14,
+        )
+        assert_equal(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.outcome_lanes",
+            len(item["outcome_lanes"]),
+            7,
+        )
+        assert_equal(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.blocked_actions",
+            len(item["blocked_actions"]),
+            20,
+        )
+        assert_true(
+            f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.not_approval",
+            item["not_approval"],
+        )
+        for false_key in [
+            "request_sent",
+            "recipient_confirmed",
+            "owner_response_received",
+            "owner_response_accepted",
+            "owner_response_rejected",
+            "owner_response_quarantined",
+            "supplement_requested",
+            "live_evidence_received",
+            "live_config_hash_accepted",
+            "maintenance_window_accepted",
+            "restart_window_accepted",
+            "rollback_owner_accepted",
+            "post_check_plan_accepted",
+            "disable_switch_accepted",
+            "host_write_authorized",
+            "ssh_read_authorized",
+            "ssh_write_authorized",
+            "docker_compose_action_authorized",
+            "systemctl_action_authorized",
+            "repair_bot_execution_authorized",
+            "ansible_apply_authorized",
+            "sudo_action_authorized",
+            "secret_value_collection_allowed",
+            "active_scan_authorized",
+            "live_host_read_authorized",
+            "runtime_gate",
+            "action_buttons_allowed",
+        ]:
+            assert_false(
+                f"host_service_owner_response_acceptance.{item['acceptance_candidate_id']}.{false_key}",
+                item[false_key],
+            )
     assert_equal(
         "ssh_network_access_inventory.schema",
         ssh_network_access_inventory["schema_version"],
@@ -5077,8 +5299,8 @@ def validate(root: Path) -> None:
         "high_value_config_control_coverage_category_count": 14,
         "high_value_config_control_coverage_c0_category_count": 8,
         "high_value_config_control_coverage_c1_category_count": 4,
-        "high_value_config_control_coverage_average_percent": 67,
-        "high_value_config_control_coverage_needs_live_evidence_count": 7,
+        "high_value_config_control_coverage_average_percent": 68,
+        "high_value_config_control_coverage_needs_live_evidence_count": 6,
         "high_value_config_control_coverage_owner_response_required_count": 14,
         "high_value_config_control_coverage_owner_response_received_count": 0,
         "high_value_config_control_coverage_owner_response_accepted_count": 0,
@@ -10996,6 +11218,8 @@ def validate(root: Path) -> None:
         "repo_owner_namespace_redacted=true",
         "raw_repository_namespace_visible=false",
         "public_api_raw_repo_namespace_allowed=false",
+        "public_product_identity_redacted=true",
+        "public_api_raw_project_slug_allowed=false",
     ]:
         assert_text_contains("platform_operator_service.source_namespace_redaction", platform_operator_service, text)
     for text in ["source_scope_id", "source_namespace_redacted"]:
@@ -14689,7 +14913,7 @@ def validate(root: Path) -> None:
     assert_text_contains(
         "iwooos_page.high_value_config_control_coverage_docker_systemd_percent",
         iwooos_projection_page,
-        "{ key: 'dockerSystemd', rank: 'P1-1', value: '50%'",
+        "{ key: 'dockerSystemd', rank: 'P1-1', value: '54%'",
     )
     assert_text_contains(
         "iwooos_page.high_value_config_control_coverage_ssh_network_percent",
@@ -14718,8 +14942,8 @@ def validate(root: Path) -> None:
         "high_value_config_control_coverage_category_count=14",
         "high_value_config_control_coverage_c0_category_count=8",
         "high_value_config_control_coverage_c1_category_count=4",
-        "high_value_config_control_coverage_average_percent=67",
-        "high_value_config_control_coverage_needs_live_evidence_count=7",
+        "high_value_config_control_coverage_average_percent=68",
+        "high_value_config_control_coverage_needs_live_evidence_count=6",
         "high_value_config_control_coverage_owner_response_required_count=14",
         "high_value_config_control_coverage_owner_response_received_count=0",
         "high_value_config_control_coverage_owner_response_accepted_count=0",
@@ -14733,6 +14957,10 @@ def validate(root: Path) -> None:
         "host_service_config_inventory_surface_count=9",
         "host_service_config_inventory_write_capable_surface_count=3",
         "host_service_config_inventory_runtime_gate_count=0",
+        "host_service_owner_response_acceptance_candidate_count=9",
+        "host_service_owner_response_acceptance_write_capable_candidate_count=3",
+        "host_service_owner_response_acceptance_reviewer_check_count=14",
+        "host_service_owner_response_acceptance_runtime_gate_count=0",
         "ssh_network_access_inventory_surface_count=16",
         "ssh_network_access_inventory_write_capable_surface_count=6",
         "ssh_network_access_inventory_runtime_gate_count=0",