wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add owner response audit handoff packets

Browse Source
This commit is contained in:
Your Name
2026-05-19 13:03:59 +08:00
parent 0c37b63237
commit 97abba8112
19 changed files with 281 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/security/security-mirror-progress-guard.py
View File

@@ -111,6 +111,7 @@ def validate(root: Path) -> None:
"s4_13_owner_response_validation_reviewer_audit_redaction_examples",
"s4_13_owner_response_validation_reviewer_audit_retention_rules",
"s4_13_owner_response_validation_reviewer_audit_retention_checks",
"s4_13_owner_response_validation_reviewer_audit_handoff_packets",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -191,6 +192,11 @@ def validate(root: Path) -> None:
owner_summary["owner_response_validation_reviewer_audit_retention_check_count"],
6,
)
assert_equal(
"owner_rollup.owner_response_validation_reviewer_audit_handoff_packet_count",
owner_summary["owner_response_validation_reviewer_audit_handoff_packet_count"],
6,
)
assert_false("owner_rollup.runtime_execution_authorized", owner_summary["runtime_execution_authorized"])
assert_false("owner_rollup.repo_creation_authorized", owner_summary["repo_creation_authorized"])
assert_false("owner_rollup.refs_sync_authorized", owner_summary["refs_sync_authorized"])

58
scripts/security/source-control-owner-response-guard.py
View File

@@ -368,6 +368,15 @@ EXPECTED_ROLLUP_REVIEWER_AUDIT_RETENTION_CHECKS = [
"check-reviewer-audit-no-runtime-retention-side-effect",
]
EXPECTED_ROLLUP_REVIEWER_AUDIT_HANDOFF_PACKETS = [
"handoff-current-counters-and-boundary",
"handoff-required-source-packets",
"handoff-safe-display-fields",
"handoff-forbidden-runtime-interpretations",
"handoff-next-owner-response-focus",
"handoff-post-review-followup-gates",
]
def load_json(path: Path) -> dict[str, Any]:
return json.loads(path.read_text(encoding="utf-8"))
@@ -460,6 +469,11 @@ def validate(root: Path) -> None:
rollup_summary["owner_response_validation_reviewer_audit_retention_check_count"],
len(EXPECTED_ROLLUP_REVIEWER_AUDIT_RETENTION_CHECKS),
)
assert_equal(
"rollup.owner_response_validation_reviewer_audit_handoff_packet_count",
rollup_summary["owner_response_validation_reviewer_audit_handoff_packet_count"],
len(EXPECTED_ROLLUP_REVIEWER_AUDIT_HANDOFF_PACKETS),
)
assert_true("rollup.quarantine_required", rollup_summary["quarantine_required"])
assert_equal("rollup.primary_ready_count", rollup_summary["primary_ready_count"], 0)
@@ -1152,6 +1166,50 @@ def validate(root: Path) -> None:
item["execution_authorized"],
)
reviewer_audit_handoff_packets = rollup["owner_response_validation_reviewer_audit_handoff_packets"]
assert_equal(
"owner_response_validation_reviewer_audit_handoff_packets.ids",
[item["packet_id"] for item in reviewer_audit_handoff_packets],
EXPECTED_ROLLUP_REVIEWER_AUDIT_HANDOFF_PACKETS,
)
assert_equal(
"owner_response_validation_reviewer_audit_handoff_packets.display_order",
[item["display_order"] for item in reviewer_audit_handoff_packets],
list(range(1, len(EXPECTED_ROLLUP_REVIEWER_AUDIT_HANDOFF_PACKETS) + 1)),
)
for item in reviewer_audit_handoff_packets:
assert_equal(
f"owner_response_validation_reviewer_audit_handoff_packets.{item['packet_id']}.awooop_display_mode",
item["awooop_display_mode"],
"display_reviewer_audit_handoff_packet_only",
)
assert_false(
f"owner_response_validation_reviewer_audit_handoff_packets.{item['packet_id']}.execution_authorized",
item["execution_authorized"],
)
assert_true(
f"owner_response_validation_reviewer_audit_handoff_packets.{item['packet_id']}.not_approval",
item["not_approval"],
)
for blocked in item["blocked_interpretations"]:
if blocked in {
"treat_handoff_as_runtime_gate",
"increase_received_or_accepted_count",
"accept_owner_response_from_handoff_only",
"skip_source_packet_preflight",
"create_action_button_from_handoff",
"enqueue_runtime_job_from_handoff",
"start_scan_or_repo_action_from_handoff",
"mark_s4_9_received_from_handoff",
"treat_handoff_complete_as_primary_ready",
"treat_handoff_complete_as_payload_ingested",
"treat_handoff_complete_as_runtime_approved",
}:
assert_false(
f"owner_response_validation_reviewer_audit_handoff_packets.{item['packet_id']}.runtime_execution_authorized",
item["execution_authorized"],
)
first_lane = LANES[0]
first_collection_item = collection_order_by_id[first_lane["lane_id"]]
first_missing_lane = missing_lane_by_id[first_lane["lane_id"]]