wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add Telegram egress migration plan draft [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-18 19:33:41 +08:00
parent 01bce6d815
commit a396f25b8f
11 changed files with 1649 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

121
scripts/security/security-mirror-progress-guard.py
View File

@@ -234,6 +234,9 @@ def validate(root: Path) -> None:
telegram_notification_egress_owner_request_draft = load_json(
security_dir / "telegram-notification-egress-owner-request-draft.snapshot.json"
)
telegram_notification_egress_migration_plan_draft = load_json(
security_dir / "telegram-notification-egress-migration-plan-draft.snapshot.json"
)
public_runtime_config_change_evidence_acceptance = load_json(
security_dir / "public-runtime-config-change-evidence-acceptance.snapshot.json"
)
@@ -21773,6 +21776,124 @@ def validate(root: Path) -> None:
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.{false_key}",
item[false_key],
)
assert_equal(
"telegram_notification_egress_migration_plan_draft.schema",
telegram_notification_egress_migration_plan_draft["schema_version"],
"telegram_notification_egress_migration_plan_draft_v1",
)
assert_equal(
"telegram_notification_egress_migration_plan_draft.status",
telegram_notification_egress_migration_plan_draft["status"],
"migration_plan_draft_ready_no_runtime_action",
)
assert_equal(
"telegram_notification_egress_migration_plan_draft.mode",
telegram_notification_egress_migration_plan_draft["mode"],
"metadata_only_no_workflow_script_api_change_no_telegram_send",
)
expected_telegram_egress_migration_plan_summary = {
"source_request_draft_count": 11,
"source_direct_bot_api_call_count": 18,
"migration_candidate_count": 11,
"workflow_migration_candidate_count": 6,
"ops_script_migration_candidate_count": 4,
"api_direct_migration_candidate_count": 1,
"proposed_wave_count": 3,
"plan_field_count": 17,
"reviewer_check_count": 15,
"outcome_lane_count": 9,
"blocked_action_count": 21,
"owner_response_required_count": 11,
"maintenance_window_required_count": 11,
"rollback_owner_required_count": 11,
"postcheck_required_count": 11,
"delivery_receipt_required_count": 11,
"owner_response_received_count": 0,
"owner_response_accepted_count": 0,
"migration_authorized_count": 0,
"workflow_modification_authorized_count": 0,
"script_modification_authorized_count": 0,
"api_sender_refactor_authorized_count": 0,
"telegram_send_authorized_count": 0,
"bot_api_call_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"raw_payload_storage_allowed_count": 0,
"production_write_authorized_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
}
for key, expected in expected_telegram_egress_migration_plan_summary.items():
assert_equal(
f"telegram_notification_egress_migration_plan_draft.summary.{key}",
telegram_notification_egress_migration_plan_draft["summary"][key],
expected,
)
assert_equal(
"telegram_notification_egress_migration_plan_draft.proposed_waves",
telegram_notification_egress_migration_plan_draft["proposed_waves"],
[
"wave_1_workflow_notification_wrapper",
"wave_2_ops_notification_wrapper",
"wave_3_api_sender_gateway",
],
)
for key, value in telegram_notification_egress_migration_plan_draft["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"telegram_notification_egress_migration_plan_draft.execution_boundaries.{key}", value)
else:
assert_false(f"telegram_notification_egress_migration_plan_draft.execution_boundaries.{key}", value)
for item in telegram_notification_egress_migration_plan_draft["migration_candidates"]:
assert_equal(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.plan_fields",
len(item["plan_fields"]),
17,
)
assert_equal(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.reviewer_checks",
len(item["reviewer_checks"]),
15,
)
assert_equal(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.outcome_lanes",
len(item["outcome_lanes"]),
9,
)
assert_equal(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.blocked_actions",
len(item["blocked_actions"]),
21,
)
for true_key in [
"owner_response_required",
"maintenance_window_required",
"rollback_owner_required",
"postcheck_required",
"delivery_receipt_required",
"not_authorization",
]:
assert_true(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.{true_key}",
item[true_key],
)
for false_key in [
"owner_response_received",
"owner_response_accepted",
"migration_authorized",
"workflow_modification_authorized",
"script_modification_authorized",
"api_sender_refactor_authorized",
"telegram_send_authorized",
"bot_api_call_authorized",
"secret_value_collection_allowed",
"raw_payload_storage_allowed",
"production_write_authorized",
"runtime_gate",
"action_buttons_allowed",
]:
assert_false(
f"telegram_notification_egress_migration_plan_draft.{item['migration_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"public_runtime_config_change_evidence_acceptance.schema",
public_runtime_config_change_evidence_acceptance["schema_version"],