docs(security): 補 S4.9 owner response intake form [skip ci]

2026-06-05 10:59:30 +08:00
parent 37c0e1718b
commit a516d3f81f
3 changed files with 209 additions and 2 deletions
--- a/docs/security/S4-9-OWNER-RESPONSE-INTAKE-FORM.md
+++ b/docs/security/S4-9-OWNER-RESPONSE-INTAKE-FORM.md
@@ -0,0 +1,165 @@
+# S4.9 Owner Response Intake Form
+
+| 項目 | 內容 |
+|------|------|
+| 日期 | 2026-06-05 |
+| 基準 | `gitea/main=37c0e171 docs(governance): 對齊 P1-001 最新正式 deploy marker [skip ci]` |
+| 對應規範 | `docs/security/S4-9-CANONICAL-OWNER-RESPONSE-ENVELOPE.md` |
+| 對應收件包 | `docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md` |
+| 模式 | owner response intake form only |
+| 不可誤讀 | 本表單不是 request sent、不是 response received、不是 response accepted、不是 GitHub primary / repo / refs / workflow / secret / runner / runtime 授權 |
+
+## 1. 使用邊界
+
+本表單只用來讓 owner 依 S4.9 五題提供脫敏 metadata。填表前、填表中、填表後都不得把它解讀成 source-control mutation 或 runtime execution approval。
+
+允許內容：
+
+- owner role / team
+- decision
+- decision reason
+- affected scope
+- redacted evidence refs
+- followup owner
+
+禁止內容：
+
+- token、secret、private key、cookie、session、authorization header、runner token、webhook secret
+- DB dump、repo archive、git object pack、裸 repo tarball、private URL credential
+- repo create、visibility change、refs sync、delete refs、force push、workflow 修改、runner 啟用
+- Kali scan、`/execute`、SSH 修改主機、host update、runtime restart / rollout / scale / delete
+
+## 2. 填寫規則
+
+| 欄位 | 必填 | 填寫方式 |
+|------|------|----------|
+| `owner_role_or_team` | 是 | 填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊 |
+| `decision` | 是 | 只能填 `confirm`、`defer`、`reject`、`request_more_evidence` |
+| `decision_reason` | 是 | 用短句說明判斷理由；不可貼 raw log、raw API body、未脫敏截圖 |
+| `affected_scope` | 是 | 寫 repo 群、namespace、endpoint、host scope、legacy disposition 或 canonical owner 範圍 |
+| `redacted_evidence_refs` | 是 | 只填文件路徑、snapshot id、ticket id、hash、脫敏 metadata pointer 或 quarantine pointer |
+| `followup_owner` | 是 | 填後續補證、審查或決策負責角色 / 團隊 |
+
+## 3. Owner 填寫表
+
+### 3.1 `response-public-only-vs-local-gitea-gap`
+
+| 欄位 | 請填寫 |
+|------|--------|
+| `owner_role_or_team` |  |
+| `decision` |  |
+| `decision_reason` |  |
+| `affected_scope` |  |
+| `redacted_evidence_refs` |  |
+| `followup_owner` |  |
+
+提示：請判定 `wooo/clawbot-v5`、`wooo/wooo-aiops` 是否屬本輪 inventory / migration scope。不得附帶 repo create、refs sync 或 token value。
+
+### 3.2 `response-org-user-endpoint-identity`
+
+| 欄位 | 請填寫 |
+|------|--------|
+| `owner_role_or_team` |  |
+| `decision` |  |
+| `decision_reason` |  |
+| `affected_scope` |  |
+| `redacted_evidence_refs` |  |
+| `followup_owner` |  |
+
+提示：請判定 `wooo` 應以 user、org 或兩者盤點，並提供 canonical endpoint 的脫敏 evidence refs。不得要求 write / admin token。
+
+### 3.3 `response-internal-110-adjacent-scope`
+
+| 欄位 | 請填寫 |
+|------|--------|
+| `owner_role_or_team` |  |
+| `decision` |  |
+| `decision_reason` |  |
+| `affected_scope` |  |
+| `redacted_evidence_refs` |  |
+| `followup_owner` |  |
+
+提示：請逐項判定 `bitan-pharmacy`、`root/momo-pro-system`、`tsenyang-website`、`wooo/wooo-infra-config` 是否納入本輪 scope。不得夾帶 fetch / push / delete refs 要求。
+
+### 3.4 `response-repo-owner-canonical-scope`
+
+| 欄位 | 請填寫 |
+|------|--------|
+| `owner_role_or_team` |  |
+| `decision` |  |
+| `decision_reason` |  |
+| `affected_scope` |  |
+| `redacted_evidence_refs` |  |
+| `followup_owner` |  |
+
+提示：請指定 in-scope repo 的 owner、canonical source、GitHub target candidate 與 visibility review owner。GitHub target candidate 不等於 repo creation approval。
+
+### 3.5 `response-legacy-or-inaccessible-disposition`
+
+| 欄位 | 請填寫 |
+|------|--------|
+| `owner_role_or_team` |  |
+| `decision` |  |
+| `decision_reason` |  |
+| `affected_scope` |  |
+| `redacted_evidence_refs` |  |
+| `followup_owner` |  |
+
+提示：請留下 legacy / inaccessible / external repo 的 disposition、理由與後續 owner。不得把 disposition 回覆解讀為 archive / delete / disable approval。
+
+## 4. Reviewer 收件欄
+
+Reviewer 只能填分類結果，不得改寫 owner 原意，也不得把表單變成執行批准。
+
+| 檢查 | 結果 | 備註 |
+|------|------|------|
+| 五題是否全部填寫 |  |  |
+| 六欄 canonical envelope 是否完整 |  |  |
+| decision 是否只使用允許值 |  |  |
+| affected scope 是否清楚 |  |  |
+| redacted evidence refs 是否只含脫敏參照 |  |  |
+| 是否含疑似 sensitive payload |  | 疑似即送 quarantine，不渲染 raw payload |
+| 是否夾帶執行要求 |  | 夾帶即 hard reject 或切獨立人工批准 |
+| 是否需要補證 |  |  |
+| 是否可進 reviewer validation |  | 仍非 accepted |
+
+## 5. 可用 outcome lane
+
+| Outcome | 使用時機 | Gate 影響 |
+|---------|----------|-----------|
+| `keep_waiting_owner_response` | 表單未回、只收到空白表、只收到口頭同意 | received / accepted 維持 0 |
+| `request_more_evidence` | 欄位缺漏、scope 不清、evidence refs 不足 | 不增加 accepted |
+| `quarantine_sensitive_payload` | 疑似含 token、secret、private key、cookie、session、未脫敏截圖、private URL credential | 不保存 raw payload |
+| `reject_execution_request` | 夾帶 repo / refs / workflow / secret / runner / scan / host / runtime 執行要求 | 不建立 action button、不進 runtime gate |
+| `ready_for_reviewer_validation` | 五題完整、證據已脫敏、無執行要求 | 只進 reviewer checklist，仍非 accepted |
+
+## 6. 驗收前狀態
+
+```text
+request_sent=false
+request_sent_count=0
+received_response_count=0
+accepted_response_count=0
+rejected_response_count=0
+owner_response_received_count=0
+owner_response_accepted_count=0
+redacted_payload_ingested=false
+runtime_execution_authorized=false
+action_buttons_allowed=false
+repo_creation_authorized=false
+refs_sync_authorized=false
+workflow_modification_authorized=false
+github_primary_switch_authorized=false
+host_update_authorized=false
+active_scan_authorized=false
+secret_value_collection_authorized=false
+```
+
+## 7. 本輪完成度
+
+| 工作 | 完成度 | 說明 |
+|------|--------|------|
+| S4.9 owner response intake form | 100% | 五題表單、六欄填寫規則、reviewer 收件欄與 outcome lanes 已固定 |
+| S4.9 owner response gate | 0% | 尚未送件、尚未收到 owner response、尚未 accepted |
+| IwoooS 整體 | 維持 64% | 表單完成不代表 runtime readiness 提升 |
+| active runtime gate | 0 | 不變 |