From a9060b4981e6a07816922e358efd705a7188850b Mon Sep 17 00:00:00 2001 From: Your Name Date: Mon, 15 Jun 2026 17:59:38 +0800 Subject: [PATCH] =?UTF-8?q?docs(iwooos):=20=E5=90=8C=E6=AD=A5=E9=AB=98?= =?UTF-8?q?=E5=83=B9=E5=80=BC=E9=85=8D=E7=BD=AE=E5=84=AA=E5=85=88=E9=A0=86?= =?UTF-8?q?=E5=BA=8F=20[skip=20ci]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index 7066a6edb..effc9f531 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -116,9 +116,11 @@ | 優先 | 類別 | 目前成熟度 | 下一步 | |------|------|------------|--------| | P1-1 | Docker Compose / systemd / host service config | `58%` | repo-only 清冊已納入 9 個 surface，owner request draft 與 owner response acceptance ledger 已完成；事故恢復、依賴圖、port binding、cold-start sequence、source-of-truth 與 daemon / runner 競爭回補已納入；仍缺 owner response、110 / 188 live hash、maintenance / restart window、rollback owner、post-check plan、disable switch 與 no-secret-value evidence | -| P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `62%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner request draft、owner response acceptance 與事故型端口 / 防火牆變更證據驗收 ledger 已完成；仍缺 owner-provided change / incident ref、actor、before / after state、health impact、notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence | -| P1-3 | Backup / restore / escrow / retention | `64%` | repo-only 清冊已納入 38 個 surface，owner request draft 與 owner response acceptance ledger 已完成，並補 restore recovery、freshness SLO、隔離還原目標、remote delete guard、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；仍缺 owner response、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence | -| P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface，owner request draft 已轉成 60 份草稿；仍缺 owner response、live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof | +| P1-2 | AI provider / model routing / Ollama proxy / cost and privacy | `60%` | provider、model routing、Ollama proxy 與 fallback order 已納入高價值配置分類；仍缺 provider owner、fallback order、cost review、privacy review、benchmark、dry-run 結果與 rollback owner，不切 production | +| P1-3 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `62%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner request draft、owner response acceptance 與事故型端口 / 防火牆變更證據驗收 ledger 已完成；仍缺 owner-provided change / incident ref、actor、before / after state、health impact、notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence | +| P1-4 | K8s / ArgoCD / production manifests | `64%` | manifest inventory、owner response acceptance 與 GitOps change evidence acceptance 已完成；仍缺 proposed commit ref、rendered manifest diff、ArgoCD app / sync revision、health before / after、rollout、route smoke、metrics / alert、blast radius、rollback revision、maintenance window 與 post-check owner | +| P1-5 | Backup / restore / escrow / retention | `64%` | repo-only 清冊已納入 38 個 surface，owner request draft 與 owner response acceptance ledger 已完成，並補 restore recovery、freshness SLO、隔離還原目標、remote delete guard、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；仍缺 owner response、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence | +| P1-6 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `68%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface，owner response acceptance 已補 no-false-green 回補 Gate；仍缺 owner response、live drift evidence、reload owner、receiver owner、receipt proof、stale / silence review、post-reload readback、route smoke plan 與 noise budget | ## 4. 固定 0 / false 邊界