wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): 綁定 S4.9 owner handoff queue
Some checks failed
CD Pipeline / tests (push) Successful in 1m31s
Details
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-11 15:40:04 +08:00
parent d13ae1237e
commit ab1ee29638
7 changed files with 451 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

182
docs/security/gitea-inventory-owner-attestation-response.snapshot.json
View File

@@ -28,6 +28,13 @@
"owner_response_display_section_count": 8,
"owner_response_request_packet_count": 1,
"owner_response_collection_check_count": 6,
"owner_response_intake_handoff_queue_count": 5,
"owner_response_intake_handoff_queue_ready_count": 0,
"owner_response_intake_handoff_queue_received_count": 0,
"owner_response_intake_handoff_queue_accepted_count": 0,
"owner_response_intake_handoff_queue_runtime_gate_count": 0,
"owner_response_intake_handoff_queue_raw_payload_allowed": false,
"owner_response_intake_handoff_queue_action_buttons_allowed": false,
"intake_preflight_check_count": 6,
"intake_outcome_lane_count": 5,
"acceptance_check_count": 8,
@@ -363,6 +370,181 @@
]
}
],
"owner_response_intake_handoff_queue": [
{
"handoff_lane_id": "publicGap",
"display_order": 1,
"source_template_id": "response-public-only-vs-local-gitea-gap",
"template_label": "D1",
"handoff_status": "waiting_owner_response_metadata",
"required_owner_field_count": 6,
"required_owner_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_repos",
"evidence_refs",
"followup_owner"
],
"current_blocker": "缺少 public-only / local gap 的逐 repo owner 判定。",
"next_safe_step": "只等待負責人提供脫敏 metadata pointer；不得收 raw response 或啟動 repo / refs 動作。",
"received_response_count": 0,
"accepted_response_count": 0,
"runtime_gate_count": 0,
"raw_payload_allowed": false,
"secret_plaintext_allowed": false,
"action_buttons_allowed": false,
"execution_authorized": false,
"not_approval": true,
"still_forbidden": [
"mark_received_from_handoff_queue",
"mark_accepted_from_handoff_queue",
"store_owner_response_raw_body",
"create_github_repo",
"sync_refs",
"switch_github_primary"
]
},
{
"handoff_lane_id": "namespaceIdentity",
"display_order": 2,
"source_template_id": "response-org-user-endpoint-identity",
"template_label": "D2",
"handoff_status": "waiting_owner_response_metadata",
"required_owner_field_count": 6,
"required_owner_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"canonical_namespace",
"evidence_refs",
"followup_owner"
],
"current_blocker": "缺少 Gitea `wooo` user / org canonical namespace 判定。",
"next_safe_step": "只等待負責人提供 canonical namespace 與脫敏 evidence ref；不得使用 write/admin token。",
"received_response_count": 0,
"accepted_response_count": 0,
"runtime_gate_count": 0,
"raw_payload_allowed": false,
"secret_plaintext_allowed": false,
"action_buttons_allowed": false,
"execution_authorized": false,
"not_approval": true,
"still_forbidden": [
"mark_received_from_handoff_queue",
"mark_accepted_from_handoff_queue",
"store_owner_response_raw_body",
"store_token_value",
"write_gitea_repo",
"switch_github_primary"
]
},
{
"handoff_lane_id": "adjacentScope",
"display_order": 3,
"source_template_id": "response-internal-110-adjacent-scope",
"template_label": "D3",
"handoff_status": "waiting_owner_response_metadata",
"required_owner_field_count": 6,
"required_owner_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_sources",
"evidence_refs",
"followup_owner"
],
"current_blocker": "缺少 110 相鄰來源逐項 scope 判定。",
"next_safe_step": "只等待 owner 標示來源是否 in-scope、legacy、external 或需補證；不得 fetch、push 或刪 refs。",
"received_response_count": 0,
"accepted_response_count": 0,
"runtime_gate_count": 0,
"raw_payload_allowed": false,
"secret_plaintext_allowed": false,
"action_buttons_allowed": false,
"execution_authorized": false,
"not_approval": true,
"still_forbidden": [
"mark_received_from_handoff_queue",
"mark_accepted_from_handoff_queue",
"store_owner_response_raw_body",
"fetch_refs",
"delete_refs",
"switch_github_primary"
]
},
{
"handoff_lane_id": "canonicalOwner",
"display_order": 4,
"source_template_id": "response-repo-owner-canonical-scope",
"template_label": "D4",
"handoff_status": "waiting_owner_response_metadata",
"required_owner_field_count": 8,
"required_owner_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"repo_owner",
"canonical_source",
"github_target_candidate",
"visibility_review_owner",
"evidence_refs"
],
"current_blocker": "缺少 repo owner、canonical source、GitHub target candidate 與 visibility review owner。",
"next_safe_step": "只等待負責人補齊 owner / canonical / visibility metadata；不得建立 GitHub repo 或改 visibility。",
"received_response_count": 0,
"accepted_response_count": 0,
"runtime_gate_count": 0,
"raw_payload_allowed": false,
"secret_plaintext_allowed": false,
"action_buttons_allowed": false,
"execution_authorized": false,
"not_approval": true,
"still_forbidden": [
"mark_received_from_handoff_queue",
"mark_accepted_from_handoff_queue",
"store_owner_response_raw_body",
"create_github_repo",
"change_repo_visibility",
"switch_github_primary"
]
},
{
"handoff_lane_id": "legacyDisposition",
"display_order": 5,
"source_template_id": "response-legacy-or-inaccessible-disposition",
"template_label": "D5",
"handoff_status": "waiting_owner_response_metadata",
"required_owner_field_count": 7,
"required_owner_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_repos_or_sources",
"disposition",
"evidence_refs",
"followup_owner"
],
"current_blocker": "缺少 legacy、inaccessible 或 external repo disposition 與後續 owner。",
"next_safe_step": "只等待負責人補 disposition metadata；不得 archive、delete 或停用 Gitea repo。",
"received_response_count": 0,
"accepted_response_count": 0,
"runtime_gate_count": 0,
"raw_payload_allowed": false,
"secret_plaintext_allowed": false,
"action_buttons_allowed": false,
"execution_authorized": false,
"not_approval": true,
"still_forbidden": [
"mark_received_from_handoff_queue",
"mark_accepted_from_handoff_queue",
"store_owner_response_raw_body",
"archive_repo",
"delete_repo",
"disable_gitea_repo"
]
}
],
"owner_response_audit_event_templates": [
{
"event_template_id": "audit-owner-response-request-shown",

10
docs/security/iwooos-posture-projection.snapshot.json
View File

@@ -9,6 +9,8 @@
"docs/security/security-mirror-status-rollup.snapshot.json",
"docs/security/security-rollout-policy.snapshot.json",
"docs/security/source-control-owner-response-validation-rollup.snapshot.json",
"docs/security/gitea-inventory-owner-attestation-response.snapshot.json",
"docs/schemas/gitea_inventory_owner_attestation_response_v1.schema.json",
"docs/security/source-control-primary-readiness-gate.snapshot.json",
"docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md",
"docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json",
@@ -111,6 +113,14 @@
"s4_9_owner_response_intake_accepted_count": 0,
"s4_9_owner_response_intake_rejected_count": 0,
"s4_9_owner_response_intake_runtime_gate_count": 0,
"s4_9_owner_response_intake_source_bound": true,
"s4_9_owner_response_intake_handoff_queue_count": 5,
"s4_9_owner_response_intake_handoff_queue_ready_count": 0,
"s4_9_owner_response_intake_handoff_queue_received_count": 0,
"s4_9_owner_response_intake_handoff_queue_accepted_count": 0,
"s4_9_owner_response_intake_handoff_queue_runtime_gate_count": 0,
"s4_9_owner_response_intake_handoff_queue_raw_payload_allowed": false,
"s4_9_owner_response_intake_handoff_queue_action_buttons_allowed": false,
"visual_command_dashboard_widget_count": 14,
"visual_command_dashboard_first_layer": true,
"visual_command_dashboard_default_visible": false,