wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add approval review packet contract [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-05-13 16:36:37 +08:00
parent f124df9823
commit aff70dd896
28 changed files with 800 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
docs/security/security-mirror-status-rollup.snapshot.json
View File

@@ -16,15 +16,17 @@
"docs/security/security-approval-queue.snapshot.json",
"docs/security/security-approval-gate.snapshot.json",
"docs/security/security-approval-decision-record.snapshot.json",
"docs/security/security-approval-review-packet.snapshot.json",
"docs/security/security-rollout-policy.snapshot.json"
],
"summary": {
"total_contracts": 29,
"ready_for_mirror_count": 26,
"total_contracts": 30,
"ready_for_mirror_count": 27,
"partial_ready_count": 2,
"contract_only_count": 1,
"blocked_count": 0,
"approval_queue_total": 8,
"approval_review_packet_total": 8,
"pending_approval_count": 7,
"block_candidate_count": 1,
"dry_run_status": "contract_defined_not_executed",
@@ -53,8 +55,8 @@
{
"phase_id": "S3_approval_gate",
"state": "draft_ready",
"current_result": "Approval queue 已列出 8 個候選，security_approval_gate_v1 已定義人工 gate，security_approval_decision_record_v1 已定義決策紀錄格式。",
"next_gate": "先 review redacted finding ingestion、safe crawl 與 Gitea read-only inventory；決策紀錄不等於執行授權。"
"current_result": "Approval queue 已列出 8 個候選，security_approval_gate_v1 已定義人工 gate，security_approval_decision_record_v1 已定義決策紀錄格式，security_approval_review_packet_v1 已定義人工審查封包。",
"next_gate": "先 review redacted finding ingestion、safe crawl 與 Gitea read-only inventory；review packet 與決策紀錄都不等於執行授權。"
},
{
"phase_id": "S4_migration_execution",
@@ -80,6 +82,22 @@
"把 LOW / MEDIUM observation 變成 blocking gate"
]
},
{
"action_id": "mirror_approval_review_packets",
"title": "AwoooP 顯示 8 個人工審查封包",
"mode": "approval_required",
"source_contract": "security_approval_review_packet_v1",
"allowed_processing": [
"顯示 review order、review lane、required reviewers 與 requested decision",
"顯示仍然禁止事項與 follow-up runtime gate",
"將人工決策另寫入 security_approval_decision_record_v1"
],
"blocked_processing": [
"把 review packet 當成批准",
"把 review packet 當成 execution authorization",
"新增 scan / execute / repo / refs action button"
]
},
{
"action_id": "review_redacted_finding_ingestion",
"title": "先審 redacted finding ingestion adapter",
@@ -150,7 +168,8 @@
"session_sync_notes": [
"本 rollup 是跨 Session 的共同讀取入口，避免 AwoooP 主線與 Security Supply Chain Session 對進度與 gate 判讀不一致。",
"S2/S3 目前仍屬框架期；狀態與人工 gate 可見，不代表 production ingestion、scan、repo migration 或 runtime enforcement 已啟用。",
"S3.1 只新增人工決策紀錄格式；決策紀錄仍維持 execution_authorized=false，不可直接跳到執行面。"
"S3.1 只新增人工決策紀錄格式；決策紀錄仍維持 execution_authorized=false，不可直接跳到執行面。",
"S3.2 只新增人工審查封包格式；review packet 只讓 AwoooP 顯示與準備人審，不代表批准。"
],
"forbidden_actions": [
"start_kali_scan",