From b1c639c627383afeff7593a91e14ee9dbdecde1e Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 13 May 2026 19:15:24 +0800 Subject: [PATCH] docs(security): add GitHub primary readiness gate [skip ci] --- docs/LOGBOOK.md | 22 + ...curity_mirror_status_rollup_v1.schema.json | 10 + ...trol_primary_readiness_gate_v1.schema.json | 255 ++++++++++++ ...WOOOP-MIRROR-ONLY-CONSUMPTION-CHECKLIST.md | 5 +- ...ECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md | 28 +- docs/security/SECURITY-MIRROR-ACCEPTANCE.md | 2 +- docs/security/SECURITY-MIRROR-INTAKE-PLAN.md | 7 +- docs/security/SECURITY-MIRROR-READINESS.md | 7 +- docs/security/SECURITY-MIRROR-ROUTE.md | 6 +- .../security/SECURITY-MIRROR-STATUS-ROLLUP.md | 8 +- ...SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md | 5 +- .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 13 +- .../SOURCE-CONTROL-PRIMARY-READINESS-GATE.md | 63 +++ .../security-mirror-acceptance.snapshot.json | 8 +- .../security-mirror-dry-run.snapshot.json | 8 +- ...security-mirror-event-sample.snapshot.json | 9 +- .../security-mirror-intake-plan.snapshot.json | 9 +- .../security-mirror-quarantine.snapshot.json | 2 +- .../security-mirror-readiness.snapshot.json | 14 +- .../security-mirror-route.snapshot.json | 12 +- ...ecurity-mirror-status-rollup.snapshot.json | 31 +- ...pply-chain-contract-manifest.snapshot.json | 26 +- ...ntrol-primary-readiness-gate.snapshot.json | 390 ++++++++++++++++++ 23 files changed, 884 insertions(+), 56 deletions(-) create mode 100644 docs/schemas/source_control_primary_readiness_gate_v1.schema.json create mode 100644 docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md create mode 100644 docs/security/source-control-primary-readiness-gate.snapshot.json diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 4718aa19d..93330f98e 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,25 @@ +## 2026-05-13 | 資安供應鏈 S4.0：GitHub Primary Readiness Gate + +**背景**：長期方向已確認要讓 GitHub 成為 primary、Gitea 降成本地 mirror / fallback，但目前 Gitea 全量 inventory、refs truth、workflow/runner/secret name parity、owner/visibility/canonical 與 rollback ADR 都還沒完成。本輪補上 `source_control_primary_readiness_gate_v1`，先把 cutover 前必看的 gate 定義清楚。 + +**本次交付**： +- 新增 `docs/schemas/source_control_primary_readiness_gate_v1.schema.json`。 +- 新增 `docs/security/source-control-primary-readiness-gate.snapshot.json`，目前 8 個 candidate repos、7 個 in-scope blocked repos、0 個 primary ready。 +- 新增 `docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md`，以繁體中文說明 GitHub primary readiness 只做 gate 準備，不授權切換。 +- 更新資安供應鏈 manifest，contract 數量從 32 增至 33。 +- 更新鏡像 readiness、接收計畫、事件範例、路由矩陣、驗收契約、隔離契約、dry-run、status rollup、AwoooP mirror-only checklist、AwoooP handoff 與整體進度。 + +**累積狀態**： +- 鏡像 readiness 目前為 33 個 contracts：30 個 ready for mirror、2 個 partial ready、1 個 contract-only、0 個 blocked。 +- GitHub primary readiness：8 個 candidate repos、7 個 in-scope blocked、1 個 external scope review、0 個 primary ready。 +- 主要 blocking gates：Gitea authenticated inventory、refs truth / branch-tag parity、workflow / runner / secret name inventory、owner / visibility / canonical、rollback ADR。 + +**邊界**： +- 沒有建立 GitHub repo、修改 visibility、sync refs、delete refs、force push 或切 GitHub primary。 +- 沒有停用、刪除、封存或降級 Gitea repo。 +- 沒有搬移或保存 secret value。 +- 沒有新增 runtime endpoint、DB migration、model 或執行 action。 + ## 2026-05-13 | 資安供應鏈 S3.4：後續 Runtime Gate 準備契約 **背景**：S3.3 已建立 `security_approval_state_transition_v1`，讓 AwoooP 可顯示人工決策後的 next state。本輪補上 `security_followup_runtime_gate_v1`，定義 `approve_scope` 後若未來要進 runtime gate，必須先具備哪些 minimum evidence、preflight checks、rollback / disable requirement 與仍然禁止事項。 diff --git a/docs/schemas/security_mirror_status_rollup_v1.schema.json b/docs/schemas/security_mirror_status_rollup_v1.schema.json index 8092a024b..5b4b36496 100644 --- a/docs/schemas/security_mirror_status_rollup_v1.schema.json +++ b/docs/schemas/security_mirror_status_rollup_v1.schema.json @@ -66,6 +66,8 @@ "approval_state_transition_rule_total", "followup_runtime_gate_template_total", "active_runtime_gate_count", + "primary_readiness_candidate_repo_count", + "github_primary_ready_count", "pending_approval_count", "block_candidate_count", "dry_run_status", @@ -113,6 +115,14 @@ "type": "integer", "minimum": 0 }, + "primary_readiness_candidate_repo_count": { + "type": "integer", + "minimum": 0 + }, + "github_primary_ready_count": { + "type": "integer", + "minimum": 0 + }, "pending_approval_count": { "type": "integer", "minimum": 0 diff --git a/docs/schemas/source_control_primary_readiness_gate_v1.schema.json b/docs/schemas/source_control_primary_readiness_gate_v1.schema.json new file mode 100644 index 000000000..3a8713d1a --- /dev/null +++ b/docs/schemas/source_control_primary_readiness_gate_v1.schema.json @@ -0,0 +1,255 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "urn:awoooi:source-control-primary-readiness-gate-v1", + "title": "Gitea 到 GitHub Primary Readiness Gate v1", + "description": "定義 GitHub primary cutover 前，AwoooP 需要只讀顯示的 parity、owner、rollback 與人工批准門檻。此契約只做 gate 準備，不授權 repo、refs 或 primary switch。", + "type": "object", + "required": [ + "schema_version", + "status", + "date", + "mode", + "runtime_execution_authorized", + "source_indexes", + "summary", + "global_readiness_gates", + "repo_readiness", + "gate_rules", + "forbidden_actions" + ], + "properties": { + "schema_version": { + "const": "source_control_primary_readiness_gate_v1" + }, + "status": { + "type": "string", + "enum": ["draft_blocked"] + }, + "date": { + "type": "string" + }, + "mode": { + "type": "string", + "enum": ["primary_readiness_gate_only"] + }, + "runtime_execution_authorized": { + "type": "boolean", + "const": false + }, + "source_indexes": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "summary": { + "type": "object", + "required": [ + "candidate_repo_count", + "in_scope_repo_count", + "external_scope_count", + "primary_ready_count", + "blocked_in_scope_count", + "approval_required_count", + "runtime_actions_authorized", + "github_primary_switch_authorized", + "action_buttons_allowed", + "raw_secret_storage_authorized" + ], + "properties": { + "candidate_repo_count": { + "type": "integer", + "minimum": 0 + }, + "in_scope_repo_count": { + "type": "integer", + "minimum": 0 + }, + "external_scope_count": { + "type": "integer", + "minimum": 0 + }, + "primary_ready_count": { + "type": "integer", + "minimum": 0 + }, + "blocked_in_scope_count": { + "type": "integer", + "minimum": 0 + }, + "approval_required_count": { + "type": "integer", + "minimum": 0 + }, + "runtime_actions_authorized": { + "type": "boolean", + "const": false + }, + "github_primary_switch_authorized": { + "type": "boolean", + "const": false + }, + "action_buttons_allowed": { + "type": "boolean", + "const": false + }, + "raw_secret_storage_authorized": { + "type": "boolean", + "const": false + } + }, + "additionalProperties": false + }, + "global_readiness_gates": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "required": [ + "gate_id", + "title", + "status", + "required_before_primary", + "current_gap", + "allowed_now", + "execution_authorized" + ], + "properties": { + "gate_id": { + "type": "string" + }, + "title": { + "type": "string" + }, + "status": { + "type": "string", + "enum": ["blocked", "pending_review", "missing_evidence", "not_started"] + }, + "required_before_primary": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "current_gap": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "allowed_now": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "execution_authorized": { + "type": "boolean", + "const": false + } + }, + "additionalProperties": false + } + }, + "repo_readiness": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "required": [ + "github_repo", + "source_key", + "scope_status", + "readiness_state", + "risk", + "target_state", + "primary_ready", + "blockers", + "evidence_refs", + "allowed_now", + "still_forbidden" + ], + "properties": { + "github_repo": { + "type": "string" + }, + "source_key": { + "type": "string" + }, + "scope_status": { + "type": "string", + "enum": ["in_scope", "external_scope_review"] + }, + "readiness_state": { + "type": "string", + "enum": [ + "blocked_waiting_refs_parity", + "blocked_waiting_internal_remote_decision", + "blocked_waiting_target_decision", + "observe_scope_review" + ] + }, + "risk": { + "type": "string", + "enum": ["LOW", "MEDIUM", "HIGH"] + }, + "target_state": { + "type": "string" + }, + "primary_ready": { + "type": "boolean", + "const": false + }, + "blockers": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "evidence_refs": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "allowed_now": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "still_forbidden": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + }, + "additionalProperties": false + } + }, + "gate_rules": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "forbidden_actions": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + }, + "additionalProperties": false +} diff --git a/docs/security/AWOOOP-MIRROR-ONLY-CONSUMPTION-CHECKLIST.md b/docs/security/AWOOOP-MIRROR-ONLY-CONSUMPTION-CHECKLIST.md index fe7e9596d..e0209724d 100644 --- a/docs/security/AWOOOP-MIRROR-ONLY-CONSUMPTION-CHECKLIST.md +++ b/docs/security/AWOOOP-MIRROR-ONLY-CONSUMPTION-CHECKLIST.md @@ -53,6 +53,7 @@ AwoooP 初期不得直接啟動掃描、不得呼叫 Codex patch runner、不得 | `source_control_reconcile_plan_v1` | refs-blocked repo draft reconcile plan | Approval candidate、migration reviewer handoff | approval-only | 只顯示草案，不 push refs、不切 primary | | `source_control_ref_detail_diff_v1` | refs-blocked repo branch/tag 明細 diff | Migration reviewer evidence | mirror-only | 只顯示 diff，不 fetch、不 push、不刪 refs | | `source_control_ref_truth_classification_v1` | refs diff 真相來源與 deprecated 候選分類 | Repo owner review queue、migration reviewer handoff | approval-only | 只顯示分類與人工判定隊列，不執行 sync/delete | +| `source_control_primary_readiness_gate_v1` | GitHub primary readiness / parity gate | Source-control review、Operator Console、Audit | approval-only | 只顯示 primary blockers、parity gates、rollback ADR 缺口；目前 `primary_ready_count=0` | | `local_repo_canonical_probe_v1` | 本機 working tree lineage 比對 | Canonical decision evidence | mirror-only | 不自動合併、不自動建 repo、不刪除 | | `git_remote_refs_probe_v1` | 指定 repo remote refs read-only probe | Source readiness evidence | mirror-only | 不 fetch、不 push、不自動 mirror | | `approval_required_event_v1` | 上述事件的高風險 gate | Approval queue、Audit | approval-only | `blocked_until_approved=true` | @@ -97,7 +98,8 @@ AwoooP 初期不得直接啟動掃描、不得呼叫 Codex patch runner、不得 | `security_approval_review_packet_v1.mode=approval_review_packet_only` | `approve_required` | 顯示 8 個 review packets、review lane 與 still forbidden；不得當成批准或執行授權 | | `security_approval_state_transition_v1.mode=approval_state_transition_only` | `observe` | 顯示 5 個 decision options 的 next state；不得把 transition 當 execution authorization | | `security_followup_runtime_gate_v1.mode=runtime_gate_preparation_only` | `observe` | 顯示 8 個後續 runtime gate 準備模板、0 個 active runtime gates；不得新增 action button | -| `security_mirror_readiness_v1.status=draft` | `observe` | 顯示 32 個 contracts 的 readiness；不得把 readiness 當 execution authorization | +| `source_control_primary_readiness_gate_v1.status=draft_blocked` | `approve_required` | 顯示 8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready；不得切 primary | +| `security_mirror_readiness_v1.status=draft` | `observe` | 顯示 33 個 contracts 的 readiness；不得把 readiness 當 execution authorization | | `security_mirror_intake_plan_v1.status=draft` | `observe` | 顯示 5 個 intake waves 與 4 個 acceptance gates；不得執行 wave | | `security_mirror_event_v1.execution_authorized=false` | `observe` | 只包裝鏡像 payload，明確不授權執行、不顯示執行按鈕 | | `security_mirror_route_v1.status=draft` | `observe` | 顯示 5 個 route groups、channel policy 與 review lane；不得轉成 execution router | @@ -165,6 +167,7 @@ AwoooP 初期不得直接啟動掃描、不得呼叫 Codex patch runner、不得 | Source Control draft reconcile plan | `docs/security/source-control-reconcile-plan.snapshot.json` / `docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md` | | Source Control branch/tag detail diff | `docs/security/source-control-ref-detail-diff.snapshot.json` / `docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md` | | Source Control ref truth classification | `docs/security/source-control-ref-truth-classification.snapshot.json` / `docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md` | +| Source Control GitHub primary readiness gate | `docs/security/source-control-primary-readiness-gate.snapshot.json` / `docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md` | | Kali 112 integration status | `docs/security/kali-integration-status.snapshot.json` / `docs/security/KALI-INTEGRATION-STATUS.md` | | Security finding contract | `docs/security/security-finding-kali-sample.snapshot.json` / `docs/security/SECURITY-FINDING-CONTRACT.md` | | Kali scan scope approval package | `docs/security/kali-scan-scope-approval.snapshot.json` / `docs/security/KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md` | diff --git a/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md b/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md index 23c28726f..79380cd50 100644 --- a/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md +++ b/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md @@ -73,7 +73,7 @@ ```text Kali / Code Review / GitHub / Gitea / Codex -> security_supply_chain_contract_manifest_v1 - -> security_mirror_readiness_v1 / security_mirror_intake_plan_v1 / security_mirror_event_v1 / security_mirror_route_v1 / security_mirror_acceptance_v1 / security_mirror_quarantine_v1 / security_mirror_dry_run_v1 / security_mirror_status_rollup_v1 / security_finding_v1 / kali_scan_scope_approval_v1 / security_approval_queue_v1 / security_approval_gate_v1 / security_approval_decision_record_v1 / security_approval_review_packet_v1 / security_approval_state_transition_v1 / security_followup_runtime_gate_v1 / coding_task_v1 / source_control_migration_event_v1 / gitea_repo_inventory_v1 / local_git_remote_inventory_v1 / github_target_probe_v1 / github_target_decision_v1 / github_target_repo_approval_package_v1 / security_rollout_policy_v1 + -> security_mirror_readiness_v1 / security_mirror_intake_plan_v1 / security_mirror_event_v1 / security_mirror_route_v1 / security_mirror_acceptance_v1 / security_mirror_quarantine_v1 / security_mirror_dry_run_v1 / security_mirror_status_rollup_v1 / security_finding_v1 / kali_scan_scope_approval_v1 / security_approval_queue_v1 / security_approval_gate_v1 / security_approval_decision_record_v1 / security_approval_review_packet_v1 / security_approval_state_transition_v1 / security_followup_runtime_gate_v1 / source_control_primary_readiness_gate_v1 / coding_task_v1 / source_control_migration_event_v1 / gitea_repo_inventory_v1 / local_git_remote_inventory_v1 / github_target_probe_v1 / github_target_decision_v1 / github_target_repo_approval_package_v1 / security_rollout_policy_v1 -> AWOOOI ingestion / asset_inventory / AIOps KPI / AOL -> mirror 到 AwoooP Runtime State / Channel Event / Audit -> AwoooP Policy / Approval / Exception / Operator Console @@ -195,6 +195,18 @@ Snapshot：`docs/security/security-followup-runtime-gate.snapshot.json` AwoooP 初期處理方式：只顯示準備條件與禁止事項，不新增 action button，不啟用 runtime gate，不執行 scan、repo、refs、deploy、secret、RBAC、NetworkPolicy 或 firewall 類動作。 +### `source_control_primary_readiness_gate_v1` + +用途：定義 S4.0 GitHub primary readiness gate，讓 AwoooP 在任何 primary cutover 前能顯示 Gitea inventory、refs truth、workflow/runner/secret name parity、owner/visibility/canonical 與 rollback ADR 缺口。 + +Schema：`docs/schemas/source_control_primary_readiness_gate_v1.schema.json` + +Snapshot：`docs/security/source-control-primary-readiness-gate.snapshot.json` + +目前 readiness gate：8 個 candidate repos、7 個 in-scope blocked repos、1 個 external scope review、0 個 primary ready。所有 repo / refs / primary switch 動作都必須維持 disabled。 + +AwoooP 初期處理方式：只顯示 blockers、evidence refs 與 required review，不建立 GitHub repo、不修改 visibility、不 sync refs、不切 primary、不停用 Gitea。 + ### `security_mirror_readiness_v1` 用途：集中整理 Security Supply Chain contracts 的 mirror readiness，讓 AwoooP 先知道哪些可 mirror、哪些 partial、哪些 contract-only。 @@ -203,7 +215,7 @@ Schema：`docs/schemas/security_mirror_readiness_v1.schema.json` Snapshot：`docs/security/security-mirror-readiness.snapshot.json` -目前 readiness：32 個 contracts，29 個 ready for mirror，2 個 partial ready，1 個 contract-only，0 個 blocked。所有 contract 都是 `execution_allowed=false`。 +目前 readiness：33 個 contracts，30 個 ready for mirror，2 個 partial ready，1 個 contract-only，0 個 blocked。所有 contract 都是 `execution_allowed=false`。 AwoooP 初期處理方式：先 mirror readiness index，再依 readiness 分批 mirror 其他 snapshots；不得把 readiness 當 execution authorization。 @@ -239,7 +251,7 @@ Schema：`docs/schemas/security_mirror_route_v1.schema.json` Snapshot：`docs/security/security-mirror-route.snapshot.json` -目前 route：5 個 route groups，涵蓋 32 個 contracts；所有 route 都是 `runtime_execution_authorized=false`。 +目前 route：5 個 route groups，涵蓋 33 個 contracts；所有 route 都是 `runtime_execution_authorized=false`。 AwoooP 初期處理方式：只依 route group 顯示 Operator Console / Runtime State / Channel Event / Audit / Approval Queue，不把 route 轉成 execution router。 @@ -287,7 +299,7 @@ Schema：`docs/schemas/security_mirror_status_rollup_v1.schema.json` Snapshot：`docs/security/security-mirror-status-rollup.snapshot.json` -目前 rollup：`framework_ready_waiting_approval`；32 個 contracts、29 ready、2 partial、1 contract-only、0 blocked；approval queue 仍為 8 items，其中 7 pending approval、1 block candidate；review packets 8 筆；state transition rules 5 筆；follow-up runtime gate templates 8 筆；active runtime gates 0 筆；decision records 目前 0 筆。 +目前 rollup：`framework_ready_waiting_approval`；33 個 contracts、30 ready、2 partial、1 contract-only、0 blocked；approval queue 仍為 8 items，其中 7 pending approval、1 block candidate；review packets 8 筆；state transition rules 5 筆；follow-up runtime gate templates 8 筆；active runtime gates 0 筆；GitHub primary candidate repos 8 筆；primary ready 0 筆；decision records 目前 0 筆。 AwoooP 初期處理方式：只顯示階段狀態、下一個 gate 與禁止事項，可寫入 Audit evidence；不得把 rollup 當 runtime authorization。 @@ -323,7 +335,7 @@ Schema：`docs/schemas/security_supply_chain_contract_manifest_v1.schema.json` "schema_version": "security_supply_chain_contract_manifest_v1", "status": "draft", "default_enforcement_level": "mirror_only", - "contract_count": 32 + "contract_count": 33 } ``` @@ -738,7 +750,7 @@ Console 初期不提供高風險執行按鈕。 2026-05-12 contract manifest 追加：已新增 `docs/schemas/security_supply_chain_contract_manifest_v1.schema.json`、`docs/security/security-supply-chain-contract-manifest.snapshot.json` 與 `docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md`。AwoooP 應先讀 manifest 作為 mirror-only contract registry，不把 manifest 當 execution router。 -2026-05-13 mirror route 追加：已新增 `docs/schemas/security_mirror_route_v1.schema.json`、`docs/security/security-mirror-route.snapshot.json` 與 `docs/security/SECURITY-MIRROR-ROUTE.md`。AwoooP 可依 5 個 route groups 將 32 個 contracts 分流到 Operator Console、Runtime State、Channel Event、Audit evidence 與 Approval Queue；route 只決定目的地、channel policy 與 review lane，不是 execution router。 +2026-05-13 mirror route 追加：已新增 `docs/schemas/security_mirror_route_v1.schema.json`、`docs/security/security-mirror-route.snapshot.json` 與 `docs/security/SECURITY-MIRROR-ROUTE.md`。AwoooP 可依 5 個 route groups 將 33 個 contracts 分流到 Operator Console、Runtime State、Channel Event、Audit evidence 與 Approval Queue；route 只決定目的地、channel policy 與 review lane，不是 execution router。 2026-05-13 mirror acceptance 追加：已新增 `docs/schemas/security_mirror_acceptance_v1.schema.json`、`docs/security/security-mirror-acceptance.snapshot.json` 與 `docs/security/SECURITY-MIRROR-ACCEPTANCE.md`。AwoooP 可用 7 個 acceptance checks 驗收 mirror ingestion；blocking checks 只針對 contract count mismatch、缺 event envelope、route coverage 不完整或未脫敏 evidence，不得阻擋 runtime 流程。 @@ -746,7 +758,7 @@ Console 初期不提供高風險執行按鈕。 2026-05-13 mirror dry-run 追加：已新增 `docs/schemas/security_mirror_dry_run_v1.schema.json`、`docs/security/security-mirror-dry-run.snapshot.json` 與 `docs/security/SECURITY-MIRROR-DRY-RUN.md`。AwoooP 未來可用 6 個 dry-run steps 回報接入演練結果；本 snapshot 狀態為 `contract_defined_not_executed`，不得視為 production ingestion 已啟用。 -2026-05-13 mirror status rollup 追加：已新增 `docs/schemas/security_mirror_status_rollup_v1.schema.json`、`docs/security/security-mirror-status-rollup.snapshot.json` 與 `docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md`。AwoooP 與 Security Supply Chain Session 可用同一份 rollup 同步 S0-S4、32 個 contracts、approval queue summary、review packet summary、state transition summary、follow-up runtime gate template summary 與下一個安全 gate；本契約不授權任何 runtime action。 +2026-05-13 mirror status rollup 追加：已新增 `docs/schemas/security_mirror_status_rollup_v1.schema.json`、`docs/security/security-mirror-status-rollup.snapshot.json` 與 `docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md`。AwoooP 與 Security Supply Chain Session 可用同一份 rollup 同步 S0-S4、33 個 contracts、approval queue summary、review packet summary、state transition summary、follow-up runtime gate template summary、GitHub primary readiness summary 與下一個安全 gate；本契約不授權任何 runtime action。 2026-05-13 S3 approval gate 追加：已新增 `docs/schemas/security_approval_gate_v1.schema.json`、`docs/security/security-approval-gate.snapshot.json` 與 `docs/security/SECURITY-APPROVAL-GATE.md`。AwoooP 可用 8 個 gate items 記錄人工批准、拒絕、延後或補 evidence；批准後仍需 follow-up runtime gate，不得直接執行。 @@ -758,6 +770,8 @@ Console 初期不提供高風險執行按鈕。 2026-05-13 S3 follow-up runtime gate 準備追加：已新增 `docs/schemas/security_followup_runtime_gate_v1.schema.json`、`docs/security/security-followup-runtime-gate.snapshot.json` 與 `docs/security/SECURITY-FOLLOWUP-RUNTIME-GATE.md`。AwoooP 可顯示 8 個後續 runtime gate 準備模板、minimum evidence、preflight checks 與 rollback / disable requirement；目前 `active_runtime_gates=0`，不得新增 action button 或啟用 runtime gate。 +2026-05-13 S4.0 GitHub primary readiness gate 追加：已新增 `docs/schemas/source_control_primary_readiness_gate_v1.schema.json`、`docs/security/source-control-primary-readiness-gate.snapshot.json` 與 `docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md`。AwoooP 可顯示 8 個 candidate repos、7 個 in-scope blocked repos、Gitea inventory、refs truth、workflow/runner/secret name parity 與 rollback ADR 缺口；目前 `primary_ready_count=0`，不得建立 repo、sync refs、切 GitHub primary 或停用 Gitea。 + 2026-05-13 Kali 112 live 整合狀態追加：已在授權下登入 `192.168.0.112` 做 read-only 盤點與低風險更新，並新增 `docs/schemas/kali_integration_status_v1.schema.json`、`docs/security/kali-integration-status.snapshot.json` 與 `docs/security/KALI-INTEGRATION-STATUS.md`。Kali Scanner API `/health` healthy、`kali-scanner.service` active/enabled、node-exporter 與 wg-easy container up；已 targeted update `nmap`、`nikto`、`nuclei`、`curl`、`openssl`、CA 套件，安裝 `jq`，時區改為 `Asia/Taipei`，更新後無 reboot required。AwoooP 可 mirror health / update / gap evidence，但不得直接啟動 scan、credentialed scan 或 `/execute`。 本波仍不做： diff --git a/docs/security/SECURITY-MIRROR-ACCEPTANCE.md b/docs/security/SECURITY-MIRROR-ACCEPTANCE.md index 328a94c8f..6731d00fd 100644 --- a/docs/security/SECURITY-MIRROR-ACCEPTANCE.md +++ b/docs/security/SECURITY-MIRROR-ACCEPTANCE.md @@ -27,7 +27,7 @@ | Check | 目的 | 失敗時是否阻擋鏡像 | |-------|------|--------------------| -| `CONTRACT_COUNT_MATCH` | 確認 manifest、readiness、route coverage 對齊 32 個 contracts | 是 | +| `CONTRACT_COUNT_MATCH` | 確認 manifest、readiness、route coverage 對齊 33 個 contracts | 是 | | `EVENT_ENVELOPE_REQUIRED` | 確認每筆 payload 都不可執行、不可顯示執行按鈕 | 是 | | `ROUTE_GROUP_COVERAGE` | 確認 5 個 route groups 覆蓋所有 contracts | 是 | | `REDACTION_ONLY` | 確認不保存 raw sensitive value | 是 | diff --git a/docs/security/SECURITY-MIRROR-INTAKE-PLAN.md b/docs/security/SECURITY-MIRROR-INTAKE-PLAN.md index ef978aee8..9ebe4d6f0 100644 --- a/docs/security/SECURITY-MIRROR-INTAKE-PLAN.md +++ b/docs/security/SECURITY-MIRROR-INTAKE-PLAN.md @@ -19,10 +19,10 @@ | Wave | 目的 | 主要 contracts | Exit gate | |------|------|----------------|-----------| -| `M0_index_bootstrap` | 先載入 readiness、manifest、低摩擦 policy、鏡像事件信封、鏡像路由矩陣、驗收契約、隔離契約、dry-run 報告格式、status rollup、approval gate、decision record、review packet、state transition 與 follow-up runtime gate preparation | readiness / manifest / rollout policy / mirror event / mirror route / acceptance / quarantine / dry-run / status rollup / approval gate / decision record / review packet / state transition / follow-up runtime gate | 顯示 32 個 contract 且 `execution_allowed=false` | +| `M0_index_bootstrap` | 先載入 readiness、manifest、低摩擦 policy、鏡像事件信封、鏡像路由矩陣、驗收契約、隔離契約、dry-run 報告格式、status rollup、approval gate、decision record、review packet、state transition、follow-up runtime gate preparation 與 GitHub primary readiness gate | readiness / manifest / rollout policy / mirror event / mirror route / acceptance / quarantine / dry-run / status rollup / approval gate / decision record / review packet / state transition / follow-up runtime gate / primary readiness gate | 顯示 33 個 contract 且 `execution_allowed=false` | | `M1_kali_visibility` | 顯示 Kali 112、scan scope、approval queue | Kali status / scan scope / approval queue / finding sample | 顯示 5 個 scope groups 與 8 個 queue items，沒有執行按鈕 | -| `M2_source_control_visibility` | 顯示 Gitea/GitHub source-control evidence | migration / inventory / refs / approval board | 顯示 blocking reasons，repo/refs actions 全 disabled | -| `M3_approval_candidates` | 顯示 approval candidates、S3 gate、decision record、review packet、state transition、follow-up runtime gate preparation 與人工決策留痕 | approval events / approval queue / approval gate / decision record / review packet / state transition / follow-up runtime gate / source-control board | 可留痕，不可自動批准或執行 | +| `M2_source_control_visibility` | 顯示 Gitea/GitHub source-control evidence 與 GitHub primary readiness blockers | migration / inventory / refs / approval board / primary readiness gate | 顯示 blocking reasons，repo/refs/primary actions 全 disabled | +| `M3_approval_candidates` | 顯示 approval candidates、S3 gate、decision record、review packet、state transition、follow-up runtime gate preparation、GitHub primary readiness gate 與人工決策留痕 | approval events / approval queue / approval gate / decision record / review packet / state transition / follow-up runtime gate / primary readiness gate / source-control board | 可留痕，不可自動批准或執行 | | `M4_patch_only_backlog` | 顯示 Codex patch-only backlog lane | coding task | 只顯示 lane，不接 Codex runner action | ## 2. AwoooP 可做 @@ -41,6 +41,7 @@ 12. 使用 `security_approval_review_packet_v1` 顯示 review packet、required reviewers、blocked reason、evidence refs、review order。 13. 使用 `security_approval_state_transition_v1` 顯示人工決策後的 next state，但不自動執行後續動作。 14. 使用 `security_followup_runtime_gate_v1` 顯示未來 runtime gate 的準備模板，但不啟用 runtime gate。 +15. 使用 `source_control_primary_readiness_gate_v1` 顯示 GitHub primary parity、owner、rollback 與人工批准缺口，但不切 primary。 ## 3. AwoooP 不可做 diff --git a/docs/security/SECURITY-MIRROR-READINESS.md b/docs/security/SECURITY-MIRROR-READINESS.md index 023706a7f..0d7858f5a 100644 --- a/docs/security/SECURITY-MIRROR-READINESS.md +++ b/docs/security/SECURITY-MIRROR-READINESS.md @@ -23,7 +23,7 @@ | 狀態 | 數量 | 說明 | |------|------|------| -| `ready_for_mirror` | 29 | 可直接 mirror 成 Operator Console / Runtime State / Channel Event / Audit evidence | +| `ready_for_mirror` | 30 | 可直接 mirror 成 Operator Console / Runtime State / Channel Event / Audit evidence | | `partial_ready` | 2 | 可 mirror，但 evidence 仍不完整 | | `contract_only` | 1 | 有 schema / handoff，尚無正式 snapshot | | `blocked` | 0 | 目前沒有禁止 mirror 的 contract | @@ -80,7 +80,8 @@ AwoooP 可以將 ready / partial contracts mirror 到： 12. 再 mirror `security_approval_review_packet_v1`，只顯示人工審查封包、review lane 與仍然禁止事項。 13. 再 mirror `security_approval_state_transition_v1`，只顯示決策後 next state 與 follow-up runtime gate。 14. 再 mirror `security_followup_runtime_gate_v1`，只顯示 runtime gate 準備模板、preflight checks 與 rollback / disable requirement。 -15. 再 mirror `kali_integration_status_v1` 與 `kali_scan_scope_approval_v1`。 -16. 最後再 mirror source-control 相關 contracts。 +15. 再 mirror `source_control_primary_readiness_gate_v1`，只顯示 GitHub primary parity、owner、rollback 與人工批准缺口。 +16. 再 mirror `kali_integration_status_v1` 與 `kali_scan_scope_approval_v1`。 +17. 最後再 mirror source-control 其他 contracts。 整個 S2 不新增 execution router、不新增執行按鈕、不新增 runtime blocker。 diff --git a/docs/security/SECURITY-MIRROR-ROUTE.md b/docs/security/SECURITY-MIRROR-ROUTE.md index c8e21d0be..20e011497 100644 --- a/docs/security/SECURITY-MIRROR-ROUTE.md +++ b/docs/security/SECURITY-MIRROR-ROUTE.md @@ -27,8 +27,8 @@ |-------------|------|---------------------|-------------| | `M0_index_bootstrap` | 載入 readiness、manifest、policy、event、intake、route、acceptance、quarantine、dry-run、status rollup、S3 review packet、state transition 與 follow-up runtime gate 位置 | `no_channel_event` | `observe` | | `M1_kali_visibility` | 顯示 Kali 112、111 / 168 scope、approval queue 與 finding sample | `approval_required_only` | `approval_required` | -| `M2_source_control_visibility` | 顯示 Gitea / GitHub repo、branch、tag、canonical 差異 | `low_noise_status` | `source_control_review` | -| `M3_approval_candidates` | 顯示人工批准候選、S3 gate、decision record、review packet、state transition、follow-up runtime gate preparation 與留痕 | `approval_required_only` | `approval_required` | +| `M2_source_control_visibility` | 顯示 Gitea / GitHub repo、branch、tag、canonical 差異與 GitHub primary readiness blockers | `low_noise_status` | `source_control_review` | +| `M3_approval_candidates` | 顯示人工批准候選、S3 gate、decision record、review packet、state transition、follow-up runtime gate preparation、GitHub primary readiness gate 與留痕 | `approval_required_only` | `approval_required` | | `M4_patch_only_backlog` | 顯示 Code Review 後的 Codex patch-only backlog lane | `no_channel_event` | `patch_only` | ## 2. AwoooP 可做 @@ -52,7 +52,7 @@ S2.7 後，AwoooP 主線只需要能讀到： -1. 32 個 contracts。 +1. 33 個 contracts。 2. 5 個 route groups。 3. 所有 route group 都是 `runtime_execution_authorized=false`。 4. Channel Event 初期低噪音。 diff --git a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md index 5204831c1..6fc4cf95e 100644 --- a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md +++ b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md @@ -19,14 +19,15 @@ | 類型 | 狀態 | |------|------| -| Contract manifest | 32 個 contracts | -| Mirror readiness | 29 ready、2 partial、1 contract-only、0 blocked | +| Contract manifest | 33 個 contracts | +| Mirror readiness | 30 ready、2 partial、1 contract-only、0 blocked | | Approval queue | 8 items：7 pending approval、1 block candidate | | Approval gate | S3.0 已建立；0 approved、7 pending、1 block candidate | | Decision records | S3.1 已建立；目前 0 筆決策紀錄 | | Review packets | S3.2 已建立；8 packets、7 ready for human review、1 block candidate | | State transitions | S3.3 已建立；5 個 decision options 都有 next state，且都不授權執行 | | Follow-up runtime gate templates | S3.4 已建立；8 個 templates、0 個 active runtime gates | +| GitHub primary readiness gate | S4.0 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready | | Dry-run | `contract_defined_not_executed` | | Runtime actions | `false` | | Payload ingestion | `false` | @@ -51,12 +52,13 @@ 下一步仍不是 runtime enforcement。 -建議先讓 AwoooP 主線只讀消費本 rollup、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1` 與 `security_followup_runtime_gate_v1`，並由人工依序 review： +建議先讓 AwoooP 主線只讀消費本 rollup、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1` 與 `source_control_primary_readiness_gate_v1`，並由人工依序 review： 1. redacted finding ingestion adapter。 2. safe web crawl scope。 3. Gitea private/internal read-only inventory。 4. GitHub target / owner / visibility / canonical。 5. Kali `/execute` 維持 block candidate。 +6. GitHub primary readiness blockers 與 rollback ADR 缺口。 任何批准後的執行仍需下一階段 runtime gate 與獨立 evidence，不得由本 rollup 自動觸發。 diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md b/docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md index be6bcd44e..3196c97a8 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-CONTRACT-MANIFEST.md @@ -11,7 +11,7 @@ ## 0. 核心結論 -目前 Security Supply Chain 已有 32 個主要契約可交給 AwoooP 消費。Manifest 的用途是把分散的 schema、snapshot、人讀文件、允許動作與禁止動作收成一份入口，避免不同 Session 各自解讀。 +目前 Security Supply Chain 已有 33 個主要契約可交給 AwoooP 消費。Manifest 的用途是把分散的 schema、snapshot、人讀文件、允許動作與禁止動作收成一份入口，避免不同 Session 各自解讀。 初期預設仍是 `mirror_only`。Manifest 不授權 runtime enforcement、不授權 GitHub/Gitea 主控切換、不授權 repo 建立或 refs sync。 @@ -48,6 +48,7 @@ | `source_control_reconcile_plan_v1` | approval-only | refs-blocked repo 的 draft reconcile plan | `source-control-reconcile-plan.snapshot.json` | | `source_control_ref_detail_diff_v1` | mirror-only | refs-blocked repo 的 branch/tag 明細 diff | `source-control-ref-detail-diff.snapshot.json` | | `source_control_ref_truth_classification_v1` | approval-only | refs diff 的真相來源候選與 deprecated 候選分類 | `source-control-ref-truth-classification.snapshot.json` | +| `source_control_primary_readiness_gate_v1` | approval-only | GitHub primary readiness / parity gate | `source-control-primary-readiness-gate.snapshot.json` | | `local_repo_canonical_probe_v1` | mirror-only | momo/ewoooc lineage evidence | `local-repo-canonical-ewoooc-momo.snapshot.json` | | `git_remote_refs_probe_v1` | mirror-only | 110 / GitHub remote refs readiness | `bitan-tsenyang`、`wooo-infra-config` | | `approval_required_event_v1` | approval-only | 高風險 / 敏感邊界 approval | `gitea-readonly-inventory-approval.snapshot.json` | @@ -57,7 +58,7 @@ 1. 先讀 `security_rollout_policy_v1`，確認目前仍是 `mirror_only`。 2. 再讀本 manifest，取得可消費 contract 與禁止動作。 3. 將 snapshot mirror 成 Runtime State / Channel Event / Audit evidence。 -4. 只對 `approval_required_event_v1`、repo approval package、`security_approval_review_packet_v1`、`security_approval_state_transition_v1` 與 `security_followup_runtime_gate_v1` 建 approval candidate / review lane / next-state display / runtime gate preparation display。 +4. 只對 `approval_required_event_v1`、repo approval package、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1` 與 `source_control_primary_readiness_gate_v1` 建 approval candidate / review lane / next-state display / runtime gate preparation / primary readiness display。 5. 不新增執行按鈕，不做 runtime enforcement。 ## 3. 永久禁止 diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index 9e3f5e3cc..e507674fc 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -4,7 +4,7 @@ |------|------| | 日期 | 2026-05-13 | | 狀態 | S0/S1 read-only evidence 建置中 | -| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 | +| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + GitHub Primary Readiness Gate + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | ## 0. 本階段完成後整體進度 @@ -20,11 +20,11 @@ | S1.2b branch/tag detail diff | 完成草案 | 3 個 refs-blocked mapped repos 已完成 branch/tag 明細 diff；已忽略本 PR 分支避免 evidence 自我污染 | 人工判定真相來源與 deprecated refs | | S1.2c refs 真相來源分類 | 完成草案 | 141 個 ref review items 已分類：4 個真相來源、114 個 drift deprecated 候選、3 個 release tags、20 個 GitHub-only refs | repo owner 單 ref / 單 repo 判定 | | S1.3 低摩擦 rollout policy | 完成草案 | observe-first / mirror-only matrix 已建立 | AwoooP read-only policy 消費 | -| S1.4 契約索引 | 完成草案 | 32 個主要 contract 已集中成 manifest | AwoooP mirror-only contract registry | +| S1.4 契約索引 | 完成草案 | 33 個主要 contract 已集中成 manifest | AwoooP mirror-only contract registry | | S1.5 Kali 112 live 整合狀態 | 完成第一波 | 112 已登入盤點、scanner API healthy、targeted scanner packages updated、Asia/Taipei timezone、no reboot required | scan result ingestion + `/execute` high-risk gate | | S1.6 Kali finding / scan scope approval | 完成草案 | `security_finding_v1` sample snapshot 與 `kali_scan_scope_approval_v1` approval package 已建立；111/168 已納入 observe-only scope | 人工批准 safe crawl / credentialed scan / runtime ingestion / full-upgrade gate | | S1.7 Security approval queue | 完成草案 | 8 個 approval queue items 已集中：7 pending approval、1 block candidate；AwoooP 可 mirror 但不得執行 | 先 review redacted finding ingestion，再 review safe crawl / Gitea inventory | -| S2 AwoooP mirror-only readiness | 完成草案 | `security_mirror_readiness_v1` 已整理 32 個 contracts：29 ready、2 partial、1 contract-only、0 blocked | AwoooP 主線建立只讀入口 | +| S2 AwoooP mirror-only readiness | 完成草案 | `security_mirror_readiness_v1` 已整理 33 個 contracts：30 ready、2 partial、1 contract-only、0 blocked | AwoooP 主線建立只讀入口 | | S2.1 AwoooP mirror-only intake plan | 完成草案 | `security_mirror_intake_plan_v1` 已建立 5 個 intake waves 與 4 個 acceptance gates | AwoooP 主線照 wave mirror，不新增 execution router | | S2.2 AwoooP 鏡像事件信封 | 完成草案 | `security_mirror_event_v1` 已建立，要求每筆鏡像 payload 標示 `execution_authorized=false` 與 `action_buttons_allowed=false` | AwoooP 鏡像 payload 統一信封 | | S2.3 AwoooP 鏡像路由矩陣 | 完成草案 | `security_mirror_route_v1` 已建立 5 個 route groups，定義目的地、channel policy 與 review lane | AwoooP 消費時不猜路由、不新增執行入口 | @@ -38,6 +38,7 @@ | S3.2 人工審查封包契約 | 完成草案 | `security_approval_review_packet_v1` 已建立；8 個 review packets、7 ready for human review、1 block candidate、0 個 runtime action 授權 | AwoooP 可顯示 review lane，不可把 packet 當批准或執行 | | S3.3 人工決策狀態轉移契約 | 完成草案 | `security_approval_state_transition_v1` 已建立；5 個 decision options 都有 next state、0 個 runtime action 授權 | AwoooP 可顯示決策後狀態，不可把 transition 當執行 | | S3.4 後續 runtime gate 準備契約 | 完成草案 | `security_followup_runtime_gate_v1` 已建立；8 個 gate templates、0 個 active runtime gates、0 個 approved scope | AwoooP 可顯示前置 evidence、preflight checks 與 rollback / disable requirement，不可啟用 runtime gate | +| S4.0 GitHub primary readiness gate | 完成草案 | `source_control_primary_readiness_gate_v1` 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready | AwoooP 可顯示 parity、owner、rollback ADR 缺口，不可切 primary | | S4 migration execution | 未開始 | GitHub primary 長期方向已確認，但 refs / tags / workflow / secret 名稱尚未全量驗證 | SHA/tag/workflow parity 與 rollback ADR | ## 1. 已建立的主要 evidence @@ -66,6 +67,8 @@ | Source Control branch/tag detail diff JSON | `docs/security/source-control-ref-detail-diff.snapshot.json` | | Source Control ref truth classification | `docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md` | | Source Control ref truth classification JSON | `docs/security/source-control-ref-truth-classification.snapshot.json` | +| Source Control GitHub primary readiness gate | `docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md` | +| Source Control GitHub primary readiness gate JSON | `docs/security/source-control-primary-readiness-gate.snapshot.json` | | Kali 112 integration status | `docs/security/KALI-INTEGRATION-STATUS.md` | | Kali 112 integration status JSON | `docs/security/kali-integration-status.snapshot.json` | | Security finding contract | `docs/security/SECURITY-FINDING-CONTRACT.md` | @@ -129,6 +132,6 @@ 3. 依 `SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md` 對 `awoooi`、`clawbot-v5`、`wooo-aiops` 做單 repo / 單 ref owner 判定；仍不得 push refs。 4. 對 `ewoooc` / `momo-pro-system` 完成 server-side canonical 判定。 5. 依 `KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md` 取得 safe crawl、credentialed scan、runtime ingestion、full-upgrade / reboot 等 gate 的人工批准；不得直接接 `/execute`。 -6. AwoooP 主線先讀 `security_mirror_readiness_v1`、`security_mirror_intake_plan_v1`、`security_mirror_event_v1`、`security_mirror_route_v1`、`security_mirror_acceptance_v1`、`security_mirror_quarantine_v1`、`security_mirror_dry_run_v1`、`security_mirror_status_rollup_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1` 與 `security_followup_runtime_gate_v1`，只建立 mirror-only / read-only policy 入口，不新增執行按鈕。 +6. AwoooP 主線先讀 `security_mirror_readiness_v1`、`security_mirror_intake_plan_v1`、`security_mirror_event_v1`、`security_mirror_route_v1`、`security_mirror_acceptance_v1`、`security_mirror_quarantine_v1`、`security_mirror_dry_run_v1`、`security_mirror_status_rollup_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1` 與 `source_control_primary_readiness_gate_v1`，只建立 mirror-only / read-only policy 入口，不新增執行按鈕。 7. AwoooP 主線消費 `security_rollout_policy_v1` 時，只做 read-only policy，不做 runtime blocking。 -8. AwoooP 主線再讀 `security_approval_queue_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1` 與 `security_supply_chain_contract_manifest_v1`，顯示 review order、批准範圍、審查封包、決策紀錄、決策後狀態、後續 runtime gate 準備條件與 blocked reason，不新增 execution router。 +8. AwoooP 主線再讀 `security_approval_queue_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1`、`source_control_primary_readiness_gate_v1` 與 `security_supply_chain_contract_manifest_v1`，顯示 review order、批准範圍、審查封包、決策紀錄、決策後狀態、後續 runtime gate 準備條件、GitHub primary readiness blockers 與 blocked reason，不新增 execution router。 diff --git a/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md b/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md new file mode 100644 index 000000000..7a03e4cac --- /dev/null +++ b/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md @@ -0,0 +1,63 @@ +# GitHub Primary Readiness Gate + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-05-13 | +| 狀態 | 草案，blocked by default | +| Schema | `docs/schemas/source_control_primary_readiness_gate_v1.schema.json` | +| Snapshot | `docs/security/source-control-primary-readiness-gate.snapshot.json` | +| 模式 | `primary_readiness_gate_only` | +| runtime 執行授權 | `false` | + +## 0. 核心結論 + +`source_control_primary_readiness_gate_v1` 是 S4.0 的 GitHub primary readiness gate 草案。 + +它只回答一件事：如果長期方向要把 Gitea 降成本地 mirror / fallback，並把 GitHub 做成 primary，AwoooP 在任何切換前必須看到哪些 parity、owner、rollback 與人工批准 evidence。 + +它不是 cutover plan，也不是 refs sync plan。目前 `primary_ready_count=0`、`github_primary_switch_authorized=false`。 + +## 1. 目前狀態 + +| 指標 | 數量 | +|------|------| +| Candidate repos | 8 | +| In-scope repos | 7 | +| External scope review | 1 | +| Primary ready | 0 | +| Blocked in-scope | 7 | +| Approval required | 7 | + +## 2. 全域 Gate + +| Gate | 目前狀態 | 說明 | +|------|----------|------| +| Gitea authenticated inventory | blocked | private/internal 全量 repo list 尚未完成 | +| refs truth / branch-tag parity | blocked | 3 個 mapped repos 仍有 refs drift | +| workflow / runner / secret name parity | missing evidence | 尚未有全量 workflow、webhook、runner、secret 名稱 inventory | +| owner / visibility / canonical | pending review | 7 個 in-scope targets 仍需人工決策 | +| rollback ADR | not started | 尚未有逐 repo GitHub primary ADR 與 rollback plan | + +## 3. AwoooP 可做 + +1. 顯示每個 repo 的 readiness state、blockers 與 evidence refs。 +2. 顯示 `primary_ready_count=0`。 +3. 將 7 個 in-scope repos 維持在 approval / review lane。 +4. 顯示哪些 evidence 仍缺：Gitea authenticated inventory、refs truth、workflow/runner/secret name inventory、rollback ADR。 +5. 把狀態寫入 Audit evidence 與 Operator Console。 + +## 4. AwoooP 不可做 + +1. 不建立 GitHub repo。 +2. 不修改 repo visibility。 +3. 不 sync refs、不 delete refs、不 force push。 +4. 不切 GitHub primary。 +5. 不停用、刪除、封存或降級 Gitea repo。 +6. 不搬移或保存 secret value。 +7. 不顯示 repo、refs、primary switch 類 action button。 + +## 5. 階段定位 + +S4.0 只是把「切換前一定要看見什麼」先定義清楚。 + +這讓長期回到 GitHub 的方向可以繼續往前，但仍維持低摩擦：目前只 mirror、只顯示、只留痕，不執行。 diff --git a/docs/security/security-mirror-acceptance.snapshot.json b/docs/security/security-mirror-acceptance.snapshot.json index 945b03d36..9f9d39c08 100644 --- a/docs/security/security-mirror-acceptance.snapshot.json +++ b/docs/security/security-mirror-acceptance.snapshot.json @@ -11,8 +11,8 @@ "docs/security/security-mirror-route.snapshot.json" ], "summary": { - "total_contracts": 32, - "ready_for_mirror_count": 29, + "total_contracts": 33, + "ready_for_mirror_count": 30, "route_group_count": 5, "acceptance_check_count": 7, "blocking_check_count": 4 @@ -21,7 +21,7 @@ { "check_id": "CONTRACT_COUNT_MATCH", "title": "契約數量一致", - "expected_result": "AwoooP 讀到 32 個 contracts，且 manifest、readiness、route coverage 的 contract 集合一致。", + "expected_result": "AwoooP 讀到 33 個 contracts，且 manifest、readiness、route coverage 的 contract 集合一致。", "evidence_refs": [ "docs/security/security-supply-chain-contract-manifest.snapshot.json", "docs/security/security-mirror-readiness.snapshot.json", @@ -60,7 +60,7 @@ { "check_id": "ROUTE_GROUP_COVERAGE", "title": "路由群組覆蓋", - "expected_result": "5 個 route groups 合併後涵蓋 manifest 32 個 contracts，且每個 group 都有 destinations、channel_policy 與 review_lane。", + "expected_result": "5 個 route groups 合併後涵蓋 manifest 33 個 contracts，且每個 group 都有 destinations、channel_policy 與 review_lane。", "evidence_refs": [ "docs/security/security-mirror-route.snapshot.json", "docs/security/SECURITY-MIRROR-ROUTE.md" diff --git a/docs/security/security-mirror-dry-run.snapshot.json b/docs/security/security-mirror-dry-run.snapshot.json index ea5da4ce7..550c7c93a 100644 --- a/docs/security/security-mirror-dry-run.snapshot.json +++ b/docs/security/security-mirror-dry-run.snapshot.json @@ -14,8 +14,8 @@ "docs/security/security-mirror-quarantine.snapshot.json" ], "summary": { - "total_contracts": 32, - "ready_for_mirror_count": 29, + "total_contracts": 33, + "ready_for_mirror_count": 30, "route_group_count": 5, "acceptance_check_count": 7, "quarantine_lane_count": 5, @@ -30,7 +30,7 @@ "docs/security/security-supply-chain-contract-manifest.snapshot.json", "docs/security/security-mirror-readiness.snapshot.json" ], - "pass_condition": "看到 32 個 contracts、29 個 ready for mirror，且所有 contract execution_allowed=false。", + "pass_condition": "看到 33 個 contracts、30 個 ready for mirror，且所有 contract execution_allowed=false。", "execution_allowed": false, "blocked_actions": [ "execute_contract", @@ -60,7 +60,7 @@ "docs/security/security-mirror-route.snapshot.json", "docs/security/SECURITY-MIRROR-ROUTE.md" ], - "pass_condition": "route groups 合併後涵蓋 32 個 contracts，沒有未知 execution route。", + "pass_condition": "route groups 合併後涵蓋 33 個 contracts，沒有未知 execution route。", "execution_allowed": false, "blocked_actions": [ "fallback_to_execution_route", diff --git a/docs/security/security-mirror-event-sample.snapshot.json b/docs/security/security-mirror-event-sample.snapshot.json index 54e8e5537..8712e89a3 100644 --- a/docs/security/security-mirror-event-sample.snapshot.json +++ b/docs/security/security-mirror-event-sample.snapshot.json @@ -16,8 +16,8 @@ "risk": "LOW", "summary": "AwoooP 可 mirror Security Supply Chain readiness index，但不得把 readiness 視為執行授權。", "payload_summary": { - "total_contracts": 32, - "ready_for_mirror_count": 29, + "total_contracts": 33, + "ready_for_mirror_count": 30, "partial_ready_count": 2, "contract_only_count": 1, "blocked_count": 0, @@ -36,7 +36,8 @@ "docs/security/SECURITY-APPROVAL-DECISION-RECORD.md", "docs/security/SECURITY-APPROVAL-REVIEW-PACKET.md", "docs/security/SECURITY-APPROVAL-STATE-TRANSITION.md", - "docs/security/SECURITY-FOLLOWUP-RUNTIME-GATE.md" + "docs/security/SECURITY-FOLLOWUP-RUNTIME-GATE.md", + "docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md" ], "blocked_actions": [ "execute_mirror_item", @@ -48,7 +49,7 @@ "store_secret_value" ], "labels": { - "phase": "S3.4", + "phase": "S4.0", "redacted": "true", "action_surface": "none", "mirror_only": "true" diff --git a/docs/security/security-mirror-intake-plan.snapshot.json b/docs/security/security-mirror-intake-plan.snapshot.json index 8156f18e8..61a89701f 100644 --- a/docs/security/security-mirror-intake-plan.snapshot.json +++ b/docs/security/security-mirror-intake-plan.snapshot.json @@ -18,7 +18,8 @@ "docs/security/security-approval-decision-record.snapshot.json", "docs/security/security-approval-review-packet.snapshot.json", "docs/security/security-approval-state-transition.snapshot.json", - "docs/security/security-followup-runtime-gate.snapshot.json" + "docs/security/security-followup-runtime-gate.snapshot.json", + "docs/security/source-control-primary-readiness-gate.snapshot.json" ], "intake_waves": [ { @@ -56,7 +57,7 @@ "execution_router", "blocking_gate" ], - "exit_gate": "Operator Console 能顯示 32 個 contract、5 個 route groups、7 個 acceptance checks、5 個 quarantine lanes、6 個 dry-run steps、status rollup、approval gate、decision record、review packet、state transition 與 follow-up runtime gate preparation，且 mirror event envelope action_buttons_allowed=false。" + "exit_gate": "Operator Console 能顯示 33 個 contract、5 個 route groups、7 個 acceptance checks、5 個 quarantine lanes、6 個 dry-run steps、status rollup、approval gate、decision record、review packet、state transition、follow-up runtime gate preparation 與 GitHub primary readiness gate，且 mirror event envelope action_buttons_allowed=false。" }, { "wave_id": "M1_kali_visibility", @@ -102,6 +103,7 @@ "source_control_reconcile_plan_v1", "source_control_ref_detail_diff_v1", "source_control_ref_truth_classification_v1", + "source_control_primary_readiness_gate_v1", "local_repo_canonical_probe_v1", "git_remote_refs_probe_v1" ], @@ -115,6 +117,7 @@ "mirror repo/branch/tag 差異", "顯示 pending owner / visibility / canonical decision", "顯示 refs truth review lane", + "顯示 GitHub primary readiness blockers、parity gates 與 rollback ADR 缺口", "顯示 Gitea inventory partial reason" ], "blocked_processing": [ @@ -137,6 +140,7 @@ "security_approval_review_packet_v1", "security_approval_state_transition_v1", "security_followup_runtime_gate_v1", + "source_control_primary_readiness_gate_v1", "github_target_repo_approval_package_v1", "source_control_approval_board_v1", "kali_scan_scope_approval_v1" @@ -154,6 +158,7 @@ "display_review_packet", "display_decision_next_state", "display_followup_runtime_gate_template", + "display_primary_readiness_gate", "display_required_reviewers", "display_blocked_until_approved" ], diff --git a/docs/security/security-mirror-quarantine.snapshot.json b/docs/security/security-mirror-quarantine.snapshot.json index 7bd4266e1..06b58db61 100644 --- a/docs/security/security-mirror-quarantine.snapshot.json +++ b/docs/security/security-mirror-quarantine.snapshot.json @@ -11,7 +11,7 @@ "docs/security/security-supply-chain-contract-manifest.snapshot.json" ], "summary": { - "total_contracts": 32, + "total_contracts": 33, "quarantine_lane_count": 5, "auto_retry_allowed": false, "runtime_blocking_allowed": false diff --git a/docs/security/security-mirror-readiness.snapshot.json b/docs/security/security-mirror-readiness.snapshot.json index d1a3f162b..50be1ca3f 100644 --- a/docs/security/security-mirror-readiness.snapshot.json +++ b/docs/security/security-mirror-readiness.snapshot.json @@ -5,8 +5,8 @@ "default_enforcement_level": "mirror_only", "runtime_execution_authorized": false, "summary": { - "total_contracts": 32, - "ready_for_mirror_count": 29, + "total_contracts": 33, + "ready_for_mirror_count": 30, "partial_ready_count": 2, "contract_only_count": 1, "blocked_count": 0 @@ -317,6 +317,16 @@ "human_docs": ["docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md"], "notes": "可 mirror refs truth classification 與 review lanes；不得執行分類結果。" }, + { + "contract": "source_control_primary_readiness_gate_v1", + "readiness": "ready_for_mirror", + "consumption_mode": "approval_only", + "mirror_allowed": true, + "execution_allowed": false, + "snapshot_paths": ["docs/security/source-control-primary-readiness-gate.snapshot.json"], + "human_docs": ["docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md"], + "notes": "可 mirror GitHub primary readiness blockers、parity gates 與 rollback ADR 缺口；目前 primary_ready_count=0。" + }, { "contract": "local_repo_canonical_probe_v1", "readiness": "ready_for_mirror", diff --git a/docs/security/security-mirror-route.snapshot.json b/docs/security/security-mirror-route.snapshot.json index 1397ab575..5bc0c0664 100644 --- a/docs/security/security-mirror-route.snapshot.json +++ b/docs/security/security-mirror-route.snapshot.json @@ -11,7 +11,7 @@ "docs/security/security-mirror-event-sample.snapshot.json" ], "summary": { - "total_contracts": 32, + "total_contracts": 33, "route_group_count": 5, "channel_event_policy": "初期只對階段完成、blocked 狀態或需要人工批准的高風險候選發低噪音事件；LOW / MEDIUM observation 不發阻擋事件。", "approval_queue_policy": "只有 approval-only、suggest-only 或 blocked-until-approved 項目可進 approval queue；approval queue 不代表可執行。" @@ -47,7 +47,7 @@ "顯示 security_mirror_quarantine_v1 隔離 lane 與 retry gate", "顯示 security_mirror_dry_run_v1 dry-run steps", "顯示 security_mirror_status_rollup_v1 跨 Session 狀態與下一個 gate", - "顯示 S3 review packet、state transition 與 follow-up runtime gate preparation contract 位置" + "顯示 S3 review packet、state transition、follow-up runtime gate preparation 與 GitHub primary readiness gate contract 位置" ], "blocked_processing": [ "新增執行按鈕", @@ -55,7 +55,7 @@ "runtime blocking", "自動批准任何 queue item" ], - "exit_gate": "AwoooP 可顯示 32 個 contract、5 個 route groups、7 個 acceptance checks、5 個 quarantine lanes、6 個 dry-run steps、status rollup、approval gate、decision record、review packet、state transition 與 follow-up runtime gate preparation，且所有 route 都維持 runtime_execution_authorized=false。" + "exit_gate": "AwoooP 可顯示 33 個 contract、5 個 route groups、7 個 acceptance checks、5 個 quarantine lanes、6 個 dry-run steps、status rollup、approval gate、decision record、review packet、state transition、follow-up runtime gate preparation 與 GitHub primary readiness gate，且所有 route 都維持 runtime_execution_authorized=false。" }, { "wave_id": "M1_kali_visibility", @@ -104,6 +104,7 @@ "source_control_reconcile_plan_v1", "source_control_ref_detail_diff_v1", "source_control_ref_truth_classification_v1", + "source_control_primary_readiness_gate_v1", "local_repo_canonical_probe_v1", "git_remote_refs_probe_v1", "approval_required_event_v1" @@ -119,6 +120,7 @@ "allowed_processing": [ "顯示 repo / branch / tag 差異", "顯示 owner、visibility、canonical 與 refs review lane", + "顯示 GitHub primary readiness blockers 與 rollback ADR 缺口", "顯示 Gitea inventory partial reason", "顯示 GitHub primary cutover blocked reason" ], @@ -142,6 +144,7 @@ "security_approval_review_packet_v1", "security_approval_state_transition_v1", "security_followup_runtime_gate_v1", + "source_control_primary_readiness_gate_v1", "github_target_repo_approval_package_v1", "source_control_approval_board_v1", "kali_scan_scope_approval_v1" @@ -160,6 +163,7 @@ "顯示人工 review packet、review lane 與 action_buttons_allowed=false", "顯示人工 decision next state，且 approve_scope 仍需 follow-up runtime gate", "顯示 follow-up runtime gate template，且 active_runtime_gates=0", + "顯示 GitHub primary readiness gate，且 primary_ready_count=0", "顯示 required reviewers", "顯示 blocked_until_approved", "記錄人工決策結果" @@ -202,7 +206,7 @@ "acceptance_gates": [ { "gate_id": "ROUTE_COVERS_ALL_CONTRACTS", - "requirement": "route_groups 合併後必須涵蓋 manifest 的 32 個 contracts。" + "requirement": "route_groups 合併後必須涵蓋 manifest 的 33 個 contracts。" }, { "gate_id": "NO_EXECUTION_SURFACE", diff --git a/docs/security/security-mirror-status-rollup.snapshot.json b/docs/security/security-mirror-status-rollup.snapshot.json index b7dcb92c0..b66ab152a 100644 --- a/docs/security/security-mirror-status-rollup.snapshot.json +++ b/docs/security/security-mirror-status-rollup.snapshot.json @@ -19,11 +19,12 @@ "docs/security/security-approval-review-packet.snapshot.json", "docs/security/security-approval-state-transition.snapshot.json", "docs/security/security-followup-runtime-gate.snapshot.json", + "docs/security/source-control-primary-readiness-gate.snapshot.json", "docs/security/security-rollout-policy.snapshot.json" ], "summary": { - "total_contracts": 32, - "ready_for_mirror_count": 29, + "total_contracts": 33, + "ready_for_mirror_count": 30, "partial_ready_count": 2, "contract_only_count": 1, "blocked_count": 0, @@ -32,6 +33,8 @@ "approval_state_transition_rule_total": 5, "followup_runtime_gate_template_total": 8, "active_runtime_gate_count": 0, + "primary_readiness_candidate_repo_count": 8, + "github_primary_ready_count": 0, "pending_approval_count": 7, "block_candidate_count": 1, "dry_run_status": "contract_defined_not_executed", @@ -66,8 +69,8 @@ { "phase_id": "S4_migration_execution", "state": "not_started", - "current_result": "GitHub primary 是長期方向，但 refs / tags / workflow / secret 名稱尚未全量驗證。", - "next_gate": "SHA/tag/workflow parity、rollback ADR 與逐 repo 人工批准。" + "current_result": "GitHub primary 是長期方向；source_control_primary_readiness_gate_v1 已定義 8 個 candidate repos、7 個 in-scope blocked repos、0 個 primary ready。", + "next_gate": "Gitea authenticated inventory、refs truth、workflow/runner/secret name parity、rollback ADR 與逐 repo 人工批准。" } ], "next_safe_actions": [ @@ -185,6 +188,23 @@ "切 GitHub primary" ] }, + { + "action_id": "review_github_primary_readiness_gate", + "title": "審查 GitHub primary readiness blockers", + "mode": "approval_required", + "source_contract": "source_control_primary_readiness_gate_v1", + "allowed_processing": [ + "顯示 7 個 in-scope repos 仍 blocked", + "顯示 Gitea inventory、refs truth、workflow/secret name parity 與 rollback ADR 缺口", + "要求 repo owner 補 owner / visibility / canonical 決策" + ], + "blocked_processing": [ + "建立 GitHub repo", + "sync refs", + "切 GitHub primary", + "停用或封存 Gitea repo" + ] + }, { "action_id": "keep_kali_execute_blocked", "title": "Kali /execute 維持 block candidate", @@ -208,7 +228,8 @@ "S3.1 只新增人工決策紀錄格式；決策紀錄仍維持 execution_authorized=false，不可直接跳到執行面。", "S3.2 只新增人工審查封包格式；review packet 只讓 AwoooP 顯示與準備人審，不代表批准。", "S3.3 只新增人工決策狀態轉移語義；approve_scope 只進入 waiting runtime gate，不代表可立即執行。", - "S3.4 只新增後續 runtime gate 準備模板；active_runtime_gates=0，不新增 action button。" + "S3.4 只新增後續 runtime gate 準備模板；active_runtime_gates=0，不新增 action button。", + "S4.0 只新增 GitHub primary readiness gate；github_primary_ready_count=0，不新增 repo / refs / primary switch action。" ], "forbidden_actions": [ "start_kali_scan", diff --git a/docs/security/security-supply-chain-contract-manifest.snapshot.json b/docs/security/security-supply-chain-contract-manifest.snapshot.json index 6db483ac0..50502c6e9 100644 --- a/docs/security/security-supply-chain-contract-manifest.snapshot.json +++ b/docs/security/security-supply-chain-contract-manifest.snapshot.json @@ -2,7 +2,7 @@ "schema_version": "security_supply_chain_contract_manifest_v1", "status": "draft", "default_enforcement_level": "mirror_only", - "contract_count": 32, + "contract_count": 33, "contracts": [ { "contract": "security_rollout_policy_v1", @@ -203,7 +203,7 @@ "switch_github_primary", "store_secret_value" ], - "notes": "整理 32 個 Security Supply Chain contracts 的 mirror readiness，供 AwoooP 安全消費。" + "notes": "整理 33 個 Security Supply Chain contracts 的 mirror readiness，供 AwoooP 安全消費。" }, { "contract": "security_mirror_intake_plan_v1", @@ -513,6 +513,28 @@ ], "notes": "把 refs diff 分成 main/dev 真相來源、drift deprecated 候選、release tag 與 GitHub-only review lane；仍不授權 sync。" }, + { + "contract": "source_control_primary_readiness_gate_v1", + "schema_path": "docs/schemas/source_control_primary_readiness_gate_v1.schema.json", + "snapshot_paths": ["docs/security/source-control-primary-readiness-gate.snapshot.json"], + "human_docs": ["docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md"], + "consumer": "AwoooP source-control review / Operator Console / Audit", + "consumption_mode": "approval_only", + "allowed_actions": [ + "mirror_primary_readiness_gate", + "display_primary_blockers", + "request_owner_parity_rollback_review" + ], + "forbidden_actions": [ + "execute_primary_cutover", + "create_repo", + "change_visibility", + "sync_refs", + "switch_github_primary", + "disable_gitea" + ], + "notes": "定義 S4.0 GitHub primary readiness gate；7 個 in-scope repos 仍 blocked，primary_ready_count=0。" + }, { "contract": "local_repo_canonical_probe_v1", "schema_path": "docs/schemas/local_repo_canonical_probe_v1.schema.json", diff --git a/docs/security/source-control-primary-readiness-gate.snapshot.json b/docs/security/source-control-primary-readiness-gate.snapshot.json new file mode 100644 index 000000000..d006221bf --- /dev/null +++ b/docs/security/source-control-primary-readiness-gate.snapshot.json @@ -0,0 +1,390 @@ +{ + "schema_version": "source_control_primary_readiness_gate_v1", + "status": "draft_blocked", + "date": "2026-05-13", + "mode": "primary_readiness_gate_only", + "runtime_execution_authorized": false, + "source_indexes": [ + "docs/security/github-target-decision.snapshot.json", + "docs/security/source-control-approval-board.snapshot.json", + "docs/security/source-control-reconcile-plan.snapshot.json", + "docs/security/source-control-ref-detail-diff.snapshot.json", + "docs/security/source-control-ref-truth-classification.snapshot.json", + "docs/security/gitea-repo-inventory.snapshot.json", + "docs/security/gitea-org-repo-inventory-blocked.snapshot.json", + "docs/security/security-followup-runtime-gate.snapshot.json" + ], + "summary": { + "candidate_repo_count": 8, + "in_scope_repo_count": 7, + "external_scope_count": 1, + "primary_ready_count": 0, + "blocked_in_scope_count": 7, + "approval_required_count": 7, + "runtime_actions_authorized": false, + "github_primary_switch_authorized": false, + "action_buttons_allowed": false, + "raw_secret_storage_authorized": false + }, + "global_readiness_gates": [ + { + "gate_id": "GITEA_AUTHENTICATED_INVENTORY_REQUIRED", + "title": "Gitea private/internal 全量 inventory", + "status": "blocked", + "required_before_primary": [ + "Gitea authenticated inventory 或 redacted admin export status=ok", + "確認所有 private/internal repo 都被納入 mapping", + "只保存 token_present=true/false，不保存 token value" + ], + "current_gap": [ + "目前只有 public-only / blocked endpoint evidence", + "GITEA_READONLY_TOKEN 未提供", + "不得使用 write-capable credential 當 read-only token" + ], + "allowed_now": [ + "顯示 blocked reason", + "等待 read-only token 或 redacted admin export", + "更新 approval board 與 decision table" + ], + "execution_authorized": false + }, + { + "gate_id": "REFS_TRUTH_REQUIRED", + "title": "refs 真相來源與 branch/tag parity", + "status": "blocked", + "required_before_primary": [ + "main/dev 與 active branch 真相來源已人工判定", + "release tags 保留或棄用決策完成", + "deprecated candidate refs 已由 repo owner review" + ], + "current_gap": [ + "3 個 mapped repos 仍有 refs drift", + "141 個 refs review items 尚待人工判定", + "不得 push/delete/force push refs" + ], + "allowed_now": [ + "mirror ref truth classification", + "顯示 single-ref review lane", + "更新 draft reconcile plan" + ], + "execution_authorized": false + }, + { + "gate_id": "WORKFLOW_SECRET_NAME_PARITY_REQUIRED", + "title": "workflow / webhook / runner / secret 名稱 parity", + "status": "missing_evidence", + "required_before_primary": [ + "workflow 名稱與觸發條件 inventory 完成", + "webhook / deploy key / runner / branch protection / CODEOWNERS inventory 完成", + "secret 只列名稱與 owner，不保存 value" + ], + "current_gap": [ + "尚未建立全量 workflow / webhook / runner / secret 名稱 inventory", + "不得搬移或輸出 secret value", + "不得因缺資料而假設 GitHub ready" + ], + "allowed_now": [ + "建立 read-only inventory plan", + "列出需要 owner 補證的欄位", + "維持 GitHub primary blocked" + ], + "execution_authorized": false + }, + { + "gate_id": "OWNER_VISIBILITY_CANONICAL_REQUIRED", + "title": "owner / visibility / canonical 決策", + "status": "pending_review", + "required_before_primary": [ + "7 個 in-scope targets 完成 owner 決策", + "visibility 與 canonical repo 已人工確認", + "not_found_or_private 不得自動解讀為 repo 不存在" + ], + "current_gap": [ + "7 個 targets 仍需人工批准", + "ewoooc / momo-pro-system canonical 關係尚未確認", + "bitan-pharmacy 與 tsenyang-website GitHub target 未確認" + ], + "allowed_now": [ + "顯示 approval board", + "要求 repo owner 補決策", + "更新 visibility decision table" + ], + "execution_authorized": false + }, + { + "gate_id": "ROLLBACK_ADR_REQUIRED", + "title": "GitHub primary ADR 與 rollback plan", + "status": "not_started", + "required_before_primary": [ + "逐 repo GitHub primary ADR 完成", + "rollback plan 與 Gitea mirror/fallback 角色明確", + "切換前後監控與驗證 gate 已定義" + ], + "current_gap": [ + "目前只有長期方向，尚無逐 repo primary ADR", + "尚未定義 rollback ownership", + "不得切換 GitHub primary" + ], + "allowed_now": [ + "建立 ADR 草案", + "列出 rollback evidence requirements", + "讓 AwoooP mirror blocked state" + ], + "execution_authorized": false + } + ], + "repo_readiness": [ + { + "github_repo": "owenhytsai/awoooi", + "source_key": "wooo/awoooi", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_refs_parity", + "risk": "HIGH", + "target_state": "exists_refs_blocked", + "primary_ready": false, + "blockers": [ + "main SHA 不一致", + "branches/tags/workflows/webhooks/secrets 名稱 inventory 尚未完成", + "GitHub primary ADR 與 rollback plan 尚未完成" + ], + "evidence_refs": [ + "docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md", + "docs/security/source-control-ref-detail-diff.snapshot.json", + "docs/security/source-control-ref-truth-classification.snapshot.json" + ], + "allowed_now": [ + "顯示 refs truth review lane", + "更新 draft reconcile plan", + "要求 repo owner 判定真相來源" + ], + "still_forbidden": [ + "push refs", + "force push", + "delete refs", + "switch GitHub primary", + "disable Gitea" + ] + }, + { + "github_repo": "owenhytsai/clawbot-v5", + "source_key": "wooo/clawbot-v5", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_refs_parity", + "risk": "MEDIUM", + "target_state": "exists_refs_blocked", + "primary_ready": false, + "blockers": [ + "main SHA 不一致", + "GitHub 缺 Gitea tag 的處理方式尚未決定", + "逐 repo rollback plan 尚未完成" + ], + "evidence_refs": [ + "docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md", + "docs/security/source-control-reconcile-plan.snapshot.json" + ], + "allowed_now": [ + "顯示 refs blocked reason", + "更新 draft reconcile plan", + "要求 repo owner 決定 tag 保留方式" + ], + "still_forbidden": [ + "push refs", + "delete refs", + "switch GitHub primary", + "delete Gitea repo" + ] + }, + { + "github_repo": "owenhytsai/wooo-aiops", + "source_key": "wooo/wooo-aiops", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_refs_parity", + "risk": "MEDIUM", + "target_state": "exists_refs_blocked", + "primary_ready": false, + "blockers": [ + "main SHA 不一致", + "GitHub-only branch 與 tags 來源尚未釐清", + "逐 repo rollback plan 尚未完成" + ], + "evidence_refs": [ + "docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md", + "docs/security/source-control-reconcile-plan.snapshot.json" + ], + "allowed_now": [ + "顯示 GitHub-only refs review lane", + "更新 refs truth classification", + "要求 repo owner 判定來源" + ], + "still_forbidden": [ + "push refs", + "delete GitHub-only refs", + "force push", + "switch GitHub primary" + ] + }, + { + "github_repo": "owenhytsai/wooo-infra-config", + "source_key": "wooo/wooo-infra-config", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_internal_remote_decision", + "risk": "MEDIUM", + "target_state": "exists_aligned", + "primary_ready": false, + "blockers": [ + "110 internal remote 用途尚未確認", + "infra secrets 名稱 inventory 尚未完成", + "逐 repo primary ADR 尚未完成" + ], + "evidence_refs": [ + "docs/security/GIT-REMOTE-REFS-WOOO-INFRA-CONFIG-SNAPSHOT.md", + "docs/security/github-target-decision.snapshot.json" + ], + "allowed_now": [ + "顯示 internal remote purpose review", + "要求 owner 判定 110 remote 是 active source、legacy mirror 或 fallback", + "只保存 secret 名稱 inventory，不保存 value" + ], + "still_forbidden": [ + "delete remote", + "sync refs", + "move secret values", + "switch GitHub primary" + ] + }, + { + "github_repo": "owenhytsai/ewoooc", + "source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_target_decision", + "risk": "HIGH", + "target_state": "not_found_or_private", + "primary_ready": false, + "blockers": [ + "GitHub target 未授權 probe 看不到", + "ewoooc/momo-pro-system canonical 關係尚未確認", + "server-side refs diff 尚未完成" + ], + "evidence_refs": [ + "docs/security/GITEA-PUBLIC-REPO-SEARCH-SNAPSHOT.md", + "docs/security/LOCAL-REPO-CANONICAL-EWOOOC-MOMO-SNAPSHOT.md", + "docs/security/github-target-decision.snapshot.json" + ], + "allowed_now": [ + "顯示 target creation/access review", + "要求 owner / visibility / canonical 決策", + "補 server-side read-only refs diff" + ], + "still_forbidden": [ + "auto_create_repo", + "auto_merge_unrelated_histories", + "delete_working_tree", + "switch GitHub primary" + ] + }, + { + "github_repo": "owenhytsai/bitan-pharmacy", + "source_key": "bitan-pharmacy", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_target_decision", + "risk": "MEDIUM", + "target_state": "not_found_or_private", + "primary_ready": false, + "blockers": [ + "GitHub target 未確認", + "repo 是否仍 active 尚未確認", + "owner / visibility 決策尚未完成" + ], + "evidence_refs": [ + "docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md", + "docs/security/github-target-decision.snapshot.json" + ], + "allowed_now": [ + "顯示 target creation/access review", + "要求 owner 確認 active 狀態", + "保持 read-only evidence" + ], + "still_forbidden": [ + "auto_create_repo", + "push refs", + "delete 110 remote", + "switch GitHub primary" + ] + }, + { + "github_repo": "owenhytsai/tsenyang-website", + "source_key": "tsenyang-website", + "scope_status": "in_scope", + "readiness_state": "blocked_waiting_target_decision", + "risk": "MEDIUM", + "target_state": "not_found_or_private", + "primary_ready": false, + "blockers": [ + "GitHub target 未確認", + "repo 是否仍 active 尚未確認", + "owner / visibility 決策尚未完成" + ], + "evidence_refs": [ + "docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md", + "docs/security/github-target-decision.snapshot.json" + ], + "allowed_now": [ + "顯示 target creation/access review", + "要求 owner 確認 active 狀態", + "保持 read-only evidence" + ], + "still_forbidden": [ + "auto_create_repo", + "push refs", + "delete 110 remote", + "switch GitHub primary" + ] + }, + { + "github_repo": "nexu-io/open-design", + "source_key": "open-design", + "scope_status": "external_scope_review", + "readiness_state": "observe_scope_review", + "risk": "LOW", + "target_state": "external_scope", + "primary_ready": false, + "blockers": [ + "尚未確認是否屬於 AWOOOI 資安供應鏈範圍", + "不納入 GitHub primary cutover 候選" + ], + "evidence_refs": [ + "docs/security/github-target-probe.snapshot.json" + ], + "allowed_now": [ + "顯示 scope review", + "維持 observe-only" + ], + "still_forbidden": [ + "加入 primary cutover queue", + "修改 repo visibility", + "sync refs" + ] + } + ], + "gate_rules": [ + "本契約只定義 GitHub primary readiness gate，不代表任何 repo 已可切換 primary。", + "primary_ready_count 必須維持 0，直到逐 repo parity、owner、visibility、rollback ADR 與人工批准全部完成。", + "not_found_or_private 不能當成 repo 不存在，也不能自動建立 GitHub repo。", + "Gitea 在 cutover 前仍是實際本地控制面；不得停用、刪除、封存或降級任何 repo。", + "secret 只能 inventory 名稱與 owner，不得搬移或保存 secret value。", + "任何 refs sync / repo creation / visibility change / primary switch 都需要新的 runtime gate 與人工批准。" + ], + "forbidden_actions": [ + "create_github_repo", + "change_repo_visibility", + "sync_git_refs", + "delete_git_refs", + "force_push", + "switch_github_primary", + "disable_gitea", + "delete_or_archive_gitea_repo", + "move_secret_values", + "store_secret_token_cookie_private_key_or_exploit_payload", + "add_action_button" + ] +}