wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): 強化 S4.9 owner response 基準一致性
All checks were successful
Code Review / ai-code-review (push) Successful in 14s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-12 12:14:45 +08:00
parent 7cea7ef02a
commit c6fe7c2dd7
4 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
scripts/security/source-control-owner-response-guard.py
View File

@@ -13,6 +13,10 @@ from pathlib import Path
from typing import Any
EXPECTED_ROLLUP_DATE = "2026-06-12"
EXPECTED_TEMPLATE_COUNT_FORMULA = "5 + 9 + 5 + 5 = 24"
STALE_TEMPLATE_COUNT_FORMULA = "5 + 7 + 5 + 5 = 22"
LANES = [
{
"lane_id": "s4_9_gitea_inventory_owner_attestation_response",
@@ -498,13 +502,16 @@ def validate_markdown_consistency(security_dir: Path) -> None:
encoding="utf-8"
)
assert_contains("rollup_doc.total_template_formula", rollup_doc, "5 + 9 + 5 + 5 = 24")
assert_contains("rollup_doc.date", rollup_doc, EXPECTED_ROLLUP_DATE)
assert_contains("rollup_doc.total_template_formula", rollup_doc, EXPECTED_TEMPLATE_COUNT_FORMULA)
assert_contains("rollup_doc.total_template_display", rollup_doc, "24 templates")
assert_not_contains("rollup_doc.stale_formula", rollup_doc, "5 + 7 + 5 + 5 = 22")
assert_not_contains("rollup_doc.stale_date", rollup_doc, "2026-06-04")
assert_not_contains("rollup_doc.stale_formula", rollup_doc, STALE_TEMPLATE_COUNT_FORMULA)
assert_not_contains("rollup_doc.stale_display", rollup_doc, "22 templates")
assert_contains("gap_audit_doc.latest_baseline_present", gap_audit_doc, "gitea/main=")
assert_not_contains("gap_audit_doc.stale_baseline_b615", gap_audit_doc, "b615bde5")
assert_not_contains("gap_audit_doc.stale_baseline_f1bad", gap_audit_doc, "f1bad81d")
assert_not_contains("gap_audit_doc.stale_baseline_b17a", gap_audit_doc, "b17a28c2")
assert_contains("gap_audit_doc.rollup_consistency", gap_audit_doc, "S4.13 rollup 文件一致性")
@@ -515,6 +522,7 @@ def validate(root: Path) -> None:
rollup_summary = rollup["summary"]
assert_equal("rollup.status", rollup["status"], "draft_waiting_owner_responses")
assert_equal("rollup.date", rollup["date"], EXPECTED_ROLLUP_DATE)
assert_false("rollup.runtime_execution_authorized", rollup["runtime_execution_authorized"])
assert_equal("rollup.response_packet_count", rollup_summary["response_packet_count"], len(LANES))
assert_equal("rollup.validation_lane_count", rollup_summary["validation_lane_count"], len(LANES))
@@ -1130,6 +1138,18 @@ def validate(root: Path) -> None:
assert_equal("missing_response_lanes.count", len(missing_lane_by_id), len(LANES))
assert_equal("owner_response_collection_order.count", len(collection_order_by_id), len(LANES))
cross_packet_checks = {item["check_id"]: item for item in rollup["cross_packet_acceptance_checks"]}
assert_equal(
"cross_packet_acceptance_checks.template_counts_match.pass_condition",
cross_packet_checks["template_counts_match"]["pass_condition"],
EXPECTED_TEMPLATE_COUNT_FORMULA,
)
assert_not_contains(
"rollup.snapshot.stale_template_count_formula",
json.dumps(rollup, ensure_ascii=False),
STALE_TEMPLATE_COUNT_FORMULA,
)
evidence_routing_rules = rollup["owner_response_evidence_routing_rules"]
assert_equal(
"owner_response_evidence_routing_rules.ids",
@@ -1826,6 +1846,7 @@ def validate(root: Path) -> None:
local_validation = rollup["latest_local_validation"]
assert_equal("rollup.latest_local_validation.status", local_validation["status"], "repo_snapshot_guard_pass")
assert_equal("rollup.latest_local_validation.date", local_validation["date"], EXPECTED_ROLLUP_DATE)
assert_equal("rollup.latest_local_validation.scope", local_validation["scope"], "repo_snapshot_only")
assert_equal("rollup.latest_local_validation.result", local_validation["result"], "SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK")
assert_equal("rollup.latest_local_validation.received_response_count", local_validation["received_response_count"], 0)