wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(iwooos): 記錄 CD runner lock 阻塞 [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-16 12:23:14 +08:00
parent b10c5d1722
commit c9b4363ba2
1 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
docs/LOGBOOK.md
View File

@@ -1,3 +1,57 @@
## 2026-06-16｜CD / Runner / Secret 注入事故後回讀 Gate 與 CD Lock 阻塞
**背景**：CD / Runner / repository secret injection 屬於高價值配置面，不能因 code-review 成功、CD 開始、UI marker 預期存在或 deploy 通知預覽就視為 runtime 已授權。近期 110 冷啟動、端口異動、Harbor / registry / StockPlatform / monitoring 類事故也證明，部署通道本身必須有事故後回讀欄位與 no-false-green 邊界。本階段已完成 repo 內只讀 gate、snapshot、guard 與前台 marker；但 production deploy 被後續 `9f4ed285` 觸發的 CD run `3071` 擋在 Docker build lock timeout，正式站尚未出現新 marker。
**完成項目**：
- 新增 `scripts/security/cd-runner-secret-injection-post-incident-readback-plan.py` 與 `docs/security/cd-runner-secret-injection-post-incident-readback-plan.snapshot.json`。
- 新增 `docs/security/CD-RUNNER-SECRET-INJECTION-POST-INCIDENT-READBACK-PLAN.md`，把 CD pipeline、Gitea workflow / runner、repository secret metadata、deploy marker 與跨專案同步轉成事故後回讀候選。
- Post-incident readback plan 固定為 candidates `5`、C0 candidates `4`、C1 candidates `1`、write-capable candidates `5`、secret-sensitive candidates `5`、runner-or-workflow candidates `5`、deploy-or-run readback required candidates `5`、cross-project sync required candidates `5`、no-false-green required candidates `5`。
- Readback fields `44`、required readback fields `33`、reviewer checks `30`、outcome lanes `11`、blocked actions `52`。
- `secret_metadata` 只讀成熟度從 `68%` 推進到 `70%`；`gitea_workflow_runner_source_control` 只讀成熟度從 `72%` 推進到 `74%`。
- 高價值配置平均成熟度維持 `71%`；needs-live-evidence 類別維持 `9`；IwoooS headline 維持 `64%`；active runtime gate 維持 `0`。
- `/zh-TW/iwooos` repo 內前台 marker 已加入 `cd_runner_secret_injection_post_incident_readback_plan_candidate_count=5`、`blocked_action_count=52`、`secret_metadata_coverage_percent=70`、`gitea_workflow_runner_source_control_coverage_percent=74`、`runtime_gate_count=0`。
**本地驗證**：
- `python3 -m py_compile scripts/security/cd-runner-secret-injection-post-incident-readback-plan.py scripts/security/high-value-config-control-coverage.py scripts/security/iwooos-config-control-guard.py scripts/security/security-mirror-progress-guard.py` 通過。
- `python3 scripts/security/cd-runner-secret-injection-post-incident-readback-plan.py --root . --output /tmp/cd-runner-secret-injection-post-incident-readback-plan.verify.json --generated-at 2026-06-16T00:30:00+08:00` → `CD_RUNNER_SECRET_INJECTION_POST_INCIDENT_READBACK_PLAN_OK candidates=5 c0=4 write_capable=5 checks=30 lanes=11 accepted=0 runtime_gate=0`。
- `python3 scripts/security/high-value-config-control-coverage.py --root . --output docs/security/high-value-config-control-coverage.snapshot.json --generated-at 2026-06-16T00:30:00+08:00` → `HIGH_VALUE_CONFIG_CONTROL_COVERAGE_OK categories=14 c0=8 avg=71 runtime_gate=0`。
- JSON parse 驗證新 snapshot、high-value snapshot、posture projection snapshot、`apps/web/messages/zh-TW.json`、`apps/web/messages/en.json` 通過。
- `python3 scripts/security/iwooos-config-control-guard.py --root .` → `IWOOOS_CONFIG_CONTROL_GUARD_OK`。
- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。
- `python3 scripts/security/public-frontend-env-guard.py --root .` → `OK public frontend sensitive surface guard files=225 patterns=12 allowlisted=2 violations=0 runtime_gate=0`。
- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
- `python3 scripts/security/package-supply-chain-owner-policy-guard.py --root .` → `PACKAGE_SUPPLY_CHAIN_OWNER_POLICY_GUARD_OK`。
- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=890`。
- `pnpm --filter @awoooi/web typecheck` 通過；`apps/web/tsconfig.tsbuildinfo` 只屬 typecheck 快取副作用，未納入提交。
- `git diff --check` 與 `git diff --cached --check` 通過。
- 前端與新增 artifact 精準掃描未命中 `批准！`、內部協作逐字稿、`source_thread_id`、`blocked_waiting_`、`blockers=`、原始個人 namespace、原始 repo namespace 或 raw namespace。
**Gitea / CD**：
- Code commit：`bb459d59 feat(iwooos): 新增 CD runner secret 事故回讀 gate`。
- Code-review run：`3070`，成功。
- CD run：`3069`，因後續 `9f4ed285` 推送被取消；取消前已完成 API image push，digest `sha256:b4499da0c73faec8cd5662eb031340ac696d116399e069b4a21bbc09f5629237`，但沒有 deploy marker。
- 後續 main commit：`9f4ed285 feat(governance): 顯性化 AI Agent 日週月報主看板`。
- Code-review run：`3072`，成功。
- CD run：`3071`，失敗；build-and-deploy job 在 `Docker build lock busy (attempt 180/180)` 後 timeout，未取得 Docker build lock、未看到 empty lock 清除、未看到 stale lock 清除。
- 後續 retry commit：`7c44391f chore(cd): retry AI Agent 日週月報主看板部署`，為無檔案差異 commit；截至本紀錄寫入時，公開 Actions 頁尚未顯示對應新 CD run。
- 後續 docs commit：`b10c5d17 docs(governance): 記錄日週月報部署重試`；該段由另一個 Session 記錄 runner lock readback / empty lock cleanup evidence，本視窗未執行主機或 Docker 寫操作。
- 截至本紀錄重檢，公開 Actions 頁仍只顯示 `3071` Failure，尚未看到 `7c44391f` 或 `b10c5d17` 對應的新 CD run。
- Deploy marker：未產生；production 尚未部署 `bb459d59`、`9f4ed285`、`7c44391f` 與 `b10c5d17` 的 runtime image。
**Production 回讀**：
- `https://awoooi.wooo.work/zh-TW/iwooos?_v=bb459d59-cd-runner-secret-readback-post-fail` 回 `200`，但 CD / runner / secret post-incident readback 5 個必要 marker 全部缺漏，確認 production 尚未部署本階段前台 marker。
- `/zh-TW/iwooos` 與 `/zh-TW/awooop/tenants` HTML 回讀中，`批准！`、內部協作逐字稿、`source_thread_id`、`blocked_waiting_`、`blockers=`、原始個人 namespace、原始 repo namespace、raw namespace 命中皆為 `0`。
- 因 CD run `3071` 失敗，未執行新 marker 的 production desktop / mobile 成功驗收；不得把本地驗證、code-review 成功或 route `200` 視為 production acceptance。
**完成度與邊界**：
- CD / Runner / Secret injection post-incident readback plan：repo 內 artifact / guard / 前台 marker `100%`。
- Production deploy / marker readback：`0%`，阻塞於 CD runner Docker build lock timeout。
- Secret metadata 只讀成熟度：`68% -> 70%`；Gitea workflow / runner source control 只讀成熟度：`72% -> 74%`。
- 高價值配置平均成熟度：維持 `71%`；IwoooS headline 維持 `64%`；active runtime gate 維持 `0`。
- readback received / accepted、runtime execution authorized、action buttons allowed、workflow modification authorized、runner change authorized、repo secret change authorized、secret rotation authorized、Gitea action dispatch authorized、host write、production write、active scan 與 runtime gate 全部仍為 `0 / false`。
- 本輪未 SSH、未 Docker / systemd / Nginx / firewall / ArgoCD / K8s live action、未 workflow dispatch、未改 runner、未改 repository secret、未讀 secret value / hash / partial token、未 active scan、未 force push。
- 下一優先：CD runner Docker build lock owner readback；必收 lock holder / runner process attribution、canceled run cleanup evidence、safe unlock owner decision、rollback / maintenance window、post-unlock deploy marker、desktop / mobile production verification。未完成前不得把 CD success、UI 可見或 route `200` 當成 runtime 授權。
## 2026-06-16｜P2-405E AI Agent 日週月報主看板顯性化
**背景**：統帥明確指出在 governance automation inventory 頁面仍「看不到日報、週報、月報」。既有 `ai_agent_report_status_board_v1`、API 與中段 UI 已能證明日報 / 週報 / 月報 `3/3` 可見，但入口被埋在長頁面中，視覺權重不足。本階段只做前端顯性化與文件同步，不新增發送、批准、排程或寫入能力。