Merge remote-tracking branch 'gitea/main' into codex/github-redacted-evidence-validator-20260627

docs/LOGBOOK.md

@@ -1,3 +1,35 @@
+## 2026-06-27 — 22:51 AwoooP controlled automation copy guard 進 main
+
+**背景**：上一段已把正式 AwoooP Approvals / Runs / Work Items / Alerts HTML payload 中殘留的舊 manual gate 語意清零；本段不是再做文案文件，而是把防回歸規則寫成 repo guard，避免 `待人工決策`、`阻塞與人工閘門`、`人工接手`、`manual gate`、`owner review` 等語意再次回到低 / 中 / 高風險流程。
+
+**完成內容**：
+- 新增 `scripts/security/awooop-controlled-automation-copy-guard.py`，read-only 掃描 AwoooP routes 與 zh-TW / en messages，禁止舊 manual / default-human gate 字串回流。
+- guard 要求正式 copy 保留 controlled automation 新語意：`待 AI 受控決策`、`阻塞與 AI 受控隊列`、`AI 處置包與工作項`、`受控執行邊界`、`受控授權閘門`、`controlled gate`、`controlled review`。
+- guard 同時鎖定 `/zh-TW/awooop/alerts` 必須存在並導向 `#ai-alert-card-delivery-readback`，避免 Alerts smoke 退回 404。
+- `scripts/security/security-mirror-progress-guard.py` 已串接 AwoooP controlled automation copy guard。
+- 新增 `apps/api/tests/test_awooop_controlled_automation_copy_guard.py`，把 guard 納入 pytest 防線。
+
+**本地驗證結果**：
+- `python3 scripts/security/awooop-controlled-automation-copy-guard.py --root .`：`AWOOOP_CONTROLLED_AUTOMATION_COPY_GUARD_OK`。
+- `python3 -m py_compile scripts/security/awooop-controlled-automation-copy-guard.py scripts/security/security-mirror-progress-guard.py apps/api/tests/test_awooop_controlled_automation_copy_guard.py`：通過。
+- `DATABASE_URL=sqlite:///test.db PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_awooop_controlled_automation_copy_guard.py -q`：`1 passed`。
+- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
+- `git diff --check`：通過。
+
+**Gitea / CI 狀態**：
+- guard commit：`219fc3835 test(awooop): guard controlled automation copy`。
+- rebase 當下 `gitea-ssh/main=0e2e8057c` 已包含 `219fc3835`；本 LOGBOOK commit 會再推進 main head。
+- `code-review.yaml #3710` 因較新的 main push 被取消；最新 head `0040a595a` 的 `code-review.yaml #3712` 成功，`ansible-lint.yml #3711` 成功。
+- `cd.yaml #3709` 是 `219fc3835` 被後續 push supersede 後的舊 run；本段 guard / test 變更不在 CD path filter 內，不需要新的 deploy marker 才能生效於 repo 防線。
+
+**production readback 邊界**：
+- 產品 runtime 仍由上一段 deploy marker `f98aaa8ee chore(cd): deploy a2733fd [skip ci]` 覆蓋的 AwoooP copy 清理提供。
+- 重新讀回 Approvals / Runs / Work Items / Alerts：HTTP `200`，舊詞 hit count 皆為 `0`；Alerts final URL 仍回 `/zh-TW/awooop/runs`。
+- 本段未做 host / Docker / systemd / Nginx / firewall / K8s / DB / Wazuh runtime 寫操作，未讀 secret，未 force push。
+
+**下一步**：
+- 後續若再改 AwoooP / IwoooS approval 類 copy，必須先跑 `python3 scripts/security/awooop-controlled-automation-copy-guard.py --root .` 與 `python3 scripts/security/security-mirror-progress-guard.py --root .`，避免把 manual gate 當作 low / medium / high 的預設終局。
+
 ## 2026-06-27 — 22:28 AwoooP manual gate payload residue 正式清零
 
 **背景**：正式 `/zh-TW/awooop/approvals`、Runs、Work Items 的 HTML payload 仍因 Next / i18n namespace 序列化帶出 IwoooS 舊文案 `人工閘門`，每頁各命中 32 次；`/zh-TW/awooop/alerts` 也回 404。這會讓 AwoooP 看起來仍把人工 gate 當作 low / medium / high 的預設終局。

docs/security/wazuh-manager-registry-reviewer-validation.snapshot.json

@@ -150,11 +150,12 @@
     "firewall_change",
     "nginx_reload"
   ],
-  "generated_at": "2026-06-27T21:45:00+08:00",
-  "mode": "committed_post_enable_iwooos_readback_passed_no_runtime_no_secret_collection",
+  "generated_at": "2026-06-27T22:10:00+08:00",
+  "mode": "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
   "no_false_green_rules": [
     "reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
     "post-enable IwoooS readback passed 只代表 production API / 前台已讀回 reviewer passed，不代表 live Wazuh 查詢或 runtime action。",
+    "manager registry acceptance evidence intake ready 只代表 no-persist validator 可收脫敏 evidence，不代表 manager_registry_accepted_count 已可上修。",
     "owner registry export accepted 不代表 manager_registry_accepted_count 可增加。",
     "Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
     "reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。"
@@ -173,7 +174,10 @@
     "ready_for_reviewer_validation",
     "accepted_for_readonly_posture_only",
     "post_enable_iwooos_readback_passed",
-    "manager_registry_acceptance_evidence_review"
+    "manager_registry_acceptance_evidence_review",
+    "manager_registry_acceptance_evidence_intake_ready",
+    "accepted_for_manager_registry_acceptance_review_only",
+    "commit_manager_registry_accepted_readback_evidence"
   ],
   "per_host_required_fields": [
     "node_alias",
@@ -276,6 +280,12 @@
       "failure_lane": "post_enable_iwooos_readback_passed_no_runtime",
       "required_evidence": "production API 與前台 smoke 已讀回 reviewer passed；此讀回只更新 read-only posture，不查 live Wazuh、不保存 raw payload、不開 runtime gate。",
       "title": "Post-enable IwoooS readback 已讀回但不開 runtime"
+    },
+    {
+      "check_id": "RV-11",
+      "failure_lane": "waiting_manager_registry_acceptance_evidence",
+      "required_evidence": "新增 no-persist acceptance evidence validator；只有 reviewer packet 通過後才可進 commit review，global manager_registry_accepted_count 仍維持 0。",
+      "title": "Manager registry acceptance evidence 可收件但不自動上修"
     }
   ],
   "schema_version": "wazuh_manager_registry_reviewer_validation_v1",
@@ -284,7 +294,7 @@
     "docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
     "docs/security/wazuh-managed-host-coverage-gate.snapshot.json"
   ],
-  "status": "post_enable_iwooos_readback_passed_no_runtime_no_secret_collection",
+  "status": "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
   "summary": {
     "active_response_authorized_count": 0,
     "evidence_slot_count": 6,
@@ -292,14 +302,17 @@
     "forbidden_action_count": 11,
     "forbidden_payload_count": 27,
     "host_write_authorized_count": 0,
+    "manager_registry_acceptance_evidence_received_count": 0,
+    "manager_registry_acceptance_evidence_review_ready_count": 0,
+    "manager_registry_acceptance_intake_endpoint_available_count": 1,
     "manager_registry_accepted_count": 0,
-    "outcome_lane_count": 14,
+    "outcome_lane_count": 17,
     "owner_registry_export_accepted_count": 1,
     "owner_registry_export_received_count": 1,
     "per_host_required_field_count": 9,
     "post_enable_readback_passed_count": 1,
     "required_owner_field_count": 28,
-    "reviewer_validation_check_count": 10,
+    "reviewer_validation_check_count": 11,
     "reviewer_validation_failed_count": 0,
     "reviewer_validation_passed_count": 1,
     "reviewer_validation_quarantined_count": 0,