From d636eaa008fb61900300b31af50e312a3ae024cd Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 14 Jun 2026 17:23:19 +0800 Subject: [PATCH] =?UTF-8?q?docs(security):=20=E5=90=8C=E6=AD=A5=E9=AB=98?= =?UTF-8?q?=E5=83=B9=E5=80=BC=E9=85=8D=E7=BD=AE=20owner=20packet=20?= =?UTF-8?q?=E5=BF=AB=E7=85=A7=20[skip=20ci]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/LOGBOOK.md | 21 ++ .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 13 +- .../HIGH-VALUE-CONFIG-OWNER-PACKET.md | 16 +- .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 2 +- ...alue-config-control-coverage.snapshot.json | 7 +- ...gh-value-config-owner-packet.snapshot.json | 285 +++++++++++++++++- ...-04-15-MASTER-ai-autonomous-flywheel-v2.md | 4 +- ...026-06-04-iwooos-security-governance-p0.md | 2 +- 8 files changed, 325 insertions(+), 25 deletions(-) diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index ed23c8dc1..3f47e4e6e 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,24 @@ +## 2026-06-14｜P0 高價值配置 Owner Packet / Coverage snapshot 同步完成 + +**背景**：高價值配置 Gate 已補上 Nginx / certbot P0 路徑與工作樹 preflight；延伸的 owner response packet 與 control coverage snapshot 也必須同步重產，避免 reviewer 看到舊清冊而漏掉 C0 補件要求。 + +**完成項目**： +- `docs/security/high-value-config-owner-packet.snapshot.json` 已由最新 Gate snapshot 重產，新增 `nginx_public_gateway`、`dns_tls_certbot` 與 `security_evidence_tooling` 三個 packet。 +- `docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md` 補上 2026-06-14 P0 path sync，明列 Nginx / DNS TLS affected files、owner response 與不可誤讀邊界。 +- `docs/security/high-value-config-control-coverage.snapshot.json` 已從最新 `high-value-config-change-gate.py` 重產，`nginx_public_gateway` 顯示 `k8s/nginx/**`，`dns_tls_certbot` 顯示 `scripts/ops/**/*cert*` 與 `scripts/ops/**/*tls*`。 +- `docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md` 補上 P0 pattern 覆蓋同步說明。 + +**本地驗證**： +- Owner packet 重產：`HIGH_VALUE_CONFIG_OWNER_PACKET_OK packets=3 c0=2 c1=0 runtime_gate=0`。 +- Coverage 重產：`HIGH_VALUE_CONFIG_CONTROL_COVERAGE_OK categories=14 c0=8 avg=66 runtime_gate=0`。 +- Owner packet summary：`packet_count=3`、`c0_packet_count=2`、`request_sent_count=0`、`received_response_count=0`、`accepted_response_count=0`、`runtime_gate_count=0`。 +- Coverage summary：`category_count=14`、`c0_category_count=8`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`runtime_gate_count=0`、`action_button_count=0`。 + +**完成度與邊界**： +- P0 owner packet / coverage snapshot sync slice：`100%`。 +- Production browser verification：不適用；本輪是 repo 內只讀 snapshot 與文件同步，不變更前端或 runtime。 +- owner response received / accepted、live evidence、runtime gate、Nginx live config、`nginx -t`、reload、DNS / TLS live probe、certbot renew、host write、active scan、production write 全部維持 `0 / false`。 + ## 2026-06-14｜P0 高價值配置 Gate 工作樹預檢本地完成 **背景**：高價值配置 Gate 已能用 `--changed-file` 或 `--base / --head` 做分類，但本地低摩擦 preflight 仍需要在沒有參數時直接讀取目前工作樹，否則 reviewer 容易忘記手動列檔，讓 Nginx / certbot 類變更在提交前漏掉。 diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index f8d4d5549..b6ce9151f 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -2,7 +2,7 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-12 | +| 日期 | 2026-06-14 | | 狀態 | `coverage_matrix_ready` | | 工具 | `scripts/security/high-value-config-control-coverage.py` | | Snapshot | `docs/security/high-value-config-control-coverage.snapshot.json` | @@ -15,6 +15,17 @@ 本階段仍是只讀覆蓋矩陣，不接 blocking CI、不 SSH、不讀 live host、不執行 `nginx -t`、不 reload Nginx、不做 DNS / TLS probe、不 renew cert、不同步 refs、不修改 workflow、不收 secret value、不啟動 agent-bounty runtime。 +## 1.1 2026-06-14 P0 pattern 覆蓋同步 + +本輪 snapshot 已從最新 `high-value-config-change-gate.py` 讀回 P0 pattern 補強： + +| 類別 | 新增覆蓋 | 目前解讀 | +|------|----------|----------| +| `nginx_public_gateway` | `k8s/nginx/**` | K8s 內 Nginx 公開入口設定納入 P0 / C0 owner response 與 rollback 管控 | +| `dns_tls_certbot` | `scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` | 憑證修復、renewal 與 TLS 腳本納入 P0 / C0 owner response 與維護窗口管控 | + +此同步只修正長期覆蓋矩陣與變更 Gate 的一致性，不代表 live evidence 已收到，也不代表可執行 `nginx -t`、reload、certbot renew 或 DNS / TLS 變更。 + ## 2. 覆蓋摘要 | 指標 | 目前值 | 說明 | diff --git a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md index 39cc05216..bf7facfa8 100644 --- a/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md +++ b/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md @@ -2,8 +2,8 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-11 | -| 狀態 | `owner_packet_draft_ready` | +| 日期 | 2026-06-14 | +| 狀態 | `owner_packet_draft_ready_p0_path_sync` | | 工具 | `scripts/security/high-value-config-owner-packet.py` | | 輸入 | `docs/security/high-value-config-change-gate.snapshot.json` | | Snapshot | `docs/security/high-value-config-owner-packet.snapshot.json` | @@ -15,6 +15,18 @@ P0.2 已能將變更分類成 C0 / C1 / C2 / C3。本文件與工具負責下一 本階段仍是只讀草案，不送 request、不收 owner response、不標記 received / accepted、不建立 action button、不接 blocking CI、不執行 runtime。 +## 1.1 2026-06-14 P0 path sync + +本輪 owner packet snapshot 已跟隨高價值配置 Gate 的 P0 pattern 補強重產： + +| Packet | affected files | 邊界 | +|--------|----------------|------| +| `nginx_public_gateway` | `k8s/nginx/awoooi-prod.conf` | 只要求 public gateway owner response、rendered diff、`nginx -t` 計畫、route smoke 計畫與 rollback ref，不代表已讀 live conf 或 reload | +| `dns_tls_certbot` | `scripts/ops/188-registry-certbot-fix.sh`、`scripts/ops/fix-188-registry-certbot-renewal.sh` | 只要求 domain / TLS owner response、renewal window、ACME smoke 計畫、public HTTPS smoke 計畫與 rollback ref，不代表 certbot renew 或 DNS / TLS 變更 | +| `security_evidence_tooling` | Gate 文件、snapshot 與工具 | 只要求 snapshot parse、guard smoke、doc secret sanity 與 no runtime gate increase | + +重產結果為 `packet_count=3`、`c0_packet_count=2`、`c1_packet_count=0`、`runtime_gate_count=0`；request / received / accepted 仍全部維持 `0`。 + ## 2. Canonical 欄位 高價值配置 packet 對齊 S4.9 canonical owner response envelope，使用以下欄位： diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index ff22b1df2..06cd033f3 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -7,7 +7,7 @@ | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 | | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | -| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | +| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | diff --git a/docs/security/high-value-config-control-coverage.snapshot.json b/docs/security/high-value-config-control-coverage.snapshot.json index ee4659f9d..6eef11724 100644 --- a/docs/security/high-value-config-control-coverage.snapshot.json +++ b/docs/security/high-value-config-control-coverage.snapshot.json @@ -23,6 +23,7 @@ "patterns": [ "infra/ansible/roles/nginx/templates/*.j2", "infra/ansible/playbooks/nginx-sync.yml", + "k8s/nginx/**", "ops/nginx/**", "docs/runbooks/disaster-recovery/DR-Nginx.md" ], @@ -58,6 +59,8 @@ "docs/runbooks/REGISTRY-CERTBOT-188.md", "docs/runbooks/**/*CERTBOT*.md", "docs/runbooks/**/*TLS*.md", + "scripts/ops/**/*cert*", + "scripts/ops/**/*tls*", "ops/**/*cert*", "ops/**/*tls*", "infra/**/*cert*", @@ -564,8 +567,8 @@ "websocket_route_change_authorized": false, "workflow_modification_authorized": false }, - "generated_at": "2026-06-12T10:35:00+08:00", - "git_commit": "e4747722", + "generated_at": "2026-06-14T17:21:00+08:00", + "git_commit": "3db8d53d", "lowest_coverage_categories": [ { "category_id": "docker_compose_systemd_host_config", diff --git a/docs/security/high-value-config-owner-packet.snapshot.json b/docs/security/high-value-config-owner-packet.snapshot.json index ae805b17b..6bd535eb4 100644 --- a/docs/security/high-value-config-owner-packet.snapshot.json +++ b/docs/security/high-value-config-owner-packet.snapshot.json @@ -24,6 +24,7 @@ "path_patterns": [ "infra/ansible/roles/nginx/templates/*.j2", "infra/ansible/playbooks/nginx-sync.yml", + "k8s/nginx/**", "ops/nginx/**", "docs/runbooks/disaster-recovery/DR-Nginx.md" ], @@ -57,6 +58,8 @@ "docs/runbooks/REGISTRY-CERTBOT-188.md", "docs/runbooks/**/*CERTBOT*.md", "docs/runbooks/**/*TLS*.md", + "scripts/ops/**/*cert*", + "scripts/ops/**/*tls*", "ops/**/*cert*", "ops/**/*tls*", "infra/**/*cert*", @@ -490,8 +493,8 @@ "runtime_execution_authorized": false, "secret_value_collected": false }, - "generated_at": "2026-06-11T13:00:00+08:00", - "git_commit": "ccf87213", + "generated_at": "2026-06-14T17:21:00+08:00", + "git_commit": "3db8d53d", "next_steps": [ "若 packet_count > 0，將 packet 交給 owner 補 canonical 欄位；不得把草案視為已送件。", "若 owner 回覆含 secret 或執行要求，先 quarantine 或 reject_execution_request。", @@ -500,14 +503,264 @@ "packets": [ { "affected_files": [ - "docs/LOGBOOK.md", + "scripts/ops/188-registry-certbot-fix.sh", + "scripts/ops/fix-188-registry-certbot-renewal.sh" + ], + "allowed_decisions": [ + "confirm", + "defer", + "reject", + "request_more_evidence" + ], + "blocked_requests": [ + "repo_create", + "visibility_change", + "refs_sync", + "refs_delete", + "force_push", + "workflow_modify", + "runner_enable", + "secret_value_submit", + "ssh_host_modify", + "nginx_reload", + "dns_tls_modify", + "argocd_sync", + "kubectl_apply", + "active_scan", + "agent_bounty_runtime_execute", + "payout_or_withdrawal" + ], + "category_id": "dns_tls_certbot", + "control_tier": "C0", + "false_flags": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "dns_tls_change_authorized": false, + "force_push_authorized": false, + "host_write_authorized": false, + "nginx_reload_authorized": false, + "refs_sync_authorized": false, + "request_sent": false, + "response_accepted": false, + "response_received": false, + "runner_change_authorized": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "workflow_modification_authorized": false + }, + "field_templates": [ + { + "field": "owner_role_or_team", + "instruction": "填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊。", + "required": true + }, + { + "field": "decision", + "instruction": "只能填 confirm、defer、reject、request_more_evidence；不得附帶 runtime 執行批准。", + "required": true + }, + { + "field": "decision_reason", + "instruction": "填脫敏短理由；不可貼 raw log、raw API body、未脫敏截圖或內部對話。", + "required": true + }, + { + "field": "affected_scope", + "instruction": "填受影響 repo、host、domain、namespace、route、service、secret name 或產品邊界。", + "required": true + }, + { + "field": "redacted_evidence_refs", + "instruction": "只填文件路徑、snapshot id、ticket id、commit、hash 或脫敏 metadata pointer。", + "required": true + }, + { + "field": "followup_owner", + "instruction": "填後續補證、審查或決策負責角色 / 團隊。", + "required": true + }, + { + "field": "rollback_owner", + "instruction": "填回滾負責角色 / 團隊；不是直接執行授權。", + "required": true + }, + { + "field": "maintenance_window", + "instruction": "填維護窗口或明確寫 deferred / not scheduled；不得用口頭同意代替。", + "required": true + }, + { + "field": "validation_plan", + "instruction": "填 preflight、post-check、rollback check；若只讀文件變更，寫 guard / json / doc secret sanity。", + "required": true + } + ], + "label": "DNS / TLS / certbot / certificate path", + "outcome_lanes": [ + "keep_waiting_owner_response", + "request_more_evidence", + "quarantine_sensitive_payload", + "reject_execution_request", + "ready_for_reviewer_validation" + ], + "packet_id": "high_value_config_owner_packet:dns_tls_certbot", + "priority": "P0", + "redaction_rules": [ + "只收 redacted evidence refs，不收 secret value。", + "疑似 token、cookie、authorization header、private key、runner token 或 webhook secret 一律 quarantine。", + "內部工作視窗對話、抱怨、口頭同意不得進產品文案或 LOGBOOK raw text。" + ], + "required_gate": "domain_tls_owner_response_required", + "required_validation": [ + "domain_inventory", + "certificate_path_check", + "renewal_window", + "acme_path_smoke", + "public_https_smoke", + "rollback_ref" + ], + "reviewer_checklist": [ + "canonical owner fields 全部存在。", + "decision 只使用允許值。", + "affected scope 可映射到 repo / host / domain / route / service / secret name。", + "redacted evidence refs 不含 raw payload。", + "沒有夾帶執行要求。", + "C0 / C1 若要進 runtime，需獨立人工批准與維護窗口。" + ], + "status": "draft_waiting_owner_response" + }, + { + "affected_files": [ + "k8s/nginx/awoooi-prod.conf" + ], + "allowed_decisions": [ + "confirm", + "defer", + "reject", + "request_more_evidence" + ], + "blocked_requests": [ + "repo_create", + "visibility_change", + "refs_sync", + "refs_delete", + "force_push", + "workflow_modify", + "runner_enable", + "secret_value_submit", + "ssh_host_modify", + "nginx_reload", + "dns_tls_modify", + "argocd_sync", + "kubectl_apply", + "active_scan", + "agent_bounty_runtime_execute", + "payout_or_withdrawal" + ], + "category_id": "nginx_public_gateway", + "control_tier": "C0", + "false_flags": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "dns_tls_change_authorized": false, + "force_push_authorized": false, + "host_write_authorized": false, + "nginx_reload_authorized": false, + "refs_sync_authorized": false, + "request_sent": false, + "response_accepted": false, + "response_received": false, + "runner_change_authorized": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false, + "workflow_modification_authorized": false + }, + "field_templates": [ + { + "field": "owner_role_or_team", + "instruction": "填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊。", + "required": true + }, + { + "field": "decision", + "instruction": "只能填 confirm、defer、reject、request_more_evidence；不得附帶 runtime 執行批准。", + "required": true + }, + { + "field": "decision_reason", + "instruction": "填脫敏短理由；不可貼 raw log、raw API body、未脫敏截圖或內部對話。", + "required": true + }, + { + "field": "affected_scope", + "instruction": "填受影響 repo、host、domain、namespace、route、service、secret name 或產品邊界。", + "required": true + }, + { + "field": "redacted_evidence_refs", + "instruction": "只填文件路徑、snapshot id、ticket id、commit、hash 或脫敏 metadata pointer。", + "required": true + }, + { + "field": "followup_owner", + "instruction": "填後續補證、審查或決策負責角色 / 團隊。", + "required": true + }, + { + "field": "rollback_owner", + "instruction": "填回滾負責角色 / 團隊；不是直接執行授權。", + "required": true + }, + { + "field": "maintenance_window", + "instruction": "填維護窗口或明確寫 deferred / not scheduled；不得用口頭同意代替。", + "required": true + }, + { + "field": "validation_plan", + "instruction": "填 preflight、post-check、rollback check；若只讀文件變更，寫 guard / json / doc secret sanity。", + "required": true + } + ], + "label": "Nginx / reverse proxy / public route", + "outcome_lanes": [ + "keep_waiting_owner_response", + "request_more_evidence", + "quarantine_sensitive_payload", + "reject_execution_request", + "ready_for_reviewer_validation" + ], + "packet_id": "high_value_config_owner_packet:nginx_public_gateway", + "priority": "P0", + "redaction_rules": [ + "只收 redacted evidence refs，不收 secret value。", + "疑似 token、cookie、authorization header、private key、runner token 或 webhook secret 一律 quarantine。", + "內部工作視窗對話、抱怨、口頭同意不得進產品文案或 LOGBOOK raw text。" + ], + "required_gate": "public_gateway_owner_response_required", + "required_validation": [ + "rendered_diff", + "nginx_t", + "affected_route_smoke", + "admin_route_smoke_if_affected", + "acme_path_smoke_if_affected", + "rollback_ref" + ], + "reviewer_checklist": [ + "canonical owner fields 全部存在。", + "decision 只使用允許值。", + "affected scope 可映射到 repo / host / domain / route / service / secret name。", + "redacted evidence refs 不含 raw payload。", + "沒有夾帶執行要求。", + "C0 / C1 若要進 runtime，需獨立人工批准與維護窗口。" + ], + "status": "draft_waiting_owner_response" + }, + { + "affected_files": [ "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md", - "docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md", - "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", "docs/security/high-value-config-change-gate.snapshot.json", - "docs/security/high-value-config-owner-packet.snapshot.json", - "scripts/security/high-value-config-change-gate.py", - "scripts/security/high-value-config-owner-packet.py" + "scripts/security/high-value-config-change-gate.py" ], "allowed_decisions": [ "confirm", @@ -634,23 +887,23 @@ "schema_version": "high_value_config_owner_packet_v1", "source_gate_schema_version": "high_value_config_change_gate_v1", "source_gate_summary": { - "changed_file_count": 8, - "impacted_c0_category_count": 0, + "changed_file_count": 6, + "impacted_c0_category_count": 2, "impacted_c1_category_count": 0, - "impacted_category_count": 1, - "matched_high_value_file_count": 8, + "impacted_category_count": 3, + "matched_high_value_file_count": 6, "owner_evidence_complete": false, "owner_evidence_provided": false, "runtime_execution_authorized": false, - "strongest_priority": "P3", - "strongest_tier": "C3" + "strongest_priority": "P0", + "strongest_tier": "C0" }, "status": "draft_waiting_owner_response", "summary": { "accepted_response_count": 0, - "c0_packet_count": 0, + "c0_packet_count": 2, "c1_packet_count": 0, - "packet_count": 1, + "packet_count": 3, "received_response_count": 0, "request_sent_count": 0, "runtime_gate_count": 0 diff --git a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md index 144be8381..3af81218b 100644 --- a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md +++ b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md @@ -684,7 +684,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator | `docs/evaluations/ai_agent_result_capture_release_decision_owner_response_readback_2026-06-14.json` + `GET /api/v1/agents/agent-result-capture-release-decision-owner-response-readback` | P2-144 owner response readback；承接 P2-143 preflight，建立 5 條 response readback lane、18 個 required owner field、6 個 readback validation check、6 個 readback rejection guard、5 個 operator action、5 個 waiting external response 與 5 個 no external response received lane；runtime authority 固定 `result_capture_release_decision_owner_response_readback_only_no_live_write`；owner response received / accepted / rejected、redacted payload ingested、owner decision approved、verifier decision approved、maintenance window approved、release decision passed、release authorization granted、rollback release passed、live apply release passed、writer apply、execution apply、receipt write、reviewer queue write、Gateway queue write、Telegram send、Bot API call、result capture write、learning write、PlayBook trust write、production write、secret read 與 destructive action 全部 `0 / false`；feature commit `8795f100`、deploy marker `ac938037`、Gitea code-review `2965` / CD `2964` success、本地 P2-139 至 P2-144 regression `45 passed`，rebase 後含 tenants regression 的推送前回歸 `47 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、value-only 禁用外露值掃描、i18n key parity 與 diff check 通過；production API readback、desktop / mobile smoke、水平溢位 `0`、危險控制 `0`、工作溝通片語命中 `0` 已完成，下一步 P2-145 owner response acceptance gate | | `docs/evaluations/ai_agent_result_capture_release_decision_owner_response_acceptance_gate_2026-06-14.json` + `GET /api/v1/agents/agent-result-capture-release-decision-owner-response-acceptance-gate` | P2-145 owner response acceptance gate；承接 P2-144 readback，建立 5 條 acceptance gate lane、18 個 required owner field、6 個 acceptance validation check、6 個 acceptance rejection guard、5 個 operator action、5 個 blocked no external response 與 5 個 no acceptable external response；runtime authority 固定 `result_capture_release_decision_owner_response_acceptance_gate_only_no_live_write`；owner response received / accepted / rejected、redacted payload ingested、owner release authorized / approved、owner review approved、owner decision approved、verifier decision approved、maintenance window approved、rollback owner confirmed、release decision passed、release authorization granted、rollback release passed、live apply release passed、writer apply、execution apply、receipt write、reviewer queue write、Gateway queue write、Telegram send、Bot API call、result capture write、learning write、PlayBook trust write、production write、secret read 與 destructive action 全部 `0 / false`；feature commit `386dbd07`、deploy marker `36fbfc6b`、Gitea code-review `2969` / CD `2968` success、本地 P2-144 + P2-145 owner response chain regression `16 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、顯示值工作視窗污染掃描、i18n key parity 與 diff check 通過；production API readback、in-app browser smoke、desktop / mobile smoke、水平溢位 `0`、P2-145 卡片操作控制 `0`、工作溝通片語命中 `0` 已完成，下一步 P2-146 acceptance receipt preview | | `/zh-TW/iwooos` P0 配置控管優先序看板 | P0 配置控管優先序前台正式驗證完成；集中顯示 Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類即時風險配置；owner response `0 / 0`、live evidence `0`、執行期 `0`、操作按鈕 `0`；feature commit `e992af89`、deploy marker `ed651a98`、Gitea code-review `2971` / CD `2970` success；本地與正式 in-app browser、desktop `1440x1100`、mobile `390x844` 檢查通過，新增看板水平溢位 `0`、看板內外凸元素 `0`、工作溝通片語命中 `0` | 這是高價值配置控管的可視化優先序，不是 Nginx live conf 讀取、`nginx -t`、reload、DNS / TLS probe、certbot renew、ArgoCD sync、kubectl、workflow / secret 修改、public route change、agent-bounty runtime、payout / withdrawal、production write 或 runtime gate | -| `scripts/security/high-value-config-change-gate.py` + `docs/security/high-value-config-change-gate.snapshot.json` | P0 高價值配置 Gate pattern 與工作樹 preflight 補強本地完成；新增 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，讓 `k8s/nginx/awoooi-prod.conf` 命中 `nginx_public_gateway` P0 / C0，讓 `scripts/ops/188-registry-certbot-fix.sh` 與 `scripts/ops/fix-188-registry-certbot-renewal.sh` 命中 `dns_tls_certbot` P0 / C0；補強前 sample `matched=0 / C0=0`，補強後 sample `matched=3 / C0=2`；committed snapshot sample `changed_files=6`、`matched=6`、`categories=3`、`c0=2`、`c1=0`、strongest tier `C0`、strongest priority `P0`；預設模式已可讀取 staged / unstaged / untracked，臨時 `k8s/nginx/*` smoke 命中 C0；owner evidence `provided=false / complete=false`，runtime execution `false` | 這是 repo 內分類工具與快照補強，不是 Nginx live conf 讀取、`nginx -t`、reload、DNS / TLS live probe、certbot renew、主機寫入、workflow 修改、secret 收集、active scan、production write 或 runtime gate | +| `scripts/security/high-value-config-change-gate.py` + `docs/security/high-value-config-change-gate.snapshot.json` + owner packet / coverage snapshots | P0 高價值配置 Gate pattern、工作樹 preflight、owner packet 與 coverage snapshot 同步本地完成；新增 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，讓 `k8s/nginx/awoooi-prod.conf` 命中 `nginx_public_gateway` P0 / C0，讓 `scripts/ops/188-registry-certbot-fix.sh` 與 `scripts/ops/fix-188-registry-certbot-renewal.sh` 命中 `dns_tls_certbot` P0 / C0；補強前 sample `matched=0 / C0=0`，補強後 sample `matched=3 / C0=2`；committed snapshot sample `changed_files=6`、`matched=6`、`categories=3`、`c0=2`、`c1=0`、strongest tier `C0`、strongest priority `P0`；預設模式已可讀取 staged / unstaged / untracked，臨時 `k8s/nginx/*` smoke 命中 C0；owner packet snapshot `packets=3 / c0=2 / runtime_gate=0`；coverage snapshot `categories=14 / c0=8 / avg=66 / runtime_gate=0`；owner evidence `provided=false / complete=false`，runtime execution `false` | 這是 repo 內分類工具與快照補強，不是 Nginx live conf 讀取、`nginx -t`、reload、DNS / TLS live probe、certbot renew、主機寫入、workflow 修改、secret 收集、active scan、production write 或 runtime gate | | `docs/evaluations/ai_agent_live_read_model_gate_2026-06-11.json` + `GET /api/v1/agents/agent-live-read-model-gate` | P2-403B AgentSession / Redis Streams live read model gate；定義 safe fields、Redis envelope、worker gate、rollback plan 與 no-write smoke，不連 DB、不讀寫 Redis、不啟動 worker | #### 3.2.1c 2026-06-11 AI Agent 主動營運委派與版本生命週期契約 @@ -820,7 +820,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence 65. 建立 owner response readback。✅ P2-144 已完成正式驗證；承接 P2-143 preflight，固定 response readback lane `5`、required owner field `18`、readback validation check `6`、readback rejection guard `6`、operator action `5`、waiting external response `5`、no external response received lane `5`；owner response received / accepted / rejected、redacted payload ingested、reviewer queue write、Gateway queue write、Telegram send、Bot API、result capture、learning、PlayBook trust、production write、secret read、destructive operation 仍為 `0 / false`；feature commit `8795f100`、deploy marker `ac938037`、Gitea code-review `2965` / CD `2964` success；本地 P2-139 至 P2-144 regression `45 passed`，rebase 後含 tenants regression 的推送前回歸 `47 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、value-only 禁用外露值掃描、i18n key parity 與 diff check 通過；production API readback、desktop / mobile smoke、水平溢位 `0`、危險控制 `0`、工作溝通片語命中 `0` 已完成。下一步 P2-145 owner response acceptance gate。 66. 建立 owner response acceptance gate。✅ P2-145 已完成並正式驗證；承接 P2-144 readback，固定 acceptance gate lane `5`、required owner field `18`、acceptance validation check `6`、acceptance rejection guard `6`、operator action `5`、blocked no external response `5`、no acceptable external response `5`；owner response received / accepted / rejected、redacted payload ingested、reviewer queue write、Gateway queue write、Telegram send、Bot API、result capture、learning、PlayBook trust、production write、secret read、destructive operation 仍為 `0 / false`；feature commit `386dbd07`、deploy marker `36fbfc6b`、Gitea code-review `2969` / CD `2968` success；P2-144 + P2-145 regression `16 passed`、JSON parse、Python compile、Web typecheck、guard、doc secret sanity、顯示值工作視窗污染掃描、i18n key parity、diff check、production API readback、in-app browser smoke、desktop / mobile smoke、水平溢位 `0`、P2-145 卡片操作控制 `0`、工作溝通片語命中 `0` 已完成。下一步 P2-146 acceptance receipt preview，且必須等合格、遮罩、欄位完整、可驗證來源的外部正式回覆後才能建立 receipt preview。 67. 新增 P0 配置控管優先序前台可視化。✅ 正式驗證完成；`/zh-TW/iwooos` 已集中顯示 Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類即時風險配置；owner response `0 / 0`、live evidence `0`、執行期 `0`、操作按鈕 `0`；feature commit `e992af89`、deploy marker `ed651a98`、Gitea code-review `2971` / CD `2970` success；本地與正式 in-app browser、desktop `1440x1100`、mobile `390x844` smoke 通過。這不是 Nginx live conf 讀取、`nginx -t`、reload、DNS / TLS probe、certbot renew、ArgoCD sync、kubectl、workflow / secret 修改、public route change、agent-bounty runtime、payout / withdrawal、production write 或 runtime gate。 -68. 補強 P0 高價值配置 Gate path pattern 與工作樹 preflight。✅ 本地完成；`k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` 已納入 high-value config classification，Nginx public gateway 與 DNS / TLS / certbot sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；snapshot 顯示 `changed_files=6`、`matched=6`、`categories=3`、`c0=2`、`c1=0`；預設模式已可讀取 staged / unstaged / untracked，臨時 `k8s/nginx/*` smoke 命中 C0；owner evidence 仍 `provided=false / complete=false`，runtime execution 仍 `false`。這不是 live config read、`nginx -t`、reload、certbot renew、DNS / TLS probe、host write、active scan、workflow 修改、secret 收集、production write 或 runtime gate。 +68. 補強 P0 高價值配置 Gate path pattern、工作樹 preflight、owner packet 與 coverage snapshot。✅ 本地完成；`k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` 已納入 high-value config classification，Nginx public gateway 與 DNS / TLS / certbot sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；gate snapshot 顯示 `changed_files=6`、`matched=6`、`categories=3`、`c0=2`、`c1=0`；預設模式已可讀取 staged / unstaged / untracked，臨時 `k8s/nginx/*` smoke 命中 C0；owner packet snapshot `packets=3 / c0=2 / runtime_gate=0`；coverage snapshot `categories=14 / c0=8 / avg=66 / runtime_gate=0`；owner evidence 仍 `provided=false / complete=false`，runtime execution 仍 `false`。這不是 live config read、`nginx -t`、reload、certbot renew、DNS / TLS probe、host write、active scan、workflow 修改、secret 收集、production write 或 runtime gate。 #### 3.2.1d 2026-06-11 Agent 互動、學習與成長證據面 diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index a831de8ac..097abd6d5 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -74,7 +74,7 @@ | P0-7 | Telegram 批准後執行真相鏈止血 | 100% | no-action approval 不再顯示批准 / 執行中；可執行修復 approval 會寫入 `auto_repair_executions`、KM 與 verifier；下一步補 MCP evidence / PlayBook trust 產生真正修復候選 | 目標 pytest `125 passed`、py_compile、guard、production health、API / worker rollout、production pod classifier readback | | P0-8 | Telegram no-action 人工處置包與操作入口 | 100% | no-action 卡片已新增人工處置包、證據補齊清單、AwoooP 修復候選建立步驟、verifier / KM / PlayBook 回寫提醒，並改成 `處置包`、`重診`、`歷史`、`靜默`、`真相鏈`、`Runs` 鍵盤；舊訊息不 retroactive 改寫 | 目標 pytest `64 passed + 44 passed`、py_compile、guard、production health、API / worker rollout、production pod render / keyboard smoke | | P0-9 | MCP evidence -> PlayBook 修復候選產生 | D5 `88%` | 已補 webhook fallback 先建立 incident，再收 MCP evidence、查 approved PlayBook、檢查 trust / command safety、產生 medium approval candidate 與 verifier plan；D1 追加通用兜底 PlayBook / 診斷型命令不可誤當修復、阻擋理由繁中化；D2 在缺候選時產生 `repair_candidate_draft_package_v1`、`playbook_draft_required`、下一步與必填欄位；D3 新增 `awooop_repair_candidate_draft_work_item_v1` read-only projection 與 Telegram `工作項目` deeplink；D4 讓 AwoooP Work Items 詳細呈現 PlayBook 草案處置板、必填欄位、阻擋原因、下一步、Runs / 審批連結；D5 新增 `repair_candidate_coverage_gap_v1`，讓 blocked result 帶出 coverage key、target kind、blocking stage、必收 MCP evidence refs、PlayBook template fields 與 runtime 0 / false 邊界；下一步要補 MCP tool call/result 詳細證據面與真實告警 approval -> execution -> verifier -> KM / PlayBook 回寫 | 目標 pytest `7 passed`、py_compile、guard、diff check；後續部署後需補 production health、API / worker rollout 與 production pod metadata render smoke；status-chain 後續仍必須看到 tool call、PlayBook id、risk gate、repair candidate、verifier plan | -| P0-10 | 高價值配置 Gate path coverage 與工作樹 preflight 補強 | 100% | 已將 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` 納入 `high-value-config-change-gate.py`，讓 Nginx public gateway 與 DNS / TLS / certbot 既有路徑命中 P0 / C0；預設模式可讀取 staged / unstaged / untracked，避免本地 preflight 漏掉未提交配置；owner evidence 仍未提供，runtime execution 仍 false | `high-value-config-change-gate.py` sample：補強後 `changed_files=6 matched=6 categories=3 c0=2 c1=0`；工作樹 smoke：臨時 `k8s/nginx/*` 檔命中 C0；`py_compile`、snapshot JSON parse、progress guard、owner response guard、doc secret sanity、diff check | +| P0-10 | 高價值配置 Gate path coverage、工作樹 preflight、owner packet / coverage snapshot 補強 | 100% | 已將 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*` 納入 `high-value-config-change-gate.py`，讓 Nginx public gateway 與 DNS / TLS / certbot 既有路徑命中 P0 / C0；預設模式可讀取 staged / unstaged / untracked，避免本地 preflight 漏掉未提交配置；owner packet 與 coverage snapshot 已同步最新 pattern；owner evidence 仍未提供，runtime execution 仍 false | Gate sample：`changed_files=6 matched=6 categories=3 c0=2 c1=0`；工作樹 smoke：臨時 `k8s/nginx/*` 檔命中 C0；owner packet：`packets=3 c0=2 runtime_gate=0`；coverage：`categories=14 c0=8 avg=66 runtime_gate=0`；`py_compile`、snapshot JSON parse、progress guard、owner response guard、doc secret sanity、diff check | ## 3. S4.9 Owner Response Gate 規範