wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add ref truth template status ledger

Browse Source
This commit is contained in:
Your Name
2026-05-18 19:32:42 +08:00
parent 51dc2cff27
commit d7d8f9f565
33 changed files with 267 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
View File

@@ -28,7 +28,7 @@
| Review packets | S3.2 已建立；8 packets、7 ready for human review、1 block candidate |
| State transitions | S3.3 已建立；5 個 decision options 都有 next state，且都不授權執行 |
| Follow-up runtime gate templates | S3.4 已建立；8 個 templates、0 個 active runtime gates |
| GitHub primary readiness gate | S4.0 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，7 個 response templates、owner response 0 筆；S4.11 已補 refs truth owner response request packet 與收件包，5 個 response templates、owner response 0 筆；S4.12 已補 workflow / secret 名稱 owner response 收件包，5 個 response templates、owner response 0 筆；S4.13 已補四包 owner response validation rollup，22 個 templates、received / accepted / rejected 皆為 0 |
| GitHub primary readiness gate | S4.0 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，7 個 response templates、owner response 0 筆；S4.11 已補 refs truth owner response request packet、5 個 template statuses 與收件包，5 個 response templates、owner response 0 筆；S4.12 已補 workflow / secret 名稱 owner response 收件包，5 個 response templates、owner response 0 筆；S4.13 已補四包 owner response validation rollup，22 個 templates、received / accepted / rejected 皆為 0 |
| GitHub primary rollback ADR | S4.4 已建立；7 個 in-scope rollback drafts、0 個 owner approved、0 個 dry-run completed、0 個 active cutover |
| Gitea inventory | S4.5 已補認證清冊匯出請求；S4.6 已補匯入驗收契約；S4.7 已補 owner coverage attestation；S4.8 已把既有 Gitea queue/gate/review packet/follow-up gate 對齊 attestation 先行；S4.9 已補 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、owner response 收件包、6 個 intake preflight checks 與 5 個 outcome lanes；目前 status=`partial_waiting_authenticated_inventory`、未認證公開範圍 repos 2 個、本機可見 Gitea unique repos 4 個、匯出來源選項 2 類、匯入驗收 payload 0 筆、owner attestation items 5 個、收到 attestation 0 筆、owner response 0 筆、audit events emitted 0 筆、敏感 payload 必須隔離、允許收集 token value=false |
| Workflow / secret name inventory | S4.1 已建立；S4.2 補 4 個 repos、31 個 workflow files、43 個 referenced secret names 的 local evidence；S4.3 補 7 個 repos、5 類 lanes 的 redacted export request；S4.12 補 5 個 owner response templates；0 個 inventory complete、禁止收集 secret value、禁止 write token |
@@ -59,6 +59,7 @@
| S4.10 collection checks | framework detail | 0 | 只維持 request / received / accepted 狀態分離，不代表 owner response 已收到或已接受 |
| S4.10 intake preflight checks | framework detail | 0 | 只分類可收、補證、隔離或拒收，不代表 owner response accepted 或可執行 repo / refs / primary 動作 |
| S4.11 request packet | framework detail | 0 | 只顯示 owner 要回覆哪 5 類 refs truth 問題，不代表 request sent、response received、accepted 或 refs sync/delete/force push 授權 |
| S4.11 template status ledger | framework detail | 0 | 只逐項顯示 5 類 refs truth response 仍為 waiting，received / accepted 仍為 0，不代表 refs sync/delete/force push 授權 |
headline 進度要再往上，至少需要下列任一高層 gate 有實質 evidence：
@@ -104,7 +105,7 @@ python3 scripts/security/security-mirror-progress-guard.py
3. Gitea private/internal read-only inventory：先依 S4.9 收到並驗收 S4.7 owner coverage attestation response，且 S4.8 已把這個先行條件接到既有 approval queue / gate / review packet / follow-up runtime gate；再依 S4.5 認證匯出請求補全量清冊；收到脫敏 payload 後先依 S4.6 驗收 / 拒收 / 隔離；目前未認證公開範圍 2 個、本機可見 Gitea unique 4 個、覆蓋缺口 2 個、attestation items 5 個、owner response 0 筆，不保存 token value。
4. GitHub target / owner / visibility / canonical：先依 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 7 個 owner decision response templates；received / accepted response 目前皆為 0，不得把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當成 repo creation、visibility change、refs sync 或 primary approval。
5. Kali `/execute` 維持 block candidate。
6. Refs truth owner response：先依 S4.11 request packet 顯示 main/dev truth、deprecated drift、release tag、GitHub-only refs 的 5 個 response templates；received / accepted response 目前皆為 0，不得把 request packet 或 response packet 當成 refs sync、delete、force push 或 primary approval。
6. Refs truth owner response：先依 S4.11 request packet 與 template status ledger 顯示 main/dev truth、deprecated drift、release tag、GitHub-only refs 的 5 個 response templates；received / accepted response 目前皆為 0，不得把 request packet、template status ledger 或 response packet 當成 refs sync、delete、force push 或 primary approval。
7. Workflow / secret 名稱 owner response：先依 S4.12 顯示 webhook、runner、deploy key、branch protection / CODEOWNERS、repository secret name parity 的 5 個 response templates；received / accepted response 目前皆為 0，不得把 response packet 當成 secret value 收集、workflow 修改、GitHub hosted runner 啟用或 primary approval。
8. Owner response validation rollup：先依 S4.13 顯示 S4.9/S4.10/S4.11/S4.12 四包 response packets、22 個 templates、10 個 cross-packet checks 與 quarantine rules；不得把 rollup 當成 approval、runtime gate 或 execution authorization。
9. GitHub primary readiness blockers 與 rollback ADR 缺口。