docs(security): add ref truth template status ledger
This commit is contained in:
Your Name
@@ -27,7 +27,7 @@ python3 scripts/security/security-mirror-progress-guard.py
|
||||
|
||||
### 0.2 Headline 58% 不代表停滯
|
||||
|
||||
近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與 S4.11 request packet 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
|
||||
近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與 S4.11 request packet / template status ledger 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
|
||||
|
||||
| 最近完成 | 目前狀態 | headline delta |
|
||||
|----------|----------|----------------|
|
||||
@@ -38,6 +38,7 @@ python3 scripts/security/security-mirror-progress-guard.py
|
||||
| S4.10 collection checks | 已完成草案，只維持 request / received / accepted 狀態分離 | 0 |
|
||||
| S4.10 intake preflight checks | 已完成草案，只分類可收、補證、隔離或拒收 | 0 |
|
||||
| S4.11 request packet | 已完成草案，只顯示 owner 要回覆哪 5 類 refs truth 問題 | 0 |
|
||||
| S4.11 template status ledger | 已完成草案，5 類 refs truth responses 仍 waiting owner response | 0 |
|
||||
|
||||
headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收，或人工批准後出現 active runtime gate、redacted payload ingestion、GitHub primary readiness 這類落地 evidence。
|
||||
|
||||
@@ -50,7 +51,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
|
||||
| S1.2 GitHub target 逐 repo approval | 完成草案 | 7 個 approval-required targets 已拆成逐 repo pending package，並彙整成 8-item approval board；S4.10 目前 response 0 筆 | 低摩擦逐項批准 |
|
||||
| S1.2a refs reconcile plan | 完成草案 | `awoooi`、`clawbot-v5`、`wooo-aiops` 已產生 draft plan；狀態仍為 `draft_blocked` | authenticated inventory + branch/tag diff + single-repo approval |
|
||||
| S1.2b branch/tag detail diff | 完成草案 | 3 個 refs-blocked mapped repos 已完成 branch/tag 明細 diff；已忽略本 PR 分支避免 evidence 自我污染 | 人工判定真相來源與 deprecated refs |
|
||||
| S1.2c refs 真相來源分類 | 完成草案 | 141 個 ref review items 已分類：4 個真相來源、114 個 drift deprecated 候選、3 個 release tags、20 個 GitHub-only refs；S4.11 已補 owner response request packet 與收件包 | repo owner 單 ref / 單 repo 判定 |
|
||||
| S1.2c refs 真相來源分類 | 完成草案 | 141 個 ref review items 已分類：4 個真相來源、114 個 drift deprecated 候選、3 個 release tags、20 個 GitHub-only refs；S4.11 已補 owner response request packet、template status ledger 與收件包 | repo owner 單 ref / 單 repo 判定 |
|
||||
| S1.3 低摩擦 rollout policy | 完成草案 | observe-first / mirror-only matrix 已建立 | AwoooP read-only policy 消費 |
|
||||
| S1.4 契約索引 | 完成草案 | 35 個主要 contract 已集中成 manifest | AwoooP mirror-only contract registry |
|
||||
| S1.5 Kali 112 live 整合狀態 | 完成第一波 | 112 已登入盤點、scanner API healthy、targeted scanner packages updated、Asia/Taipei timezone、no reboot required | scan result ingestion + `/execute` high-risk gate |
|
||||
@@ -83,7 +84,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
|
||||
| S4.8 Gitea Owner Attestation Approval Lane 對齊 | 完成草案 | 已將既有 Gitea approval queue / gate / review packet / follow-up runtime gate 對齊 S4.7 先行條件；queue items 維持 8、review packets 維持 8、active runtime gates 維持 0 | AwoooP 先顯示 5 個 attestation items，owner decision 接受前不得執行 read-only inventory 或標記 complete |
|
||||
| S4.9 Gitea Owner Attestation Response 收件包 | 完成草案 | 已建立 owner response schema / snapshot / 人讀版；1 個 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、5 個 response templates、6 個 intake preflight checks、5 個 outcome lanes、8 個 acceptance checks、10 個 rejection rules、received response 0、accepted 0、execution authorized=false | owner 依 request packet 與模板回覆 S4.7 五個 items；AwoooP 先用 template status ledger / audit event templates / redaction examples / display sections / collection checks 維持 request / received / accepted 分離，再用 preflight / outcome lanes 判斷可審、補證、隔離、拒收或等待；response 通過只更新 read-only matrix / decision table / readiness gate，不代表 inventory 執行、audit production ingestion 或 primary approval |
|
||||
| S4.10 GitHub Target Owner Decision Response 收件包 | 完成草案 | 已建立 owner decision response schema / snapshot / 人讀版；1 個 owner response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks、7 個 response templates、8 個 acceptance checks、10 個 rejection rules、received response 0、accepted 0、execution authorized=false | owner 依 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與模板回覆 7 個 GitHub target 的 owner / visibility / canonical；response 通過只更新 read-only decision table / approval package / approval board / readiness gate，不代表 repo creation、visibility change、refs sync 或 primary approval |
|
||||
| S4.11 Source Control Ref Truth Owner Response 收件包 | 完成草案 | 已建立 owner response schema / snapshot / 人讀版；1 個 owner response request packet、5 個 response templates、8 個 acceptance checks、10 個 rejection rules、total ref review items 141、received response 0、accepted 0、execution authorized=false | owner 依 request packet 與模板回覆 main/dev truth、deprecated drift、release tag、GitHub-only refs；response 通過只更新 read-only classification / reconcile / readiness wording，不代表 refs sync、delete、force push 或 primary approval |
|
||||
| S4.11 Source Control Ref Truth Owner Response 收件包 | 完成草案 | 已建立 owner response schema / snapshot / 人讀版；1 個 owner response request packet、5 個 template statuses、5 個 response templates、8 個 acceptance checks、10 個 rejection rules、total ref review items 141、received response 0、accepted 0、execution authorized=false | owner 依 request packet、template status ledger 與模板回覆 main/dev truth、deprecated drift、release tag、GitHub-only refs；response 通過只更新 read-only classification / reconcile / readiness wording，不代表 refs sync、delete、force push 或 primary approval |
|
||||
| S4 migration execution | 未開始 | GitHub primary 長期方向已確認，但 refs / tags / workflow / secret 名稱尚未全量驗證，rollback ADR 仍待 owner approval | SHA/tag/workflow parity、rollback ADR owner approval 與 runtime gate |
|
||||
|
||||
## 1. 已建立的主要 evidence
|
||||
@@ -199,11 +200,11 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
|
||||
|
||||
1. 先依 S4.9 `GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md` 收到並驗收 S4.7 `GITEA-INVENTORY-COVERAGE-ATTESTATION.md` 的 owner response；S4.8 已把這件事接到既有 approval queue / gate / review packet / follow-up runtime gate。之後再依 S4.5 `GITEA-AUTHENTICATED-INVENTORY-EXPORT-REQUEST.md` 取得 Gitea 認證清冊；收到 payload 後依 S4.6 `GITEA-AUTHENTICATED-INVENTORY-IMPORT-ACCEPTANCE.md` 驗收 / 拒收 / 隔離。目前未認證公開範圍 2 個、本機可見 Gitea unique 4 個、覆蓋缺口 2 個、attestation items 5 個、owner response 0 筆；只能用只讀 token API 或已脫敏管理匯出補私有 / 內部 server-side 全量 repo list，不保存 token value。
|
||||
2. 依 S4.10 `GITHUB-TARGET-OWNER-DECISION-RESPONSE.md` request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks 與 `SOURCE-CONTROL-APPROVAL-BOARD.md` 對 7 個 `approval_required=true` 的 GitHub target 做 owner / visibility / canonical response；目前 response 0 筆、accepted 0 筆，通過後也只更新 read-only decision table / approval package / readiness gate，不代表 repo creation、visibility change、refs sync 或 primary approval。
|
||||
3. 依 S4.11 `SOURCE-CONTROL-REF-TRUTH-OWNER-RESPONSE.md` request packet 與 `SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md` 對 `awoooi`、`clawbot-v5`、`wooo-aiops` 做單 repo / 單 ref owner response 驗收；response 通過也只更新 read-only classification / reconcile / readiness wording，仍不得 push/delete refs 或 force push。
|
||||
3. 依 S4.11 `SOURCE-CONTROL-REF-TRUTH-OWNER-RESPONSE.md` request packet、template status ledger 與 `SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md` 對 `awoooi`、`clawbot-v5`、`wooo-aiops` 做單 repo / 單 ref owner response 驗收；response 通過也只更新 read-only classification / reconcile / readiness wording，仍不得 push/delete refs 或 force push。
|
||||
4. 依 S4.12 `SOURCE-CONTROL-WORKFLOW-SECRET-NAME-OWNER-RESPONSE.md` 與 `SOURCE-CONTROL-WORKFLOW-SECRET-NAME-EXPORT-REQUEST.md` 對 webhook、runner、deploy key、branch protection / CODEOWNERS、repository secret name parity 做 owner response 驗收；response 通過也只更新 read-only inventory / export request / readiness wording，仍不得收 secret value、改 workflow 或啟用 runner。
|
||||
5. 依 S4.13 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md` 集中檢查 S4.9 / S4.10 / S4.11 / S4.12 四包 response packets；rollup 通過也只更新 read-only wording，不代表 approval 或 execution authorization。
|
||||
6. 對 `ewoooc` / `momo-pro-system` 完成 server-side canonical 判定。
|
||||
7. 依 `KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md` 取得 safe crawl、credentialed scan、runtime ingestion、full-upgrade / reboot 等 gate 的人工批准；不得直接接 `/execute`。
|
||||
8. AwoooP 主線先讀 `security_mirror_readiness_v1`、`security_mirror_intake_plan_v1`、`security_mirror_event_v1`、`security_mirror_route_v1`、`security_mirror_acceptance_v1`、`security_mirror_quarantine_v1`、`security_mirror_dry_run_v1`、`security_mirror_status_rollup_v1`、S4.13 `source_control_owner_response_validation_rollup_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1`、`source_control_primary_readiness_gate_v1`、`source_control_primary_rollback_adr_v1` 與 `source_control_workflow_secret_name_inventory_v1`，只建立 mirror-only / read-only policy 入口，不新增執行按鈕；其中 Gitea inventory 需同時顯示 S4.5 認證清冊匯出請求、S4.6 匯入驗收契約、S4.7 owner coverage attestation 與 S4.9 owner response request packet / template status ledger / audit event templates / redaction examples / display sections / collection checks / 收件包，GitHub target 決策需同時顯示 S4.10 owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與 owner decision response templates，refs truth 需同時顯示 S4.11 owner response request packet 與 templates，workflow / secret inventory 需同時顯示 S4.3 redacted export request 與 S4.12 owner response templates，primary readiness 需同時顯示 S4.4 rollback ADR 草案。
|
||||
8. AwoooP 主線先讀 `security_mirror_readiness_v1`、`security_mirror_intake_plan_v1`、`security_mirror_event_v1`、`security_mirror_route_v1`、`security_mirror_acceptance_v1`、`security_mirror_quarantine_v1`、`security_mirror_dry_run_v1`、`security_mirror_status_rollup_v1`、S4.13 `source_control_owner_response_validation_rollup_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1`、`source_control_primary_readiness_gate_v1`、`source_control_primary_rollback_adr_v1` 與 `source_control_workflow_secret_name_inventory_v1`，只建立 mirror-only / read-only policy 入口，不新增執行按鈕；其中 Gitea inventory 需同時顯示 S4.5 認證清冊匯出請求、S4.6 匯入驗收契約、S4.7 owner coverage attestation 與 S4.9 owner response request packet / template status ledger / audit event templates / redaction examples / display sections / collection checks / 收件包，GitHub target 決策需同時顯示 S4.10 owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與 owner decision response templates，refs truth 需同時顯示 S4.11 owner response request packet、template status ledger 與 templates，workflow / secret inventory 需同時顯示 S4.3 redacted export request 與 S4.12 owner response templates，primary readiness 需同時顯示 S4.4 rollback ADR 草案。
|
||||
9. AwoooP 主線消費 `security_rollout_policy_v1` 時，只做 read-only policy，不做 runtime blocking。
|
||||
10. AwoooP 主線再讀 `security_approval_queue_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1`、`source_control_primary_readiness_gate_v1`、`source_control_primary_rollback_adr_v1`、`source_control_workflow_secret_name_inventory_v1` 與 `security_supply_chain_contract_manifest_v1`，顯示 review order、批准範圍、審查封包、決策紀錄、決策後狀態、後續 runtime gate 準備條件、Gitea inventory 覆蓋缺口、S4.5 認證匯出請求、S4.6 匯入驗收 / 隔離規則、S4.7 owner attestation items、S4.9 owner response request packet、S4.9 owner response template status ledger、S4.9 owner response audit event templates、S4.9 owner response redaction examples、S4.9 owner response display sections、S4.9 owner response collection checks、S4.9 owner response templates、S4.10 GitHub target owner response request packet、S4.10 GitHub target owner response template status ledger、S4.10 GitHub target owner response audit event templates、S4.10 GitHub target owner response redaction examples、S4.10 GitHub target owner response collection checks、S4.10 GitHub target owner response intake preflight checks、S4.10 GitHub target owner response templates、S4.11 refs truth owner response request packet、S4.11 refs truth owner response templates、S4.12 workflow / secret 名稱 owner response templates、S4.13 owner response validation rollup、GitHub primary readiness blockers、rollback ADR 草案、workflow / secret 名稱 inventory 缺口、redacted export request 與 blocked reason，不新增 execution router。
|
||||
10. AwoooP 主線再讀 `security_approval_queue_v1`、`security_approval_gate_v1`、`security_approval_decision_record_v1`、`security_approval_review_packet_v1`、`security_approval_state_transition_v1`、`security_followup_runtime_gate_v1`、`source_control_primary_readiness_gate_v1`、`source_control_primary_rollback_adr_v1`、`source_control_workflow_secret_name_inventory_v1` 與 `security_supply_chain_contract_manifest_v1`，顯示 review order、批准範圍、審查封包、決策紀錄、決策後狀態、後續 runtime gate 準備條件、Gitea inventory 覆蓋缺口、S4.5 認證匯出請求、S4.6 匯入驗收 / 隔離規則、S4.7 owner attestation items、S4.9 owner response request packet、S4.9 owner response template status ledger、S4.9 owner response audit event templates、S4.9 owner response redaction examples、S4.9 owner response display sections、S4.9 owner response collection checks、S4.9 owner response templates、S4.10 GitHub target owner response request packet、S4.10 GitHub target owner response template status ledger、S4.10 GitHub target owner response audit event templates、S4.10 GitHub target owner response redaction examples、S4.10 GitHub target owner response collection checks、S4.10 GitHub target owner response intake preflight checks、S4.10 GitHub target owner response templates、S4.11 refs truth owner response request packet、S4.11 refs truth owner response template status ledger、S4.11 refs truth owner response templates、S4.12 workflow / secret 名稱 owner response templates、S4.13 owner response validation rollup、GitHub primary readiness blockers、rollback ADR 草案、workflow / secret 名稱 inventory 缺口、redacted export request 與 blocked reason，不新增 execution router。
|
||||
|
||||
Reference in New Issue
Block a user