wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

docs(security): add ref truth template status ledger

Browse Source
This commit is contained in:
Your Name
2026-05-18 19:32:42 +08:00
parent 51dc2cff27
commit d7d8f9f565
33 changed files with 267 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
View File

@@ -122,7 +122,7 @@ GitHub primary 可以作為長期方向，但目前還不能切換。
Repo-by-repo approval package 已建立，7 個 approval-required targets 皆為 `pending`。Approval scope 採低摩擦原則：只處理高風險執行邊界，不阻擋 read-only inventory、evidence mirror 與草案規劃。
Ref truth classification 已建立，將 `awoooi`、`clawbot-v5`、`wooo-aiops` 的 141 個 refs 差異拆成 review lane。`main` / `dev` 屬真相來源判定，`drift/adopt-*` 先列 deprecated candidate，release / UAT tags 先列保留判定；S4.11 已補 owner response request packet 與收件包，5 個 templates、received / accepted response 皆為 0。不得把分類結果、request packet 或 response packet 直接執行成同步、刪除、force push 或 primary switch。
Ref truth classification 已建立，將 `awoooi`、`clawbot-v5`、`wooo-aiops` 的 141 個 refs 差異拆成 review lane。`main` / `dev` 屬真相來源判定，`drift/adopt-*` 先列 deprecated candidate，release / UAT tags 先列保留判定；S4.11 已補 owner response request packet、template status ledger 與收件包，5 個 templates、received / accepted response 皆為 0。不得把分類結果、request packet、template status ledger 或 response packet 直接執行成同步、刪除、force push 或 primary switch。
Workflow / secret name owner response 已建立，S4.12 補 5 個 templates，對應 webhook、runner、deploy key、branch protection / CODEOWNERS 與 repository secret name parity；received / accepted response 皆為 0。不得把 response packet 當成 secret value collection、workflow modification、GitHub hosted runner enablement 或 primary approval。
@@ -151,13 +151,13 @@ Owner response validation rollup 已建立，S4.13 彙整 S4.9 / S4.10 / S4.11 /
這三個 mapped repos 都不能直接視為 GitHub primary ready。
Ref truth classification 補充：完整 review lane 見 `docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md`，S4.11 owner response request packet / 收件包見 `docs/security/SOURCE-CONTROL-REF-TRUTH-OWNER-RESPONSE.md`。目前分類結果是 4 個 `manual_truth_required`、114 個 `manual_review_deprecated_candidate`、3 個 `manual_review_release_tag`、20 個 `manual_review_github_only`。
Ref truth classification 補充：完整 review lane 見 `docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md`，S4.11 owner response request packet / template status ledger / 收件包見 `docs/security/SOURCE-CONTROL-REF-TRUTH-OWNER-RESPONSE.md`。目前分類結果是 4 個 `manual_truth_required`、114 個 `manual_review_deprecated_candidate`、3 個 `manual_review_release_tag`、20 個 `manual_review_github_only`。
## 5. 下一波建議
1. 先批准 Gitea read-only inventory package，再用只讀 token 或管理匯出補齊 Gitea server repo list。
2. 依 GitHub target repo-by-repo approval package 處理 7 個 approval-required target。
3. 依 S4.11 ref truth owner response request packet / 收件包與 classification 釐清 `wooo/awoooi`、`wooo/clawbot-v5`、`wooo/wooo-aiops` 的雙端分歧來源；仍不得 push/delete refs。
3. 依 S4.11 ref truth owner response request packet / template status ledger / 收件包與 classification 釐清 `wooo/awoooi`、`wooo/clawbot-v5`、`wooo/wooo-aiops` 的雙端分歧來源；仍不得 push/delete refs。
4. 依 S4.12 workflow / secret name owner response 收件包補 webhook、runner、deploy key、branch protection / CODEOWNERS、repository secret name parity 的 redacted disposition；仍不得收 secret value、改 workflow 或啟用 hosted runner。
5. 依 S4.13 owner response validation rollup 集中檢查 S4.9-S4.12 四包 response validation；仍不得把 rollup 當 approval 或 execution authorization。
6. 釐清 `wooo/ewoooc`、`root/momo-pro-system`、`momo-pro-system`、`momo_pro_system` 的 canonical 關係。