wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

docs(security): add ref truth template status ledger

Browse Source
This commit is contained in:
Your Name
2026-05-18 19:32:42 +08:00
parent 51dc2cff27
commit d7d8f9f565
33 changed files with 267 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
View File

@@ -38,7 +38,7 @@
| Gate | 目前狀態 | 說明 |
|------|----------|------|
| Gitea authenticated inventory | blocked | private/internal 全量 repo list 尚未完成；S4.9 owner response request packet、template status ledger、audit event templates、redaction examples、display sections 與 collection checks 已可顯示，但 S4.7 owner coverage attestation response 仍未收到，audit events emitted 仍為 0；S4.13 已集中顯示四包 owner response validation，但 total accepted response 仍為 0 |
| refs truth / branch-tag parity | blocked | 3 個 mapped repos 仍有 refs drift；S4.11 已補 refs truth owner response request packet 與收件包，received / accepted response 皆為 0 |
| refs truth / branch-tag parity | blocked | 3 個 mapped repos 仍有 refs drift；S4.11 已補 refs truth owner response request packet、template status ledger 與收件包，received / accepted response 皆為 0 |
| workflow / runner / secret name parity | missing evidence | S4.1 已建立 inventory 契約；S4.12 已補 owner response 收件包，received / accepted response 皆為 0；尚未有實際 redacted workflow、webhook、runner、secret 名稱 snapshot |
| owner / visibility / canonical | pending review | 7 個 in-scope targets 仍需人工決策；S4.10 已補 owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，received / accepted response 皆為 0 |
| rollback ADR | pending review | S4.4 已建立 rollback ADR 草案；7 個 in-scope repos 仍需 owner approval、dry-run 與 validation window |
@@ -48,9 +48,9 @@
1. 顯示每個 repo 的 readiness state、blockers 與 evidence refs。
2. 顯示 `primary_ready_count=0`。
3. 將 7 個 in-scope repos 維持在 approval / review lane。
4. 顯示哪些 evidence 仍缺：Gitea authenticated inventory、S4.7 owner coverage attestation、S4.9 owner response request packet / template status ledger / audit event templates / redaction examples / display sections / collection checks / owner response、S4.10 GitHub target owner response request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks / owner response、S4.11 refs truth owner response request packet / owner response、S4.12 workflow / secret name owner response、S4.13 validation rollup、workflow/runner/secret name inventory、rollback ADR。
4. 顯示哪些 evidence 仍缺：Gitea authenticated inventory、S4.7 owner coverage attestation、S4.9 owner response request packet / template status ledger / audit event templates / redaction examples / display sections / collection checks / owner response、S4.10 GitHub target owner response request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks / owner response、S4.11 refs truth owner response request packet / template status ledger / owner response、S4.12 workflow / secret name owner response、S4.13 validation rollup、workflow/runner/secret name inventory、rollback ADR。
5. 連到 S4.10 `github_target_owner_decision_response_v1` 顯示 1 個 owner response request packet、7 個 owner response template statuses、3 個 owner response audit event templates、5 個 owner response redaction examples、6 個 owner response collection checks、6 個 intake preflight checks、7 個 owner decision response templates、8 個 acceptance checks、10 個 rejection rules，且 received / accepted response 皆為 0。
6. 連到 S4.11 `source_control_ref_truth_owner_response_v1` 顯示 1 個 owner response request packet、5 個 refs owner response templates、8 個 acceptance checks、10 個 rejection rules，且 received / accepted response 皆為 0。
6. 連到 S4.11 `source_control_ref_truth_owner_response_v1` 顯示 1 個 owner response request packet、5 個 template statuses、5 個 refs owner response templates、8 個 acceptance checks、10 個 rejection rules，且 received / accepted response 皆為 0。
7. 連到 `source_control_workflow_secret_name_inventory_v1` 顯示 8 個 candidate repos 的 inventory lane 缺口與 S4.2 local evidence；只保存 secret 名稱與 owner，不保存 value。
8. 連到 S4.12 `source_control_workflow_secret_name_owner_response_v1` 顯示 5 個 owner response templates、8 個 acceptance checks、10 個 rejection rules，且 received / accepted response 皆為 0。
9. 連到 S4.13 `source_control_owner_response_validation_rollup_v1` 顯示四包 owner response validation 狀態：22 個 templates、10 個 cross-packet checks、received / accepted / rejected response 皆為 0。
@@ -71,6 +71,6 @@
S4.0 只是把「切換前一定要看見什麼」先定義清楚。
S4.4 已補上 rollback ADR 草案，但它只是 owner review 的資料包，不是切換批准。S4.7 已補上 Gitea coverage owner attestation，S4.9 已補上 Gitea owner response request packet、template status ledger、audit event templates、redaction examples、display sections、collection checks、收件包、preflight 與 outcome lanes，S4.10 已補上 GitHub target owner decision response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，S4.11 已補上 refs truth owner response request packet 與收件包，S4.12 已補上 workflow / secret 名稱 owner response 收件包，S4.13 已補上四包 owner response validation rollup；它們只是 scope decision、response 收件提示、metadata audit template、脫敏範例、只讀顯示順序與驗收框架，不是 audit production ingestion、migration approval、repo creation approval、visibility change approval、refs sync approval、delete approval、force-push approval、secret value collection approval、workflow modification approval 或 primary approval。`owner_approved_count=0`、`dry_run_completed_count=0`、`active_cutover_count=0`。
S4.4 已補上 rollback ADR 草案，但它只是 owner review 的資料包，不是切換批准。S4.7 已補上 Gitea coverage owner attestation，S4.9 已補上 Gitea owner response request packet、template status ledger、audit event templates、redaction examples、display sections、collection checks、收件包、preflight 與 outcome lanes，S4.10 已補上 GitHub target owner decision response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，S4.11 已補上 refs truth owner response request packet、template status ledger 與收件包，S4.12 已補上 workflow / secret 名稱 owner response 收件包，S4.13 已補上四包 owner response validation rollup；它們只是 scope decision、response 收件提示、metadata audit template、脫敏範例、只讀顯示順序與驗收框架，不是 audit production ingestion、migration approval、repo creation approval、visibility change approval、refs sync approval、delete approval、force-push approval、secret value collection approval、workflow modification approval 或 primary approval。`owner_approved_count=0`、`dry_run_completed_count=0`、`active_cutover_count=0`。
這讓長期回到 GitHub 的方向可以繼續往前，但仍維持低摩擦：目前只 mirror、只顯示、只留痕，不執行。