diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 533bfb136..3d7ec245b 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -255,6 +255,14 @@ - 完成度:release lane preflight artifact / guard `100%`;owner acks / evidence `0%`;Gitea push / production deploy / production readback / runtime gate 仍 `0%`。 - 邊界:本段沒有讀 git credential、沒有推送、沒有部署、沒有 Wazuh live query、沒有 host write、沒有 runtime action;只是把 release blocker 變成可審核 gate。 +**Release lane rebase/readback 補充,22:26 Asia/Taipei**: +- `gitea/main` 已再前進到 `ffc167e2 docs(ops): record momo production import boundary readback [skip ci]`;Wazuh 分支已 rebase 到此基底,沒有覆蓋 MOMO production import boundary readback 紀錄。 +- Rebase 後 Wazuh 分支目前只比 `gitea/main` 多三個提交:`9b40ca89 fix(iwooos): 接上 Wazuh 只讀 API 邊界`、`8435a435 docs(iwooos): 記錄 Wazuh release apply proof`、`59188ca1 feat(iwooos): 新增 Wazuh release lane preflight`。 +- 已重新產生 `docs/security/wazuh-readonly-release-gate.snapshot.json` 與 `docs/security/wazuh-readonly-release-lane-preflight.snapshot.json`;兩者仍固定 source / guard 已完成,但 push、deploy、production readback、runtime gate 仍為 `0`。 +- Rebase 後重跑 `pytest apps/api/tests/test_iwooos_wazuh_api.py`、Wazuh route guard、release gate、release-lane preflight、`security-mirror-progress-guard.py`、`doc-secrets-sanity-check.py`、`py_compile`、`git diff --check` 全部通過;正式 production readback 不加 `--allow-predeploy-404` 仍正確阻擋 `404`。 +- 完成度:rebase / snapshot refresh `100%`;formal release lane owner acks `0/6`、evidence `0/6`;Gitea push / production deploy / production readback `0%`。 +- 邊界:本段沒有讀 git credential、沒有推送、沒有部署、沒有 live Wazuh query、沒有 Nginx / Docker / K8s / firewall / host / Wazuh secret 變更。 + ## 2026-06-24|21:04 recovery readback 與 MOMO V10.651 雙機基準收斂 **背景**:前一輪 MOMO workspace readback 指到 `V10.646`,但 21:04 live health 已回 `V10.651`。因此本輪重新比對 Gitea `wooo/ewoooc` `main`、正式站 `/health`、Mac Mini / MacBook Pro Codex workspace 與 full-stack cold-start,避免「網站可用」和「版本 / 資料最新」互相混淆。 diff --git a/docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md b/docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md index f6964d21b..5e4d36f2b 100644 --- a/docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md +++ b/docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md @@ -72,7 +72,7 @@ git diff --check - `wazuh-readonly-release-gate`:`source=1 push=0 deploy=0 readback=0 runtime_gate=0`。 - `wazuh-readonly-release-lane-preflight`:`ready=0 acks=0/6 evidence=0/6 runtime_gate=0`。 - `security-mirror-progress-guard`:`SECURITY_MIRROR_PROGRESS_GUARD_OK`。 -- `doc-secrets-sanity-check`:`DOC_SECRET_SANITY_OK scanned_files=969`。 +- `doc-secrets-sanity-check`:`DOC_SECRET_SANITY_OK scanned_files=970`。 - `py_compile`:通過。 - `git diff --check`:通過。 @@ -92,8 +92,9 @@ git am /private/tmp/awoooi-iwooos-wazuh-boundary-release-patch-/*.pat - `pytest apps/api/tests/test_iwooos_wazuh_api.py`:`4 passed`。 - `python3 scripts/security/wazuh-readonly-route-boundary-guard.py --root .`:`WAZUH_READONLY_ROUTE_BOUNDARY_GUARD_OK route=2 public_ui_files=1 forbidden=0 runtime_gate=0`。 - `python3 scripts/security/wazuh-readonly-release-gate.py --root .`:`WAZUH_READONLY_RELEASE_GATE_OK source=1 push=0 deploy=0 readback=0 runtime_gate=0`。 +- `python3 scripts/security/wazuh-readonly-release-lane-preflight.py --root .`:`WAZUH_READONLY_RELEASE_LANE_PREFLIGHT_OK ready=0 acks=0/6 evidence=0/6 runtime_gate=0`。 - `python3 scripts/security/security-mirror-progress-guard.py --root .`:`SECURITY_MIRROR_PROGRESS_GUARD_OK`。 -- `python3 scripts/ops/doc-secrets-sanity-check.py ...`:`DOC_SECRET_SANITY_OK scanned_files=969`。 +- `python3 scripts/ops/doc-secrets-sanity-check.py ...`:`DOC_SECRET_SANITY_OK scanned_files=970`。 - `python3 -m py_compile ...`:通過。 - `git diff --check`:通過。 diff --git a/docs/security/wazuh-readonly-release-gate.snapshot.json b/docs/security/wazuh-readonly-release-gate.snapshot.json index 109233720..216a2d20e 100644 --- a/docs/security/wazuh-readonly-release-gate.snapshot.json +++ b/docs/security/wazuh-readonly-release-gate.snapshot.json @@ -14,7 +14,7 @@ "wazuh_active_response_authorized": false, "wazuh_api_live_query_authorized": false }, - "generated_at": "2026-06-24T22:25:00+08:00", + "generated_at": "2026-06-24T22:26:00+08:00", "missing_required_source_paths": [], "mode": "repo_release_gate_no_runtime_no_secret_collection", "operator_interpretation": [ diff --git a/docs/security/wazuh-readonly-release-lane-preflight.snapshot.json b/docs/security/wazuh-readonly-release-lane-preflight.snapshot.json index 73b6bac6d..1210da7d4 100644 --- a/docs/security/wazuh-readonly-release-lane-preflight.snapshot.json +++ b/docs/security/wazuh-readonly-release-lane-preflight.snapshot.json @@ -30,7 +30,7 @@ "wazuh_active_response_authorized": false, "wazuh_api_live_query_authorized": false }, - "generated_at": "2026-06-24T22:20:00+08:00", + "generated_at": "2026-06-24T22:26:00+08:00", "mode": "repo_preflight_no_secret_no_runtime_no_push", "operator_interpretation": [ "此 preflight 通過前,不得把 Gitea credential blocker 視為可繞過。",