wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add owner response audit templates

Browse Source
This commit is contained in:
Your Name
2026-05-19 11:04:34 +08:00
parent 06adeecbe2
commit ebefc7d3bc
19 changed files with 309 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/security/security-mirror-status-rollup.snapshot.json
View File

@@ -143,15 +143,15 @@
{
"phase_id": "S4_migration_execution",
"state": "not_started",
"current_result": "GitHub primary 是長期方向；source_control_primary_readiness_gate_v1 已定義 8 個 candidate repos、7 個 in-scope blocked repos、0 個 primary ready；S4.1 已定義 workflow / secret 名稱 inventory 契約；S4.2 已補 local evidence；S4.3 已補 redacted export request；S4.4 已補 rollback ADR 草案；S4.5 已補 Gitea authenticated inventory export request；S4.6 已補 redacted import acceptance；S4.7 已補 owner coverage attestation request；S4.9 已補 Gitea owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、owner response intake packet、6 個 intake preflight checks 與 5 個 outcome lanes；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與 intake packet；S4.11 已補 refs truth owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包；S4.12 已補 workflow / secret 名稱 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與 intake packet；S4.13 已補四包 owner response validation rollup、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items 與 7 條 reviewer outcome lanes，彙整 22 個 templates、received=0、accepted=0，並標示 next_collection_candidate=S4.9，但 inventory status 仍 partial，S4.9/S4.11/S4.12 audit events emitted 仍 0 筆，GitHub target / refs truth / workflow-secret response 仍 0 筆。",
"next_gate": "依 S4.13 先集中檢查四包 owner response validation 狀態、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items 與 7 條 reviewer outcome lanes，AwoooP 只顯示 next_collection_candidate=S4.9 Gitea owner attestation，依 S4.9 owner response request packet 要求 owner 回覆，並用 template status ledger / audit event templates / redaction examples / display sections / collection checks 維持 request / received / accepted 分離；再依 S4.9 收到並驗收 S4.7 Gitea owner response、依 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 7 個 GitHub target owner / visibility / canonical response、依 S4.11 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 5 個 refs truth owner response templates、依 S4.12 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 5 個 workflow / secret 名稱 owner response templates、authenticated inventory payload 通過 S4.6 驗收、rollback ADR owner approval 與逐 repo 人工批准。"
"current_result": "GitHub primary 是長期方向；source_control_primary_readiness_gate_v1 已定義 8 個 candidate repos、7 個 in-scope blocked repos、0 個 primary ready；S4.1 已定義 workflow / secret 名稱 inventory 契約；S4.2 已補 local evidence；S4.3 已補 redacted export request；S4.4 已補 rollback ADR 草案；S4.5 已補 Gitea authenticated inventory export request；S4.6 已補 redacted import acceptance；S4.7 已補 owner coverage attestation request；S4.9 已補 Gitea owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、owner response intake packet、6 個 intake preflight checks 與 5 個 outcome lanes；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與 intake packet；S4.11 已補 refs truth owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包；S4.12 已補 workflow / secret 名稱 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與 intake packet；S4.13 已補四包 owner response validation rollup、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes 與 4 個 reviewer audit event templates，彙整 22 個 templates、received=0、accepted=0，並標示 next_collection_candidate=S4.9，但 inventory status 仍 partial，S4.9/S4.11/S4.12 audit events emitted 仍 0 筆，GitHub target / refs truth / workflow-secret response 仍 0 筆，S4.13 reviewer audit templates 也仍為 emitted=0。",
"next_gate": "依 S4.13 先集中檢查四包 owner response validation 狀態、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes 與 4 個 reviewer audit event templates，AwoooP 只顯示 next_collection_candidate=S4.9 Gitea owner attestation，依 S4.9 owner response request packet 要求 owner 回覆，並用 template status ledger / audit event templates / redaction examples / display sections / collection checks 維持 request / received / accepted 分離；再依 S4.9 收到並驗收 S4.7 Gitea owner response、依 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 7 個 GitHub target owner / visibility / canonical response、依 S4.11 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 5 個 refs truth owner response templates、依 S4.12 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 收到並驗收 5 個 workflow / secret 名稱 owner response templates、authenticated inventory payload 通過 S4.6 驗收、rollback ADR owner approval 與逐 repo 人工批准。"
}
],
"progress_display_policy": {
"headline_percent": 58,
"headline_status": "holding_until_owner_response_or_runtime_gate",
"why_headline_is_holding": [
"最近完成的是 S4.10 owner response request / status / audit / redaction / collection checks / intake preflight、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks，以及 S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes 的框架細節，改善可見性與收件安全，但 owner response received / accepted 仍為 0。",
"最近完成的是 S4.10 owner response request / status / audit / redaction / collection checks / intake preflight、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks，以及 S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates 的框架細節，改善可見性、收件安全與稽核格式，但 owner response received / accepted 仍為 0。",
"overall_percent 只在 owner response、redacted payload ingestion、active runtime gate、GitHub primary readiness 或 AwoooP production ingestion 這些高層 gate 有實質變化時調整。",
"維持 58% 是為了避免把 read-only scaffold 誤算成 runtime enforcement、Kali scan、repo migration 或 GitHub primary cutover。"
],
@@ -443,6 +443,18 @@
"runtime_delta": false,
"execution_authorized": false,
"not_authorization": true
},
{
"delta_id": "s4_13_owner_response_validation_reviewer_audit_event_templates",
"display_order": 24,
"completed_stage": "S4.13 owner response validation reviewer audit event templates",
"progress_axis": "framework_detail",
"headline_percent_delta": 0,
"framework_delta_visible": true,
"why_headline_unchanged": "reviewer audit event templates 只定義未來可留痕的脫敏 metadata 形狀，emitted_event_count=0、received_response_count=0、accepted_response_count=0，不代表 production ingestion、approval、runtime gate 或 execution authorization。",
"runtime_delta": false,
"execution_authorized": false,
"not_authorization": true
}
],
"next_safe_actions": [
@@ -454,7 +466,7 @@
"allowed_processing": [
"顯示 S4.9/S4.10/S4.11/S4.12 四個 response packets",
"顯示 22 個 templates、received=0、accepted=0、rejected=0",
"顯示 10 個 cross-packet acceptance checks、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes 與 quarantine rules",
"顯示 10 個 cross-packet acceptance checks、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates 與 quarantine rules",
"只更新 read-only wording、matrix 或 readiness evidence"
],
"blocked_processing": [
@@ -699,7 +711,7 @@
"S4.10 新增 GitHub target owner decision response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包；owner_response_request_packet_count=1、owner_response_template_status_count=7、owner_response_audit_event_template_count=3、owner_response_redaction_example_count=5、owner_response_collection_check_count=6、intake_preflight_check_count=6、response_template_count=7、received_response_count=0、accepted_response_count=0，不把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當 repo creation、visibility change、refs sync 或 GitHub primary approval。",
"S4.11 已新增 refs truth owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包；owner_response_request_packet_count=1、owner_response_template_status_count=5、owner_response_audit_event_template_count=3、owner_response_redaction_example_count=5、owner_response_collection_check_count=6、intake_preflight_check_count=6、response_template_count=5、received_response_count=0、accepted_response_count=0、audit_events_emitted=0，不把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當 refs sync、delete、force push 或 GitHub primary approval。",
"S4.12 只新增 workflow / secret 名稱 owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包；owner_response_audit_event_template_count=3、owner_response_redaction_example_count=5、owner_response_collection_check_count=6、intake_preflight_check_count=6、audit_events_emitted=0、response_template_count=5、received_response_count=0、accepted_response_count=0，不把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當 secret value collection、workflow modification、GitHub hosted runner enablement 或 GitHub primary approval。",
"S4.13 只新增 owner response validation rollup、evidence routing rules、display sections、state transition rules、reviewer checklist 與 reviewer outcome lanes；response_packet_count=4、template_count=22、received_response_count=0、accepted_response_count=0、cross_packet_check_count=10、owner_response_evidence_routing_rule_count=6、owner_response_validation_display_section_count=8、owner_response_validation_state_transition_rule_count=7、owner_response_validation_reviewer_checklist_count=9、owner_response_validation_reviewer_outcome_lane_count=7、next_collection_candidate=S4.9，不把 rollup、routing、display sections、state transition rules、reviewer checklist 或 reviewer outcome lanes 當 approval、runtime gate 或 execution authorization。"
"S4.13 只新增 owner response validation rollup、evidence routing rules、display sections、state transition rules、reviewer checklist、reviewer outcome lanes 與 reviewer audit event templates；response_packet_count=4、template_count=22、received_response_count=0、accepted_response_count=0、cross_packet_check_count=10、owner_response_evidence_routing_rule_count=6、owner_response_validation_display_section_count=8、owner_response_validation_state_transition_rule_count=7、owner_response_validation_reviewer_checklist_count=9、owner_response_validation_reviewer_outcome_lane_count=7、owner_response_validation_reviewer_audit_event_template_count=4、reviewer_audit_events_emitted=0、next_collection_candidate=S4.9，不把 rollup、routing、display sections、state transition rules、reviewer checklist、reviewer outcome lanes 或 reviewer audit event templates 當 approval、runtime gate 或 execution authorization。"
],
"forbidden_actions": [
"start_kali_scan",