docs(security): clarify IwoooS S4.9 intake readiness [skip ci]

2026-06-04 18:59:35 +08:00
parent 64490d32c6
commit f1314e089c
17 changed files with 107 additions and 19 deletions
--- a/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md
+++ b/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md
@@ -158,7 +158,7 @@ GitHub target repo-by-repo approval package 已建立於 `docs/security/GITHUB-T
 | 欄位 | Gitea | GitHub | 狀態 |
 |------|-------|--------|------|
 | Repo | `wooo/awoooi` | `owenhytsai/awoooi` | 已有對應 |
-| `main` | `0df3f1c3524304b44831cc521888b12de124ff11` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | 不一致，阻塞主控切換 |
+| `main` | `64490d32c67d24ed123cbd4e2261c69e17913e38` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | 不一致，阻塞主控切換 |
 | `release/v1.0` | `d15fb7d9f4bac86873d5c16b9c17c527b8f38bef` | `d15fb7d9f4bac86873d5c16b9c17c527b8f38bef` | 一致 |
 | `dev` | Gitea-only，仍待 owner 判定 | 無 | GitHub 缺分支 |
 | `drift/adopt-*` | 多條 | 無 | GitHub 缺分支 |
@@ -223,7 +223,7 @@ GitHub target repo-by-repo approval package 已建立於 `docs/security/GITHUB-T
  "branch_count_github": 2,
  "tag_count_gitea": 2,
  "tag_count_github": 0,
-  "latest_sha_gitea": "0df3f1c3524304b44831cc521888b12de124ff11",
+  "latest_sha_gitea": "64490d32c67d24ed123cbd4e2261c69e17913e38",
  "latest_sha_github": "202071f7a8724d5e8c29de441c3f380575a0ea94",
  "workflows_mapped": false,
  "webhooks_mapped": false,
--- a/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md
+++ b/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md
@@ -13,7 +13,7 @@
 | GitHub 分支數 | `2` |
 | Gitea tags | `2` |
 | GitHub tags | `0` |
-| Gitea main | `0df3f1c3524304b44831cc521888b12de124ff11` |
+| Gitea main | `64490d32c67d24ed123cbd4e2261c69e17913e38` |
 | GitHub main | `202071f7a8724d5e8c29de441c3f380575a0ea94` |
 | 阻塞原因 | branches 尚未完全對齊；tags 尚未完全對齊；main SHA 不一致 |

--- a/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md
+++ b/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md
@@ -2,7 +2,7 @@

 | 項目 | 內容 |
 |------|------|
-| 日期 | 2026-05-17 |
+| 日期 | 2026-06-04 |
 | 狀態 | 草案，等待 owner response |
 | 資料契約 | `docs/schemas/gitea_inventory_owner_attestation_response_v1.schema.json` |
 | 快照 | `docs/security/gitea-inventory-owner-attestation-response.snapshot.json` |
@@ -45,6 +45,39 @@ S4.7 已定義要問什麼，S4.8 已把它接到 AwoooP approval lane；S4.9
 | 授權切換 GitHub primary | `false` |
 | 允許 action button | `false` |

+## 1.1 2026-06-04 Current Intake Readiness
+
+本段把 S4.9 從「已經有收件契約」再推進成「目前可直接照表收件與預檢」的狀態。這只代表收件準備度完成，不代表 request 已送出、owner 已回覆、response 已接受或任何執行授權。
+
+| 指標 | 目前值 | 邊界 |
+|------|--------|------|
+| S4.9 收件準備度 | `100%` | 五個 templates、必填欄位、收件檢查、預檢、拒收規則與 outcome lanes 已可用 |
+| S4.9 owner response gate | `0%` | `received_response_count=0`、`accepted_response_count=0`、`rejected_response_count=0` |
+| 下一個收件焦點 | `S4.9 Gitea owner attestation response` | S4.10 / S4.11 / S4.12 仍排隊，不可提前視為 accepted |
+| 可收資料 | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner | 只收脫敏 metadata 或 repo 內文件參照 |
+| 不可收資料 | token、secret、private key、cookie、session、DB dump、git object、repo archive、private URL credential、執行 payload | 疑似敏感值先 quarantine，執行要求 hard reject |
+| 可更新結果 | read-only coverage wording、migration matrix、decision table、readiness blocker | 不寫 Gitea、不建 GitHub repo、不同步 refs、不切 primary、不開 runtime gate |
+
+### 1.1.1 五題缺口矩陣
+
+| 順序 | Template | 目前缺口 | 合格回覆最小條件 | 失敗路由 |
+|------|----------|----------|------------------|----------|
+| 1 | `response-public-only-vs-local-gitea-gap` | `wooo/clawbot-v5`、`wooo/wooo-aiops` 是否屬本輪 scope 尚未由 owner 判定 | 逐 repo 填 owner、decision、reason、affected repos、redacted evidence refs、followup owner | 缺 repo 粒度時 `request_more_evidence`；含 refs / repo 執行要求時 `hard_reject` |
+| 2 | `response-org-user-endpoint-identity` | `wooo` 應以 user、org 或兩者盤點尚未確認 | 指定 canonical namespace 或要求管理者補脫敏 evidence | 把 org 404 當完成時 `request_more_evidence`；要求 write/admin token 時 `hard_reject` |
+| 3 | `response-internal-110-adjacent-scope` | 110 adjacent sources 是否納入本輪 scope 尚未確認 | 逐 source 判定 in-scope / out-of-scope / legacy / external / follow-up | 一句話排除全部時 `request_more_evidence`；要求 fetch / push / delete refs 時 `hard_reject` |
+| 4 | `response-repo-owner-canonical-scope` | in-scope repo owner、canonical source、GitHub target 與 visibility review owner 尚未收齊 | 指定 repo owner、canonical source、GitHub target candidate、visibility review owner 與 evidence refs | 缺 owner 或 canonical 時 `request_more_evidence`；把 target candidate 當 repo creation approval 時 `hard_reject` |
+| 5 | `response-legacy-or-inaccessible-disposition` | legacy、inaccessible、external repo disposition 與後續 owner 尚未收齊 | 指定 disposition、理由、後續 owner 與脫敏 evidence refs | 把 legacy candidate 當刪除 / 封存 approval 時 `hard_reject` |
+
+### 1.1.2 收件結果分流
+
+| Outcome | 何時使用 | 計數影響 |
+|---------|----------|----------|
+| `keep_waiting_owner_response` | 只有 request packet、template status 或空回覆 | received / accepted 維持 0 |
+| `request_more_evidence` | 欄位缺漏、repo/source 粒度不足、evidence refs 不足 | 不增加 accepted |
+| `quarantine_sensitive_payload` | 疑似含 token、secret、private key、cookie、session、未脫敏截圖或 private URL credential | 不保存 raw payload |
+| `reject_execution_request` | 夾帶 repo / refs / workflow / secret / runner / Kali / primary 執行要求 | 不建立 action button、不進 runtime gate |
+| `ready_for_reviewer_validation` | 五題欄位完整、evidence 已脫敏、無執行要求 | 只進 reviewer checklist；仍非 accepted |
+
 ## 2. Owner Response 必填欄位

 每筆 response 至少要能回答：
--- a/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
+++ b/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
@@ -145,7 +145,7 @@ Owner response validation rollup 已建立，S4.13 彙整 S4.9 / S4.10 / S4.11 /

 | Repo | Status | Gitea branches | GitHub branches | Gitea tags | GitHub tags | Gitea main | GitHub main | Evidence |
 |------|--------|----------------|-----------------|------------|-------------|------------|-------------|----------|
-| `wooo/awoooi` -> `owenhytsai/awoooi` | `blocked` | `170` | `2` | `2` | `0` | `0df3f1c3524304b44831cc521888b12de124ff11` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | `docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md` |
+| `wooo/awoooi` -> `owenhytsai/awoooi` | `blocked` | `170` | `2` | `2` | `0` | `64490d32c67d24ed123cbd4e2261c69e17913e38` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | `docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md` |
 | `wooo/clawbot-v5` -> `owenhytsai/clawbot-v5` | `blocked` | `1` | `1` | `1` | `0` | `22074fbe4d6ec6c11c86f76139eea55756d1d160` | `7a769de46450087f9d6a8ef0d2ac23ed15565d2c` | `docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md` |
 | `wooo/wooo-aiops` -> `owenhytsai/wooo-aiops` | `blocked` | `2` | `3` | `0` | `19` | `507384a2e1943f4183942bf17d7b52e223067853` | `7c7aa109d93da6d75d687d6ee5131151afee37e8` | `docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md` |

--- a/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md
+++ b/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md
@@ -111,6 +111,20 @@ S4.13 不新增第 36 個主 contract，不新增 approval item，不啟用 runt

 AwoooP 顯示 S4.9 時，應同步讀取 `gitea-inventory-owner-attestation-response.snapshot.json` 的 1 個 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、6 個 intake preflight checks 與 5 個 outcome lanes；request packet 只提示 owner 要填什麼與不得貼什麼，template statuses 只逐項顯示 waiting / request ready，audit event templates 只定義 request shown / response received metadata / outcome classified 的脫敏 metadata 欄位且目前 0 emitted，redaction examples 只提供安全回覆形狀，display sections 只固定只讀 UI 順序，collection checks 只維持 request / received / accepted 狀態分離，preflight / outcome 只分類可審、補證、隔離、拒收或等待，不代表 owner response accepted 或 AwoooP production ingestion 已啟用。

+### 2.3.1 2026-06-04 S4.9 Current Intake Readiness
+
+S4.9 目前已具備可直接照表收件與預檢的準備度，但尚未收到任何 owner response。這個狀態應顯示在 AwoooP 操作控制台作為下一個收件焦點，不得變成 approval queue 或 execution queue。
+
+| 項目 | 目前值 | 不得誤讀成 |
+|------|--------|------------|
+| 收件準備度 | `100%` | owner response 已收到 |
+| owner response gate | `0%` | S4.9 已接受 |
+| request sent | `false` | 已正式送件 |
+| received / accepted / rejected | `0 / 0 / 0` | 任一項已完成 |
+| 五題缺口 | public-only/local gap、org/user endpoint、110 adjacent scope、repo owner/canonical、legacy/inaccessible disposition | inventory complete、GitHub primary ready |
+| 合格回覆封套 | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner | 執行授權或資安批准 |
+| 通過後可做 | 只更新 read-only coverage / matrix / readiness wording | 寫 Gitea、建立 repo、sync refs、切 primary、開 runtime gate |
+
 ## 2.4 S4.9 最小回覆封套

 S4.9 owner response 收件前，必須具備以下六個欄位。缺任一欄位只能補件，不得增加 received / accepted count。
--- a/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
+++ b/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
@@ -28,7 +28,7 @@

 | 證據 | 2026-06-04 結果 | Gate 判讀 |
 |------|-----------------|-----------|
-| `awoooi` Gitea / GitHub refs | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`、main SHA 不一致：`0df3f1c3524304b44831cc521888b12de124ff11` vs `202071f7a8724d5e8c29de441c3f380575a0ea94` | `blocked`；S4.11 current refs truth queue 已重產為 `194` items，但 owner response received / accepted 仍為 0 |
+| `awoooi` Gitea / GitHub refs | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`、main SHA 不一致：`64490d32c67d24ed123cbd4e2261c69e17913e38` vs `202071f7a8724d5e8c29de441c3f380575a0ea94` | `blocked`；S4.11 current refs truth queue 已重產為 `194` items，但 owner response received / accepted 仍為 0 |
 | Gitea repo inventory | user endpoint public-only 仍只看到 `wooo/awoooi`、`wooo/ewoooc`；org endpoint 仍 blocked / 404 | `blocked`；不得視為所有 Gitea 專案已盤完 |
 | GitHub target probe | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`nexu-io/open-design` 為 external scope 且 heads 增至 `644` | `pending_review`；可讀性不是 owner approval |
 | Workflow / secret 名稱本機 evidence | 8 個候選、7 個本機可見、4 個 local evidence repo、31 個 workflow files、42 個 unique referenced secret names、`secret_value_detected=false` | `missing_evidence`；仍缺 webhook、runner owner、deploy key、branch protection、repository secret parity |
--- a/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md
+++ b/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md
@@ -19,7 +19,7 @@

 | Repo | Risk | Gitea branches | GitHub branches | Gitea tags | GitHub tags | Gitea main | GitHub main |
 |------|------|----------------|-----------------|------------|-------------|------------|-------------|
-| `wooo/awoooi -> owenhytsai/awoooi` | `HIGH` | `170` | `2` | `2` | `0` | `0df3f1c3` | `202071f7` |
+| `wooo/awoooi -> owenhytsai/awoooi` | `HIGH` | `170` | `2` | `2` | `0` | `64490d32` | `202071f7` |
 | `wooo/clawbot-v5 -> owenhytsai/clawbot-v5` | `MEDIUM` | `1` | `1` | `1` | `0` | `22074fbe` | `7a769de4` |
 | `wooo/wooo-aiops -> owenhytsai/wooo-aiops` | `MEDIUM` | `2` | `3` | `0` | `19` | `507384a2` | `7c7aa109` |

--- a/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md
+++ b/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md
@@ -31,7 +31,7 @@

 #### Branch SHA 不一致

- `main`：Gitea `0df3f1c3` / GitHub `202071f7`
+- `main`：Gitea `64490d32` / GitHub `202071f7`

 #### Branch 只在 Gitea

--- a/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md
+++ b/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md
@@ -32,7 +32,7 @@

 | Ref | Type | Lane | Classification | Gitea | GitHub | 下一步 |
 |-----|------|------|----------------|-------|--------|--------|
-| `main` | `branch` | `main_truth_required` | `manual_truth_required` | `0df3f1c3` | `202071f7` | 先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。 |
+| `main` | `branch` | `main_truth_required` | `manual_truth_required` | `64490d32` | `202071f7` | 先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。 |
 | `codex/iwooos-command-map-20260531` | `branch` | `manual_review` | `manual_review` | `c80aae34` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
 | `codex/iwooos-decision-runway-20260601` | `branch` | `manual_review` | `manual_review` | `5a56162a` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
 | `codex/iwooos-deploy-ledger-20260531` | `branch` | `manual_review` | `manual_review` | `514c201f` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
--- a/docs/security/gitea-github-awoooi-inventory.snapshot.json
+++ b/docs/security/gitea-github-awoooi-inventory.snapshot.json
@@ -6,7 +6,7 @@
  "branch_count_github": 2,
  "tag_count_gitea": 2,
  "tag_count_github": 0,
-  "latest_sha_gitea": "0df3f1c3524304b44831cc521888b12de124ff11",
+  "latest_sha_gitea": "64490d32c67d24ed123cbd4e2261c69e17913e38",
  "latest_sha_github": "202071f7a8724d5e8c29de441c3f380575a0ea94",
  "workflows_mapped": false,
  "webhooks_mapped": false,
--- a/docs/security/gitea-inventory-owner-attestation-response.snapshot.json
+++ b/docs/security/gitea-inventory-owner-attestation-response.snapshot.json
@@ -1,7 +1,7 @@
 {
  "schema_version": "gitea_inventory_owner_attestation_response_v1",
  "status": "draft_waiting_owner_response",
-  "date": "2026-05-17",
+  "date": "2026-06-04",
  "mode": "owner_response_intake_only",
  "runtime_execution_authorized": false,
  "source_contract": "gitea_inventory_coverage_attestation_v1",
--- a/docs/security/source-control-primary-readiness-gate.snapshot.json
+++ b/docs/security/source-control-primary-readiness-gate.snapshot.json
@@ -84,7 +84,7 @@
      ],
      "current_gap": [
        "3 個 mapped repos 仍有 refs drift",
-        "2026-06-04 awoooi read-only refresh 顯示 Gitea heads=170、GitHub heads=2、Gitea tags=2、GitHub tags=0、main SHA=0df3f1c3524304b44831cc521888b12de124ff11 vs 202071f7a8724d5e8c29de441c3f380575a0ea94",
+        "2026-06-04 awoooi read-only refresh 顯示 Gitea heads=170、GitHub heads=2、Gitea tags=2、GitHub tags=0、main SHA=64490d32c67d24ed123cbd4e2261c69e17913e38 vs 202071f7a8724d5e8c29de441c3f380575a0ea94",
        "S4.11 current refs truth classification 已重產為 194 個 refs review items；owner response received/accepted 仍為 0",
        "S4.11 已建立 refs truth owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，但目前 received_response_count=0、accepted_response_count=0、audit_events_emitted=0",
        "不得 push/delete/force push refs"
--- a/docs/security/source-control-reconcile-plan.snapshot.json
+++ b/docs/security/source-control-reconcile-plan.snapshot.json
@@ -28,7 +28,7 @@
        "github_branch_count": 2,
        "gitea_tag_count": 2,
        "github_tag_count": 0,
-        "gitea_main_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+        "gitea_main_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
        "github_main_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94",
        "blocking_reason": "branches 尚未完全對齊；tags 尚未完全對齊"
      },
--- a/docs/security/source-control-ref-detail-diff.snapshot.json
+++ b/docs/security/source-control-ref-detail-diff.snapshot.json
@@ -702,7 +702,7 @@
        "sha_mismatch": [
          {
            "name": "main",
-            "gitea_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+            "gitea_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
            "github_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94"
          }
        ],
--- a/docs/security/source-control-ref-truth-classification.snapshot.json
+++ b/docs/security/source-control-ref-truth-classification.snapshot.json
@@ -40,7 +40,7 @@
          "classification": "manual_truth_required",
          "reason": "兩端 main SHA 不一致，這是 GitHub primary / deploy control plane 的硬阻塞。",
          "next_review": "先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。",
-          "gitea_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+          "gitea_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
          "github_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94",
          "allowed_now": [
            "mirror_classification",