docs(security): clarify IwoooS S4.9 intake readiness [skip ci]
This commit is contained in:
Your Name
@@ -9,7 +9,7 @@
|
||||
| 工作視窗 | IwoooS / AWOOOI 資安治理 P0 |
|
||||
| 本次乾淨 worktree | `/private/tmp/awoooi-iwooos-governance-p0-20260604` |
|
||||
| 本次分支 | `codex/iwooos-governance-p0-20260604` |
|
||||
| 最新觀察到的 `gitea/main` | `0df3f1c3 feat(web): bridge WOOO Open Design tokens` |
|
||||
| 最新觀察到的 `gitea/main` | `64490d32 docs(logbook): record WOOO design rollout smoke [skip ci]` |
|
||||
| 前一個正式 IwoooS 候選基準 | code `7b8fc093`、deploy marker `45c63488`、LOGBOOK `02cadee6` |
|
||||
| 最新導航 IA 基準 | code `973fc7a4`、LOGBOOK `2555c811`、deploy marker `0260ec89` |
|
||||
| 禁止事項 | 不 force push、不 destructive git、不 SSH 修改主機、不 active scan、不收 secrets 明文、不把 AwoooP approval 當資安批准、不把 UI 可見當 runtime 授權 |
|
||||
@@ -35,6 +35,7 @@
|
||||
| P0-0 | 跨 Session 同步與乾淨 worktree | 100% | 每次改檔前重新 `git fetch gitea` 與檢查 `gitea/main` | `git status --short --branch`、`git log --oneline -8 gitea/main` |
|
||||
| P0-1 | IwoooS 狀態總帳 | 100% | 本文件已落地；後續每階段只更新同一總帳與 LOGBOOK | Markdown 檢查、guard、不調高 0 / false gate |
|
||||
| P0-2 | S4.9 owner response gate | 100% | 欄位、預檢、收件、驗收、拒收與補件條件已固定成人類可讀規範 | `source-control-owner-response-guard.py --root .` 通過 |
|
||||
| P0-2a | S4.9 current intake readiness | 100% | 五題缺口、合格封套、結果分流與只讀更新邊界已補進收件包與 S4.13 rollup；owner response gate 仍 0% | JSON parse、owner response guard、progress guard |
|
||||
| P0-3 | AwoooP 同步封包 | 90% | 同步內容已固定；缺後續實際 AwoooP Session readback | 本文件與 mirror checklist readback |
|
||||
| P0-4 | production live sanity 節點 | 100% | desktop / mobile / 展開區塊 / overflow / action href 檢查已完成 | Playwright production sanity 通過 |
|
||||
| P0-5 | LOGBOOK 與完成度更新 | 90% | LOGBOOK 本輪將同步記錄；Gitea run 需等實際 push 後回填 | `docs/LOGBOOK.md` readback |
|
||||
@@ -65,6 +66,18 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count
|
||||
| 收 secrets 明文 | token、secret、private key、cookie、session、authorization header、runner token、webhook secret 全部拒收或隔離 |
|
||||
| 夾帶執行要求 | repo 建立、visibility change、refs sync、workflow 修改、runner 啟用、Kali scan、`/execute`、host update 全部 hard reject |
|
||||
|
||||
### 3.3 2026-06-04 Current Intake Readiness
|
||||
|
||||
本輪把 S4.9 從「收件規則已定義」推到「AwoooP / reviewer 可直接照表收件與預檢」。這是收件準備度，不是 owner response gate 解鎖；驗收前所有 count 仍必須維持 `0`，所有授權 flag 仍必須維持 `false`。
|
||||
|
||||
| 項目 | 完成度 | 目前狀態 | 下一步 |
|
||||
|------|--------|----------|--------|
|
||||
| 五題缺口矩陣 | 100% | public-only/local gap、org/user endpoint、110 adjacent scope、repo owner/canonical、legacy/inaccessible disposition 已拆成逐題缺口 | 等 owner 以脫敏 metadata 回覆 |
|
||||
| 合格回覆封套 | 100% | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner 已固定 | 收件時逐欄預檢 |
|
||||
| 結果分流 | 100% | waiting、request_more_evidence、quarantine、hard_reject、ready_for_reviewer_validation 已明確 | 不合格先補件 / 隔離 / 拒收 |
|
||||
| S4.9 owner response gate | 0% | request_sent=false、received=0、accepted=0、rejected=0 | 合格回覆前不得調高 |
|
||||
| 可更新範圍 | 只讀 | 只允許 coverage / migration matrix / decision table / readiness wording | 不寫 Gitea、不建 repo、不同步 refs、不切 primary |
|
||||
|
||||
## 4. 驗證節點規則
|
||||
|
||||
| 階段類型 | 必跑驗證 | 是否需要實際開頁 |
|
||||
@@ -136,7 +149,7 @@ P1 只讀重盤階段整體完成度：`62%`。它代表 freshness / inventory
|
||||
|
||||
| 分類 | 項目 | 原因 | 本輪處理 |
|
||||
|------|------|------|----------|
|
||||
| 已不符合現在要求 | `GITEA-GITHUB-MIGRATION-INVENTORY.md` 仍寫 2026-05-12 / 117 heads / 舊 main SHA | 2026-06-04 refresh 顯示 Gitea heads `170`、main SHA `0df3f1c3...` | 已更新為第三版 read-only inventory refresh |
|
||||
| 已不符合現在要求 | `GITEA-GITHUB-MIGRATION-INVENTORY.md` 仍寫 2026-05-12 / 117 heads / 舊 main SHA | 2026-06-04 refresh 顯示 Gitea heads `170`、main SHA `64490d32...` | 已更新為第三版 read-only inventory refresh |
|
||||
| 已不符合現在要求 | S4.11 `141` refs review items 被當成 current queue | current refs truth queue 已重產為 `194` items | 已改成 current classification；owner response 仍待收 |
|
||||
| 已不符合現在要求 | Workflow local evidence 指到舊暫存 worktree | 舊路徑不可重現，會污染 P1 evidence freshness | 已改為本輪乾淨 worktree，並新增 snapshot freshness 規則 |
|
||||
| 已不符合現在要求 | `SOURCE-CONTROL-PRIMARY-READINESS-GATE.md` 日期停在 2026-05-17 | Gate 內容未反映最新 refs / GitHub target / workflow evidence | 已新增 2026-06-04 P1 只讀重盤結論 |
|
||||
@@ -174,7 +187,7 @@ P1 只讀重盤階段整體完成度：`62%`。它代表 freshness / inventory
|
||||
| production mobile `/zh-TW/iwooos` | 展開「前台入口與既有資安頁」後候選卡可見；`horizontalOverflow=false` |
|
||||
| action href 檢查 | `/execute`、scan、repo / refs / workflow / secret / primary mutation href 皆為 0 |
|
||||
| 截圖 | `/private/tmp/iwooos-governance-p0-prod-desktop-summary-open-20260604.png`、`/private/tmp/iwooos-governance-p0-prod-mobile-summary-open-20260604.png` |
|
||||
| P1 `awoooi` refs inventory refresh | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=0df3f1c3...`、GitHub `main=202071f...`，仍 `blocked` |
|
||||
| P1 `awoooi` refs inventory refresh | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=64490d32...`、GitHub `main=202071f...`，仍 `blocked` |
|
||||
| P1 refs truth classification refresh | current queue `194` items；`manual_truth_required=4`、`deprecated_candidate=142`、`release_tag_review=3`、`github_only_review=20`；S4.11 owner response received / accepted 仍為 0 |
|
||||
| P1 Gitea repo inventory refresh | user endpoint public-only 2 repos；org endpoint blocked / 404；仍需只讀 token 或 redacted admin export |
|
||||
| P1 GitHub target probe refresh | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`open-design` heads `644` 僅作 external scope |
|
||||
|
||||
Reference in New Issue
Block a user